VPN and Hybrid Connectivity

# Networks and subnets (custom mode, global dynamic routing)
gcloud compute networks create bookshelf-vpc \
  --subnet-mode=custom --bgp-routing-mode=global
gcloud compute networks subnets create bookshelf-subnet \
  --network=bookshelf-vpc --region="$REGION" --range=10.10.0.0/24

gcloud compute networks create onprem-vpc \
  --subnet-mode=custom --bgp-routing-mode=global
gcloud compute networks subnets create onprem-subnet \
  --network=onprem-vpc --region="$REGION" --range=192.168.0.0/24

# Cloud Routers with distinct private ASNs
gcloud compute routers create bookshelf-router \
  --network=bookshelf-vpc --region="$REGION" --asn=65001
gcloud compute routers create onprem-router \
  --network=onprem-vpc --region="$REGION" --asn=65002

gcloud compute vpn-gateways create bookshelf-vpn \
  --network=bookshelf-vpc --region="$REGION"
gcloud compute vpn-gateways create onprem-vpn \
  --network=onprem-vpc --region="$REGION"

# The two interface addresses of each gateway
gcloud compute vpn-gateways describe bookshelf-vpn --region="$REGION" \
  --format='table(vpnInterfaces[].id,vpnInterfaces[].ipAddress)'
gcloud compute vpn-gateways describe onprem-vpn --region="$REGION" \
  --format='table(vpnInterfaces[].id,vpnInterfaces[].ipAddress)'

# Google Cloud side tunnels (to the simulated on-premises HA VPN gateway)
for N in 0 1; do
  SECRET_VAR="SHARED_SECRET_$N"
  gcloud compute vpn-tunnels create "bookshelf-tunnel-$N" \
    --region="$REGION" \
    --vpn-gateway=bookshelf-vpn --interface="$N" \
    --peer-gcp-gateway=onprem-vpn \
    --router=bookshelf-router \
    --ike-version=2 \
    --shared-secret="${!SECRET_VAR}"
done

# Simulated on-premises side tunnels (to the Google Cloud HA VPN gateway)
for N in 0 1; do
  SECRET_VAR="SHARED_SECRET_$N"
  gcloud compute vpn-tunnels create "onprem-tunnel-$N" \
    --region="$REGION" \
    --vpn-gateway=onprem-vpn --interface="$N" \
    --peer-gcp-gateway=bookshelf-vpn \
    --router=onprem-router \
    --ike-version=2 \
    --shared-secret="${!SECRET_VAR}"
done

for N in 0 1; do
  # Google Cloud side: .1 of each /30, peer is .2
  gcloud compute routers add-interface bookshelf-router \
    --region="$REGION" --interface-name="if-tunnel-$N" \
    --vpn-tunnel="bookshelf-tunnel-$N" \
    --ip-address="169.254.$N.1" --mask-length=30
  gcloud compute routers add-bgp-peer bookshelf-router \
    --region="$REGION" --peer-name="peer-onprem-$N" \
    --interface="if-tunnel-$N" \
    --peer-ip-address="169.254.$N.2" --peer-asn=65002

  # Simulated on-premises side: .2 of each /30, peer is .1
  gcloud compute routers add-interface onprem-router \
    --region="$REGION" --interface-name="if-tunnel-$N" \
    --vpn-tunnel="onprem-tunnel-$N" \
    --ip-address="169.254.$N.2" --mask-length=30
  gcloud compute routers add-bgp-peer onprem-router \
    --region="$REGION" --peer-name="peer-bookshelf-$N" \
    --interface="if-tunnel-$N" \
    --peer-ip-address="169.254.$N.1" --peer-asn=65001
done

# Tunnel state and details (expect ESTABLISHED)
gcloud compute vpn-tunnels describe bookshelf-tunnel-0 --region="$REGION" \
  --format='value(status,detailedStatus)'
gcloud compute vpn-tunnels list --filter="region:$REGION" \
  --format='table(name,status,peerIp,ikeVersion)'

# BGP sessions and learned routes
gcloud compute routers get-status bookshelf-router --region="$REGION" \
  --format='yaml(result.bgpPeerStatus,result.bestRoutes)'
gcloud compute routers get-status bookshelf-router --region="$REGION" \
  --format='table(result.bgpPeerStatus[].name,result.bgpPeerStatus[].state,result.bgpPeerStatus[].status,result.bgpPeerStatus[].numLearnedRoutes)'

gcloud compute firewall-rules create bookshelf-allow-from-onprem \
  --network=bookshelf-vpc --direction=INGRESS --action=ALLOW \
  --rules=icmp,tcp:22 --source-ranges=192.168.0.0/24
gcloud compute firewall-rules create onprem-allow-from-bookshelf \
  --network=onprem-vpc --direction=INGRESS --action=ALLOW \
  --rules=icmp,tcp:22 --source-ranges=10.10.0.0/24

# Allow IAP's source range so you can SSH to the private test VMs
gcloud compute firewall-rules create bookshelf-allow-iap-ssh \
  --network=bookshelf-vpc --direction=INGRESS --action=ALLOW \
  --rules=tcp:22 --source-ranges=35.235.240.0/20
gcloud compute firewall-rules create onprem-allow-iap-ssh \
  --network=onprem-vpc --direction=INGRESS --action=ALLOW \
  --rules=tcp:22 --source-ranges=35.235.240.0/20

gcloud compute instances create cloud-vm --zone="$ZONE" \
  --machine-type=e2-micro --subnet=bookshelf-subnet --no-address
gcloud compute instances create onprem-vm --zone="$ZONE" \
  --machine-type=e2-micro --subnet=onprem-subnet --no-address

