Skip to content

Commit 4e90bee

Browse files
maxi-citbharathkkb
maxi-cit
and
bharathkkb
authored
feat: add private service connect module (#368)
* added private-service-connect submodule * added missing default value to environment_code * added firewall usage condition * added private service connect example * fixed output vars for integration testing * Docker image devloper tools bumped to 1.4 * added discover_test.go to test/integration. This was required to run tests * added TestPrivateServiceConnect test * developer tools version bumped to 1.5 * changed names and variables so it generalize to more escenarios * updated private service connect example * added tests for DNS zones, global address and forwarding rule * added private service connect tests to cloudbuild * added versions.tf to private service connect example * fixed reviewed changes * deleting discover_test.go * deleting trailing space * deleted unused comments * fixed undefined variable at int.cloudbuild.yaml * changed example network name * enabled DNS api to test setup * added DNS admin roles to test service account * added requirements to private service connect README * updated Cloud DNS version * change assert functions from Equal to Equalf * added provider meta google-beta * added spaces on example outputs * fixed typos in module private-service-connect README * fixed README example * retargeting output values * Updated default value and name composition for DNS zones * added cft support & cft usage on private-service-connect tests * updated README * updated int.cloudbuild.yaml * bumping route example * Update modules/private-service-connect/README.md Co-authored-by: Bharath KKB <[email protected]>
1 parent 44dc6f5 commit 4e90bee

File tree

18 files changed

+680
-4
lines changed

18 files changed

+680
-4
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,21 @@ steps:
151151
- verify submodule-vpc-serverless-connector-beta
152152
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
153153
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && source_test_env && init_credentials && cd test/integration && RUN_STAGE=teardown go test -v ./... -p 1 -timeout 0 -run TestSubmoduleServerlessConnector']
154+
- id: converge private-service-connect
155+
waitFor:
156+
- create all
157+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
158+
args: ['/bin/bash', '-c', 'cft test run TestPrivateServiceConnect --stage apply --verbose']
159+
- id: verify private-service-connect
160+
waitFor:
161+
- converge private-service-connect
162+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
163+
args: ['/bin/bash', '-c', 'cft test run TestPrivateServiceConnect --stage verify --verbose']
164+
- id: destroy private-service-connect
165+
waitFor:
166+
- verify private-service-connect
167+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
168+
args: ['/bin/bash', '-c', 'cft test run TestPrivateServiceConnect --stage teardown --verbose']
154169
tags:
155170
- 'ci'
156171
- 'integration'

‎examples/private_service_connect/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Private Service Connect
2+
This example configures a single VPC inside a project and enables it to consume a Private Service Connect endpoint.
3+
4+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
5+
## Inputs
6+
7+
| Name | Description | Type | Default | Required |
8+
|------|-------------|------|---------|:--------:|
9+
| project\_id | Project ID for Private Service Connect. | `string` | n/a | yes |
10+
11+
## Outputs
12+
13+
| Name | Description |
14+
|------|-------------|
15+
| dns\_zone\_gcr\_name | Name for Managed DNS zone for GCR |
16+
| dns\_zone\_googleapis\_name | Name for Managed DNS zone for GoogleAPIs |
17+
| dns\_zone\_pkg\_dev\_name | Name for Managed DNS zone for PKG\_DEV |
18+
| forwarding\_rule\_name | Forwarding rule resource name. |
19+
| forwarding\_rule\_target | Target resource to receive the matched traffic. Only `all-apis` and `vpc-sc` are valid. |
20+
| global\_address\_id | An identifier for the global address created for the private service connect with format `projects/{{project}}/global/addresses/{{name}}` |
21+
| network\_name | The network name |
22+
| private\_service\_connect\_ip | The private service connect ip |
23+
| private\_service\_connect\_name | Private service connect name |
24+
| project\_id | The project id |
25+
26+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/private_service_connect/main.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
# Whenever a new major version of the network module is released, the
18+
# version constraint below should be updated, e.g. to ~> 4.0.
19+
#
20+
# If that new version includes provider updates, validation of this
21+
# example may fail until that is done.
22+
23+
module "private_service_connect" {
24+
source = "../../modules/private-service-connect"
25+
project_id = var.project_id
26+
network_self_link = module.simple_vpc.network_self_link
27+
private_service_connect_ip = "10.3.0.5"
28+
forwarding_rule_target = "all-apis"
29+
}
30+
31+
module "simple_vpc" {
32+
source = "terraform-google-modules/network/google"
33+
version = "~> 4.0.1"
34+
project_id = var.project_id
35+
network_name = "my-custom-network"
36+
mtu = 1460
37+
38+
subnets = [
39+
{
40+
subnet_name = "my-subnetwork"
41+
subnet_ip = "10.0.0.0/24"
42+
subnet_region = "us-west1"
43+
subnet_private_access = "true"
44+
subnet_flow_logs = "true"
45+
}
46+
]
47+
}

