GCP 上的 Terraform 共享 VPC - 静态内部 IP 地址

Question

我正在尝试编写自动化以在 GCP 上的共享 VPC 中部署实例。我有一个主机网络项目和一个服务项目。我可以在宿主项目（资源“google_compute_address”“内部”）中创建静态内部 IP 地址资源，在其中指定 VPC 宿主项目 (NET_HUB_PROJ)，但在创建实例时无法使用它。我收到以下错误：

google_compute_instance.compute: Error creating instance: googleapi: 
Error 400: Invalid value for field 
'resource.networkInterfaces[0].networkIP': '10.128.0.10'. IP address 
'projects/prototype-network-hub/regions/us-central1/addresses/bh-int- 
ip' (10.128.0.10) is reserved by another project., invalid

我的计算模块：

data "google_compute_image" "image" {
  name    = "${var.IMAGE_NAME}"
  project = "${var.IMAGE_PROJECT}"
}

resource "google_compute_address" "internal" {
  name         = "${var.NAME}-int-ip"
  address_type = "INTERNAL"
  address      = "${var.PRIVATE_IP}"
  subnetwork   = "${var.NET_HUB_SUBNETWORK}"
  region       = "${var.NET_HUB_REGION}"
  project      = "${var.NET_HUB_PROJ}"
}

resource "google_compute_address" "external" {
  count        = "${var.EXT_IP_CREATE ? 1 : 0}"
  name         = "${var.NAME}-ext-ip"
  address_type = "EXTERNAL"
  region       = "${var.REGION}"
}

resource "google_compute_instance" "compute" {
   depends_on  = ["google_compute_address.external"] 
   name = "${var.NAME}"
   machine_type = "${var.MACHINE_TYPE}"
   zone = "${var.ZONE}"
   can_ip_forward = "${var.CAN_IP_FORWARD}"
   deletion_protection ="${var.DELETION_PROTECTION}"
   allow_stopping_for_update = "${var.ALLOW_STOPPING_FOR_UPDATE}"
   tags = ["allow-ssh"]
   metadata = {
    "network" = "${var.NETWORK}"
    "env" = "${var.ENV}"
    "role" = "${var.ROLE}"
    "region" = "${var.REGION}"
    "zone" = "${var.ZONE}"
   }
   labels = {
    "network" = "${var.NETWORK}"
    "env" = "${var.ENV}"
    "role" = "${var.ROLE}"
    "region" = "${var.REGION}"
    "zone" = "${var.ZONE}"
    }
   boot_disk {
      device_name = "${var.NAME}"
      auto_delete = "${var.BOOT_DISK_AUTO_DELETE}"
      initialize_params {
      size = "${var.BOOT_DISK_SIZE}"
      type = "${var.BOOT_DISK_TYPE}"
      image = "${data.google_compute_image.image.self_link}"
      }
   }

network_interface {
   network_ip = "${google_compute_address.internal.address}"
   subnetwork_project = "${var.NET_HUB_PROJ}"
   subnetwork   = "projects/prototype-network-hub/regions/us-central1/subnetworks/custom"
   access_config {
      nat_ip = "${element(concat(google_compute_address.external.*.address, list("")), 0)}"
   }
}
service_account {
   scopes = ["service-control", "service-management", "logging-write", "monitoring-write", "storage-ro", "https://www.googleapis.com/auth/trace.append" ]
   }
}

最终目标是实现以下目标：

Answer 1

编辑（新答案）：根据 GCP 文档，如果您希望在不同项目的共享 VPC 上保留内部 IP，则静态内部 IP 必须属于服务项目（而不是代码中的主机网络项目）。请参阅此处：https : //cloud.google.com/vpc/docs/provisioning-shared-vpc#reserve_internal_ip

看到 ashared-vpc不太可能在您的 TF 代码库中找到，您必须使用data来获取self_link子网的 以用于google_compute_address. 类似于以下内容：

data "google_compute_subnetwork" "subnet" {
  name    = "${var.NET_HUB_SUBNETWORK}"
  project = "${var.NET_HUB_PROJ}"
  region  = "${var.NET_HUB_REGION}"
}

resource "google_compute_address" "internal" {
  name         = "${var.NAME}-int-ip"
  address_type = "INTERNAL"
  address      = "${var.PRIVATE_IP}"
  subnetwork   = "${data.google_compute_subnetwork.subnet.self_link}"
}

这应该在您的服务项目下创建资源，但地址位于指定子网内。

部署实例时，您应该会在internal_ipVM 实例选项卡的列下看到它被分配的实例引用。

（后代的旧答案）：不幸的是，google_compute_address不包含subnetwork_projectlike google_compute_instance。对此的一种解决方法是提供一个完整的URL到subnetwork现场google_compute_address。类似于以下内容：

resource "google_compute_address" "internal" {
  name         = "${var.NAME}-int-ip"
  address_type = "INTERNAL"
  address      = "${var.PRIVATE_IP}"
  subnetwork   = "https://www.googleapis.com/compute/v1/projects/${var.NET_HUB_PROJ}/regions/${var.NET_HUB_REGION}/subnetworks/${var.NET_HUB_SUBNETWORK}"
}