terraform-google-modules / terraform-example-foundation

Shows how the CFT modules can be composed to build a secure cloud foundation
https://cloud.google.com/architecture/security-foundations
Apache License 2.0
1.18k stars 702 forks source link

Inconsistent project names and envcode for networking projects #1198

Closed eeaton closed 1 month ago

eeaton commented 2 months ago

TL;DR

Networking projects under the Networking folder do not follow the naming conventions or environment code labels as intended.

Expected behavior

Should match the documented design at https://cloud.google.com/architecture/security-foundations/organization-structure#projects and https://cloud.google.com/architecture/security-foundations/summary#naming-conventions

environmentcode is a short form of the environment field (one of b, c, p, n, d, or net). Shared VPC host projects use the environmentcode of the associated environment. Projects for networking resources that are shared across environments, like the interconnect project, use the net environment code.

It's also strange that "hub" is used inconsistently (in the current implementation, "dns-hub" means something different from "base-net-hub") so I'll clean that up as well.

Should look like:

└── fldr-network ├── prj-net-hub-base ├── prj-net-hub-restricted ├── prj-net-dns ├── prj-net-interconnect ├── prj-d-shared-base ├── prj-d-shared-restricted ├── prj-n-shared-base ├── prj-n-shared-restricted ├── prj-p-shared-base └── prj-p-shared-restricted

Observed behavior

Common network projects like DNS, interconnect, and hub and spoke use the old naming conventions from v3, where these were all under the "common" ("c") folder.

└── fldr-network ├── prj-c-base-net-hub ├── prj-c-dns-hub ├── prj-c-interconnect ├── prj-c-restricted-net-hub ├── prj-d-shared-base ├── prj-d-shared-restricted ├── prj-n-shared-base ├── prj-n-shared-restricted ├── prj-p-shared-base └── prj-p-shared-restricted

Terraform Configuration

n/a

Terraform Version

n/a

Additional information

No response