terraform-google-modules · morgante · Dec 6, 2019 · Nov 25, 2019 · Nov 25, 2019 · Nov 25, 2019
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning][semver-site].
 ## [Unreleased]
 v2.0.0 is a backwards-incompatible release. Please see the [upgrading guide](./docs/upgrading_to_v2.0.md).
 
+### Added
+
+- Split main module up into vpc, subnets, and routes submodules. [#103]
+
 ### Fixed
 
 - Fixes subnet recreation when a subnet is updated. [#73]

diff --git a/Makefile b/Makefile
@@ -15,7 +15,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 0.1.0
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 0.6.0
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 
@@ -42,7 +42,7 @@ docker_test_prepare:
 
 # Clean up test environment within the docker container
 .PHONY: docker_test_cleanup
-docker_test_prepare:
+docker_test_cleanup:
 	docker run --rm -it \
 		-e SERVICE_ACCOUNT_JSON \
 		-e TF_VAR_org_id \

diff --git a/README.md b/README.md
@@ -8,6 +8,8 @@ It supports creating:
 - Subnets within the VPC
 - Secondary ranges for the subnets (if applicable)
 
+Sub modules are provided for creating individual vpc, subnets, and routes. See the modules directory for the various sub modules usage.
+
 ## Compatibility
 
 This module is meant for use with Terraform 0.12. If you haven't [upgraded](https://www.terraform.io/upgrade-guides/0-12.html) and need a Terraform 0.11.x-compatible version of this module, the last released version intended for Terraform 0.11.x is [0.8.0](https://registry.terraform.io/modules/terraform-google-modules/network/google/0.8.0).
@@ -100,7 +102,7 @@ Then perform the following commands on the root folder:
 | routes | List of routes being created in this VPC | list(map(string)) | `<list>` | no |
 | routing\_mode | The network routing mode (default 'GLOBAL') | string | `"GLOBAL"` | no |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | object | `<map>` | no |
-| shared\_vpc\_host | Makes this project a Shared VPC host if 'true' (default 'false') | string | `"false"` | no |
+| shared\_vpc\_host | Makes this project a Shared VPC host if 'true' (default 'false') | bool | `"false"` | no |
 | subnets | The list of subnets being created | list(map(string)) | n/a | yes |
 
 ## Outputs
@@ -109,7 +111,7 @@ Then perform the following commands on the root folder:
 |------|-------------|
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The route names associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IPs and CIDRs of the subnets being created |
 | subnets\_names | The names of the subnets being created |
@@ -122,6 +124,7 @@ Then perform the following commands on the root folder:
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 
 ### Subnet Inputs
+
 The subnets list contains maps, where each object represents a subnet. Each map has the following inputs (please see examples folder for additional references):
 
 | Name | Description | Type | Default | Required |
@@ -133,7 +136,8 @@ The subnets list contains maps, where each object represents a subnet. Each map
 | subnet\_flow\_logs  | Whether the subnet will record and send flow log data to logging | string | `"false"` | no |
 
 ### Route Inputs
-The routes list contains maps, where each object represents a route. For the next\_hop\_* inputs, only one is possible to be used in each route. Having two next_hop_* inputs will produce an error. Each map has the following inputs (please see examples folder for additional references):
+
+The routes list contains maps, where each object represents a route. For the next_hop_* inputs, only one is possible to be used in each route. Having two next_hop_* inputs will produce an error. Each map has the following inputs (please see examples folder for additional references):
 
 | Name | Description | Type | Default | Required |
 |------|-------------|:----:|:-----:|:-----:|

diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
@@ -38,4 +38,4 @@ tags:
 - 'integration'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '0.1.0'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '0.6.0'
diff --git a/build/lint.cloudbuild.yaml b/build/lint.cloudbuild.yaml
@@ -21,4 +21,4 @@ tags:
 - 'lint'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '0.1.0'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '0.6.0'
diff --git a/examples/delete_default_gateway_routes/README.md b/examples/delete_default_gateway_routes/README.md
@@ -18,7 +18,7 @@ This VPC has a single subnet with no secondary ranges, and ensures the default i
 |------|-------------|
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The routes associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IP and cidrs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

diff --git a/examples/delete_default_gateway_routes/outputs.tf b/examples/delete_default_gateway_routes/outputs.tf
@@ -54,7 +54,7 @@ output "subnets_secondary_ranges" {
   description = "The secondary ranges associated with these subnets"
 }
 
