Skip to content

Commit 3a6c8fb

Browse files
gleichdaimrannayer
gleichda
and
imrannayer
authored
feat: Create module and example for NCC (#575)
Co-authored-by: Imran Nayer <[email protected]>
1 parent 8abb57b commit 3a6c8fb

File tree

13 files changed

+772
-0
lines changed

13 files changed

+772
-0
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,21 @@ steps:
226226
- verify hierarchical-firewall-policy
227227
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
228228
args: ['/bin/bash', '-c', 'cft test run TestHierarchicalFirewallPolicy --stage teardown --verbose']
229+
- id: converge network-connectivity-center
230+
waitFor:
231+
- destroy hierarchical-firewall-policy
232+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
233+
args: ['/bin/bash', '-c', 'cft test run TestNetworkConnectivityCenter --stage apply --verbose']
234+
- id: verify network-connectivity-center
235+
waitFor:
236+
- converge network-connectivity-center
237+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
238+
args: ['/bin/bash', '-c', 'cft test run TestNetworkConnectivityCenter --stage verify --verbose']
239+
- id: destroy network-connectivity-center
240+
waitFor:
241+
- verify network-connectivity-center
242+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
243+
args: ['/bin/bash', '-c', 'cft test run TestNetworkConnectivityCenter --stage teardown --verbose']
229244
tags:
230245
- 'ci'
231246
- 'integration'

‎examples/network_connectivity_center/main.tf‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "network_connectivity_center" {
18+
source = "terraform-google-modules/network/google//modules/network-connectivity-center"
19+
project_id = var.project_id
20+
ncc_hub_name = var.ncc_hub_name
21+
ncc_hub_labels = {
22+
"module" = "ncc"
23+
}
24+
spoke_labels = {
25+
"created-by" = "terraform-google-ncc-example"
26+
}
27+
vpc_spokes = {
28+
"vpc-1" = {
29+
uri = module.vpc_spoke_vpc.network_id
30+
labels = {
31+
"spoke-type" = "vpc"
32+
}
33+
}
34+
}
35+
hybrid_spokes = {
36+
"vpn-1" = {
37+
type = "vpn"
38+
uris = [for k, v in module.local_to_remote_vpn.tunnel_self_links : v]
39+
site_to_site_data_transfer = true
40+
location = var.vpn_region
41+
}
42+
}
43+
router_appliance_spokes = {
44+
"appliance-1" = {
45+
instances = [
46+
{
47+
virtual_machine = google_compute_instance.router_appliance_1.id
48+
ip_address = google_compute_instance.router_appliance_1.network_interface[0].network_ip
49+
},
50+
51+
]
52+
location = var.instance_region
53+
site_to_site_data_transfer = false
54+
}
55+
}
56+
}
57+
58+
################################
59+
# VPC Spoke #
60+
################################
61+
module "vpc_spoke_vpc" {
62+
source = "terraform-google-modules/network/google"
63+
project_id = var.project_id
64+
network_name = var.vpc_spoke_vpc_name
65+
routing_mode = "GLOBAL"
66+
67+
subnets = [
68+
{
69+
subnet_name = "vpc-spoke-subnet-01"
70+
subnet_ip = "10.10.10.0/24"
71+
subnet_region = "us-west1"
72+
},
73+
{
74+
subnet_name = "vpc-spoke-subnet-02"
75+
subnet_ip = "10.10.20.0/24"
76+
subnet_region = "us-east1"
77+
},
78+
{
79+
subnet_name = "vpc-spoke-subnet-03"
80+
subnet_ip = "10.10.30.0/24"
81+
subnet_region = "europe-west4"
82+
}
83+
]
84+
}
85+
86+
################################
87+
# VPN Spoke #
88+
################################
89+
# Simulates an on-prem network that will be connected over VPN
90+
module "vpn_spoke_remote_vpc" {
91+
source = "terraform-google-modules/network/google"
92+
project_id = var.project_id
93+
network_name = var.vpn_spoke_remote_vpc_name
94+
routing_mode = "GLOBAL"
95+
96+
subnets = [
97+
{
98+
subnet_name = "vpn-subnet-01"
99+
subnet_ip = "10.20.10.0/24"
100+
subnet_region = "us-west1"
101+
},
102+
{
103+
subnet_name = "vpn-subnet-02"
104+
subnet_ip = "10.20.20.0/24"
105+
subnet_region = "us-east1"
106+
},
107+
{
108+
subnet_name = "vpn-subnet-03"
109+
subnet_ip = "10.20.30.0/24"
110+
subnet_region = "europe-west4"
111+
}
112+
]
113+
}
114+
115+
module "vpn_spoke_local_vpc" {
116+
source = "terraform-google-modules/network/google"
117+
project_id = var.project_id
118+
network_name = var.vpn_spoke_local_vpc_name
119+
routing_mode = "GLOBAL"
120+
subnets = []
121+
}
122+
123+
module "remote_to_local_vpn" {
124+
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
125+
version = "~> 4.0"
126+
127+
project_id = var.project_id
128+
region = var.vpn_region
129+
network = module.vpn_spoke_remote_vpc.network_id
130+
name = "remote-to-local"
131+
router_asn = 64513
132+
peer_gcp_gateway = module.local_to_remote_vpn.self_link
133+
tunnels = {
134+
remote-0 = {
135+
bgp_peer = {
136+
address = "169.254.1.2"
137+
asn = 64514
138+
}
139+
bgp_peer_options = null
140+
bgp_session_range = "169.254.1.1/30"
141+
ike_version = 2
142+
vpn_gateway_interface = 0
143+
peer_external_gateway_interface = null
144+
shared_secret = module.local_to_remote_vpn.random_secret
145+
}
146+
remote-1 = {
147+
bgp_peer = {
148+
address = "169.254.2.2"
149+
asn = 64514
150+
}
151+
bgp_peer_options = null
152+
bgp_session_range = "169.254.2.1/30"
153+
ike_version = 2
154+
vpn_gateway_interface = 1
155+
peer_external_gateway_interface = null
156+
shared_secret = module.local_to_remote_vpn.random_secret
157+
}
158+
}
159+
}
160+
161+
module "local_to_remote_vpn" {
162+
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
163+
version = "~> 4.0"
164+
165+
project_id = var.project_id
166+
region = var.vpn_region
167+
network = module.vpn_spoke_local_vpc.network_id
168+
name = "local-to-remote"
169+
peer_gcp_gateway = module.remote_to_local_vpn.self_link
170+
router_asn = 64514
171+
tunnels = {
172+
remote-0 = {
173+
bgp_peer = {
174+
address = "169.254.1.1"
175+
asn = 64513
176+
}
177+
bgp_peer_options = null
178+
bgp_session_range = "169.254.1.2/30"
179+
ike_version = 2
180+
vpn_gateway_interface = 0
181+
peer_external_gateway_interface = null
182+
shared_secret = ""
183+
}
184+
remote-1 = {
185+
bgp_peer = {
186+
address = "169.254.2.1"
187+
asn = 64513
188+
}
189+
bgp_peer_options = null
190+
bgp_session_range = "169.254.2.2/30"
191+
ike_version = 2
192+
vpn_gateway_interface = 1
193+
peer_external_gateway_interface = null
194+
shared_secret = ""
195+
}
196+
}
197+
}
198+
199+
200+
################################
201+
# Router Appliance Spoke #
202+
################################
203+
data "google_compute_zones" "available" {
204+
project = var.project_id
205+
region = var.instance_region
206+
}
207+
208+
resource "random_shuffle" "zone" {
209+
input = data.google_compute_zones.available.names
210+
result_count = 1
211+
}
212+
213+
module "router_appliance_spoke_vpc" {
214+
source = "terraform-google-modules/network/google"
215+
project_id = var.project_id
216+
network_name = var.router_appliance_vpc_name
217+
routing_mode = "GLOBAL"
218+
219+
subnets = [
220+
{
221+
subnet_name = "router-appliance-subnet-01"
222+
subnet_ip = "10.20.10.0/24"
223+
subnet_region = var.instance_region
224+
}
225+
]
226+
}
227+
228+
resource "google_compute_instance" "router_appliance_1" {
229+
name = "fake-router-appliance-1"
230+
machine_type = "e2-medium"
231+
project = var.project_id
232+
can_ip_forward = true
233+
zone = random_shuffle.zone.result[0]
234+
235+
boot_disk {
236+
initialize_params {
237+
image = "debian-cloud/debian-11"
238+
}
239+
}
240+
241+
network_interface {
242+
subnetwork = module.router_appliance_spoke_vpc.subnets["${var.instance_region}/router-appliance-subnet-01"].id
243+
access_config {
244+
network_tier = "PREMIUM"
245+
}
246+
}
247+
}

