terraform-google-modules / terraform-google-cloud-nat Goto Github PK

locals {
  address      = var.create_address ? join("", google_compute_address.default.*.address) : var.address
}


resource "google_compute_router" "router" {
  name        = var.name
  network     = var.network
#   region      = var.region
#   project     = var.project
  description = var.description
  dynamic "bgp" {
    for_each = var.bgp != null ? [var.bgp] : []
    content {
      asn = var.bgp.asn

      # advertise_mode is intentionally set to CUSTOM to not allow "DEFAULT".
      # This forces the config to explicitly state what subnets and ip ranges
      # to advertise. To advertise the same range as DEFAULT, set
      # `advertise_groups = ["ALL_SUBNETS"]`.
      advertise_mode     = lookup(var.bgp, "advertise_mode", null)
      advertised_groups  = lookup(var.bgp, "advertised_groups", null)
      keepalive_interval = lookup(var.bgp, "keepalive_interval", null)

      dynamic "advertised_ip_ranges" {
        for_each = lookup(var.bgp, "advertised_ip_ranges", [])
        content {
          range       = advertised_ip_ranges.value.range
          description = lookup(advertised_ip_ranges.value, "description", null)
        }
      }
    }
  }
}

# Reserve regional ip address for cloud nat
resource "google_compute_address" "default" {
  count      = var.create_address ? 1 : 0
  # project    = var.project
  name       = "${var.name}-address"
}

resource "google_compute_router_nat" "nats" {
  for_each = {
    for n in var.nats :
    n.name => n
  }

  name                               = each.value.name
#   project                            = google_compute_router.router.project
  router                             = google_compute_router.router.name
#   region                             = google_compute_router.router.region
  nat_ip_allocate_option             = lookup(each.value, "nat_ip_allocate_option", length(lookup(each.value, "nat_ips", [])) > 0 ? "MANUAL_ONLY" : "AUTO_ONLY")
  source_subnetwork_ip_ranges_to_nat = lookup(each.value, "source_subnetwork_ip_ranges_to_nat", "ALL_SUBNETWORKS_ALL_IP_RANGES")

#   nat_ips                             = lookup(each.value, "nat_ips", null)
  nat_ips             = [local.address]
  min_ports_per_vm                    = lookup(each.value, "min_ports_per_vm", null)
  udp_idle_timeout_sec                = lookup(each.value, "udp_idle_timeout_sec", null)
  icmp_idle_timeout_sec               = lookup(each.value, "icmp_idle_timeout_sec", null)
  tcp_established_idle_timeout_sec    = lookup(each.value, "tcp_established_idle_timeout_sec", null)
  tcp_transitory_idle_timeout_sec     = lookup(each.value, "tcp_transitory_idle_timeout_sec", null)
  enable_endpoint_independent_mapping = lookup(each.value, "enable_endpoint_independent_mapping", null)

  log_config {
    enable = false
    filter = lookup(lookup(each.value, "log_config", {}), "filter", "ALL")
  }

  dynamic "subnetwork" {
    for_each = lookup(each.value, "subnetworks", [])
    content {
      name                     = subnetwork.value.name
      source_ip_ranges_to_nat  = subnetwork.value.source_ip_ranges_to_nat
      secondary_ip_range_names = lookup(subnetwork.value, "secondary_ip_range_names", null)
    }
  }
}

output "region" {
  description = "Cloud NAT region"
  value       = var.region
  depends_on = [
    google_compute_router_nat.main,
  ]
}

Are there consideration for which I need to account?

module "cloud_nat" {
  source     = "terraform-google-modules/cloud-nat/google"
  version    = "~> 2.2.1"

  name       = "${var.prefix}-nat-gateway"
  project_id = var.project_id

  region     = var.region
  router     = google_compute_router.router.name
  
  nat_ip_allocate_option = "MANUAL_ONLY"
  nat_ips = [ google_compute_address.nat_gw.address ]
  
