update dual-shared

Author: renato-rudnicki

3-networks-dual-svpc/README.md

@@ -195,10 +195,15 @@ Run `terraform output cloudbuild_project_id` in the `0-bootstrap` folder to get
 
    ```bash
    git add .
-   git commit -m 'Initialize networks repo'
+   git commit -m 'Initialize networks repo - plan'
+   ```
+
+1. You must manually plan and apply the `production` environment since the `development`, `nonproduction` and `plan` environments depend on it.
+
+   ```bash
+   git checkout -b production
    ```
 
-1. You must manually plan and apply the `shared` environment (only once) since the `development`, `nonproduction` and `production` environments depend on it.
 1. To use the `validate` option of the `tf-wrapper.sh` script, please follow the [instructions](https://cloud.google.com/docs/terraform/policy-validation/validate-policies#install) to install the terraform-tools component.
 1. Use `terraform output` to get the Cloud Build project ID and the networks step Terraform Service Account from 0-bootstrap output. An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set using the Terraform Service Account to enable impersonation.
 
@@ -210,6 +215,36 @@ Run `terraform output cloudbuild_project_id` in the `0-bootstrap` folder to get
    echo ${GOOGLE_IMPERSONATE_SERVICE_ACCOUNT}
    ```
 
+1. Run `init` and `plan` and review output for environment production.
+
+   ```bash
+   ./tf-wrapper.sh init production
+   ./tf-wrapper.sh plan production
+   ```
+
+1. Run `validate` and check for violations.
+
+   ```bash
+   ./tf-wrapper.sh validate production $(pwd)/../gcp-policies ${CLOUD_BUILD_PROJECT_ID}
+   ```
+
+1. Run `apply` production.
+
+   ```bash
+   ./tf-wrapper.sh apply production
+   ```
+
+   1. Push your production branch since development and nonproduction depends it.  Because this is a [named environment branch](../docs/FAQ.md#what-is-a-named-branch),
+   pushing to this branch triggers both _terraform plan_ and _terraform apply_. Review the apply output in your Cloud Build project https://console.cloud.google.com/cloud-build/builds;region=DEFAULT_REGION?project=YOUR_CLOUD_BUILD_PROJECT_ID
+
+*Note:** The Production envrionment must be the first branch to be pushed as it includes the DNS Hub communication that will be used by other environments.
+
+   ```bash
+   git push --set-upstream origin production
+   ```
+
+1. You must manually plan and apply the `shared` environment (only once) since the `development`, `nonproduction` and `production` environments depend on it.
+
 1. Run `init` and `plan` and review output for environment shared.
 
    ```bash
@@ -237,17 +272,7 @@ Run `terraform output cloudbuild_project_id` in the `0-bootstrap` folder to get
    git push --set-upstream origin plan
    ```
 
-1. Merge changes to production. Because this is a [named environment branch](../docs/FAQ.md#what-is-a-named-branch),
-   pushing to this branch triggers both _terraform plan_ and _terraform apply_. Review the apply output in your Cloud Build project https://console.cloud.google.com/cloud-build/builds;region=DEFAULT_REGION?project=YOUR_CLOUD_BUILD_PROJECT_ID
-
-*Note:** The Production envrionment must be the next branch to be merged as it includes the DNS Hub communication that will be used by other environments.
-
-   ```bash
-   git checkout -b production
-   git push origin production
-   ```
-
-1. After production has been applied, apply development.
+1. After plan has been applied, apply development.
 1. Merge changes to development. Because this is a [named environment branch](../docs/FAQ.md#what-is-a-named-branch),
    pushing to this branch triggers both _terraform plan_ and _terraform apply_. Review the apply output in your Cloud Build project https://console.cloud.google.com/cloud-build/builds;region=DEFAULT_REGION?project=YOUR_CLOUD_BUILD_PROJECT_ID
 

3-networks-dual-svpc/envs/production/README.md

@@ -24,6 +24,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
 | perimeter\_additional\_members | The list of additional members to be added to the enforced perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:[email protected]` or `serviceAccount:[email protected]`. | `list(string)` | `[]` | no |
 | perimeter\_additional\_members\_dry\_run | The list of additional members to be added to the dry-run perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:[email protected]` or `serviceAccount:[email protected]`. | `list(string)` | `[]` | no |
 | remote\_state\_bucket | Backend bucket to load Terraform Remote State Data from previous steps. | `string` | n/a | yes |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | `[]` | no |
 | tfc\_org\_name | Name of the TFC organization | `string` | `""` | no |
 
 ## Outputs

3-networks-dual-svpc/envs/production/main.tf

@@ -95,4 +95,5 @@ module "base_env" {
   restricted_private_service_connect_ip = "10.17.0.7"
   remote_state_bucket                   = var.remote_state_bucket
   tfc_org_name                          = var.tfc_org_name
+  target_name_server_addresses          = var.target_name_server_addresses
 }

3-networks-dual-svpc/envs/production/production.auto.tfvars

@@ -0,0 +1 @@
+../../production.auto.tfvars

3-networks-dual-svpc/envs/production/variables.tf

@@ -14,6 +14,12 @@
  * limitations under the License.
  */
 
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
+  default     = []
+}
+
 variable "remote_state_bucket" {
   description = "Backend bucket to load Terraform Remote State Data from previous steps."
   type        = string

