DNS across hybrid environments - with Cloud DNS, Private Service Connect and VPC Service Controls

[fmichaelobrien]

Requirements: Investigate Cloud DNS and On-prem DNS scenarios for implementing DNS across hybrid environment

Slides

37 of shared deck https://docs.google.com/presentation/d/1Ztqn7G2rWFlssVwC7r5Xl-WFSFCbVo6MoHJffrXScmw/edit#slide=id.g228c00ae937_0_0 Reference all DNS sections of networking design patterns deck starting with 20, 27 https://docs.google.com/presentation/d/13sjT2tJ4yLIYGRREE3wBrylB1OvcEMpKdquVuJB_nX4/edit?resourcekey=0-N3DruQaiutFvZ98HTT7-vQ#slide=id.g1154b3b950f_2_3152

Procedures

• https://cloud.google.com/dns/docs/policies#create-in

Implementation

• on prem DNS servers are authoritative for on prem zones
• cloud DNS is authoritative for GCP zones
• DNS queries from GCP to on-prem use 35.199.192.0/19

  Manual

• simulate on-prem...(other CSP or eBGP enabled home router)
• create dns-host-ol project - host project enabled on shared vpc creation
• enable apis

  dns.googleapis.com

• set permissions Required 'compute.organizations.enableXpnHost' permission for 'projects/dns-host-ol' - https://gcp.permissions.cloud/predefinedroles/compute.xpnAdmin
• create custom vpc (for reuse as shared vpc)

  gcloud compute networks create host --project=dns-host-ol --description=hody --subnet-mode=custom --mtu=1460 --bgp-routing-mode=regional
  gcloud compute networks subnets create host-sn --project=dns-host-ol --description=host-sn --range=10.0.2.0/24 --stack-type=IPV4_ONLY --network=host --region=northamerica-northeast1 --enable-private-ip-google-access

• create host shared-vpc (custom networks, dns api enabled)
• create dns private zones in host project

  gcloud dns --project=dns-host-ol managed-zones create private --description="" --dns-name="private.obrienlabs.dev." --visibility="private" --networks="host"

• enable compute api
• create shared vpc
• create service project dns-sp-ol
• create dns egress proxy in shared vpc
• create inbound server policy in Cloud DNS for on prem
• create forwarding zone in Cloud DNS for on prem
• On Prem DNS

Automated

[obriensystems]

shadow https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/286 in addition to #298 and https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/468

[obriensystems]

AWS (prem/ground) to GCP HA VPN up for private google access and DNS forwarding simulation in https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/494