Skip to content

Commit 16fc46b

Browse files
morgantemorgante
authored
Merge pull request #24 from rjerrems/net-refactor
refactor: Harden network & add default example subnets
2 parents fe1eb58 + 7614154 commit 16fc46b

File tree

6 files changed

+264
-82
lines changed

6 files changed

+264
-82
lines changed

‎2-networks/main.tf‎

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,59 @@ module "shared_vpc_nonprod" {
4040
project_id = local.nonprod_host_project_id
4141
default_region = var.default_region
4242
network_name = "shared-vpc-nonprod"
43-
private_service_cidr = "10.1.0.0/16"
43+
private_service_cidr = "10.200.0.0/22"
4444
bgp_asn = 64512
45+
subnets = [
46+
{
47+
subnet_name = "example-subnet"
48+
subnet_ip = "10.200.4.0/22"
49+
subnet_region = var.default_region
50+
subnet_private_access = "true"
51+
subnet_flow_logs = "false"
52+
description = "Non prod example subnet."
53+
},
54+
]
55+
secondary_ranges = {
56+
example-subnet = [
57+
{
58+
range_name = "example-subnet-gke-pod"
59+
ip_cidr_range = "192.168.0.0/19"
60+
},
61+
{
62+
range_name = "example-subnet-gke-svc"
63+
ip_cidr_range = "192.168.32.0/23"
64+
},
65+
]
66+
}
4567
}
4668

4769
module "shared_vpc_prod" {
4870
source = "./modules/standard_shared_vpc"
4971
project_id = local.prod_host_project_id
5072
default_region = var.default_region
5173
network_name = "shared-vpc-prod"
52-
private_service_cidr = "10.2.0.0/16"
74+
private_service_cidr = "10.20.0.0/22"
5375
bgp_asn = 64513
76+
subnets = [
77+
{
78+
subnet_name = "example-subnet"
79+
subnet_ip = "10.20.20.0/22"
80+
subnet_region = var.default_region
81+
subnet_private_access = "true"
82+
subnet_flow_logs = "false"
83+
description = "Prod example subnet."
84+
},
85+
]
86+
secondary_ranges = {
87+
example-subnet = [
88+
{
89+
range_name = "example-subnet-gke-pod"
90+
ip_cidr_range = "192.168.96.0/19"
91+
},
92+
{
93+
range_name = "example-subnet-gke-svc"
94+
ip_cidr_range = "192.168.128.0/23"
95+
},
96+
]
97+
}
5498
}

‎2-networks/modules/standard_shared_vpc/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@
44
| Name | Description | Type | Default | Required |
55
|------|-------------|:----:|:-----:|:-----:|
66
| bgp\_asn | BGP ASN for default cloud router. | string | n/a | yes |
7+
| default\_fw\_rules\_enabled | Toggle creation of default firewall rules. | bool | `"true"` | no |
78
| default\_region | Default subnet region standard_shared_vpc currently only configures one region. | string | n/a | yes |
9+
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | bool | `"true"` | no |
10+
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | bool | `"true"` | no |
11+
| nat\_num\_addresses | Number of external IPs to reserve for Cloud NAT. | number | `"2"` | no |
812
| network\_name | Name for VPC. | string | n/a | yes |
913
| private\_service\_cidr | CIDR range for private service networking. Used for Cloud SQL and other managed services. | string | n/a | yes |
1014
| project\_id | Project ID for Shared VPC. | string | n/a | yes |