CLOUD_VM_IP=$(gcloud compute instances describe cloud-vm --zone="$ZONE" \
  --format='value(networkInterfaces[0].networkIP)')

# From the simulated on-premises VM, ping the Google Cloud VM across the tunnels
gcloud compute ssh onprem-vm --zone="$ZONE" --tunnel-through-iap \
  --command="ping -c 3 $CLOUD_VM_IP"

variable "vpn_shared_secret_0" {
  type      = string
  sensitive = true   # supply with TF_VAR_vpn_shared_secret_0, never in a .tf or .tfvars file
}

variable "vpn_shared_secret_1" {
  type      = string
  sensitive = true
}

resource "google_compute_ha_vpn_gateway" "bookshelf" {
  name    = "bookshelf-vpn"
  region  = "us-central1"
  network = google_compute_network.bookshelf.id
}

resource "google_compute_ha_vpn_gateway" "onprem" {
  name    = "onprem-vpn"
  region  = "us-central1"
  network = google_compute_network.onprem.id
}

resource "google_compute_router" "bookshelf" {
  name    = "bookshelf-router"
  region  = "us-central1"
  network = google_compute_network.bookshelf.id
  bgp {
    asn = 65001
  }
}

resource "google_compute_vpn_tunnel" "bookshelf" {
  count                 = 2
  name                  = "bookshelf-tunnel-${count.index}"
  region                = "us-central1"
  vpn_gateway           = google_compute_ha_vpn_gateway.bookshelf.id
  vpn_gateway_interface = count.index
  peer_gcp_gateway      = google_compute_ha_vpn_gateway.onprem.id
  router                = google_compute_router.bookshelf.id
  ike_version           = 2
  shared_secret         = count.index == 0 ? var.vpn_shared_secret_0 : var.vpn_shared_secret_1
}

resource "google_compute_router_interface" "bookshelf" {
  count      = 2
  name       = "if-tunnel-${count.index}"
  router     = google_compute_router.bookshelf.name
  region     = "us-central1"
  ip_range   = "169.254.${count.index}.1/30"
  vpn_tunnel = google_compute_vpn_tunnel.bookshelf[count.index].name
}

resource "google_compute_router_peer" "bookshelf" {
  count                     = 2
  name                      = "peer-onprem-${count.index}"
  router                    = google_compute_router.bookshelf.name
  region                    = "us-central1"
  peer_ip_address           = "169.254.${count.index}.2"
  peer_asn                  = 65002
  interface                 = google_compute_router_interface.bookshelf[count.index].name
}

gcloud services enable networkconnectivity.googleapis.com

gcloud network-connectivity hubs create bookshelf-hub \
  --description="Bookshelf hub"

gcloud network-connectivity spokes linked-vpn-tunnels create onprem-spoke \
  --hub=bookshelf-hub --region="$REGION" \
  --vpn-tunnels=bookshelf-tunnel-0,bookshelf-tunnel-1 \
  --site-to-site-data-transfer

# Enable OS Login for every VM in the project (optionally 2-step verification)
gcloud compute project-info add-metadata \
  --metadata=enable-oslogin=TRUE

# Regular login or administrator login (sudo)
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="$ADMINS" --role=roles/compute.osLogin
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member=group:bookshelf-sre@example.com --role=roles/compute.osAdminLogin

# A VM that runs as a service account also needs the user role on that service account
gcloud iam service-accounts add-iam-policy-binding \
  "bookshelf-vm@${PROJECT_ID}.iam.gserviceaccount.com" \
  --member="$ADMINS" --role=roles/iam.serviceAccountUser

gcloud compute addresses create bookshelf-vpn-ip --region="$REGION"

gcloud compute instances create vpn-server --zone="$ZONE" \
  --machine-type=e2-small --subnet=bookshelf-subnet \
  --address=bookshelf-vpn-ip \
  --can-ip-forward --tags=vpn-server

gcloud compute firewall-rules create bookshelf-allow-wireguard \
  --network=bookshelf-vpc --direction=INGRESS --action=ALLOW \
  --rules=udp:51820 --target-tags=vpn-server

# On the bastion VM (created with --tags=bastion and a service account holding roles/cloudsql.client):
./cloud-sql-proxy --private-ip --address 127.0.0.1 --port 5432 \
  "$PROJECT_ID:$REGION:bookshelf-catalog"

# On the administrator's laptop: forward local 5432 through IAP and SSH to the proxy on the bastion
gcloud compute ssh bastion --zone="$ZONE" --tunnel-through-iap -- \
  -N -L 5432:127.0.0.1:5432

# In another terminal, connect as if the database were local
psql "host=127.0.0.1 port=5432 dbname=catalog user=catalog_admin"

spring.datasource.url=jdbc:postgresql://127.0.0.1:5432/catalog
spring.datasource.username=catalog_admin
spring.datasource.password=${CATALOG_DB_PASSWORD}

gcloud logging read \
  'resource.type="vpn_gateway" AND resource.labels.gateway_id:*' \
  --limit=20 --format='table(timestamp,severity,jsonPayload.message)'

# Reachability analysis without sending packets
gcloud network-management connectivity-tests create onprem-to-cloud \
  --source-instance="projects/$PROJECT_ID/zones/$ZONE/instances/onprem-vm" \
  --destination-instance="projects/$PROJECT_ID/zones/$ZONE/instances/cloud-vm" \
  --protocol=ICMP
gcloud network-management connectivity-tests describe onprem-to-cloud \
  --format='yaml(reachabilityDetails)'