update integration tests

Author: renato-rudnicki

3-networks-hub-and-spoke/envs/shared/README.md

@@ -52,7 +52,11 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 
 | Name | Description |
 |------|-------------|
+| base\_dns\_policy | The name of the DNS policy being created |
 | base\_host\_project\_id | The base host project ID |
+| base\_network\_name | The name of the VPC being created |
+| restricted\_dns\_policy | The name of the DNS policy being created |
 | restricted\_host\_project\_id | The restricted host project ID |
+| restricted\_network\_name | The name of the VPC being created |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

3-networks-hub-and-spoke/envs/shared/outputs.tf

@@ -23,3 +23,23 @@ output "base_host_project_id" {
   value       = local.base_net_hub_project_id
   description = "The base host project ID"
 }
+
+output "base_network_name" {
+  value       = module.base_shared_vpc.network_name
+  description = "The name of the VPC being created"
+}
+
+output "restricted_network_name" {
+  value       = module.restricted_shared_vpc.network_name
+  description = "The name of the VPC being created"
+}
+
+output "base_dns_policy" {
+  value       = module.base_shared_vpc.base_dns_policy
+  description = "The name of the DNS policy being created"
+}
+
+output "restricted_dns_policy" {
+  value       = module.restricted_shared_vpc.restricted_dns_policy
+  description = "The name of the DNS policy being created"
+}

3-networks-hub-and-spoke/modules/base_shared_vpc/README.md

@@ -31,6 +31,7 @@
 
 | Name | Description |
 |------|-------------|
+| base\_dns\_policy | The name of the DNS policy being created |
 | firewall\_policy | Policy created for firewall policy rules. |
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |

3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf

@@ -20,7 +20,8 @@ locals {
   network_name                = "vpc-${local.vpc_name}"
   private_googleapis_cidr     = module.private_service_connect.private_service_connect_ip
   google_forward_source_range = "35.199.192.0/19"
-  advertised_ip               = var.environment_code == "p" ? [{ range = local.google_forward_source_range }, { range = local.private_googleapis_cidr }] : [{ range = local.private_googleapis_cidr }]
+  advertised_ip               = var.environment_code == "c" ? [{ range = local.google_forward_source_range }, { range = local.private_googleapis_cidr }] : [{ range = local.private_googleapis_cidr }]
+
 }
 
 /******************************************

3-networks-hub-and-spoke/modules/base_shared_vpc/outputs.tf

@@ -19,6 +19,11 @@ output "network_name" {
   description = "The name of the VPC being created"
 }
 
+output "base_dns_policy" {
+  value       = google_dns_policy.default_policy.name
+  description = "The name of the DNS policy being created"
+}
+
 output "network_self_link" {
   value       = module.main.network_self_link
   description = "The URI of the VPC being created"

3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md

@@ -53,6 +53,7 @@
 | region1\_router2 | Router 2 for Region 1 |
 | region2\_router1 | Router 1 for Region 2 |
 | region2\_router2 | Router 2 for Region 2 |
+| restricted\_dns\_policy | The name of the DNS policy being created |
 | service\_perimeter\_name | Access context manager service perimeter name for the enforced perimeter |
 | subnets\_ips | The IPs and CIDRs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf

@@ -20,7 +20,7 @@ locals {
   network_name                = "vpc-${local.vpc_name}"
   restricted_googleapis_cidr  = module.private_service_connect.private_service_connect_ip
   google_forward_source_range = "35.199.192.0/19"
-  advertised_ip               = var.environment_code == "p" ? [{ range = local.google_forward_source_range }, { range = local.restricted_googleapis_cidr }] : [{ range = local.restricted_googleapis_cidr }]
+  advertised_ip               = var.environment_code == "c" ? [{ range = local.google_forward_source_range }, { range = local.restricted_googleapis_cidr }] : [{ range = local.restricted_googleapis_cidr }]
 }
 
 /******************************************

3-networks-hub-and-spoke/modules/restricted_shared_vpc/outputs.tf

@@ -19,6 +19,11 @@ output "network_name" {
   description = "The name of the VPC being created"
 }
 