‎examples/private_service_connect/outputs.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "project_id" {
18+
value = var.project_id
19+
description = "The project id"
20+
}
21+
22+
output "network_name" {
23+
value = module.simple_vpc.network_name
24+
description = "The network name"
25+
}
26+
27+
output "private_service_connect_name" {
28+
value = module.private_service_connect.private_service_connect_name
29+
description = "Private service connect name"
30+
}
31+
32+
output "private_service_connect_ip" {
33+
value = module.private_service_connect.private_service_connect_ip
34+
description = "The private service connect ip"
35+
}
36+
37+
output "global_address_id" {
38+
value = module.private_service_connect.global_address_id
39+
description = "An identifier for the global address created for the private service connect with format `projects/{{project}}/global/addresses/{{name}}`"
40+
}
41+
42+
output "forwarding_rule_name" {
43+
value = module.private_service_connect.forwarding_rule_name
44+
description = "Forwarding rule resource name."
45+
}
46+
47+
output "forwarding_rule_target" {
48+
value = module.private_service_connect.forwarding_rule_target
49+
description = "Target resource to receive the matched traffic. Only `all-apis` and `vpc-sc` are valid."
50+
}
51+
52+
output "dns_zone_googleapis_name" {
53+
value = module.private_service_connect.dns_zone_googleapis_name
54+
description = "Name for Managed DNS zone for GoogleAPIs"
55+
}
56+
57+
output "dns_zone_gcr_name" {
58+
value = module.private_service_connect.dns_zone_gcr_name
59+
description = "Name for Managed DNS zone for GCR"
60+
}
61+
62+
output "dns_zone_pkg_dev_name" {
63+
value = module.private_service_connect.dns_zone_pkg_dev_name
64+
description = "Name for Managed DNS zone for PKG_DEV"
65+
}

‎examples/private_service_connect/variables.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "Project ID for Private Service Connect."
19+
type = string
20+
}

‎examples/private_service_connect/versions.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.13"
19+
required_providers {
20+
google = {
21+
source = "hashicorp/google"
22+
version = ">= 3.50"
23+
}
24+
google-beta = {
25+
source = "hashicorp/google-beta"
26+
version = ">= 3.50"
27+
}
28+
}
29+
}

‎examples/routes/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
# [START vpc_static_route_create]
2424
module "google_compute_route" {
2525
source = "terraform-google-modules/network/google//modules/routes"
26-
version = "~> 3.2.0"
26+
version = "~> 5.0"
2727
project_id = var.project_id # Replace this with your project ID in quotes
2828
network_name = "default"
2929

‎examples/routes/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ terraform {
1919

2020
required_providers {
2121
google = {
22-
version = "~> 3.45.0"
22+
version = "~> 4.0"
2323
}
2424
null = {
2525
version = "~> 2.1"