-output "routes" {
-  value       = module.test-vpc-module.routes
+output "route_names" {
+  value       = module.test-vpc-module.route_names
   description = "The routes associated with this VPC"
 }
diff --git a/examples/multi_vpc/outputs.tf b/examples/multi_vpc/outputs.tf
@@ -56,7 +56,7 @@ output "network_01_subnets_secondary_ranges" {
 }
 
 output "network_01_routes" {
-  value       = module.test-vpc-module-01.routes
+  value       = module.test-vpc-module-01.route_names
   description = "The routes associated with network-01"
 }
 
@@ -102,6 +102,6 @@ output "network_02_subnets_secondary_ranges" {
 }
 
 output "network_02_routes" {
-  value       = module.test-vpc-module-02.routes
+  value       = module.test-vpc-module-02.route_names
   description = "The routes associated with network-02"
 }
diff --git a/examples/secondary_ranges/README.md b/examples/secondary_ranges/README.md
@@ -19,7 +19,7 @@ ranges and the third being given a single secondary range.
 |------|-------------|
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The routes associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IP and cidrs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

diff --git a/examples/secondary_ranges/outputs.tf b/examples/secondary_ranges/outputs.tf
@@ -59,7 +59,7 @@ output "subnets_secondary_ranges" {
   description = "The secondary ranges associated with these subnets"
 }
 
-output "routes" {
-  value       = module.vpc-secondary-ranges.routes
+output "route_names" {
+  value       = module.vpc-secondary-ranges.route_names
   description = "The routes associated with this VPC"
 }
diff --git a/examples/simple_project/README.md b/examples/simple_project/README.md
@@ -18,7 +18,7 @@ This VPC has two subnets, with no secondary ranges.
 |------|-------------|
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The routes associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IP and cidrs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

diff --git a/examples/simple_project/outputs.tf b/examples/simple_project/outputs.tf
@@ -59,7 +59,7 @@ output "subnets_secondary_ranges" {
   description = "The secondary ranges associated with these subnets"
 }
 
-output "routes" {
-  value       = module.test-vpc-module.routes
+output "route_names" {
+  value       = module.test-vpc-module.route_names
   description = "The routes associated with this VPC"
 }
diff --git a/examples/simple_project_with_regional_network/README.md b/examples/simple_project_with_regional_network/README.md
@@ -18,7 +18,7 @@ This VPC has two subnets, with no secondary ranges.
 |------|-------------|
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The routes associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IP and cidrs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

diff --git a/examples/simple_project_with_regional_network/outputs.tf b/examples/simple_project_with_regional_network/outputs.tf
@@ -59,7 +59,7 @@ output "subnets_secondary_ranges" {
   description = "The secondary ranges associated with these subnets"
 }
 
-output "routes" {
-  value       = module.test-vpc-module.routes
+output "route_names" {
+  value       = module.test-vpc-module.route_names
   description = "The routes associated with this VPC"
 }
diff --git a/examples/submodule_firewall/README.md b/examples/submodule_firewall/README.md
@@ -20,7 +20,7 @@ This VPC has two subnets, with no secondary ranges.
 | internal\_ranges | Firewall attributes for internal ranges. |
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
-| routes | The routes associated with this VPC |
+| route\_names | The routes associated with this VPC |
 | subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
 | subnets\_ips | The IP and cidrs of the subnets being created |
 | subnets\_names | The names of the subnets being created |

diff --git a/examples/submodule_firewall/outputs.tf b/examples/submodule_firewall/outputs.tf
@@ -69,7 +69,7 @@ output "subnets_secondary_ranges" {
   description = "The secondary ranges associated with these subnets"
 }
 
