Skip to content

ServiceNetworkingAcrossInterconnect

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History
 
 

ServiceNetworkingAcrossInterconnect

README.md

Introduction

Dedicated Interconnect provides direct physical connections between customer on-premise network and Google network. Dedicated Interconnect enables you to transfer large amounts of data between networks which can be more cost-effective than purchasing additional bandwidth over the public internet.

This solution guide assumes that the reader is comfortable with Dedicated Interconnect as described in the product page. This solution template helps the user to create a dedicated connection with redundancy & 99.9% availability between an on-premise environment and a Google Cloud Platform project.The solution then establishes a Cloud SQL connection using the private IP address of a Cloud SQL instance created inside a Google Cloud Platform project and a VM instance present in the user on-premise environment.

This solution allows you to securely access Cloud SQL instances present in the host project from an onprem environment, without exposing the Cloud SQL instances to the public internet.

Here is a brief overview of the resources being managed by this terraform solution:

  1. Creates a VPC Network and subnet in the host project
  2. Creates a VLAN attachment to existing physical connections established at a colocation facility and opts for redundant connection to ensure 99.9% availability. It can be in the same project or in a different project
  3. Creates a cloud router
  4. Configures VLAN ID and BGP IPs capacity
  5. Configures BGP Session
  6. Creates a Cloud SQL instance in the Google Cloud Platform project
  7. Establishes a connection between the Cloud SQL instance from the on-prem VM instance

Benefits:

  • Securely access Cloud SQL instances using private IP of Cloud SQL Instance
  • Improves performance and reliability by Dedicated Interconnect
  • Reduces costs by avoiding public IP addresses

Use cases:

  • Developing and testing applications from onprem that use Cloud SQL
  • Running production applications that use Cloud SQL
  • Connecting to Cloud SQL instances from on-premises networks

Architecture

Service Networking Interconnect Scenario

Pre-requisite

The expectation is to have customer accessibility to a common peering location (aka colocation facility) where google offers Dedicated Interconnect & customer routers can directly connect to google device via cross connect.

While we have described the set of steps involved below but our public documentation describes the process in more detail.

  1. User orders Dedicated Interconnect through Google Cloud Platform console
  2. User receives LOA-CFA (letter of authorisation and connecting facility assignment) information which includes working with colocation facilities to establish cross connection with google peering network.
  3. After all the necessary connection have been established which involve setting up interconnect link which turns green suggesting it is PROVISIONED.
  4. At this point Dedicated Interconnect status is available, physical connection between customer onprem to the edge of google's network is set.
  5. User should have terraform and gcloud SDK installed in the machine from which they plan to execute this script.
  6. User should have access to Google Cloud Platform projects and access to use the physical connections established at colocation facilty which would be mapped to interconnect project. Following are two network design patterns that this solution template supports:

a. Using One Google Cloud Platform Project : if using single host project topology.

b. Using two or more Google Cloud Platform projects : if using host-service project topology for setting up Host & Service projects. Compute XpnPermission described in Step7 will be required if following the Host-Service project topology.

  1. User planning to run this script should have following permissions asssigned to them in the respective projects as described below. User can either use webconsole or gcloud cli to assign these permission to the user identity using which these scripts will be executed. User can follow either step 7.a. or 7.b. to complete this step.

    • Interconnect Project

      • compute.interconnectAttachments.use
      • compute.interconnectAttachments.get
      • compute.interconnectAttachments.list

    • Host Project

      • roles/compute.networkAdmin
      • roles/compute.securityAdmin
      • roles/iam.serviceAccountAdmin
      • roles/serviceusage.serviceUsageAdmin
      • roles/resourcemanager.projectIamAdmin

    • Service Project

      • roles/cloudsql.admin
      • roles/compute.instanceAdmin
      • roles/iam.serviceAccountAdmin
      • roles/serviceusage.serviceUsageAdmin
      • roles/resourcemanager.projectIamAdmin

    • [Optional] Compute XpnPermission

      • User should have roles/compute.xpnAdmin permission at a common folder owning the host and service project. This is required to associate the service project with the host project.

      a. Using Console : User can either use Google Cloud Platform console to assign the IAM permission to the user who plans to run this script.

      b. Using gcloud SDK : User can either use gcloud SDK to assign IAM permission to the user who plans to run the script.