‎2-networks/modules/standard_shared_vpc/dns.tf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/******************************************
18+
Default DNS Policy
19+
*****************************************/
20+
21+
resource "google_dns_policy" "default_policy" {
22+
provider = google-beta
23+
project = var.project_id
24+
name = "default-policy"
25+
enable_inbound_forwarding = var.dns_enable_inbound_forwarding
26+
enable_logging = var.dns_enable_logging
27+
networks {
28+
network_url = module.main.network_self_link
29+
}
30+
}
31+
32+
/******************************************
33+
Private Google APIs DNS Zone & records.
34+
*****************************************/
35+
36+
module "private_googleapis" {
37+
source = "terraform-google-modules/cloud-dns/google"
38+
version = "~> 3.0"
39+
project_id = var.project_id
40+
type = "private"
41+
name = "private-googleapis"
42+
domain = "googleapis.com."
43+
description = "Private DNS zone to configure private.googleapis.com"
44+
45+
private_visibility_config_networks = [
46+
module.main.network_self_link
47+
]
48+
49+
recordsets = [
50+
{
51+
name = "*"
52+
type = "CNAME"
53+
ttl = 300
54+
records = ["private.googleapis.com."]
55+
},
56+
{
57+
name = "private"
58+
type = "A"
59+
ttl = 300
60+
records = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
61+
},
62+
]
63+
}
64+
65+
/******************************************
66+
Private GCR DNS Zone & records.
67+
*****************************************/
68+
69+
module "private_gcr" {
70+
source = "terraform-google-modules/cloud-dns/google"
71+
version = "~> 3.0"
72+
project_id = var.project_id
73+
type = "private"
74+
name = "private-gcr"
75+
domain = "gcr.io."
76+
description = "Private DNS zone to configure gcr.io"
77+
78+
private_visibility_config_networks = [
79+
module.main.network_self_link
80+
]
81+
82+
recordsets = [
83+
{
84+
name = "*"
85+
type = "CNAME"
86+
ttl = 300
87+
records = ["gcr.io."]
88+
},
89+
{
90+
name = ""
91+
type = "A"
92+
ttl = 300
93+
records = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
94+
},
95+
]
96+
}

‎2-networks/modules/standard_shared_vpc/firewall.tf‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/******************************************
18+
Default firewall rules
19+
*****************************************/
20+
21+
// Allow SSH via IAP when using the allow-iap-ssh tag for Linux workloads.
22+
resource "google_compute_firewall" "allow_iap_ssh" {
23+
count = var.default_fw_rules_enabled ? 1 : 0
24+
name = "allow-iap-ssh"
25+
network = module.main.network_name
26+
project = var.project_id
27+
28+
// Cloud IAP's TCP forwarding netblock
29+
source_ranges = concat(data.google_netblock_ip_ranges.iap_forwarders.cidr_blocks_ipv4)
30+
31+
allow {
32+
protocol = "tcp"
33+
ports = ["22"]
34+
}
35+
36+
target_tags = ["allow-iap-ssh"]
37+
}
38+
39+
// Allow RDP via IAP when using the allow-iap-rdp tag for Windows workloads.
40+
resource "google_compute_firewall" "allow_iap_rdp" {
41+
count = var.default_fw_rules_enabled ? 1 : 0
42+
name = "allow-iap-rdp"
43+
network = module.main.network_name
44+
project = var.project_id
45+
46+
// Cloud IAP's TCP forwarding netblock
47+
source_ranges = concat(data.google_netblock_ip_ranges.iap_forwarders.cidr_blocks_ipv4)
48+
49+
allow {
50+
protocol = "tcp"
51+
ports = ["3389"]
52+
}
53+
54+
target_tags = ["allow-iap-rdp"]
55+
}
56+
57+
// Allow traffic for Internal & Global load balancing health check and load balancing IP ranges.
58+
resource "google_compute_firewall" "allow_lb" {
59+
count = var.default_fw_rules_enabled ? 1 : 0
60+
name = "allow-lb"
61+
network = module.main.network_name
62+
project = var.project_id
63+
64+
source_ranges = concat(data.google_netblock_ip_ranges.health_checkers.cidr_blocks_ipv4, data.google_netblock_ip_ranges.legacy_health_checkers.cidr_blocks_ipv4)
65+
66+
// Allow common app ports by default.
67+
allow {
68+
protocol = "tcp"
69+
ports = ["80", "8080", "443"]
70+
}
71+
72+
target_tags = ["allow-lb"]
73+
}

‎2-networks/modules/standard_shared_vpc/main.tf‎

Lines changed: 22 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -19,41 +19,39 @@
1919
*****************************************/
2020

