blob: b324fb1f1c1de272d869bedf3433dee86e8a03eb [file] [log] [blame]
# https://cloud.google.com/vpc/docs/shared-vpc
provider "google" {
region = var.region
credentials = file(var.credentials_file_path)
}
provider "random" {
}
resource "random_id" "host_project_name" {
byte_length = 8
}
resource "random_id" "service_project_1_name" {
byte_length = 8
}
resource "random_id" "service_project_2_name" {
byte_length = 8
}
resource "random_id" "standalone_project_name" {
byte_length = 8
}
# The project which owns the VPC.
resource "google_project" "host_project" {
name = "Host Project"
project_id = "tf-vpc-${random_id.host_project_name.hex}"
org_id = var.org_id
billing_account = var.billing_account_id
}
# One project which will use the VPC.
resource "google_project" "service_project_1" {
name = "Service Project 1"
project_id = "tf-vpc-${random_id.service_project_1_name.hex}"
org_id = var.org_id
billing_account = var.billing_account_id
}
# The other project which will use the VPC.
resource "google_project" "service_project_2" {
name = "Service Project 2"
project_id = "tf-vpc-${random_id.service_project_2_name.hex}"
org_id = var.org_id
billing_account = var.billing_account_id
}
# A project which will not use the VPC, for the sake of demonstration.
resource "google_project" "standalone_project" {
name = "Standalone Project"
project_id = "tf-vpc-${random_id.standalone_project_name.hex}"
org_id = var.org_id
billing_account = var.billing_account_id
}
# Compute service needs to be enabled for all four new projects.
resource "google_project_service" "host_project" {
project = google_project.host_project.project_id
service = "compute.googleapis.com"
}
resource "google_project_service" "service_project_1" {
project = google_project.service_project_1.project_id
service = "compute.googleapis.com"
}
resource "google_project_service" "service_project_2" {
project = google_project.service_project_2.project_id
service = "compute.googleapis.com"
}
resource "google_project_service" "standalone_project" {
project = google_project.standalone_project.project_id
service = "compute.googleapis.com"
}
# Enable shared VPC hosting in the host project.
resource "google_compute_shared_vpc_host_project" "host_project" {
project = google_project.host_project.project_id
depends_on = [google_project_service.host_project]
}
# Enable shared VPC in the two service projects - explicitly depend on the host
# project enabling it, because enabling shared VPC will fail if the host project
# is not yet hosting.
resource "google_compute_shared_vpc_service_project" "service_project_1" {
host_project = google_project.host_project.project_id
service_project = google_project.service_project_1.project_id
depends_on = [
google_compute_shared_vpc_host_project.host_project,
google_project_service.service_project_1,
]
}
resource "google_compute_shared_vpc_service_project" "service_project_2" {
host_project = google_project.host_project.project_id
service_project = google_project.service_project_2.project_id
depends_on = [
google_compute_shared_vpc_host_project.host_project,
google_project_service.service_project_2,
]
}
# Create the hosted network.
resource "google_compute_network" "shared_network" {
name = "shared-network"
auto_create_subnetworks = "true"
project = google_compute_shared_vpc_host_project.host_project.project
depends_on = [
google_compute_shared_vpc_service_project.service_project_1,
google_compute_shared_vpc_service_project.service_project_2,
]
}
# Allow the hosted network to be hit over ICMP, SSH, and HTTP.
resource "google_compute_firewall" "shared_network" {
name = "allow-ssh-and-icmp"
network = google_compute_network.shared_network.self_link
project = google_compute_network.shared_network.project
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
ports = ["22", "80"]
}
}
# Create a standalone network with the same firewall rules.
resource "google_compute_network" "standalone_network" {
name = "standalone-network"
auto_create_subnetworks = "true"
project = google_project.standalone_project.project_id
depends_on = [google_project_service.standalone_project]
}
resource "google_compute_firewall" "standalone_network" {
name = "allow-ssh-and-icmp"
network = google_compute_network.standalone_network.self_link
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
ports = ["22", "80"]
}
project = google_project.standalone_project.project_id
}
# Create a VM which hosts a web page stating its identity ("VM1")
resource "google_compute_instance" "project_1_vm" {
name = "tf-project-1-vm"
project = google_project.service_project_1.project_id
machine_type = "f1-micro"
zone = var.region_zone
boot_disk {
initialize_params {
image = "projects/debian-cloud/global/images/family/debian-8"
}
}
metadata_startup_script = "VM_NAME=VM1\n${file("scripts/install-vm.sh")}"
network_interface {
network = google_compute_network.shared_network.self_link
access_config {
// Ephemeral IP
}
}
service_account {
scopes = ["https://www.googleapis.com/auth/compute.readonly"]
}
depends_on = [google_project_service.service_project_1]
}
# Create a VM which hosts a web page demonstrating the example networking.
resource "google_compute_instance" "project_2_vm" {
name = "tf-project-2-vm"
machine_type = "f1-micro"
project = google_project.service_project_2.project_id
zone = var.region_zone
boot_disk {
initialize_params {
image = "projects/debian-cloud/global/images/family/debian-8"
}
}
metadata_startup_script = <<EOF
VM1_EXT_IP=${google_compute_instance.project_1_vm.network_interface[0].access_config[0].nat_ip}
ST_VM_EXT_IP=${google_compute_instance.standalone_project_vm.network_interface[0].access_config[0].nat_ip}
VM1_INT_IP=${google_compute_instance.project_1_vm.network_interface[0].address}
ST_VM_INT_IP=${google_compute_instance.standalone_project_vm.network_interface[0].address}
${file("scripts/install-network-page.sh")}
EOF
network_interface {
network = google_compute_network.shared_network.self_link
access_config {
// Ephemeral IP
}
}
service_account {
scopes = ["https://www.googleapis.com/auth/compute.readonly"]
}
depends_on = [google_project_service.service_project_2]
}
# Create a VM which hosts a web page stating its identity ("standalone").
resource "google_compute_instance" "standalone_project_vm" {
name = "tf-standalone-vm"
machine_type = "f1-micro"
project = google_project.standalone_project.project_id
zone = var.region_zone
boot_disk {
initialize_params {
image = "projects/debian-cloud/global/images/family/debian-8"
}
}
metadata_startup_script = "VM_NAME=standalone\n${file("scripts/install-vm.sh")}"
network_interface {
network = google_compute_network.standalone_network.self_link
access_config {
// Ephemeral IP
}
}
service_account {
scopes = ["https://www.googleapis.com/auth/compute.readonly"]
}
depends_on = [google_project_service.standalone_project]
}