-output "routes" {
-  value       = module.test-vpc-module.routes
+output "route_names" {
+  value       = module.test-vpc-module.route_names
   description = "The routes associated with this VPC"
 }
diff --git a/examples/submodule_svpc_access/main.tf b/examples/submodule_svpc_access/main.tf
@@ -25,7 +25,7 @@ module "net-vpc-shared" {
   source          = "../.."
   project_id      = var.host_project_id
   network_name    = var.network_name
-  shared_vpc_host = "true"
+  shared_vpc_host = true
 
   subnets = [
     {

diff --git a/main.tf b/main.tf
@@ -14,107 +14,40 @@
  * limitations under the License.
  */
 
-locals {
-  subnets = {
-    for x in var.subnets :
-    "${x.subnet_region}/${x.subnet_name}" => x
-  }
-}
-
 /******************************************
 	VPC configuration
  *****************************************/
-resource "google_compute_network" "network" {
-  name                    = var.network_name
+module "vpc" {
+  source                  = "./modules/vpc"
+  network_name            = var.network_name
   auto_create_subnetworks = var.auto_create_subnetworks
   routing_mode            = var.routing_mode
-  project                 = var.project_id
+  project_id              = var.project_id
   description             = var.description
-}
-
-/******************************************
-	Shared VPC
- *****************************************/
-resource "google_compute_shared_vpc_host_project" "shared_vpc_host" {
-  count      = var.shared_vpc_host == "true" ? 1 : 0
-  project    = var.project_id
-  depends_on = [google_compute_network.network]
+  shared_vpc_host         = var.shared_vpc_host
 }
 
 /******************************************
 	Subnet configuration
  *****************************************/
-resource "google_compute_subnetwork" "subnetwork" {
-  for_each                 = local.subnets
-  name                     = each.value.subnet_name
-  ip_cidr_range            = each.value.subnet_ip
-  region                   = each.value.subnet_region
-  private_ip_google_access = lookup(each.value, "subnet_private_access", "false")
-  dynamic "log_config" {
-    for_each = lookup(each.value, "subnet_flow_logs", false) ? [{
-      aggregation_interval = lookup(each.value, "subnet_flow_logs_interval", null)
-      flow_sampling        = lookup(each.value, "subnet_flow_logs_sampling", null)
-      metadata             = lookup(each.value, "subnet_flow_logs_metadata", null)
-    }] : []
-    content {
-      aggregation_interval = log_config.value.aggregation_interval
-      flow_sampling        = log_config.value.flow_sampling
-      metadata             = log_config.value.metadata
-    }
-  }
-  network     = google_compute_network.network.name
-  project     = var.project_id
-  description = lookup(each.value, "description", null)
-  secondary_ip_range = [
-    for i in range(
-      length(
-        contains(
-        keys(var.secondary_ranges), each.value.subnet_name) == true
-        ? var.secondary_ranges[each.value.subnet_name]
-        : []
-    )) :
-    var.secondary_ranges[each.value.subnet_name][i]
-  ]
+module "subnets" {
+  source           = "./modules/subnets"
+  project_id       = var.project_id
+  network_name     = module.vpc.network_name
+  description      = var.description
+  subnets          = var.subnets
+  secondary_ranges = var.secondary_ranges
 }
 