3-networks-dual-svpc/envs/shared/README.md

@@ -20,6 +20,9 @@
 
 ## Outputs
 
-No outputs.
+| Name | Description |
+|------|-------------|
+| base\_host\_project\_id | The base host project ID |
+| restricted\_host\_project\_id | The restricted host project ID |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

3-networks-dual-svpc/envs/shared/outputs.tf

@@ -14,3 +14,14 @@
  * limitations under the License.
  */
 
+
+output "restricted_host_project_id" {
+  value       = local.restricted_net_hub_project_id
+  description = "The restricted host project ID"
+}
+
+output "base_host_project_id" {
+  value       = local.base_net_hub_project_id
+  description = "The base host project ID"
+}
+

3-networks-dual-svpc/envs/shared/remote.tf

@@ -15,19 +15,21 @@
  */
 
 locals {
-  env                       = "common"
-  environment_code          = "c"
-  dns_bgp_asn_number        = var.bgp_asn_dns
-  default_region1           = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
-  default_region2           = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
-  folder_prefix             = data.terraform_remote_state.bootstrap.outputs.common_config.folder_prefix
-  parent_id                 = data.terraform_remote_state.bootstrap.outputs.common_config.parent_id
-  bootstrap_folder_name     = data.terraform_remote_state.bootstrap.outputs.common_config.bootstrap_folder_name
-  common_folder_name        = data.terraform_remote_state.org.outputs.common_folder_name
-  network_folder_name       = data.terraform_remote_state.org.outputs.network_folder_name
-  development_folder_name   = data.terraform_remote_state.env_development.outputs.env_folder
-  nonproduction_folder_name = data.terraform_remote_state.env_nonproduction.outputs.env_folder
-  production_folder_name    = data.terraform_remote_state.env_production.outputs.env_folder
+  env                           = "common"
+  environment_code              = "c"
+  dns_bgp_asn_number            = var.bgp_asn_dns
+  default_region1               = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
+  default_region2               = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
+  folder_prefix                 = data.terraform_remote_state.bootstrap.outputs.common_config.folder_prefix
+  parent_id                     = data.terraform_remote_state.bootstrap.outputs.common_config.parent_id
+  bootstrap_folder_name         = data.terraform_remote_state.bootstrap.outputs.common_config.bootstrap_folder_name
+  common_folder_name            = data.terraform_remote_state.org.outputs.common_folder_name
+  network_folder_name           = data.terraform_remote_state.org.outputs.network_folder_name
+  development_folder_name       = data.terraform_remote_state.env_development.outputs.env_folder
+  nonproduction_folder_name     = data.terraform_remote_state.env_nonproduction.outputs.env_folder
+  production_folder_name        = data.terraform_remote_state.env_production.outputs.env_folder
+  base_net_hub_project_id       = data.terraform_remote_state.org.outputs.base_net_hub_project_id       //
+  restricted_net_hub_project_id = data.terraform_remote_state.org.outputs.restricted_net_hub_project_id //
 }
 
 data "terraform_remote_state" "bootstrap" {

3-networks-dual-svpc/modules/base_env/README.md

@@ -41,6 +41,7 @@
 |------|-------------|
 | access\_level\_name | Access context manager access level name for the enforced perimeter |
 | access\_level\_name\_dry\_run | Access context manager access level name for the dry-run perimeter |
+| base\_dns\_project\_id | The base DNS project ID |
 | base\_host\_project\_id | The base host project ID |
 | base\_network\_name | The name of the VPC being created |
 | base\_network\_self\_link | The URI of the VPC being created |
@@ -49,6 +50,7 @@
 | base\_subnets\_secondary\_ranges | The secondary ranges associated with these subnets |
 | base\_subnets\_self\_links | The self-links of subnets being created |
 | enforce\_vpcsc | Enable the enforced mode for VPC Service Controls. It is not recommended to enable VPC-SC on the first run deploying your foundation. Review [best practices for enabling VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/enable), then only enforce the perimeter after you have analyzed the access patterns in your dry-run perimeter and created the necessary exceptions for your use cases. |
+| restricted\_dns\_project\_id | The restricted DNS project ID |
 | restricted\_host\_project\_id | The restricted host project ID |
 | restricted\_network\_name | The name of the VPC being created |
 | restricted\_network\_self\_link | The URI of the VPC being created |

3-networks-dual-svpc/modules/base_env/main.tf

@@ -171,7 +171,7 @@ module "restricted_shared_vpc" {
 
   project_id                       = local.restricted_project_id
   project_number                   = local.restricted_project_number
-  production_project_id            = local.production_restricted_project_id
+  restricted_dns_project_id        = local.restricted_dns_project_id
   environment_code                 = var.environment_code
   access_context_manager_policy_id = var.access_context_manager_policy_id
   restricted_services              = local.restricted_services
@@ -265,7 +265,7 @@ module "base_shared_vpc" {
   source = "../base_shared_vpc"
 
   project_id                   = local.base_project_id
-  production_project_id        = local.production_base_project_id
+  base_dns_project_id          = local.base_dns_project_id
   environment_code             = var.environment_code
   private_service_cidr         = var.base_private_service_cidr
   private_service_connect_ip   = var.base_private_service_connect_ip