‎examples/network_connectivity_center/outputs.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "project_id" {
18+
description = "The project ID (required for testing)"
19+
value = var.project_id
20+
}
21+
22+
output "ncc_hub_name" {
23+
description = "Name of the NCC Hub (required for testing)"
24+
value = element(reverse(split("/", module.network_connectivity_center.ncc_hub.name)), 0)
25+
}
26+
27+
output "vpc_spokes" {
28+
description = "All vpc spoke objects"
29+
value = module.network_connectivity_center.vpc_spokes
30+
}
31+
32+
33+
output "hybrid_spokes" {
34+
description = "All hybrid spoke objects"
35+
value = module.network_connectivity_center.hybrid_spokes
36+
}
37+
38+
output "router_appliance_spokes" {
39+
description = "All router appliance spoke objects"
40+
value = module.network_connectivity_center.router_appliance_spokes
41+
}
42+
43+
output "spokes" {
44+
description = "All spoke objects prefixed with the type of spoke (vpc, hybrid, appliance)"
45+
value = module.network_connectivity_center.spokes
46+
}

‎examples/network_connectivity_center/variables.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the network in"
19+
}
20+
21+
variable "vpn_region" {
22+
description = "The region where to deploy the VPN"
23+
default = "europe-west4"
24+
}
25+
26+
variable "instance_region" {
27+
description = "The region where to deploy the Router Instance in"
28+
default = "us-central1"
29+
}
30+
31+
variable "ncc_hub_name" {
32+
description = "The Name of the NCC Hub"
33+
type = string
34+
default = "ncc-hub"
35+
}
36+
37+
variable "vpc_spoke_vpc_name" {
38+
description = "The VPC Name for the VPC Spoke"
39+
type = string
40+
default = "vpc-spoke"
41+
}
42+
43+
variable "vpn_spoke_local_vpc_name" {
44+
description = "The name for the local VPC (GCP side) for the VPN Spoke"
45+
type = string
46+
default = "vpn-local-spoke"
47+
}
48+
49+
variable "vpn_spoke_remote_vpc_name" {
50+
description = "The name for the remote VPC (fake on-orem) for the VPN Spoke"
51+
type = string
52+
default = "vpn-remote-spoke"
53+
}
54+
55+
variable "router_appliance_vpc_name" {
56+
description = "The VPC Name for the VPC Spoke"
57+
type = string
58+
default = "router-appliance-spoke"
59+
}

0 commit comments

Comments
 (0)