3-networks-hub-and-spoke/vpc_config.yaml (588 lines of code) (raw):
regions:
region1:
name: "northamerica-northeast1"
region2:
name: "northamerica-northeast2"
enabled: false
prefix:
private_service_access: 10.16
private_service_connect: 10.17
spoke_base_region1: 10.10.0.0/21
spoke_base_region2: 10.11.0.0/21
spoke_base_proxy_region1: 10.12.0.0/21
spoke_base_proxy_region2: 10.13.0.0/21
spoke_base_sec_region1: 100.64.0.0/24
spoke_base_sec_region2: 100.65.0.0/24
spokes:
spoke_common_routes:
# the complete route name is similar to rt-${vpc_name}-${name_suffix}
# the VPC name is vpc-${env_code}-${env_type} e.g. vpc-d-shared-base
# routes:
# next_hop:
# internet: route traffic via NAT/IGW
# inspect: route traffic via FW (Fortigate in this case)
- id: rt_nat_to_internet
name_suffix: "1000-egress-internet-default"
description: "Tag based route through IGW to access internet"
destination_range: 0.0.0.0/0
tags: egress-internet
# next_hop: inspect
next_hop_internet: "true"
priority: 1000
- id: rt_windows_activation
name_suffix: "1000-all-default-windows-kms"
description: "Route through IGW to allow Windows KMS activation for GCP."
destination_range: 35.190.247.13/32
# next_hop: internet
next_hop_internet: "true"
priority: 1000
all_env_ip_range: 10.0.0.0/8
management:
env_code: "m"
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: false
mode: spoke
base:
env_type: "shared-base"
enabled: true
private_service_cidr: 10.16.2.0/24
private_service_connect_ip: 10.17.0.2
subnets:
- id: base-mgmt-primary
description: "Management primary subnets"
ip_ranges:
region1: 10.10.0.0/25
region2: 10.11.0.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_mgmt_s1
mode: service
identity:
env_code: "i"
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: false
mode: spoke
base:
env_type: "shared-base"
enabled: true
private_service_cidr: 10.16.3.0/24
private_service_connect_ip: 10.17.0.3
subnets:
- id: base-iden-primary
description: "Identity Primary subnet"
ip_ranges:
region1: 10.10.128.0/25
region2: 10.11.128.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_iden_s1
mode: service
- id: proj_base_iden_s2
mode: service
development:
env_code: "d"
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: false
# route_all_pbr : route via pbr any subnet to subnet packet for inspection (Fortigate in this case)
route_all_pbr: true
mode: spoke
base:
env_type: "shared-base"
enabled: true
private_service_cidr: 10.16.4.0/24
private_service_connect_ip: 10.17.0.4
subnets:
- id: base-dev-public
description: "Development Public subnet"
ip_ranges:
region1: 10.10.1.0/25
region2: 10.11.1.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_dev_pub_s1
mode: service
- id: proj_base_dev_pub_s2
mode: service
- id: base-dev-app
description: "Development App subnet"
ip_ranges:
region1: 10.10.1.128/26
region2: 10.11.1.128/26
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_dev_app_s1
mode: service
- id: proj_base_dev_app_s2
mode: service
secondary_ranges:
- range_suffix: "gke-pod"
ip_cidr_range:
region1: 100.64.1.0/25
- range_suffix: "gke-svc"
ip_cidr_range:
region1: 100.64.1.128/25
- id: base-dev-data
description: "Development App subnet"
ip_ranges:
region1: 10.10.1.192/26
region2: 10.11.1.192/26
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_dev_data_s1
mode: service
- id: proj_base_dev_data_s2
mode: service
- id: proxy
ip_ranges:
region1: 10.12.1.0/24
region2: 10.13.1.0/24
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
nonproduction:
env_code: "n"
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: false
# route_all_pbr : route via pbr any subnet to subnet packet for inspection (Fortigate in this case)
route_all_pbr: true
mode: spoke
base:
env_type: "shared-base"
enabled: true
private_service_cidr: 10.16.5.0/24
private_service_connect_ip: 10.17.0.5
subnets:
- id: base-np-public
description: "Nonprod Public subnet"
ip_ranges:
region1: 10.10.2.0/25
region2: 10.11.2.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_np_pub_s1
mode: service
- id: proj_base_np_pub_s2
mode: service
- id: base-np-app
description: "Nonprod App subnet"
