Skip to content

Commit 79b217e

Browse files
Samir-Citdaniel-cit
Samir-Cit
and
daniel-cit
authored
feat: Add support to proxy-only subnetworks and new IP CIDR allocation (#1040)
Co-authored-by: Daniel Andrade <[email protected]>
1 parent f16e805 commit 79b217e

File tree

18 files changed

+327
-101
lines changed

18 files changed

+327
-101
lines changed

‎0-bootstrap/terraform.example.tfvars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ default_region = "us-central1"
5656
# gcp_audit_viewer = "[email protected]"
5757
# }
5858
# }
59-
#
59+
6060

6161

6262
/* ----------------------------------------

‎3-networks-dual-svpc/envs/development/main.tf‎

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,48 @@ locals {
2222
/*
2323
* Base network ranges
2424
*/
25-
base_private_service_cidr = "10.16.64.0/21"
25+
base_private_service_cidr = "10.16.8.0/21"
2626
base_subnet_primary_ranges = {
27-
(local.default_region1) = "10.0.64.0/21"
28-
(local.default_region2) = "10.1.64.0/21"
27+
(local.default_region1) = "10.0.64.0/18"
28+
(local.default_region2) = "10.1.64.0/18"
29+
}
30+
base_subnet_proxy_ranges = {
31+
(local.default_region1) = "10.18.2.0/23"
32+
(local.default_region2) = "10.19.2.0/23"
2933
}
3034
base_subnet_secondary_ranges = {
3135
(local.default_region1) = [
3236
{
3337
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
34-
ip_cidr_range = "100.64.64.0/21"
38+
ip_cidr_range = "100.64.64.0/18"
3539
},
3640
{
3741
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
38-
ip_cidr_range = "100.64.72.0/21"
42+
ip_cidr_range = "100.65.64.0/18"
3943
}
4044
]
4145
}
4246
/*
4347
* Restricted network ranges
4448
*/
45-
restricted_private_service_cidr = "10.24.64.0/21"
49+
restricted_private_service_cidr = "10.16.40.0/21"
4650
restricted_subnet_primary_ranges = {
47-
(local.default_region1) = "10.8.64.0/21"
48-
(local.default_region2) = "10.9.64.0/21"
51+
(local.default_region1) = "10.8.64.0/18"
52+
(local.default_region2) = "10.9.64.0/18"
53+
}
54+
restricted_subnet_proxy_ranges = {
55+
(local.default_region1) = "10.26.2.0/23"
56+
(local.default_region2) = "10.27.2.0/23"
4957
}
5058
restricted_subnet_secondary_ranges = {
5159
(local.default_region1) = [
5260
{
5361
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
54-
ip_cidr_range = "100.72.64.0/21"
62+
ip_cidr_range = "100.72.64.0/18"
5563
},
5664
{
5765
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
58-
ip_cidr_range = "100.72.72.0/21"
66+
ip_cidr_range = "100.73.64.0/18"
5967
}
6068
]
6169
}
@@ -76,13 +84,14 @@ module "base_env" {
7684
enable_partner_interconnect = false
7785
base_private_service_cidr = local.base_private_service_cidr
7886
base_subnet_primary_ranges = local.base_subnet_primary_ranges
87+
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
7988
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
80-
base_private_service_connect_ip = "10.2.64.5"
89+
base_private_service_connect_ip = "10.17.0.2"
8190
restricted_private_service_cidr = local.restricted_private_service_cidr
8291
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
92+
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
8393
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
84-
restricted_private_service_connect_ip = "10.10.64.5"
94+
restricted_private_service_connect_ip = "10.17.0.6"
8595
remote_state_bucket = var.remote_state_bucket
8696
tfc_org_name = var.tfc_org_name
87-
8897
}

