terraform core/client landing zone shadowing - for hybrid, triage or day 2 deployments

[obriensystems]

20240403: shadow work in the terraform-example-foundation under https://github.com/terraform-google-modules/terraform-example-foundation/issues/1133

• see https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/621 20240304: replaced by https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/351 Same as #824 A terraform version of the landing zone Introduce a 2024 light LZ - an IaaS NGFW based landing zone based on TEF V4

see kcc automation #766 see hybrid #818 branch https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/gh870-terraform org

There is a requirement for a mixed day 2 deployment strategy around kubernetes and gcloud or terraform. The following packages will shadow the existing kubernetes yaml config - but in terraform

• core-landing-zone - inventory
• client-setup - inventory
• client-landing-zone - inventory
• client-project-setup
• gatekeeper-policies - optional https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/gatekeeper-policies
• project/hub-env - optional for non-firewall-plus https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-firewall-plus-with-intrusion-prevention IaaS security via Fortinet https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/solutions/project/hub-env/README.md#resources

see

graph LR;
    style LZV2 fill:#44f,stroke:#f66,stroke-width:2px,color:#fff,stroke-dasharray: 5 5
    %% mapped and documented
    project/hub-env-->core-landing-zone;
    client-setup;
    client-setup-->dns-project;
    client-setup-->kcc-management-project;
    client-landing-zone-->client-setup;
    client-project-setup-->client-landing-zone;
    client-project-setup-->client-management-project;
    gatekeeper-policies;

    kcc-management-project;
    core-landing-zone-->kcc-management-project;
    dns-project-->core-landing-zone;
    logging-project-->core-landing-zone;
    client-management-project-->client-setup;
    host-project-->client-landing-zone;

mermaid - diagrams as code

Structure

Based on parts of the following repositories

• some of this one but these models are customized TEF V1 modules
• TEF V4
• https://github.com/terraform-google-modules/terraform-example-foundation
• Fortinet
• https://github.com/40net-cloud/fortinet-gcp-solutions/tree/master/FortiGate
• https://github.com/fortinet/fortigate-tutorial-gcp/tree/main/terraform
• we have parts of our base and client architecture as a reference here

Architecture

• https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Architecture
• see existing LZ V2 architecture that we will generally model off as a defacto port from KCC LZ V2
• core-landing-zone https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/core-landing-zone
• client-setup - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/client-setup
• client-landing-zone - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/client-landing-zone
• client-project-setup - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/client-project-setup
• guardrails - https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/main/solutions/guardrails

Work Items

• Fortigate based HA cluster with 4 VPCs
• client VPC that is peered with the NGFW southbound VPC
• gitops deploy pipeline based on github or ADO with terraform provider token based authentication to ADO for example

[obriensystems]

Initial port/copy and back reference to base https://github.com/40net-cloud/fortinet-gcp-solutions/tree/master/FortiGate to https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/tree/gh870-terraform/terraform via https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/compare/main...gh870-terraform https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/commit/b8022ebf5e037e05128d492ee9f9093cc2bfe54e

[fmichaelobrien]

Reopening as shadow of the terraform-example-foundation work in https://github.com/terraform-google-modules/terraform-example-foundation/issues/1133

[fmichaelobrien]

duplicates https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/360