ip_ranges:
region1: 10.10.2.128/26
region2: 10.11.2.128/26
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_np_app_s1
mode: service
- id: proj_base_np_app_s2
mode: service
secondary_ranges:
- range_suffix: "gke-pod"
ip_cidr_range:
region1: 100.64.2.0/25
region2: 100.65.2.0/25
- range_suffix: "gke-svc"
ip_cidr_range:
region1: 100.64.2.128/25
region2: 100.65.2.128/25
- id: base-np-data
description: "Nonprod data subnet"
ip_ranges:
region1: 10.10.2.192/26
region2: 10.11.2.192/26
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_np_data_s1
mode: service
- id: proj_base_np_data_s2
mode: service
- id: proxy
ip_ranges:
region1: 10.12.2.0/24
region2: 10.13.2.0/24
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
production:
env_code: "p"
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: false
# route_all_pbr : route via pbr any subnet to subnet packet for inspection (Fortigate in this case)
route_all_pbr: true
mode: spoke
base:
env_type: "shared-base"
enabled: true
private_service_cidr: 10.16.6.0/23
private_service_connect_ip: 10.17.0.6
subnets:
- id: base-prod-public
description: "Prod Public subnet"
ip_ranges:
region1: 10.10.4.0/24
region2: 10.11.4.0/24
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_prod_pub_s1
mode: service
- id: proj_base_prod_pub_s2
mode: service
- id: base-prod-app
description: "Prod App subnet"
ip_ranges:
region1: 10.10.5.0/25
region2: 10.11.5.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_prod_app_s1
mode: service
- id: proj_base_prod_app_s2
mode: service
secondary_ranges:
- range_suffix: "gke-pod"
ip_cidr_range:
region1: 100.64.4.0/24
region2: 100.65.4.0/24
- range_suffix: "gke-svc"
ip_cidr_range:
region1: 100.64.5.0/24
region2: 100.65.5.0/24
- id: base-prod-data
description: "Prod data subnet"
ip_ranges:
region1: 10.10.5.128/25
region2: 10.11.5.128/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_base_prod_data_s1
mode: service
- id: proj_base_prod_data_s2
mode: service
- id: proxy
ip_ranges:
region1: 10.12.4.0/23
region2: 10.13.4.0/23
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
restricted:
env_type: "shared-restricted"
enabled: true
private_service_cidr: 10.16.8.0/23
private_service_connect_ip: 10.17.0.8
subnets:
- id: restr-prod-public
description: "Prod Public restricted subnet"
ip_ranges:
region1: 10.10.6.0/24
region2: 10.11.6.0/24
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_restr_prod_pub_s1
mode: service
- id: proj_restr_prod_pub_s2
mode: service
- id: restr-prod-app
description: "Prod App restricted subnet"
ip_ranges:
region1: 10.10.7.0/25
region2: 10.11.7.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_restr_prod_app_s1
mode: service
- id: proj_restr_prod_app_s2
mode: service
secondary_ranges:
- range_suffix: "gke-pod"
ip_cidr_range:
region1: 100.64.6.0/24
region2: 100.65.6.0/24
- range_suffix: "gke-svc"
ip_cidr_range:
region1: 100.64.7.0/24
region2: 100.65.7.0/24
- id: restr-prod-data
description: "Prod restricted data subnet"
ip_ranges:
region1: 10.10.7.128/25
region2: 10.11.7.128/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
service_projects:
- id: proj_restr_prod_data_s1
mode: service
- id: proj_restr_prod_data_s2
mode: service
- id: proxy
ip_ranges:
region1: 10.12.6.0/23
region2: 10.13.6.0/23
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
common:
env_code: c
env_enabled: true
# Toggle creation of 2'nd cloud router in each enabled region
router_ha_enabled: true
common_routes:
# the complete route name is similar to rt-${vpc_name}-${name_suffix}
# the VPC name is vpc-${env_code}-${env_type} e.g. vpc-d-shared-base
# next_hop:
# internet: route traffic via NAT/IGW
# inspect: route traffic via FW (Fortigate in this case)
- id: rt_nat_to_internet
name_suffix: "1000-egress-internet-default"
description: "Tag based route through IGW to access internet"
destination_range: 0.0.0.0/0
tags: egress-internet
# next_hop: internet
next_hop_internet: "true"
priority: 1000
- id: rt_windows_activation
name_suffix: "1000-all-default-windows-kms"
description: "Route through IGW to allow Windows KMS activation for GCP."
