HA VPN over Interconnect modules and blueprint

blueprints/networking/ha-vpn-over-interconnect/README.md

@@ -0,0 +1,36 @@
+# HA VPN over Interconnect
+
+This blueprint creates a complete HA VPN over Interconnect setup, which leverages IPSec to encrypt all traffic transiting through purposedly-created VLAN Attachments.
+
+This blueprint supports Dedicated Interconnect - in case Partner Interconnect is used instead (hence the VLAN Attachments are already created), simply refer to the [net-ipsec-over-interconnect](../../../modules/net-ipsec-over-interconnect/) module documentation.
+
+TODO(sruffilli): add a diagram
+
+## Managed resources and services
+
+This blueprint creates two distinct sets of resources:
+
+- Underlay
+  - A Cloud Router dedicated to the underlay networking, which exchanges and routes the VPN gateways ranges
+  - Two VLAN Attachments, each created from a distinct Dedicated Interconnect connected to two different EADs in the same Metro
+- Overlay
+  - foo
+  - bar
+
+## Prerequisites
+
+A single pre-existing project and a VPC is used in this blueprint to keep variables and complexity to a minimum.
+
+The provided project needs a valid billing account and the Compute APIs enabled.
+
+The two Dedicated Interconnect connections should already exist, either in the same project or in any other project belonging to the same GCP Organization.
+
+<!-- BEGIN TFDOC -->
+
+<!-- END TFDOC -->
+
+## Test
+
+```hcl
+TODO
+```

blueprints/networking/ha-vpn-over-interconnect/overlay.tf

@@ -0,0 +1,80 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_compute_router" "encrypted-interconnect-overlay-router" {
+  name    = "ioic-overlay-router-${var.region}"
+  project = var.project_id
+  network = var.network
+  region  = var.region
+  bgp {
+    advertise_mode = (
+      var.overlay_config.gcp_bgp.custom_advertise != null
+      ? "CUSTOM"
+      : "DEFAULT"
+    )
+    advertised_groups = (
+      try(var.overlay_config.gcp_bgp.custom_advertise.all_subnets, false)
+      ? ["ALL_SUBNETS"]
+      : []
+    )
+    dynamic "advertised_ip_ranges" {
+      for_each = try(var.overlay_config.gcp_bgp.custom_advertise.ip_ranges, {})
+      iterator = range
+      content {
+        range       = range.key
+        description = range.value
+      }
+    }
+    keepalive_interval = try(var.overlay_config.gcp_bgp.keepalive, null)
+    asn                = var.overlay_config.gcp_bgp.asn
+  }
+}
+
+resource "google_compute_external_vpn_gateway" "default" {
+  name            = "peer-vpn-gateway"
+  project         = var.project_id
+  description     = "Peer IPSec over Interconnect VPN gateway"
+  redundancy_type = length(var.overlay_config.onprem_vpn_gateway) == 2 ? "TWO_IPS_REDUNDANCY" : "SINGLE_IP_INTERNALLY_REDUNDANT"
+  dynamic "interface" {
+    for_each = var.overlay_config.onprem_vpn_gateway.interfaces
+    content {
+      id         = interface.key
+      ip_address = interface.value
+    }
+  }
+}
+
+module "vpngw" {
+  source     = "../../../modules/net-ipsec-over-interconnect"
+  for_each   = var.overlay_config.tunnels
+  project_id = var.project_id
+  network    = var.network
+  region     = var.region
+  name       = "vpngw-${each.key}"
+  interconnect_attachments = {
+    a = module.va-a.id
+    b = module.va-b.id
+  }
+  peer_gateway_config = {
+    create = false
+    id     = google_compute_external_vpn_gateway.default.id
+  }
+  router_config = {
+    create = false
+    name   = google_compute_router.encrypted-interconnect-overlay-router.id
+  }
+  tunnels = each.value
+}

