Skip to content

Commit 01d071f

Browse files
gleichdagleichda
committed
Create module and example for NCC
1 parent 830b09c commit 01d071f

File tree

14 files changed

+820
-0
lines changed

14 files changed

+820
-0
lines changed

‎examples/network_connectivity_center/main.tf‎

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "network_connectivity_center" {
18+
source = "terraform-google-modules/network/google//modules/network-connectivity-center"
19+
project_id = var.project_id
20+
ncc_hub_name = var.ncc_hub_name
21+
vpc_spokes = {
22+
"vpc-1" = {
23+
uri = module.vpc_spoke_vpc.network_id
24+
}
25+
}
26+
hybrid_spokes = {
27+
"vpn-1" = {
28+
type = "vpn"
29+
uris = [for k, v in module.local_to_remote_vpn.tunnel_self_links : v]
30+
site_to_site_data_transfer = true
31+
location = var.vpn_region
32+
}
33+
}
34+
router_appliance_spokes = {
35+
"appliance-1" = {
36+
instances = [
37+
{
38+
virtual_machine = google_compute_instance.router_appliance_1.id
39+
ip_address = google_compute_instance.router_appliance_1.network_interface[0].network_ip
40+
},
41+
{
42+
virtual_machine = google_compute_instance.router_appliance_2.id
43+
ip_address = google_compute_instance.router_appliance_2.network_interface[0].network_ip
44+
}
45+
]
46+
location = var.instance_region
47+
site_to_site_data_transfer = false
48+
}
49+
}
50+
}
51+
52+
################################
53+
# VPC Spoke #
54+
################################
55+
module "vpc_spoke_vpc" {
56+
source = "terraform-google-modules/network/google"
57+
project_id = var.project_id
58+
network_name = var.vpc_spoke_vpc_name
59+
routing_mode = "GLOBAL"
60+
61+
subnets = [
62+
{
63+
subnet_name = "vpc-spoke-subnet-01"
64+
subnet_ip = "10.10.10.0/24"
65+
subnet_region = "us-west1"
66+
},
67+
{
68+
subnet_name = "vpc-spoke-subnet-02"
69+
subnet_ip = "10.10.20.0/24"
70+
subnet_region = "us-east1"
71+
},
72+
{
73+
subnet_name = "vpc-spoke-subnet-03"
74+
subnet_ip = "10.10.30.0/24"
75+
subnet_region = "europe-west4"
76+
}
77+
]
78+
}
79+
80+
################################
81+
# VPN Spoke #
82+
################################
83+
# Simulates an on-prem network that will be connected over VPN
84+
module "vpn_spoke_remote_vpc" {
85+
source = "terraform-google-modules/network/google"
86+
project_id = var.project_id
87+
network_name = var.vpn_spoke_remote_vpc_name
88+
routing_mode = "GLOBAL"
89+
90+
subnets = [
91+
{
92+
subnet_name = "vpn-subnet-01"
93+
subnet_ip = "10.20.10.0/24"
94+
subnet_region = "us-west1"
95+
},
96+
{
97+
subnet_name = "vpn-subnet-02"
98+
subnet_ip = "10.20.20.0/24"
99+
subnet_region = "us-east1"
100+
},
101+
{
102+
subnet_name = "vpn-subnet-03"
103+
subnet_ip = "10.20.30.0/24"
104+
subnet_region = "europe-west4"
105+
}
106+
]
107+
}
108+
109+
module "vpn_spoke_local_vpc" {
110+
source = "terraform-google-modules/network/google"
111+
project_id = var.project_id
112+
network_name = var.vpn_spoke_local_vpc_name
113+
routing_mode = "GLOBAL"
114+
subnets = []
115+
}
116+
117+
module "remote_to_local_vpn" {
118+
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
119+
version = "~> 4.0"
120+
121+
project_id = var.project_id
122+
region = var.vpn_region
123+
network = module.vpn_spoke_remote_vpc.network_id
124+
name = "remote-to-local"
125+
router_asn = 64513
126+
peer_gcp_gateway = module.local_to_remote_vpn.self_link
127+
tunnels = {
128+
remote-0 = {
129+
bgp_peer = {
130+
address = "169.254.1.2"
131+
asn = 64514
132+
}
133+
bgp_peer_options = null
134+
bgp_session_range = "169.254.1.1/30"
135+
ike_version = 2
136+
vpn_gateway_interface = 0
137+
peer_external_gateway_interface = null
138+
shared_secret = module.local_to_remote_vpn.random_secret
139+
}
140+
remote-1 = {
141+
bgp_peer = {
142+
address = "169.254.2.2"
143+
asn = 64514
144+
}
145+
bgp_peer_options = null
146+
bgp_session_range = "169.254.2.1/30"
147+
ike_version = 2
148+
vpn_gateway_interface = 1
149+
peer_external_gateway_interface = null
150+
shared_secret = module.local_to_remote_vpn.random_secret
151+
}
152+
}
153+
}
154+
155+
module "local_to_remote_vpn" {
156+
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
157+
version = "~> 4.0"
158+
159+
project_id = var.project_id
160+
region = var.vpn_region
161+
network = module.vpn_spoke_local_vpc.network_id
162+
name = "local-to-remote"
163+
peer_gcp_gateway = module.remote_to_local_vpn.self_link
164+
router_asn = 64514
165+
tunnels = {
166+
remote-0 = {
167+
bgp_peer = {
168+
address = "169.254.1.1"
169+
asn = 64513
170+
}
171+
bgp_peer_options = null
172+
bgp_session_range = "169.254.1.2/30"
173+
ike_version = 2
174+
vpn_gateway_interface = 0
175+
peer_external_gateway_interface = null
176+
shared_secret = ""
177+
}
178+
remote-1 = {
179+
bgp_peer = {
180+
address = "169.254.2.1"
181+
asn = 64513
182+
}
183+
bgp_peer_options = null
184+
bgp_session_range = "169.254.2.2/30"
185+
ike_version = 2
186+
vpn_gateway_interface = 1
187+
peer_external_gateway_interface = null
188+
shared_secret = ""
189+
}
190+
}
191+
}
192+
193+
194+
################################
195+
# Router Appliance Spoke #
196+
################################
197+
data "google_compute_zones" "available" {
198+
project = var.project_id
199+
region = var.instance_region
200+
}
201+
202+
resource "random_shuffle" "zone" {
203+
input = data.google_compute_zones.available.names
204+
result_count = 1
205+
}
206+
207+
module "router_appliance_spoke_vpc" {
208+
source = "terraform-google-modules/network/google"
209+
project_id = var.project_id
210+
network_name = var.router_appliance_vpc_name
211+
routing_mode = "GLOBAL"
212+
213+
subnets = [
214+
{
215+
subnet_name = "router-appliance-subnet-01"
216+
subnet_ip = "10.20.10.0/24"
217+
subnet_region = var.instance_region
218+
}
219+
]
220+
}
221+
222+
resource "google_compute_instance" "router_appliance_1" {
223+
name = "fake-router-appliance-1"
224+
machine_type = "e2-medium"
225+
project = var.project_id
226+
can_ip_forward = true
227+
zone = random_shuffle.zone.result[0]
228+
229+
boot_disk {
230+
initialize_params {
231+
image = "debian-cloud/debian-11"
232+
}
233+
}
234+
235+
network_interface {
236+
subnetwork = module.router_appliance_spoke_vpc.subnets["${var.instance_region}/router-appliance-subnet-01"].id
237+
access_config {
238+
network_tier = "PREMIUM"
239+
}
240+
}
241+
}
242+
243+
resource "google_compute_instance" "router_appliance_2" {
244+
name = "fake-router-appliance-2"
245+
machine_type = "e2-medium"
246+
project = var.project_id
247+
can_ip_forward = true
248+
zone = random_shuffle.zone.result[0]
249+
250+
boot_disk {
251+
initialize_params {
252+
image = "debian-cloud/debian-11"
253+
}
254+
}
255+
256+
network_interface {
257+
subnetwork = module.router_appliance_spoke_vpc.subnets["${var.instance_region}/router-appliance-subnet-01"].id
258+
access_config {
259+
network_tier = "PREMIUM"
260+
}
261+
}
262+
}