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"

  subnetworks = [ for subnet in local.private_subnets: {
    name = subnet.self_link
    source_ip_ranges_to_nat = [ subnet.ip_cidr_range ]
    secondary_ip_range_names = []
  }]

}

variable "cluster_node_ips" {
  type    = list(string)
  default = ["1.2.3.4", "5.6.7.8"]
}

terraform {
  backend "gcs" {
    bucket = "123-infra"
    pr123x = "terraform/non-prod.tfstate"
  }
}

provider "google" {
  project     = "project-co"
  region      = "europe-west3"
}

resource "google_service_account" "default-service-account" {
  account_id   = "sa-id-non-prod"
  display_name = "project default SA Non-prod"
}

resource "google_compute_network" "cluster_network" {
  name = "non-prod-network"
}

resource "google_container_cluster" "project" {
  name     = "cluster-non-prod"
  location = "europe-west3-b"

  network = google_compute_network.cluster_network.self_link
  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_compute_router" "router" {
  project = "project-co"
  name    = "non-prod-nat-router"
  network = google_compute_network.cluster_network.self_link
  region  = "europe-west3"
}

module "cloud-nat" {
  source     = "terraform-google-modules/cloud-nat/google"
  version    = "~> 1.2"
  project_id = "project-co"
  region     = "europe-west3"
  router     = google_compute_router.router.name
}

resource "google_container_node_pool" "project_node_pool" {
  name       = "node-pool-non-prod"
  location   = "europe-west3-b"
  cluster    = google_container_cluster.project.name
  node_count = 1

  node_config {
    machine_type = "e2-medium"

    # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    service_account = google_service_account.default-service-account.email
    oauth_scopes    = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]
  }
}

resource "google_container_node_pool" "project_node_pool_vpn" {
  name       = "node-pool-vpn-non-prod"
  location   = "europe-west3-b"
  cluster    = google_container_cluster.project.name
  node_count = 1

  node_config {
    machine_type = "e2-medium"
    taint {
      effect = "NO_SCHEDULE"
      key = "vpnPod"
      value = "true"
    }
    # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    service_account = google_service_account.default-service-account.email
    oauth_scopes    = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]
  }
}

resource "google_compute_firewall" "non-prod-firewall" {
  project = "project-co"
  name    = "allow-http"
  network = google_compute_network.cluster_network.name
  allow {
    protocol = "tcp"
    ports    = ["80", "1194", "443", "7111"]
  }
  source_ranges = ["35.235.240.0/20", "0.0.0.0/0"]
}


resource "google_sql_database" "project-db" {
  name     = "project"
  instance = google_sql_database_instance.project-db-instance.name
}

resource "google_sql_database_instance" "project-db-instance" {
  name             = "project-db-non-prod"
  database_version = "POSTGRES_11"
  region = "europe-west3"

  settings {
    # Second-generation instance tiers are based on the machine
    # type. See argument reference below.
    tier = "db-custom-2-12288"

    database_flags {
      name = "temp_file_limit"
      value = "2147483647"
    }

    ip_configuration {

      dynamic "authorized_networks" {
        for_each = var.cluster_node_ips
        iterator = node_ip
        content {
          name = node_ip.value
          value = node_ip.value
        }
      }
    }
  }
}

module "cloud-nat" {
	source		= "terraform-google-modules/cloud-nat/google"
	version		= "~> 1.4"
	# ... 
	source_subnetwork_ip_ranges_to_nat	= "LIST_OF_SUBNETWORKS"
	subnetworks	=	[{
		name					= "test"
		source_ip_ranges_to_nat	= ["10.10.0.0/24"]
		secondary_ip_range_names= []
		}
	]
}

module "cloud-nat" {
  source     = "terraform-google-modules/cloud-nat/google"
  version    = "~> 1.2"
  project_id = var.project_id
  region     = var.services_region
  router     = "services-router"
  name       = "services-nat" 

  nat_ip_allocate_option= "MANUAL_ONLY"
  nat_ips                = module.address.self_links
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES"