blueprints/networking/ha-vpn-over-interconnect/underlay.tf

@@ -0,0 +1,65 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_compute_router" "encrypted-interconnect-underlay-router" {
+  name                          = "ioic-underlay-router-${var.region}"
+  project                       = var.project_id
+  network                       = var.network
+  region                        = var.region
+  encrypted_interconnect_router = true
+  bgp {
+    advertise_mode = "DEFAULT"
+    asn            = var.underlay_config.gcp_bgp.asn
+  }
+}
+
+module "va-a" {
+  source       = "../../../modules/net-vlan-attachment"
+  project_id   = var.project_id
+  network      = var.network
+  region       = var.region
+  name         = "${var.underlay_config.attachments.a.base_name}-a"
+  bandwidth    = var.underlay_config.attachments.a.bandwidth
+  bgp_range    = var.underlay_config.attachments.a.bgp_range
+  description  = "Encrypted VLAN Attachment ${var.underlay_config.attachments.a.base_name}-a"
+  interconnect = var.underlay_config.attachments.a.interconnect_self_link
+  peer_asn     = var.underlay_config.attachments.a.onprem_asn
+  router_config = {
+    create = false
+    name   = google_compute_router.encrypted-interconnect-underlay-router.id
+  }
+  vlan_tag              = var.underlay_config.attachments.a.vlan_tag
+  vpn_gateways_ip_range = var.underlay_config.attachments.a.vpn_gateways_ip_range
+}
+
+module "va-b" {
+  source       = "../../../modules/net-vlan-attachment"
+  project_id   = var.project_id
+  network      = var.network
+  region       = var.region
+  name         = "${var.underlay_config.attachments.a.base_name}-b"
+  bandwidth    = var.underlay_config.attachments.b.bandwidth
+  bgp_range    = var.underlay_config.attachments.b.bgp_range
+  description  = "Encrypted VLAN Attachment ${var.underlay_config.attachments.a.base_name}-b"
+  interconnect = var.underlay_config.attachments.b.interconnect_self_link
+  peer_asn     = var.underlay_config.attachments.b.onprem_asn
+  router_config = {
+    create = false
+    name   = google_compute_router.encrypted-interconnect-underlay-router.id
+  }
+  vlan_tag              = var.underlay_config.attachments.b.vlan_tag
+  vpn_gateways_ip_range = var.underlay_config.attachments.b.vpn_gateways_ip_range
+}

blueprints/networking/ha-vpn-over-interconnect/variables.tf

@@ -0,0 +1,91 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+variable "network" {
+  description = "The VPC name to which resources are associated to."
+  type        = string
+}
+
+variable "project_id" {
+  description = "The project id."
+  type        = string
+}
+
+variable "region" {
+  description = "GCP Region."
+  type        = string
+}
+
+variable "overlay_config" {
+  description = "Configuration for the overlay resources"
+  type = object({
+    gcp_bgp = object({
+      asn       = number
+      name      = optional(string)
+      keepalive = optional(number)
+      custom_advertise = optional(object({
+        all_subnets = bool
+        ip_ranges   = map(string)
+      }))
+    })
+    onprem_vpn_gateway = object({
+      redundancy_type = optional(string, "TWO_IPS_REDUNDANCY")
+      interfaces      = list(string)
+    })
+    tunnels = map(map(object({
+      bgp_peer = object({
+        address        = string
+        asn            = number
+        route_priority = optional(number, 1000)
+        custom_advertise = optional(object({
+          all_subnets          = bool
+          all_vpc_subnets      = bool
+          all_peer_vpc_subnets = bool
+          ip_ranges            = map(string)
+        }))
+      })
+      # each BGP session on the same Cloud Router must use a unique /30 CIDR
+      # from the 169.254.0.0/16 block.
+      bgp_session_range               = string
+      ike_version                     = optional(number, 2)
+      peer_external_gateway_interface = optional(number)
+      peer_gateway                    = optional(string, "default")
+      router                          = optional(string)
+      shared_secret                   = optional(string)
+      vpn_gateway_interface           = number
+      }))
+    )
+  })
+}
+
+variable "underlay_config" {
+  description = "Configuration for the underlay resources"
+  type = object({
+    attachments = map(object({
+      bandwidth              = optional(string, "BPS_10G")
+      base_name              = optional(string, "encrypted-vlan-attachment")
+      bgp_range              = string
+      interconnect_self_link = string
+      onprem_asn             = number
+      vlan_tag               = number
+      vpn_gateways_ip_range  = string
+    }))
+    gcp_bgp = object({
+      asn = number
+    })
+  })
+}