      User can then use this service account and impersonate this service account while running the terraform code.

      Once you have created this service account you can then update providers.tf.template file by updating the impersonate_service_account field with the service account you have created with appropriate permission as described above and renaming the providers.tf.template to providers.tf file.

      Once the providers.tf file is updated. The updated content of providers.tf file may look like

      provider "google" {
  impersonate_service_account = "iac-sa@<GCP-HOST-PROJECT-ID>.iam.gserviceaccount.com"
}
provider "google-beta" {
  impersonate_service_account = "iac-sa@<GCP-HOST-PROJECT-ID>.iam.gserviceaccount.com"
}

      Note : User should have service account admin and project iam admin permissions in the respective Google Cloud Platform projects in order to assign the above mentioned permissions.

Execution

  1. User should have authenticated using gcloud command gcloud auth application-default login command in the CLI/machine using which user plans to execute the terraform code.
  2. User can now change their working directory using cd to the example directory cloudsql-easy-networking/examples/ServiceNetworkingAcrossInterconnect in order to execute the terraform code.
  3. Update the variables in terraform.tfvars as per your configuration like host_project_id, service_project_id etc. User can also go through the Inputs section of this readme that describes the list of input variables that can be updated. Here are two examples of the terraform.tfvars file which can be referred while updating your terraform.tfvars file.
  4. Enter command terraform init . This command initializes the working directory containing terraform configuration files.
  5. Enter command terraform validate to validate the configuration files present in this directory.
  6. Enter command terraform plan. This command creates an execution plan, which lets you preview the changes that terraform plans to make in your infrastructure. Review the content displayed in the plan stage and if all looks good then move to next step.
  7. Enter terraform applyand type yes when asked for confirmation/approval. This command executes the actions proposed in a terraform plan and applies the configuration changes.
  8. Deleting resources : Enter terraform destroy and type yes when asked for confirmation/approval. This command will delete the resources created using the terraform.

Examples

  1. This example leverages the existing network and subnetwork. Network information like network_name, network_id and subnetwork_id should be passed in the terraform.tfvars file. The terraform.tfvars should look like

      host_project_id        = "<GCP-HOST-PROJECT-ID>"
  service_project_id     = "<GCP-SERVICE-PROJECT-ID>"
  database_version       = "MYSQL_8_0"
  cloudsql_instance_name = "cn-sqlinstance10"
  region                 = "us-west2"
  zone                   = "us-west2-a"
  create_network         = false
  create_subnetwork      = false
  network_name           = "cloudsql-easy"
  subnetwork_name        = "cloudsql-easy-subnet"
  subnetwork_ip_cidr     = "10.2.0.0/16"

  # Variables for Interconnect
  interconnect_project_id  = "<GCP-INTERCONNECT-PROJECT-ID>"
  first_interconnect_name  = "interconnect-1"
  second_interconnect_name = "interconnect-2"
  ic_router_bgp_asn        = 65001

  //first vlan attachment configuration values
  first_va_name          = "vlan-attachment-a"
  first_va_asn           = "65418"
  create_first_vc_router = false
  first_va_bandwidth     = "BPS_1G"
  first_va_bgp_range     = "169.254.61.0/29"
  first_vlan_tag         = 601


  //second vlan attachment configuration values
  second_va_name          = "vlan-attachment-b"
  second_va_asn           = "65418"
  create_second_vc_router = false
  second_va_bandwidth     = "BPS_1G"
  second_va_bgp_range     = "169.254.61.8/29"
  second_vlan_tag         = 601

  2. This example creates new network and subnetwork with the provided CIDR.

      host_project_id        = "<GCP-HOST-PROJECT-ID>"
  service_project_id     = "<GCP-SERVICE-PROJECT-ID>"
  database_version       = "MYSQL_8_0"
  cloudsql_instance_name = "cn-sqlinstance10"
  region                 = "us-west2"
  zone                   = "us-west2-a"
  create_network         = true
  create_subnetwork      = true
  network_name           = "cloudsql-easy"
  subnetwork_name        = "cloudsql-easy-subnet"
  subnetwork_ip_cidr     = "10.2.0.0/16"

