Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: '3-networks' minor inconsistencies and typos #304

Merged
merged 2 commits into from
Dec 15, 2020
Merged

fix: '3-networks' minor inconsistencies and typos #304

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fd66491
Fix minor inconsistencies and typos
vovinacci Dec 10, 2020
932ea3c
Fix comment
vovinacci Dec 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions 3-networks/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# 3-networks

The purpose of this step is to :
The purpose of this step is to:

- Setup the global [DNS Hub](https://cloud.google.com/blog/products/networking/cloud-forwarding-peering-and-zones).
- Setup base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem dedicated interconnect and baseline firewall rules for each environment.
Expand Down Expand Up @@ -35,7 +35,7 @@ If you are not able to use dedicated interconnect, you can also use an HA VPN to
### Setup to run via Cloud Build

1. Clone repo `gcloud source repos clone gcp-networks --project=YOUR_CLOUD_BUILD_PROJECT_ID`
1. Change freshly cloned repo and change to non master branch `git checkout -b plan`
1. Change to the freshly cloned repo and change to non-master branch `git checkout -b plan`
1. Copy contents of foundation to new repo `cp -RT ../terraform-example-foundation/3-networks/ .` (modify accordingly based on your current directory).
1. Copy cloud build configuration files for terraform `cp ../terraform-example-foundation/build/cloudbuild-tf-* . ` (modify accordingly based on your current directory)
1. Copy terraform wrapper script `cp ../terraform-example-foundation/build/tf-wrapper.sh . ` to the root of your new repository (modify accordingly based on your current directory).
Expand All @@ -55,7 +55,7 @@ If you are not able to use dedicated interconnect, you can also use an HA VPN to
1. Review the plan output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
1. Merge changes to production with `git checkout -b production` and `git push origin production`
1. Review the apply output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
1. After production has been applied apply development and non-production
1. After production has been applied, apply development and non-production
1. Merge changes to development with `git checkout -b development` and `git push origin development`
1. Review the apply output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
1. Merge changes to non-production with `git checkout -b non-production` and `git push origin non-production`
Expand Down Expand Up @@ -90,7 +90,7 @@ If you are not able to use dedicated interconnect, you can also use an HA VPN to
1. Review the plan output in your Master's web UI.
1. Merge changes to production branch with `git checkout -b production` and `git push origin production`
1. Review the apply output in your Master's web UI (You might want to use the option to "Scan Multibranch Pipeline Now" in your Jenkins Master UI).
1. After production has been applied apply development and non-production
1. After production has been applied, apply development and non-production
1. Merge changes to development with `git checkout -b development` and `git push origin development`
1. Review the apply output in your Master's web UI (You might want to use the option to "Scan Multibranch Pipeline Now" in your Jenkins Master UI).
1. Merge changes to non-production with `git checkout -b non-production` and `git push origin non-production`
Expand All @@ -108,7 +108,7 @@ If you are not able to use dedicated interconnect, you can also use an HA VPN to
1. Rename access_context.auto.example.tfvars to access_context.auto.tfvars and update the file with the access_context_manager_policy_id.
1. Update backend.tf with your bucket from bootstrap. You can run
```for i in `find -name 'backend.tf'`; do sed -i 's/UPDATE_ME/<YOUR-BUCKET-NAME>/' $i; done```.
You can run `terraform output gcs_bucket_tfstate` in the 0-bootstap folder to obtain the bucket name.
You can run `terraform output gcs_bucket_tfstate` in the 0-bootstrap folder to obtain the bucket name.

We will now deploy each of our environments(development/production/non-production) using this script.
When using Cloud Build or Jenkins as your CI/CD tool each environment corresponds to a branch in the repository for 3-networks step
Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/development/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
| firewall\_enable\_logging | Toggle firewall logginglogging for VPC Firewalls. | `bool` | `true` | no |
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
| nat\_enabled | Toggle creation of NAT cloud router. | `bool` | `false` | no |
| nat\_num\_addresses | Number of external IPs to reserve for Cloud NAT. | `number` | `2` | no |
Expand All @@ -30,7 +30,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| optional\_fw\_rules\_enabled | Toggle creation of optional firewall rules: IAP SSH, IAP RDP and Internal & Global load balancing health check and load balancing IP ranges. | `bool` | `false` | no |
| org\_id | Organization ID | `string` | n/a | yes |
| parent\_folder | Optional - if using a folder for testing. | `string` | `""` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetwoks. | `bool` | `true` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |

Expand Down
13 changes: 7 additions & 6 deletions 3-networks/envs/development/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ locals {
env = "development"
restricted_project_id = data.google_projects.restricted_host_project.projects[0].project_id
restricted_project_number = data.google_project.restricted_host_project.number
base_project_id = data.google_projects.base_project.projects[0].project_id
base_project_id = data.google_projects.base_host_project.projects[0].project_id
parent_id = var.parent_folder != "" ? "folders/${var.parent_folder}" : "organizations/${var.org_id}"
}

Expand All @@ -40,7 +40,7 @@ data "google_project" "restricted_host_project" {
project_id = data.google_projects.restricted_host_project.projects[0].project_id
}

data "google_projects" "base_project" {
data "google_projects" "base_host_project" {