‎examples/network_connectivity_center/outputs.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "ncc_hub" {
18+
description = "The NCC Hub object"
19+
value = module.network_connectivity_center.ncc_hub
20+
}
21+
22+
output "vpc_spokes" {
23+
description = "All vpc spoke objects"
24+
value = module.network_connectivity_center.vpc_spokes
25+
}
26+
27+
28+
output "hybrid_spokes" {
29+
description = "All hybrid spoke objects"
30+
value = module.network_connectivity_center.hybrid_spokes
31+
}
32+
33+
output "router_appliance_spokes" {
34+
description = "All router appliance spoke objects"
35+
value = module.network_connectivity_center.router_appliance_spokes
36+
}
37+
38+
output "spokes" {
39+
description = "All spoke objects prefixed with the type of spoke (vpc, hybrid, appliance)"
40+
value = module.network_connectivity_center.spokes
41+
}

‎examples/network_connectivity_center/variables.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the network in"
19+
}
20+
21+
variable "vpn_region" {
22+
description = "The region where to deploy the VPN"
23+
default = "europe-west4"
24+
}
25+
26+
variable "instance_region" {
27+
description = "The region where to deploy the Router Instance in"
28+
default = "us-central1"
29+
}
30+
31+
variable "ncc_hub_name" {
32+
description = "The Name of the NCC Hub"
33+
type = string
34+
default = "ncc-hub"
35+
}
36+
37+
variable "vpc_spoke_vpc_name" {
38+
description = "The VPC Name for the VPC Spoke"
39+
type = string
40+
default = "vpc-spoke"
41+
}
42+
43+
variable "vpn_spoke_local_vpc_name" {
44+
description = "The name for the local VPC (GCP side) for the VPN Spoke"
45+
type = string
46+
default = "vpn-local-spoke"
47+
}
48+
49+
variable "vpn_spoke_remote_vpc_name" {
50+
description = "The name for the remote VPC (fake on-orem) for the VPN Spoke"
51+
type = string
52+
default = "vpn-remote-spoke"
53+
}
54+
55+
variable "router_appliance_vpc_name" {
56+
description = "The VPC Name for the VPC Spoke"
57+
type = string
58+
default = "router-appliance-spoke"
59+
}

‎examples/network_connectivity_center/versions.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">=0.13.0"
19+
20+
required_providers {
21+
google = {
22+
source = "hashicorp/google"
23+
version = ">= 5.40.0"
24+
25+
}
26+
}
27+
}

0 commit comments

Comments
 (0)