GCP Networking

Creates a VPC network with subnets, firewall rules, Cloud NAT, and VPC peering for a GKE cluster.

Use this module when the Rabbit platform needs a dedicated VPC with private networking, NAT egress, and firewall rules before provisioning a GKE cluster.

Supported Features

• VPC network creation.
• Subnet with configurable CIDR and private Google access.
• Firewall rules with allow/deny actions, INGRESS/EGRESS direction, priorities, network tags, and service-account-based filtering.
• Cloud Router and Cloud NAT for egress from private nodes.
• Reserved regional static IP for load balancing.
• Global internal address for VPC peering (used by Cloud SQL private IP).
• VPC peering via service networking connection.
• HTTP health check for backend services.

Prerequisites

• GCP credentials with permission to manage Compute Engine networking resources.
• The servicenetworking.googleapis.com API enabled when VPC peering is needed.

Important Notes

• This module must run before gcp-gke-cluster because the cluster references the VPC and subnet created here.
• cluster_network and cluster_subnetwork names must match what the GKE cluster module expects.
• nat_ip_allocate_option set to AUTO_ONLY lets GCP assign NAT IPs automatically.
• Firewall rules are created as a map; keys are arbitrary identifiers.

Minimal Example

services:
  - name: "GCP Networking"
    module: "gcp-networking"
    id: "networking"
    deployment_order: 10
    configurations:
      cluster_name: "my-cluster"
      cluster_network: "my-network"
      cluster_subnetwork: "my-subnetwork"
      subnet_cidr: "10.0.0.0/24"
      region: "us-central1"

Outputs

Output	Description
vpc_name	The name of the created VPC.
subnet_name	The name of the created subnet.
public_ip	The reserved public IP address.

Full Configuration Schema

The fields below are public module inputs under configurations.

configurations:
  subnet_cidr: "10.0.0.0/24"
  region: "us-central1"
  cluster_name: "gcp-gke-cluster"
  cluster_network: "gcp-gke-cluster-network"
  cluster_subnetwork: "gcp-gke-cluster-subnetwork"
  network_tier: "PREMIUM"
  auto_create_subnetworks: false
  private_ip_google_access: true
  router_name: "gcp-gke-cluster-router"
  router_nat_name: "gcp-gke-cluster-router-nat"
  router_nat_log_config_enable: true
  router_nat_log_config_filter: "ERRORS_ONLY"
  source_ip_ranges_to_nat: ["ALL_IP_RANGES"]
  source_subnetwork_ip_ranges_to_nat: "LIST_OF_SUBNETWORKS"
  nat_ip_allocate_option: "AUTO_ONLY"
  enable_endpoint_independent_mapping: true
  google_compute_global_address_name: "rabbit-gke-test"
  google_compute_global_address_purpose: "VPC_PEERING"
  google_compute_global_address_address_type: "INTERNAL"
  google_compute_global_address_prefix_length: 20
  router_bgp_asn: 64514
  http_health_check_port: "8080"
  http_health_check_path: "/health"
  http_health_check_interval_sec: "10"
  http_health_check_timeout_sec: "5"
  firewall_rules:
    rule1:
      name: "allow-http"
      protocol: "tcp"
      ports: ["80", "8080"]
      source_ranges: ["0.0.0.0/0"]
    rule2:
      name: "deny-telnet-egress"
      action: "deny"
      direction: "EGRESS"
      protocol: "tcp"
      ports: ["23"]
      destination_ranges: ["0.0.0.0/0"]
      priority: 900
    rule3:
      name: "allow-app-to-db"
      protocol: "tcp"
      ports: ["5432"]
      source_service_accounts: ["app@my-project.iam.gserviceaccount.com"]
      target_service_accounts: ["db@my-project.iam.gserviceaccount.com"]

Top-Level Fields

Field	Type	Required	Description
subnet_cidr	string	Yes	Subnet CIDR range. Defaults to 10.0.0.0/24.
region	string	Yes	GCP region. Defaults to us-central1.
cluster_name	string	Yes	Cluster name used for naming derived resources.
cluster_network	string	Yes	VPC network name.
cluster_subnetwork	string	Yes	Subnet name.
network_tier	string	No	Network tier for the static IP. Defaults to PREMIUM.
auto_create_subnetworks	boolean	No	Auto-create subnetworks in the VPC. Defaults to false.
private_ip_google_access	boolean	No	Enables private Google access on the subnet. Defaults to true.
router_name	string	No	Cloud Router name.
router_nat_name	string	No	Cloud NAT name.
router_nat_log_config_enable	boolean	No	Enables NAT logging. Defaults to true.
router_nat_log_config_filter	string	No	NAT log filter. Defaults to ERRORS_ONLY.
source_ip_ranges_to_nat	array[string]	No	IP ranges to NAT. Defaults to ["ALL_IP_RANGES"].
source_subnetwork_ip_ranges_to_nat	string	No	Subnetwork IP range NAT mode. Defaults to LIST_OF_SUBNETWORKS.
nat_ip_allocate_option	string	No	NAT IP allocation. Defaults to AUTO_ONLY.
enable_endpoint_independent_mapping	boolean	No	Enables endpoint-independent mapping. Defaults to true.
google_compute_global_address_name	string	No	Global address name for VPC peering.
google_compute_global_address_purpose	string	No	Global address purpose. Defaults to VPC_PEERING.
google_compute_global_address_address_type	string	No	Global address type. Defaults to INTERNAL.
google_compute_global_address_prefix_length	number	No	Global address prefix length. Defaults to 20.
router_bgp_asn	number	No	BGP ASN for the Cloud Router. Defaults to 64514.
http_health_check_port	string	No	Health check port. Defaults to 8080.
http_health_check_path	string	No	Health check path. Defaults to /health.
http_health_check_interval_sec	string	No	Health check interval in seconds. Defaults to 10.
http_health_check_timeout_sec	string	No	Health check timeout in seconds. Defaults to 5.
firewall_rules	map[firewall_rule]	No	Map of firewall rule definitions.

firewall_rules

Field	Type	Required	Description
name	string	Yes	Firewall rule name suffix. The full name is cluster-<cluster_name>-<name>-<key>.
protocol	string	Yes	Network protocol: tcp, udp, icmp, esp, ah, sctp, or all.
ports	array[string]	No	Ports the rule applies to. Omit for protocols without ports (for example icmp); defaults to all ports.
action	string	No	allow or deny. Defaults to allow.
direction	string	No	INGRESS or EGRESS. Defaults to INGRESS.
priority	number	No	Rule priority, 0–65535. Lower numbers take precedence. Defaults to 1000.
description	string	No	Free-form rule description.
disabled	boolean	No	Create the rule but leave it disabled. Defaults to false.
source_ranges	array[string]	INGRESS*	Source CIDR ranges. INGRESS rules only.
source_tags	array[string]	INGRESS*	Source network tags. INGRESS rules only.
source_service_accounts	array[string]	INGRESS*	Source service account emails. INGRESS rules only.
destination_ranges	array[string]	EGRESS	Destination CIDR ranges. Required for EGRESS rules.
target_tags	array[string]	No	Network tags of instances the rule applies to. Defaults to all instances in the network.
target_service_accounts	array[string]	No	Service accounts of instances the rule applies to. Defaults to all instances in the network.

* INGRESS rules require at least one of source_ranges, source_tags, or source_service_accounts.

Validation is enforced at plan time: invalid action, direction, or priority values fail the plan, EGRESS rules cannot use source filters and must set destination_ranges, and service-account-based filters cannot be combined with tag-based filters (a GCP restriction).