filter = "parent.id:${split("/", data.google_active_folder.env.name)[1]} labels.application_name=base-shared-vpc-host labels.environment=${local.env} lifecycleState=ACTIVE"
}

Expand Down Expand Up @@ -105,7 +105,7 @@ module "restricted_shared_vpc" {
}

/******************************************
Base shared VPC
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should stay as Base as per page 30 of the security foundation guide here https://services.google.com/fh/files/misc/google-cloud-security-foundations-guide.pdf

Private shared VPC
*****************************************/

module "base_shared_vpc" {
Expand Down Expand Up @@ -149,9 +149,10 @@ module "base_shared_vpc" {
}
]
secondary_ranges = {
"sb-${local.environment_code}-shared-base-${var.default_region1}" = [{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-pod"
ip_cidr_range = "192.168.96.0/19"
"sb-${local.environment_code}-shared-base-${var.default_region1}" = [
{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-pod"
ip_cidr_range = "192.168.96.0/19"
},
{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-svc"
Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/development/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,13 @@ variable "dns_enable_logging" {

variable "subnetworks_enable_logging" {
type = bool
description = "Toggle subnetworks flow logging for VPC Subnetwoks."
description = "Toggle subnetworks flow logging for VPC Subnetworks."
default = true
}

variable "firewall_enable_logging" {
type = bool
description = "Toggle firewall logginglogging for VPC Firewalls."
description = "Toggle firewall logging for VPC Firewalls."
default = true
}

Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/non-production/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
| firewall\_enable\_logging | Toggle firewall logginglogging for VPC Firewalls. | `bool` | `true` | no |
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
| nat\_enabled | Toggle creation of NAT cloud router. | `bool` | `false` | no |
| nat\_num\_addresses | Number of external IPs to reserve for Cloud NAT. | `number` | `2` | no |
Expand All @@ -30,7 +30,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| optional\_fw\_rules\_enabled | Toggle creation of optional firewall rules: IAP SSH, IAP RDP and Internal & Global load balancing health check and load balancing IP ranges. | `bool` | `false` | no |
| org\_id | Organization ID | `string` | n/a | yes |
| parent\_folder | Optional - if using a folder for testing. | `string` | `""` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetwoks. | `bool` | `true` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |

Expand Down
6 changes: 3 additions & 3 deletions 3-networks/envs/non-production/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,13 +92,13 @@ module "restricted_shared_vpc" {
}
]
secondary_ranges = {
"sb-${local.environment_code}-shared-restricted-${var.default_region2}" = [
"sb-${local.environment_code}-shared-restricted-${var.default_region1}" = [
{
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region2}-gke-pod"
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region1}-gke-pod"
ip_cidr_range = "192.168.0.0/19"
},
{
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region2}-gke-svc"
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region1}-gke-svc"
ip_cidr_range = "192.168.32.0/23"
}
]
Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/non-production/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,13 @@ variable "dns_enable_logging" {

variable "subnetworks_enable_logging" {
type = bool
description = "Toggle subnetworks flow logging for VPC Subnetwoks."
description = "Toggle subnetworks flow logging for VPC Subnetworks."
default = true
}

variable "firewall_enable_logging" {
type = bool
description = "Toggle firewall logginglogging for VPC Firewalls."
description = "Toggle firewall logging for VPC Firewalls."
default = true
}

Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/production/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
| firewall\_enable\_logging | Toggle firewall logginglogging for VPC Firewalls. | `bool` | `true` | no |
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
| nat\_enabled | Toggle creation of NAT cloud router. | `bool` | `false` | no |
| nat\_num\_addresses | Number of external IPs to reserve for Cloud NAT. | `number` | `2` | no |
Expand All @@ -30,7 +30,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
| optional\_fw\_rules\_enabled | Toggle creation of optional firewall rules: IAP SSH, IAP RDP and Internal & Global load balancing health check and load balancing IP ranges. | `bool` | `false` | no |
| org\_id | Organization ID | `string` | n/a | yes |
| parent\_folder | Optional - if using a folder for testing. | `string` | `""` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetwoks. | `bool` | `true` | no |
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |

Expand Down
7 changes: 4 additions & 3 deletions 3-networks/envs/production/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,9 +149,10 @@ module "base_shared_vpc" {
}
]
secondary_ranges = {
"sb-${local.environment_code}-shared-base-${var.default_region1}" = [{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-pod"
ip_cidr_range = "192.168.96.0/19"
"sb-${local.environment_code}-shared-base-${var.default_region1}" = [
{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-pod"
ip_cidr_range = "192.168.96.0/19"
},
{
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-svc"
Expand Down
4 changes: 2 additions & 2 deletions 3-networks/envs/production/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,13 @@ variable "dns_enable_logging" {

variable "subnetworks_enable_logging" {
type = bool
description = "Toggle subnetworks flow logging for VPC Subnetwoks."
description = "Toggle subnetworks flow logging for VPC Subnetworks."
default = true
}

variable "firewall_enable_logging" {
type = bool
description = "Toggle firewall logginglogging for VPC Firewalls."
description = "Toggle firewall logging for VPC Firewalls."
default = true
}
variable "dns_enable_inbound_forwarding" {
Expand Down