‎3-networks-dual-svpc/envs/non-production/main.tf‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,48 @@ locals {
2222
/*
2323
* Base network ranges
2424
*/
25-
base_private_service_cidr = "10.16.128.0/21"
25+
base_private_service_cidr = "10.16.16.0/21"
2626
base_subnet_primary_ranges = {
27-
(local.default_region1) = "10.0.128.0/21"
28-
(local.default_region2) = "10.1.128.0/21"
27+
(local.default_region1) = "10.0.128.0/18"
28+
(local.default_region2) = "10.1.128.0/18"
29+
}
30+
base_subnet_proxy_ranges = {
31+
(local.default_region1) = "10.18.4.0/23"
32+
(local.default_region2) = "10.19.4.0/23"
2933
}
3034
base_subnet_secondary_ranges = {
3135
(local.default_region1) = [
3236
{
3337
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
34-
ip_cidr_range = "100.64.128.0/21"
38+
ip_cidr_range = "100.64.128.0/18"
3539
},
3640
{
3741
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
38-
ip_cidr_range = "100.64.136.0/21"
42+
ip_cidr_range = "100.65.128.0/18"
3943
}
4044
]
4145
}
4246
/*
4347
* Restricted network ranges
4448
*/
45-
restricted_private_service_cidr = "10.24.128.0/21"
49+
restricted_private_service_cidr = "10.16.48.0/21"
4650
restricted_subnet_primary_ranges = {
47-
(local.default_region1) = "10.8.128.0/21"
48-
(local.default_region2) = "10.9.128.0/21"
51+
(local.default_region1) = "10.8.128.0/18"
52+
(local.default_region2) = "10.9.128.0/18"
53+
}
54+
restricted_subnet_proxy_ranges = {
55+
(local.default_region1) = "10.26.4.0/23"
56+
(local.default_region2) = "10.27.4.0/23"
4957
}
5058
restricted_subnet_secondary_ranges = {
5159
(local.default_region1) = [
5260
{
5361
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
54-
ip_cidr_range = "100.72.128.0/21"
62+
ip_cidr_range = "100.72.128.0/18"
5563
},
5664
{
5765
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
58-
ip_cidr_range = "100.72.136.0/21"
66+
ip_cidr_range = "100.73.128.0/18"
5967
}
6068
]
6169
}
@@ -76,12 +84,14 @@ module "base_env" {
7684
enable_partner_interconnect = false
7785
base_private_service_cidr = local.base_private_service_cidr
7886
base_subnet_primary_ranges = local.base_subnet_primary_ranges
87+
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
7988
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
80-
base_private_service_connect_ip = "10.2.128.5"
89+
base_private_service_connect_ip = "10.17.0.3"
8190
restricted_private_service_cidr = local.restricted_private_service_cidr
91+
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
8292
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
8393
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
84-
restricted_private_service_connect_ip = "10.10.128.5"
94+
restricted_private_service_connect_ip = "10.17.0.7"
8595
remote_state_bucket = var.remote_state_bucket
8696
tfc_org_name = var.tfc_org_name
8797
}

‎3-networks-dual-svpc/envs/production/main.tf‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,48 @@ locals {
2222
/*
2323
* Base network ranges
2424
*/
25-
base_private_service_cidr = "10.16.192.0/21"
25+
base_private_service_cidr = "10.16.24.0/21"
2626
base_subnet_primary_ranges = {
27-
(local.default_region1) = "10.0.192.0/21"
28-
(local.default_region2) = "10.1.192.0/21"
27+
(local.default_region1) = "10.0.192.0/18"
28+
(local.default_region2) = "10.1.192.0/18"
29+
}
30+
base_subnet_proxy_ranges = {
31+
(local.default_region1) = "10.18.6.0/23"
32+
(local.default_region2) = "10.19.6.0/23"
2933
}
3034
base_subnet_secondary_ranges = {
3135
(local.default_region1) = [
3236
{
3337
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
34-
ip_cidr_range = "100.64.192.0/21"
38+
ip_cidr_range = "100.64.192.0/18"
3539
},
3640
{
3741
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
38-
ip_cidr_range = "100.64.200.0/21"
42+
ip_cidr_range = "100.65.192.0/18"
3943
}
4044
]
4145
}
4246
/*
4347
* Restricted network ranges
4448
*/
45-
restricted_private_service_cidr = "10.24.192.0/21"
49+
restricted_private_service_cidr = "10.16.56.0/21"
4650
restricted_subnet_primary_ranges = {
47-
(local.default_region1) = "10.8.192.0/21"
48-
(local.default_region2) = "10.9.192.0/21"
51+
(local.default_region1) = "10.8.192.0/18"
52+
(local.default_region2) = "10.9.192.0/18"
53+
}
54+
restricted_subnet_proxy_ranges = {
55+
(local.default_region1) = "10.26.6.0/23"
56+
(local.default_region2) = "10.27.6.0/23"
4957
}
5058
restricted_subnet_secondary_ranges = {
5159
(local.default_region1) = [
5260
{
5361
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
54-
ip_cidr_range = "100.72.192.0/21"
62+
ip_cidr_range = "100.72.192.0/18"
5563
},
5664
{
5765
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
58-
ip_cidr_range = "100.72.200.0/21"
66+
ip_cidr_range = "100.73.192.0/18"
5967
}
6068
]
6169
}
@@ -76,12 +84,14 @@ module "base_env" {
7684
enable_partner_interconnect = false
7785
base_private_service_cidr = local.base_private_service_cidr
7886
base_subnet_primary_ranges = local.base_subnet_primary_ranges
87+
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
7988
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
80-
base_private_service_connect_ip = "10.2.192.5"
89+
base_private_service_connect_ip = "10.17.0.4"
8190
restricted_private_service_cidr = local.restricted_private_service_cidr
8291
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
92+
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
8393
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
84-
restricted_private_service_connect_ip = "10.10.192.5"
94+
restricted_private_service_connect_ip = "10.17.0.8"
8595
remote_state_bucket = var.remote_state_bucket
8696
tfc_org_name = var.tfc_org_name
8797
}

