search

terraform-google-modules / terraform-example-foundation

Shows how the CFT modules can be composed to build a secure cloud foundation
https://cloud.google.com/architecture/security-foundations
Apache License 2.0
1.22k stars 714 forks source link

Route scope tags preventing NAT egress from working for GKE autopilot #1324

Open ajbeach2 opened 1 month ago

ajbeach2 commented 1 month ago

TL;DR

As written, the cloud foundation kit shared VPC does not work with private GKE cluster with NAT. After many hours of debugging:

https://github.com/terraform-google-modules/terraform-example-foundation/blob/5f1fd0f4104a47f8ce865caf3de3326f25c78324/3-networks-dual-svpc/modules/base_shared_vpc/main.tf#L46

This route scope tag prevents egress rules from applying. This needs to be be configurable at the module level so that NAT works with GKE autopiolot