+output "restricted_dns_policy" {
+  value       = google_dns_policy.default_policy.name
+  description = "The name of the DNS policy being created"
+}
+
 output "network_self_link" {
   value       = module.main.network_self_link
   description = "The URI of the VPC being created"

test/integration/networks/networks_test.go

@@ -51,6 +51,7 @@ func getNetworkResourceNames(envCode string, networkMode string, firewallMode st
 		"base": {
 			"network_name":          fmt.Sprintf("vpc-%s-shared-base%s", envCode, networkMode),
 			"global_address":        fmt.Sprintf("ga-%s-shared-base%s-vpc-peering-internal", envCode, networkMode),
+			"dns_zone_forward":      "fz-dns-hub",
 			"dns_zone_googleapis":   fmt.Sprintf("dz-%s-shared-base-apis", envCode),
 			"dns_zone_gcr":          fmt.Sprintf("dz-%s-shared-base-gcr", envCode),
 			"dns_zone_pkg_dev":      fmt.Sprintf("dz-%s-shared-base-pkg-dev", envCode),
@@ -69,6 +70,7 @@ func getNetworkResourceNames(envCode string, networkMode string, firewallMode st
 		"restricted": {
 			"network_name":          fmt.Sprintf("vpc-%s-shared-restricted%s", envCode, networkMode),
 			"global_address":        fmt.Sprintf("ga-%s-shared-restricted%s-vpc-peering-internal", envCode, networkMode),
+			"dns_zone_forward":      "fz-dns-hub",
 			"dns_zone_googleapis":   fmt.Sprintf("dz-%s-shared-restricted-apis", envCode),
 			"dns_zone_gcr":          fmt.Sprintf("dz-%s-shared-restricted-gcr", envCode),
 			"dns_zone_pkg_dev":      fmt.Sprintf("dz-%s-shared-restricted-pkg-dev", envCode),
@@ -331,22 +333,17 @@ func TestNetworks(t *testing.T) {
 				tfdDir = "../../../3-networks-hub-and-spoke/envs/%s"
 			}
 
-			var tfdDirDNS string
-			if networkMode == "" {
-				tfdDirDNS = "../../../3-networks-dual-svpc/envs/production"
-			} else {
-				tfdDirDNS = "../../../3-networks-hub-and-spoke/envs/shared"
-			}
-
 			envCode := string(envName[0:1])
 			networks := tft.NewTFBlueprintTest(t,
 				tft.WithTFDir(fmt.Sprintf(tfdDir, envName)),
-				tft.WithTFDir(fmt.Sprintf(tfdDirDNS)),
 				tft.WithVars(vars),
 				tft.WithRetryableTerraformErrors(testutils.RetryableTransientErrors, 10, 2*time.Minute),
 				tft.WithPolicyLibraryPath("/workspace/policy-library", bootstrap.GetTFSetupStringOutput("project_id")),
 				tft.WithBackendConfig(backendConfig),
 			)
+
+			networkMode := getNetworkMode(t)
+
 			networks.DefineVerify(
 				func(assert *assert.Assertions) {
 					// perform default verification ensuring Terraform reports no additional changes on an applied blueprint
@@ -359,9 +356,6 @@ func TestNetworks(t *testing.T) {
 					servicePerimeterLink := fmt.Sprintf("accessPolicies/%s/servicePerimeters/%s", policyID, networks.GetStringOutput("restricted_service_perimeter_name"))
 					accessLevel := fmt.Sprintf("accessPolicies/%s/accessLevels/%s", policyID, networks.GetStringOutput("access_level_name_dry_run"))
 					networkNames := getNetworkResourceNames(envCode, networkMode, firewallMode)
-					baseSharedProjectID := networks.GetStringOutput("base_host_project_id")
-					restrictedProjectID := networks.GetStringOutput("restricted_host_project_id")
-					dnsFwZoneName := "fz-dns-hub"
 
 					servicePerimeter, err := gcloud.RunCmdE(t, fmt.Sprintf("access-context-manager perimeters dry-run describe %s --policy %s", servicePerimeterLink, policyID))
 					assert.NoError(err)
@@ -378,22 +372,30 @@ func TestNetworks(t *testing.T) {
 					} {
 						projectID := networks.GetStringOutput(fmt.Sprintf("%s_host_project_id", networkType))
 
-						for _, dnsType := range []string{
-							"dns_zone_googleapis",
-							"dns_zone_gcr",
-							"dns_zone_pkg_dev",
-							"dns_zone_peering_zone",
-						} {
-							dnsName := networkNames[networkType][dnsType]
-							dnsZone := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsName, projectID, terraformSA)
-							assert.Equal(dnsName, dnsZone.Get("name").String(), fmt.Sprintf("dnsZone %s should exist", dnsName))
+						if networkMode == "-spoke" {
+							for _, dnsType := range []string{
+								"dns_zone_googleapis",
+								"dns_zone_gcr",
+								"dns_zone_pkg_dev",
+								"dns_zone_peering_zone",
+							} {
+								dnsName := networkNames[networkType][dnsType]
+								dnsZone := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsName, projectID, terraformSA)
+								assert.Equal(dnsName, dnsZone.Get("name").String(), fmt.Sprintf("dnsZone %s should exist", dnsName))
+							}
+						} else {
+							for _, dnsType := range []string{
+								"dns_zone_googleapis",
+								"dns_zone_gcr",
+								"dns_zone_pkg_dev",
+								"dns_zone_forward",
+							} {
+								dnsName := networkNames[networkType][dnsType]
+								dnsZone := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsName, projectID, terraformSA)
+								assert.Equal(dnsName, dnsZone.Get("name").String(), fmt.Sprintf("dnsZone %s should exist", dnsName))
+							}
 						}
 