}

module "cloud-nat" {
  source  = "terraform-google-modules/cloud-nat/google"
  version = "1.3.0"

  project_id             = <redacted>
  region                 = "us-central1"
  name                   = "k8s-nat"
  router                 = google_compute_router.nat_router.name
  nat_ip_allocate_option = false
  nat_ips                = [google_compute_address.nat_address.self_link]
  log_config_enable      = "false"
  log_config_filter      = "ALL"
}

  # module.cloud-nat.google_compute_router_nat.main will be updated in-place
  ~ resource "google_compute_router_nat" "main" {
        icmp_idle_timeout_sec              = 30
        id                                 = "<redacted>"
        min_ports_per_vm                   = 64
        name                               = "k8s-nat"
        nat_ip_allocate_option             = "MANUAL_ONLY"
        nat_ips                            = [
            "https://www.googleapis.com/compute/v1/projects/<redacted>",
        ]
        project                            = "<redacted>"
        region                             = "us-central1"
        router                             = "k8s-nat-router"
        source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
        tcp_established_idle_timeout_sec   = 1200
        tcp_transitory_idle_timeout_sec    = 30
        udp_idle_timeout_sec               = 30

      - log_config {
          - enable = false -> null
          - filter = "ALL" -> null
        }
    }

module "cloud-nat" {
  source  = "terraform-google-modules/cloud-nat/google"
  version = "1.3.0"

  project_id             = <redacted>
  region                 = "us-central1"
  name                   = "k8s-nat"
  router                 = google_compute_router.nat_router.name
  nat_ip_allocate_option = false
  nat_ips                = [google_compute_address.nat_address.self_link]
}

  # module.cloud-nat.google_compute_router_nat.main will be updated in-place
  ~ resource "google_compute_router_nat" "main" {
        icmp_idle_timeout_sec              = 30
        id                                 = "<redacted>"
        min_ports_per_vm                   = 64
        name                               = "k8s-nat"
        nat_ip_allocate_option             = "MANUAL_ONLY"
        nat_ips                            = [
            "https://www.googleapis.com/compute/v1/projects/<redacted>",
        ]
        project                            = "<redacted>"
        region                             = "us-central1"
        router                             = "k8s-nat-router"
        source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
        tcp_established_idle_timeout_sec   = 1200
        tcp_transitory_idle_timeout_sec    = 30
        udp_idle_timeout_sec               = 30

      - log_config {
          - enable = false -> null
          - filter = "ALL" -> null
        }
    }

resource "google_compute_router_nat" "main" {
  region     = "${google_compute_router.main.region}"	
  router     = "${google_compute_router.main.name}"
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
  subnetwork {
    name                    = "${data.google_compute_subnetwork.main.self_link}"
    source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
  }
}

module "cloud_router" {
  source  = "terraform-google-modules/cloud-router/google"
  version = "2.0.0"

  name    = "${var.region-eu-west1}-cloud-nat"
  project = var.project_id
  region  = var.region-eu-west1
  network = google_compute_network.vpc_mdm_network.name

  nats = [{
      name : "test"
      source_subnetwork_ip_ranges_to_nat : "LIST_OF_SUBNETWORKS"
      min_ports_per_vm : 32
      max_ports_per_vm : 65536
      enable_dynamic_port_allocation : true
      enable_endpoint_independent_mapping : false
      nat_ip_allocate_option = "MANUAL_ONLY"
      log_config = {
        filter : "ERRORS_ONLY"
      }
      subnetworks = [
        {
          name : google_compute_subnetwork.mysubnetwork.name
          source_ip_ranges_to_nat : [
            "PRIMARY_IP_RANGE"
          ]
        }
      ]
      nat_ips = [
        google_compute_address.my_gateway.self_link,
      ]
    }
]
}