  # Variables for Interconnect
  interconnect_project_id  = "<GCP-INTERCONNECT-PROJECT-ID>"
  first_interconnect_name  = "interconnect-1"
  second_interconnect_name = "interconnect-2"
  ic_router_bgp_asn        = 65001

  //first vlan attachment configuration values
  first_va_name          = "vlan-attachment-a"
  first_va_asn           = "65418"
  create_first_vc_router = false
  first_va_bandwidth     = "BPS_1G"
  first_va_bgp_range     = "169.254.61.0/29"
  first_vlan_tag         = 601


  //second vlan attachment configuration values
  second_va_name          = "vlan-attachment-b"
  second_va_asn           = "65418"
  create_second_vc_router = false
  second_va_bandwidth     = "BPS_1G"
  second_va_bgp_range     = "169.254.61.8/29"
  second_vlan_tag         = 601

Requirements

No requirements.

Providers

Name Version
google 4.84.0

Modules

Name Source Version
firewall_rules ../../modules/firewall-rules n/a
gce_sa ../../modules/iam-service-account n/a
google_compute_instance ../../modules/computeinstance n/a
host_project ../../modules/services n/a
host_vpc ../../modules/net-vpc n/a
nat ../../modules/net-cloudnat n/a
service_project ../../modules/services n/a
sql_db ../../modules/cloudsql n/a
tf_host_prjct_service_accounts ../../modules/iam-service-account n/a
tf_svc_prjct_service_accounts ../../modules/iam-service-account n/a
vlan_attachment_a ../../modules/net-vlan-attachment n/a
vlan_attachment_b ../../modules/net-vlan-attachment n/a

Resources

Name Type
google_compute_router.interconnect-router resource
google_compute_network.host_vpc data source
google_compute_subnetwork.host_vpc_subnetwork data source

