This Terraform configuration provides a flexible and robust framework for deploying and managing essential networking components within your Google Cloud Platform (GCP) environment. It empowers you to create a secure, highly available, and customizable network infrastructure that aligns with your organization's specific requirements.

Key features of this configuration include:

• Virtual Private Cloud (VPC) Network: Establish a custom VPC network tailored to your needs. Designate subnets for different purposes, manage routing tables, and leverage Private Service Access (PSA) for seamless communication with Google-managed services.- Service Connection Policies (SCP): Implements Private Service Connect to automate private connectivity to a managed service.
• High Availability VPN (HA VPN): Create redundant VPN tunnels for secure, resilient site-to-site connectivity. Leverage BGP for dynamic routing and optimal path selection.
• Cloud NAT: Enable private Google Compute Engine (GCE) instances within your VPC to access the internet while maintaining the security of private IP addresses.
• Dedicated Interconnect: Establish a private, high-bandwidth connection between your on-premises network and Google Cloud. Configure VLAN attachments to dedicate connections for specific services or traffic types.

• High Availability: This configuration promotes high availability through redundant VPN tunnels and strategically placed subnets.
• Modularity: The modular structure of this configuration allows you to easily add or remove components as needed.
• PSA and PSC configuration : This module allows you to use either or both PSA (Service Networking) and PSC (Private Service Connectivity) for your large scale deployments.

• Before creating networking resources, ensure you have the completed the following pre-requsites:

1. Completed Prior Stages: Successful deployment of networking resources depends on the completion of the following stages:

   • 01-organization: This stage handles the activation of required Google Cloud APIs.

2. Enable the following APIs :

   • Compute Engine API: Used for creating and managing VPC networks, subnets, forwarding rules, HA VPN tunnels/gateways, Cloud NAT and firewall rules.
   • Service Networking API: to manage Private Service Access (PSA) configurations.
   • Network Connectivity API
     • Enables connectivity with and between Google Cloud resources.
   • Service Consumer Management API : enabled in the project that Private Service Connect endpoints are deployed in. This API lets Google Cloud create the Network Connectivity Service Account that deploys Private Service Connect endpoints.

3. Permissions required for this stage :

   • Compute Network Admin : roles/compute.networkAdmin : Grants full control over VPC networks, subnets, firewall rules, and related resources.
   • Compute Shared VPN Admin : roles/compute.xpnAdmin : Permissions to administer shared VPC host projects, specifically enabling the host projects and associating shared VPC service projects to the host project's network.

• ha-vpn.tf:

  • Defines the HA VPN gateway, creating two redundant tunnels for high availability.
  • Configures BGP sessions for dynamic routing between your on-premises network and GCP.
  • Manages custom route advertisement to control traffic flow.

• interconnect.tf :

  • Creates Interconnect attachments (VLAN attachments):Establishes connectivity between your on-premises network and your VPC network.
  • Supports both Dedicated Interconnect and Partner Interconnect:Provides flexibility in choosing the Interconnect type that best suits your needs.
  • Configures VLAN attachments:Sets up the necessary VLAN tags and other parameters for the Interconnect attachment.
  • Connects the Interconnect attachment to your existing VPC network.
  • creates Cloud Router and BGP peering:Enables dynamic routing between your on-premises network and your VPC network.

• nat.tf: Sets up the Cloud NAT gateway and associates it with the VPC network.

  • Sets up a Cloud NAT gateway to provide internet access for instances in your private subnets.
  • Configures NAT routing to direct outbound traffic to the internet.

• scp.tf: Defines SCP for provisioning Private Service Connectivity to services like Memorystore for Redis Clusters.

  • Automates private connectivity to a managed service.

• vpc.tf: Creates the VPC network, subnets, and routing configuration.

  • Creates a VPC network with specified subnets and IP ranges.
  • Configures routing tables, including custom routes for PSA if required.
  • Supports Private Service Access (PSA) for private connectivity to Google-managed services.

• locals.tf: Defines local variables for use within the configuration.

• output.tf: Provides outputs for easy access to information about the created resources.

• variables.tf: Defines input variables for customizing the network configuration.

NOTE :

If you're creating Subnet secondary IP address range for Pods and Services for GKE cluster as a producer please refer to the official documentation for Pods and Services.