‎3-networks-dual-svpc/modules/base_env/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
| base\_private\_service\_cidr | CIDR range for private service networking. Used for Cloud SQL and other managed services in the Base Shared Vpc. | `string` | n/a | yes |
88
| base\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC | `string` | n/a | yes |
99
| base\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
10+
| base\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
1011
| base\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Base Shared Vpc. | `map(list(map(string)))` | n/a | yes |
1112
| base\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br> flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br> metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br> metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br> filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br> aggregation_interval = optional(string, "INTERVAL_5_SEC")<br> flow_sampling = optional(string, "0.5")<br> metadata = optional(string, "INCLUDE_ALL_METADATA")<br> metadata_fields = optional(list(string), [])<br> filter_expr = optional(string, "true")<br> })</pre> | `{}` | no |
1213
| custom\_restricted\_services | List of custom services to be protected by the VPC-SC perimeter. If empty, all supported services (https://cloud.google.com/vpc-service-controls/docs/supported-products) will be protected. | `list(string)` | `[]` | no |
@@ -24,6 +25,7 @@
2425
| restricted\_private\_service\_cidr | CIDR range for private service networking. Used for Cloud SQL and other managed services in the Restricted Shared Vpc. | `string` | n/a | yes |
2526
| restricted\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC | `string` | n/a | yes |
2627
| restricted\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
28+
| restricted\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
2729
| restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
2830
| restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br> flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br> metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br> metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br> filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br> aggregation_interval = optional(string, "INTERVAL_5_SEC")<br> flow_sampling = optional(string, "0.5")<br> metadata = optional(string, "INCLUDE_ALL_METADATA")<br> metadata_fields = optional(list(string), [])<br> filter_expr = optional(string, "true")<br> })</pre> | `{}` | no |
2931
| tfc\_org\_name | Name of the TFC organization | `string` | n/a | yes |

‎3-networks-dual-svpc/modules/base_env/main.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,24 @@ module "restricted_shared_vpc" {
218218
subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
219219
subnet_flow_logs_filter = var.restricted_vpc_flow_logs.filter_expr
220220
description = "Second ${var.env} subnet example."
221+
},
222+
{
223+
subnet_name = "sb-${var.environment_code}-shared-restricted-${var.default_region1}-proxy"
224+
subnet_ip = var.restricted_subnet_proxy_ranges[var.default_region1]
225+
subnet_region = var.default_region1
226+
subnet_flow_logs = false
227+
description = "First ${var.env} proxy-only subnet example."
228+
role = "ACTIVE"
229+
purpose = "REGIONAL_MANAGED_PROXY"
230+
},
231+
{
232+
subnet_name = "sb-${var.environment_code}-shared-restricted-${var.default_region2}-proxy"
233+
subnet_ip = var.restricted_subnet_proxy_ranges[var.default_region2]
234+
subnet_region = var.default_region2
235+
subnet_flow_logs = false
236+
description = "Second ${var.env} proxy-only subnet example."
237+
role = "ACTIVE"
238+
purpose = "REGIONAL_MANAGED_PROXY"
221239
}
222240
]
223241
secondary_ranges = {
@@ -270,8 +288,27 @@ module "base_shared_vpc" {
270288
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
271289
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
272290
description = "Second ${var.env} subnet example."
291+
},
292+
{
293+
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region1}-proxy"
294+
subnet_ip = var.base_subnet_proxy_ranges[var.default_region1]
295+
subnet_region = var.default_region1
296+
subnet_flow_logs = false
297+
description = "First ${var.env} proxy-only subnet example."
298+
role = "ACTIVE"
299+
purpose = "REGIONAL_MANAGED_PROXY"
300+
},
301+
{
302+
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region2}-proxy"
303+
subnet_ip = var.base_subnet_proxy_ranges[var.default_region2]
304+
subnet_region = var.default_region2
305+
subnet_flow_logs = false
306+
description = "Second ${var.env} proxy-only subnet example."
307+
role = "ACTIVE"
308+
purpose = "REGIONAL_MANAGED_PROXY"
273309
}
274310
]
311+
275312
secondary_ranges = {
276313
"sb-${var.environment_code}-shared-base-${var.default_region1}" = var.base_subnet_secondary_ranges[var.default_region1]
277314
}

‎3-networks-dual-svpc/modules/base_env/variables.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ variable "base_subnet_primary_ranges" {
7171
description = "The base subnet primary IPTs ranges to the Base Shared Vpc."
7272
}
7373

74+
variable "base_subnet_proxy_ranges" {
75+
type = map(string)
76+
description = "The base proxy-only subnet primary IPTs ranges to the Base Shared Vpc."
77+
}
78+
7479
variable "base_subnet_secondary_ranges" {
7580
type = map(list(map(string)))
7681
description = "The base subnet secondary IPTs ranges to the Base Shared Vpc."
@@ -109,6 +114,11 @@ variable "restricted_subnet_primary_ranges" {
109114
description = "The base subnet primary IPTs ranges to the Restricted Shared Vpc."
110115
}
111116

117+
variable "restricted_subnet_proxy_ranges" {
118+
type = map(string)
119+
description = "The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc."
120+
}
121+
112122
variable "restricted_subnet_secondary_ranges" {
113123
type = map(list(map(string)))
114124
description = "The base subnet secondary IPTs ranges to the Restricted Shared Vpc"

0 commit comments

Comments
 (0)