Inputs

Name Description Type Default Required
cloudsql_instance_name Name of the cloud sql instance which will be created. string n/a yes
database_version Database version of the mysql in Cloud SQL . string n/a yes
first_interconnect_name Name of the first interconnect object. This will be used to populate the URL of the underlying Interconnect object that this attachment's traffic will traverse through. string n/a yes
first_va_asn (Required) Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. string n/a yes
first_va_bgp_range Up to 16 candidate prefixes that can be used to restrict the allocation of cloudRouterIpAddress and customerRouterIpAddress for this attachment. All prefixes must be within link-local address space (169.254.0.0/16) and must be /29 or shorter (/28, /27, etc). string n/a yes
first_vlan_tag The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. number n/a yes
host_project_id Project Id of the Host GCP Project. string n/a yes
ic_router_bgp_asn Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. string n/a yes
interconnect_project_id The ID of the project in which the resource(physical connection at colocation facilitity) belongs. string n/a yes
network_name Name of the VPC network to be created if var.create_network is marked as true or Name of the already existing network if var.create_network is false. string n/a yes
region Name of a GCP region. string n/a yes
second_interconnect_name Name of the second interconnect object. This will be used to populate the URL of the underlying Interconnect object that this attachment's traffic will traverse through. string n/a yes
second_va_asn (Required) Local BGP Autonomous System Number (ASN). Must be an RFC6996 private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. string n/a yes
second_va_bgp_range Up to 16 candidate prefixes that can be used to restrict the allocation of cloudRouterIpAddress and customerRouterIpAddress for this attachment. All prefixes must be within link-local address space (169.254.0.0/16) and must be /29 or shorter (/28, /27, etc). string n/a yes
second_vlan_tag The IEEE 802.1Q VLAN tag for this attachment, in the range 2-4094. number n/a yes
subnetwork_ip_cidr CIDR range for the subnet to be created if var.create_subnetwork is set to true. string n/a yes
subnetwork_name Name of the sub network to be created if var.create_subnetwork is marked as true or Name of the already existing sub network if var.create_subnetwork is false. string n/a yes
zone Name of a GCP zone, should be in the same region as specified in the region variable. string n/a yes
access_config Access configurations, i.e. IPs via which the VM instance can be accessed via the Internet. 
object({
    nat_ip       = string
    network_tier = string
  })
 null no
aggregation_interval The aggregation interval for flow logs in that subnet. The interval can be set to any of the following: 5-sec (default), 30-sec, 1-min, 5-min, 10-min, or 15-min. string "INTERVAL_10_MIN" no
cloudsql_private_range_cidr Cidr of the private IP range. string "" no
cloudsql_private_range_name Name of the default IP range. string "privateip-range" no
cloudsql_private_range_prefix_length Prefix length of the private IP range. string "20" no
create_first_vc_router Select 'true' to create a separate router for this VLAN attachment, or 'false' to use the current router configuration. bool false no
create_mysql_db Flag to check if an mysql db needs to be created bool true no
create_nat Boolean variable to create the Cloud NAT for allowing the VM to connect to external Internet. bool true no
create_network Variable to determine if a new network should be created or not. bool true no
create_second_vc_router Select 'true' to create a separate router for this VLAN attachment, or 'false' to use the current router configuration. bool false no
create_subnetwork Variable to determine if a new sub network should be created or not. bool true no
deletion_protection Enable delete protection. bool true no
enable_export_routes Enable export routes. bool true no
enable_import_routes Enable import routes. bool true no
enable_private_access Enable private access in the subnet. bool true no
first_va_bandwidth Provisioned bandwidth capacity for the first interconnect attachment. string "BPS_10G" no
first_va_description The description of the first interconnect attachment string "interconnect-a vlan attachment 0" no
first_va_name The name of the first interconnect attachment string "vlan-attachment-a" no
flow_sampling Flow sampling rate of logs. number 0.5 no
gce_sa_name Name of the service account to be used by the compute instance. string "gce-sa" no
gce_tags List of tags to be applied to gce instance. list(string) 
[
  "cloudsql"
]
 no
ic_router_advertise_groups User-specified list of prefix groups to advertise in custom mode. This field can only be populated if advertiseMode is CUSTOM and is advertised to all peers of the router. list(string) 
[
  "ALL_SUBNETS"
]
 no
ic_router_advertise_mode User-specified flag to indicate which mode to use for advertisement. Default value is DEFAULT. Possible values are: DEFAULT, CUSTOM string "CUSTOM" no
ic_router_name Name of the interconnect router. string "interconnect-router" no
metadata The metadata annotations that you want to include in the logs. string "INCLUDE_ALL_METADATA" no
nat_name Name of the cloud nat to be created. string "sqleasy-nat" no
network_routing_mode Network Routing Mode to be used, Could be REGIONAL or GLOBAL. string "GLOBAL" no
network_tier Networking tier to be used. string "STANDARD" no
router_name Name of the router to be used by the NAT. string "sqleasynatrouter" no
second_va_bandwidth Provisioned bandwidth capacity for the second interconnect attachment. string "BPS_10G" no
second_va_description The description of the second interconnect attachment string "interconnect-b vlan attachment 1" no
second_va_name The name of the Second interconnect attachment. string "vlan-attachment-b" no
service_project_id Project Id of the Service GCP Project attached to the Host GCP project. string null no
source_image Source disk image. If neither source_image nor source_image_family is specified, defaults to the latest public image. string "" no
source_image_family Source image family. If neither source_image nor source_image_family is specified, defaults to the latest public image. string "ubuntu-2204-lts" no
source_image_project Project where the source image comes from. The default project contains images. string "ubuntu-os-cloud" no
startup_script User startup script to run when instances spin up string null no
terraform_sa_name Name of the service account to be used by the terraform for automation & execution in build jobs. string "terraform-sa" no
test_dbname Database Name to be created from startup script. string "test_db" no
user_specified_ip_range User-specified list of individual IP ranges to advertise in custom mode. This range specifies google private api address. list(string) 
[
  "199.36.154.8/30"
]
 no

Outputs

Name Description
cloudsql_generated_password CloudSQL instance generated password.
cloudsql_instance_name Name of the cloud sql instance created in the project.
cloudsql_private_ip CloudSQL instance private ip address.
host_network_id Network ID for the host VPC network created in the host project.
host_psa_ranges PSA range allocated for the private service connection in the host vpc.
host_subnetwork_id Subnetwork ID created inside the host VPC network created in the host project.
host_vpc_name Name of the host VPC created in the host project.