 /******************************************
 	Routes
  *****************************************/
-resource "google_compute_route" "route" {
-  count                  = length(var.routes)
-  project                = var.project_id
-  network                = var.network_name
-  name                   = lookup(var.routes[count.index], "name", format("%s-%s-%d", lower(var.network_name), "route", count.index))
-  description            = lookup(var.routes[count.index], "description", "")
-  tags                   = compact(split(",", lookup(var.routes[count.index], "tags", "")))
-  dest_range             = lookup(var.routes[count.index], "destination_range", "")
-  next_hop_gateway       = lookup(var.routes[count.index], "next_hop_internet", "false") == "true" ? "default-internet-gateway" : ""
-  next_hop_ip            = lookup(var.routes[count.index], "next_hop_ip", "")
-  next_hop_instance      = lookup(var.routes[count.index], "next_hop_instance", "")
-  next_hop_instance_zone = lookup(var.routes[count.index], "next_hop_instance_zone", "")
-  next_hop_vpn_tunnel    = lookup(var.routes[count.index], "next_hop_vpn_tunnel", "")
-  priority               = lookup(var.routes[count.index], "priority", "1000")
-
-  depends_on = [
-    google_compute_network.network,
-    google_compute_subnetwork.subnetwork,
-  ]
-}
-
-resource "null_resource" "delete_default_internet_gateway_routes" {
-  count = var.delete_default_internet_gateway_routes ? 1 : 0
-
-  provisioner "local-exec" {
-    command = "${path.module}/scripts/delete-default-gateway-routes.sh ${var.project_id} ${var.network_name}"
-  }
-
-  triggers = {
-    number_of_routes = length(var.routes)
-  }
-
-  depends_on = [
-    google_compute_network.network,
-    google_compute_subnetwork.subnetwork,
-    google_compute_route.route,
-  ]
+module "routes" {
+  source                                 = "./modules/routes"
+  project_id                             = var.project_id
+  network_name                           = module.vpc.network_name
+  routes                                 = var.routes
+  delete_default_internet_gateway_routes = var.delete_default_internet_gateway_routes
+  network                                = module.vpc.network
+  subnets                                = module.subnets.subnets
 }
diff --git a/modules/fabric-net-firewall/README.md b/modules/fabric-net-firewall/README.md
@@ -74,7 +74,7 @@ module "net-firewall" {
 |------|-------------|:----:|:-----:|:-----:|
 | admin\_ranges | IP CIDR ranges that have complete access to all subnets. | list | `<list>` | no |
 | admin\_ranges\_enabled | Enable admin ranges-based rules. | string | `"false"` | no |
-| custom\_rules | List of custom rule definitions (refer to variables file for syntax). | map | `<map>` | no |
+| custom\_rules | List of custom rule definitions (refer to variables file for syntax). | object | `<map>` | no |
 | http\_source\_ranges | List of IP CIDR ranges for tag-based HTTP rule, defaults to 0.0.0.0/0. | list | `<list>` | no |
 | https\_source\_ranges | List of IP CIDR ranges for tag-based HTTPS rule, defaults to 0.0.0.0/0. | list | `<list>` | no |
 | internal\_allow | Allow rules for internal ranges. | list | `<list>` | no |
@@ -89,6 +89,10 @@ module "net-firewall" {
 | Name | Description |
 |------|-------------|
 | admin\_ranges | Admin ranges data. |
+| custom\_egress\_allow\_rules | Custom egress rules with allow blocks. |
+| custom\_egress\_deny\_rules | Custom egress rules with allow blocks. |
+| custom\_ingress\_allow\_rules | Custom ingress rules with allow blocks. |
+| custom\_ingress\_deny\_rules | Custom ingress rules with deny blocks. |
 | internal\_ranges | Internal ranges. |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/fabric-net-firewall/versions.tf b/modules/fabric-net-firewall/versions.tf
@@ -16,4 +16,7 @@
 
 terraform {
   required_version = "~> 0.12.0"
+  required_providers {
+    google = "~> 2.19.0"
+  }
 }
diff --git a/modules/fabric-net-svpc-access/versions.tf b/modules/fabric-net-svpc-access/versions.tf
@@ -16,4 +16,7 @@
 
 terraform {
   required_version = "~> 0.12.0"
+  required_providers {
+    google = "~> 2.19.0"
+  }
 }