destination_range: 35.190.247.13/32
# next_hop: internet
next_hop_internet: "true"
priority: 1000
dns_hub:
env_type: "dns-hub"
mode: spoke
dns_vpc_ip_range: 172.16.0.0/24
routes:
rt_private_googleapis:
name_suffix: "1000-all-default-private-api"
description: "Route through IGW to allow private google api access."
destination_range: 199.36.153.8/30
# next_hop: internet
next_hop_internet: "true"
priority: 1000
subnets:
- id: primary
ip_ranges:
region1: 172.16.0.0/25
region2: 172.16.128.0/25
subnet_suffix: ""
target_servers:
- ipv4_address: 192.168.0.1
forwarding_path: default
- ipv4_address: 192.168.0.2
forwarding_path: default
net_hub:
env_enabled: true
nat_igw_enabled: true
windows_activation_enabled: true
enable_hub_and_spoke_transitivity: false
router_ha_enabled: true
mode: hub
base:
env_type: "shared-base-hub"
enabled: true
private_service_connect_ip: 10.17.0.9
dns_enable_inbound_forwarding: true
dns_enable_logging: true
firewall_enable_logging: true
nat_bgp_asn: 64514
nat_num_addresses_region1: 2
nat_num_addresses_region2: 2
windows_activation_enabled: true
subnets:
- id: primary
ip_ranges:
region1: 10.10.8.0/25
region2: 10.11.8.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-internal
ip_ranges:
region1: 10.10.8.128/27
region2: 10.11.8.128/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-external
ip_ranges:
region1: 10.10.8.160/27
region2: 10.11.8.160/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-hasync
ip_ranges:
region1: 10.10.8.192/27
region2: 10.11.8.192/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-hamgmt
ip_ranges:
region1: 10.10.8.224/27
region2: 10.11.8.224/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: proxy
ip_ranges:
region1: 10.12.8.0/23
region2: 10.13.8.0/23
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
restricted:
env_type: "shared-restricted-hub"
enabled: true
private_service_connect_ip: 10.17.0.10
dns_enable_inbound_forwarding: true
dns_enable_logging: true
firewall_enable_logging: true
nat_bgp_asn: 64514
nat_num_addresses_region1: 2
nat_num_addresses_region2: 2
windows_activation_enabled: true
subnets:
- id: primary
ip_ranges:
region1: 10.10.10.0/25
region2: 10.11.10.0/25
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-internal
ip_ranges:
region1: 10.10.10.128/27
region2: 10.11.10.128/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-external
ip_ranges:
region1: 10.10.10.160/27
region2: 10.11.10.160/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-hasync
ip_ranges:
region1: 10.10.10.192/27
region2: 10.11.10.192/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: fg-hamgmt
ip_ranges:
region1: 10.10.10.224/27
region2: 10.11.10.224/27
subnet_suffix: ""
flow_logs:
enable: false
interval: 1
private_access : true
- id: proxy
ip_ranges:
region1: 10.12.10.0/23
region2: 10.13.10.0/23
subnet_suffix: "-proxy"
flow_logs:
enable: false
interval: 1
private_access : false
role: ACTIVE
purpose: "REGIONAL_MANAGED_PROXY"
onsite:
on_site_ip_range: 192.168.0.0/16
sites:
site1:
nameservers:
- ipv4_address = "192.168.0.1"
forwarding_path = "default"
- ipv4_address = "192.168.0.2"
forwarding_path = "default"