GoogleCloudPlatform / terraform-google-nat-gateway

Modular NAT Gateway on Google Compute Engine for Terraform.
Apache License 2.0
156 stars 133 forks source link

Are Routes Invalidated When Next Hop Instance is Killed? #46

Open naftulikay opened 6 years ago

naftulikay commented 6 years ago

In the NAT module, the following is used for creating zonal routes (source):

resource "google_compute_route" "nat-gateway" {
  name                   = "${var.name}nat-${var.zone == "" ? lookup(var.region_params["${var.region}"], "zone") : var.zone}"
  project                = "${var.project}"
  dest_range             = "0.0.0.0/0"
  network                = "${data.google_compute_network.network.self_link}"
  next_hop_instance      = "${element(split("/", element(module.nat-gateway.instances[0], 0)), 10)}"
  next_hop_instance_zone = "${var.zone == "" ? lookup(var.region_params["${var.region}"], "zone") : var.zone}"
  tags                   = ["${compact(concat(list("${var.name}nat-${var.region}"), var.tags))}"]
  priority               = "${var.route_priority}"
}

One question that comes to mind is this: if the instance in the MIG is killed, is the route invalidated? Does it need to be recreated? I'd imagine that the ID of the instance would change on being created again, and this would break the routes or at least cause Terraform to show changes.

I am investigating this and updates to what I find will be posted to that pull request.

IngoS11 commented 5 years ago

I see this behavior in our setup as well. When the gateway instances are recreated the routes do not get updated on the first Terraform run. Only when Terraform is run again it notices that the routes are outdated and updates them accordingly.

Evesy commented 5 years ago

On the off chance you're still using this and facing this issue, we had the same thing.

In the end, we changed the MIG to assign a static internal IP to the instances and changed the route rules to use the IP as the next hop rather than the instance name. That way even if the machine is relaunched it will retain the same internal IP and the route will continue to be valid