F5Networks / f5-google-gdm-templates-v2

Google Deployment Templates for quickly deploying BIG-IP services in Google Cloud Platform
5 stars 12 forks source link

Support Shared VPC deployment scenarios #21

Open memes opened 1 year ago

memes commented 1 year ago

Is your feature request related to a problem?

Current GDM modules do not support deploying any of the solutions in various Shared VPC deployment scenarios. Shared VPCs occur when a VM is defined with one or more network interfaces attached to VPC networks that exist in different GCP projects than the one that will host the VMs. This pattern is common in larger and/or regulated enterprises that want to enforce separation of concerns between security, networking, and application teams.

This forces some of our enterprise customers to customize the modules themselves.

Describe the solution you'd like

Allow consumers of the module to enter network and subnetwork values in the YAML configuration file either as a simple name, or as a self-link, and modify the python logic to recognize self-links and use them as-is with a fallback to the existing behavior.

Example pseudo code:

net_ref = match(/projects\/RFC1035\/global\/networks\/RFC1035/, net_name) ? net_name : 'projects/' + project + '/global/networks/' + net_name
sub_ref = # same approach but matching subnet regex

This will preserve expectations for those familiar with the current behavior and still support use-cases where NICs must be attached to resources defined in different projects.

Shared VPCs should be supported for quickstart, failover and autoscale examples.

Describe alternatives you've considered

An alternative is to replicate and extend the approach taken by GDM v1 templates, which provided an additional field for a single shared VPC network project for NIC0 through network1SharedVpc. The downside of this approach is that is introduces a new field that is unused by many deployments, and really it should be eight additional fields in order to support the most extreme example where every BIG-IP NIC is attached to a different Shared VPC project.

mikeshimkus commented 1 year ago

Thanks @memes. We opened internal issue EC-348 to track this.