To configure networking.tfvars for your environment, here's an example which can be used for your reference :

project_id = ""                # Replace with your Google Cloud Project ID
region     = "us-central1"     # Specify the region for your resources

## VPC input variables

network_name = "workbench-vpc" # Name of the VPC
subnets = [
  {
    name                  = "workbench-subnet"   # Name of the subnet
    ip_cidr_range         = "10.20.0.0/24"       # CIDR range for the subnet
    region                = "us-central1"        # Region for the subnet
    enable_private_access = true                 # Enable Private Google Access (required for Workbench)
  }
]

# Configuration for setting up a Shared VPC Host project,
# enabling centralized network management and resource sharing across multiple projects.
shared_vpc_host = false        # Set to true if using a Shared VPC Host

## PSC/Service Connectivity Variables

create_scp_policy      = false # Set to true to create a Service Connectivity Policy
subnets_for_scp_policy = []    # List subnets for the SCP policy in the same region

## Cloud NAT input variables

create_nat = true              # Set to true to create a Cloud NAT instance

## Cloud HA VPN input variables

create_havpn = false           # Set to true to create a High Availability VPN
peer_gateways = {
  default = {
    gcp = ""                   # Specify the peer VPN gateway, e.g., projects/<peer-project-id>/regions/<region>/vpnGateways/<vpn-name>
  }
}

tunnel_1_router_bgp_session_range = "169.254.1.0/30" # BGP session range for Tunnel 1
tunnel_1_bgp_peer_asn             = 64514            # ASN for Tunnel 1 BGP peer
tunnel_1_bgp_peer_ip_address      = ""               # IP address for Tunnel 1 BGP peer
tunnel_1_shared_secret            = ""               # Shared secret for Tunnel 1

tunnel_2_router_bgp_session_range = "169.254.2.0/30" # BGP session range for Tunnel 2
tunnel_2_bgp_peer_asn             = 64514            # ASN for Tunnel 2 BGP peer
tunnel_2_bgp_peer_ip_address      = ""               # IP address for Tunnel 2 BGP peer
tunnel_2_shared_secret            = ""               # Shared secret for Tunnel 2

## Cloud Interconnect input variables

create_interconnect = false     # Set to true to create a Cloud Interconnect

NOTE : run the terraform commands with the -var-file referencing the networking.tfvars present under the /configuration folder. Example :

terraform plan -var-file=../../configuration/networking.tfvars
terraform apply -var-file=../../configuration/networking.tfvars

• Initialize: Run terraform init.
• Plan: Run terraform plan -var-file=../../configuration/networking.tfvars to review the planned changes.
• Apply: If the plan looks good, run terraform apply -var-file=../../configuration/networking.tfvars to create or update the resources.

• Dependencies: Ensure that the required GCP services are enabled in your project.
• Resource Names: Choose unique names to avoid conflicts.
• Security: Review the default firewall rules and SCPs to ensure they align with your security requirements.

[
  "ALL_SUBNETS"
]

map(object({
    external = optional(object({
      redundancy_type = string
      interfaces      = list(string)
      description     = optional(string, "Terraform managed external VPN gateway")
    }))
    gcp = optional(string)
  }))

list(object({
    name                  = string
    ip_cidr_range         = string
    region                = string
    description           = optional(string)
    enable_private_access = optional(bool, true)
    flow_logs_config = optional(object({
      aggregation_interval = optional(string)
      filter_expression    = optional(string)
      flow_sampling        = optional(number)
      metadata             = optional(string)
      # only if metadata == "CUSTOM_METADATA"
      metadata_fields = optional(list(string))
    }))
    ipv6 = optional(object({
      access_type = optional(string, "INTERNAL")
      # this field is marked for internal use in the API documentation
      # enable_private_access = optional(string)
    }))
    secondary_ip_ranges = optional(map(string))

    iam = optional(map(list(string)), {})
    iam_bindings = optional(map(object({
      role    = string
      members = list(string)
      condition = optional(object({
        expression  = string
        title       = string
        description = optional(string)
      }))
    })), {})
    iam_bindings_additive = optional(map(object({
      member = string
      role   = string
      condition = optional(object({
        expression  = string
        title       = string
        description = optional(string)
      }))
    })), {})
  }))

[
  ""
]

[
  "199.36.154.8/30"
]