‎modules/private-service-connect/README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Private Service Connect
2+
3+
This module enables the usage of [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) for a specific subnetwork.
4+
5+
The resources created/managed by this module are:
6+
7+
- Private DNS zone to configure `private.googleapis.com.`
8+
- Private DNS zone to configure `gcr.io.`
9+
- Private DNS zone to configure `pdk.dev.`
10+
- Global Address resource to configure `Private Service Connect` endpoint
11+
- Global Forwarding Rule resource to forward traffic to respective HTTP(S) load balancing
12+
13+
## Usage
14+
15+
Basic usage of this module is as follows:
16+
17+
```hcl
18+
module "private_service_connect" {
19+
source = "terraform-google-modules/network/google//modules/private_service_connect"
20+
21+
project_id = "<PROJECT_ID>"
22+
network_self_link = "<NETWORK_SELF_LINK>"
23+
private_service_connect_ip = "10.3.0.5"
24+
forwarding_rule_target = "all-apis"
25+
}
26+
```
27+
28+
Private Service Connect IP must fulfill requirements detailed [here](https://cloud.google.com/vpc/docs/configure-private-service-connect-apis#ip-address-requirements).
29+
30+
Target subnetwork must have Private Google Access enabled.
31+
32+
**Note:** All egress traffic is allowed from VPC internal networks by default.
33+
34+
If you have a firewall rule blocking egress traffic, you will need to configure a [new egress rule](https://cloud.google.com/vpc/docs/using-firewalls#creating_firewall_rules) with following attributes:
35+
36+
- Direction: Egress
37+
- Priority: Higher than blocking egress rule
38+
- Target tags: <FIREWALL_RULE_TAG>
39+
- Destination filters:
40+
- IP ranges: <PRIVATE_SERVICE_CONNECT_IP>
41+
- Protocols and ports: tcp:443
42+
43+
## Requirements
44+
45+
- Cloud DNS API must be enabled.
46+
- Service Account running Terraform must have `dns.managedZones.*` permissions. You can add them by assigning `DNS Admin` default role to the Service Account.
47+
48+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
49+
## Inputs
50+
51+
| Name | Description | Type | Default | Required |
52+
|------|-------------|------|---------|:--------:|
53+
| dns\_code | Code to identify DNS resources in the form of `{dns_code}-{dns_type}` | `string` | `"dz"` | no |
54+
| forwarding\_rule\_name | Forwarding rule resource name. The forwarding rule name for PSC Google APIs must be an 1-20 characters string with lowercase letters and numbers and must start with a letter. Defaults to `globalrule` | `string` | `"globalrule"` | no |
55+
| forwarding\_rule\_target | Target resource to receive the matched traffic. Only `all-apis` and `vpc-sc` are valid. | `string` | n/a | yes |
56+
| network\_self\_link | Network self link for Private Service Connect. | `string` | n/a | yes |
57+
| private\_service\_connect\_ip | The internal IP to be used for the private service connect. | `string` | n/a | yes |
58+
| private\_service\_connect\_name | Private Service Connect endpoint name. Defaults to `global-psconnect-ip` | `string` | `"global-psconnect-ip"` | no |
59+
| project\_id | Project ID for Private Service Connect. | `string` | n/a | yes |
60+
61+
## Outputs
62+
63+
| Name | Description |
64+
|------|-------------|
65+
| dns\_zone\_gcr\_name | Name for Managed DNS zone for GCR |
66+
| dns\_zone\_googleapis\_name | Name for Managed DNS zone for GoogleAPIs |
67+
| dns\_zone\_pkg\_dev\_name | Name for Managed DNS zone for PKG\_DEV |
68+
| forwarding\_rule\_name | Forwarding rule resource name. |
69+
| forwarding\_rule\_target | Target resource to receive the matched traffic. Only `all-apis` and `vpc-sc` are valid. |
70+
| global\_address\_id | An identifier for the global address created for the private service connect with format `projects/{{project}}/global/addresses/{{name}}` |
71+
| private\_service\_connect\_ip | Private service connect ip |
72+
| private\_service\_connect\_name | Private service connect name |
73+
74+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)