-						dnsZoneSharedBaseHubSpoke := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsFwZoneName, baseSharedProjectID, terraformSA)
-						assert.Equal(dnsFwZoneName, dnsZoneSharedBaseHubSpoke.Get("name").String(), fmt.Sprintf("dnsZone %s should exist for base", dnsFwZoneName))
-						dnsZoneRestrictedHubSpoke := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsFwZoneName, restrictedProjectID, terraformSA)
-						assert.Equal(dnsFwZoneName, dnsZoneRestrictedHubSpoke .Get("name").String(), fmt.Sprintf("dnsZone %s should exist for restricted", dnsFwZoneName))
-
 						networkName := networkNames[networkType]["network_name"]
 						networkUrl := fmt.Sprintf("https://www.googleapis.com/compute/v1/projects/%s/global/networks/%s", projectID, networkName)
 						dnsPolicyName := networkNames[networkType]["dns_policy_name"]
@@ -462,18 +464,16 @@ func TestNetworks(t *testing.T) {
 							} {
 
 								routerName := networkNames[networkType][router.router]
+								bgpAdvertisedIpRange := "35.199.192.0/19"
 								computeRouter := gcloud.Runf(t, "compute routers describe %s --region %s --project %s --impersonate-service-account %s", routerName, router.region, projectID, terraformSA)
 								networkSelfLink := fmt.Sprintf("https://www.googleapis.com/compute/v1/projects/%s/global/networks/%s", projectID, networkNames[networkType]["network_name"])
 								assert.Equal(routerName, computeRouter.Get("name").String(), fmt.Sprintf("router %s should exist", routerName))
 								assert.Equal("64514", computeRouter.Get("bgp.asn").String(), fmt.Sprintf("router %s should have bgp asm 64514", routerName))
-								assert.Equal(1, len(computeRouter.Get("bgp.advertisedIpRanges").Array()), fmt.Sprintf("router %s should have only one advertised IP range", routerName))
-								assert.Equal(googleapisCIDR[envName][networkType], computeRouter.Get("bgp.advertisedIpRanges.0.range").String(), fmt.Sprintf("router %s should have only range %s", routerName, googleapisCIDR[envName][networkType]))
-								assert.Equal(networkSelfLink, computeRouter.Get("network").String(), fmt.Sprintf("router %s should have be from network %s", routerName, networkNames[networkType]["network_name"]))
-
-								dnsZoneSharedBaseSVPC := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsFwZoneName, baseSharedProjectID, terraformSA)
-								assert.Equal(dnsFwZoneName, dnsZoneSharedBaseSVPC.Get("name").String(), fmt.Sprintf("dnsZone %s should exist for base", dnsFwZoneName))
-								dnsZoneRestrictedSVPC := gcloud.Runf(t, "dns managed-zones describe %s --project %s --impersonate-service-account %s", dnsFwZoneName, restrictedProjectID, terraformSA)
-								assert.Equal(dnsFwZoneName, dnsZoneRestrictedSVPC.Get("name").String(), fmt.Sprintf("dnsZone %s should exist for restricted", dnsFwZoneName))
+								assert.Equal(networkSelfLink, computeRouter.Get("network").String(), fmt.Sprintf("router %s should be on network %s", routerName, networkNames[networkType]["network_name"]))
+								if strings.Contains(projectID, "prj-p") && networkMode != "-spoke" {
+									assert.Equal(bgpAdvertisedIpRange, computeRouter.Get("bgp.advertisedIpRanges.0.range").String(), fmt.Sprintf("router %s should have range %s", routerName, bgpAdvertisedIpRange))
+									assert.Equal(googleapisCIDR[envName][networkType], computeRouter.Get("bgp.advertisedIpRanges.0.range").String(), fmt.Sprintf("router %s should have only range %s", routerName, googleapisCIDR[envName][networkType]))
+								}
 							}
 						}
 					}
@@ -483,4 +483,3 @@ func TestNetworks(t *testing.T) {
 
 	}
 }
-