2121
module "main" {
22-
source = "terraform-google-modules/network/google"
23-
version = "~> 2.0"
24-
project_id = var.project_id
25-
network_name = var.network_name
26-
shared_vpc_host = "true"
22+
source = "terraform-google-modules/network/google"
23+
version = "~> 2.0"
24+
project_id = var.project_id
25+
network_name = var.network_name
26+
shared_vpc_host = "true"
27+
delete_default_internet_gateway_routes = "true"
2728

2829
subnets = var.subnets
2930
secondary_ranges = var.secondary_ranges
3031

3132
routes = [
3233
{
33-
name = "gcp-windows-activation"
34-
description = "Route through IGW to allow Windows kms activation."
34+
name = "egress-internet"
35+
description = "Tag based route through IGW to access internet"
36+
destination_range = "0.0.0.0/0"
37+
tags = "egress-internet"
38+
next_hop_internet = "true"
39+
},
40+
{
41+
name = "private-google-access"
42+
description = "Route through IGW to allow private google api access."
43+
destination_range = "199.36.153.8/30"
44+
next_hop_internet = "true"
45+
},
46+
{
47+
name = "windows-activation"
48+
description = "Route through IGW to allow Windows KMS activation for GCP."
3549
destination_range = "35.190.247.13/32"
3650
next_hop_internet = "true"
3751
},
3852
]
3953
}
4054

41-
/******************************************
42-
Default DNS Policy
43-
*****************************************/
44-
45-
resource "google_dns_policy" "default_policy" {
46-
provider = google-beta
47-
project = var.project_id
48-
name = "default-policy"
49-
enable_inbound_forwarding = true
50-
enable_logging = true
51-
networks {
52-
network_url = module.main.network_self_link
53-
}
54-
}
55-
56-
5755
/***************************************************************
5856
Configure Service Networking for Cloud SQL & future services.
5957
**************************************************************/
@@ -93,7 +91,7 @@ resource "google_compute_router" "default_router" {
9391
}
9492

9593
resource "google_compute_address" "nat_external_addresses" {
96-
count = 2
94+
count = var.nat_num_addresses
9795
project = var.project_id
9896
name = "nat-external-address-${count.index}"
9997
region = var.default_region
@@ -113,59 +111,3 @@ resource "google_compute_router_nat" "default_nat" {
113111
enable = true
114112
}
115113
}
116-
117-
/******************************************
118-
Default firewall rules
119-
*****************************************/
120-
121-
122-
// Allow SSH when using the allow-ssh tag for Linux workloads.
123-
resource "google_compute_firewall" "allow_ssh" {
124-
name = "allow-ssh"
125-
network = module.main.network_name
126-
project = var.project_id
127-
128-
// Cloud IAP's TCP forwarding netblock
129-
source_ranges = concat(data.google_netblock_ip_ranges.iap_forwarders.cidr_blocks_ipv4)
130-
131-
allow {
132-
protocol = "tcp"
133-
ports = ["22"]
134-
}
135-
136-
target_tags = ["allow-ssh"]
137-
}
138-
139-
// Allow RDP when using the allow-rdp tag for Windows workloads.
140-
resource "google_compute_firewall" "allow_rdp" {
141-
name = "allow-rdp"
142-
network = module.main.network_name
143-
project = var.project_id
144-
145-
// Cloud IAP's TCP forwarding netblock
146-
source_ranges = concat(data.google_netblock_ip_ranges.iap_forwarders.cidr_blocks_ipv4)
147-
148-
allow {
149-
protocol = "tcp"
150-
ports = ["3389"]
151-
}
152-
153-
target_tags = ["allow-rdp"]
154-
}
155-
156-
// Allow traffic for Internal & Global load balancing health check and load balancing IP ranges.
157-
resource "google_compute_firewall" "allow_lb" {
158-
name = "lb-healthcheck"
159-
network = module.main.network_name
160-
project = var.project_id
161-
162-
source_ranges = concat(data.google_netblock_ip_ranges.health_checkers.cidr_blocks_ipv4, data.google_netblock_ip_ranges.legacy_health_checkers.cidr_blocks_ipv4)
163-
164-
// Allow common app ports by default.
165-
allow {
166-
protocol = "tcp"
167-
ports = ["80", "8080", "443"]
168-
}
169-
170-
target_tags = ["allow-lb"]
171-
}

0 commit comments

Comments
 (0)