Points de contrôle
Create managementnet and its resources
/ 40
Create privatenet and its resources
/ 40
Create mynetwork and its resources
/ 20
Automating the Deployment of Networks with Terraform
GSP460
Overview
In this lab, you create a Terraform configuration with a module to automate the deployment of a custom network with resources. Specifically, you deploy 3 networks with firewall rules and VM instances.
Objectives
- Create a configuration for a custom-mode network
- Create a configuration for a firewall rule
- Create a module for VM instances
- Create a configuration for an auto-mode network
- Create and deploy a configuration
- Verify the deployment of a configuration
Setup and requirements
Before you click the Start Lab button
Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources will be made available to you.
This hands-on lab lets you do the lab activities yourself in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials that you use to sign in and access Google Cloud for the duration of the lab.
To complete this lab, you need:
- Access to a standard internet browser (Chrome browser recommended).
- Time to complete the lab---remember, once you start, you cannot pause a lab.
How to start your lab and sign in to the Google Cloud console
-
Click the Start Lab button. If you need to pay for the lab, a pop-up opens for you to select your payment method. On the left is the Lab Details panel with the following:
- The Open Google Cloud console button
- Time remaining
- The temporary credentials that you must use for this lab
- Other information, if needed, to step through this lab
-
Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).
The lab spins up resources, and then opens another tab that shows the Sign in page.
Tip: Arrange the tabs in separate windows, side-by-side.
Note: If you see the Choose an account dialog, click Use Another Account. -
If necessary, copy the Username below and paste it into the Sign in dialog.
{{{user_0.username | "Username"}}} You can also find the Username in the Lab Details panel.
-
Click Next.
-
Copy the Password below and paste it into the Welcome dialog.
{{{user_0.password | "Password"}}} You can also find the Password in the Lab Details panel.
-
Click Next.
Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges. -
Click through the subsequent pages:
- Accept the terms and conditions.
- Do not add recovery options or two-factor authentication (because this is a temporary account).
- Do not sign up for free trials.
After a few moments, the Google Cloud console opens in this tab.
Activate Cloud Shell
Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.
- Click Activate Cloud Shell at the top of the Google Cloud console.
When you are connected, you are already authenticated, and the project is set to your Project_ID,
gcloud
is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.
- (Optional) You can list the active account name with this command:
- Click Authorize.
Output:
- (Optional) You can list the project ID with this command:
Output:
gcloud
, in Google Cloud, refer to the gcloud CLI overview guide.
Task 1. Set up Terraform and Cloud Shell
Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open-source tool that codifies APIs into declarative configuration files that can be shared among team members, treated as code, edited, reviewed, and versioned.
Initialize Terraform
Terraform uses a plugin-based architecture to support the numerous infrastructure and service providers available. Each "Provider" is its own encapsulated binary distributed separately from Terraform itself. Initialize Terraform by setting Google as the provider.
- Create a directory for your Terraform configuration by running the following command:
-
In Cloud Shell, click Open Editor to open Cloud Shell Editor. Click Open in a new window if required.
-
Expand the tfnet folder in the left pane of the code editor.
-
To create a new file in the tfnet folder, click File > New File.
-
Name the new file provider.tf, and then open it.
-
Copy the code into provider.tf:
provider "google" {} -
Initialize Terraform by running the following commands:
cd tfnet terraform init
The output should look like this:
You are now ready to work with Terraform in Cloud Shell.
Task 2. Create managementnet and its resources
Create the custom-mode network managementnet along with its firewall rule and VM instance (managementnet-us-vm).
Configure managementnet
Create a new configuration and define managementnet.
- To create a new file, click File > New File.
- Name the new file managementnet.tf, and then open it.
- Copy the following base code into managementnet.tf:
This base template is a great starting point for any Google Cloud resource. The name field allows you to name the resource, and the type field allows you to specify the Google Cloud resource that you want to create. You can also define properties, but these are optional for some resources.
- In managementnet.tf, replace
[RESOURCE_TYPE]
with"google_compute_network"
.
- In managementnet.tf, replace
[RESOURCE_NAME]
with"managementnet"
. - Add the following property to managementnet.tf:
Unlike an auto-mode network, a custom mode network does not automatically create a subnetwork in each region. Therefore, you are setting auto_create_subnetworks to false
.
- Verify that managementnet.tf looks like this:
- To save managementnet.tf, click File > Save.
Add a subnet to managementnet
Add managementsubnet-us to the VPC network.
- Add the following resource to managementnet.tf:
- To save managementnet.tf, click File > Save.
Configure the firewall rule
Define a firewall rule to allow HTTP, SSH, RDP and ICMP traffic on managementnet.
- Add the following base code to managementnet.tf:
- In managementnet.tf, replace
[RESOURCE_TYPE]
with"google_compute_firewall"
:
- In managementnet.tf, replace
[RESOURCE_NAME]
with"managementnet-allow-http-ssh-rdp-icmp"
. - Add the following property to managementnet.tf:
- Add the following properties to managementnet.tf:
The list of allow rules specify which protocols and ports are permitted.
- Verify that your additions to managementnet.tf look like this:
- To save managementnet.tf, click File > Save.
Configure the VM instance
Define the VM instance by creating a VM instance module. A module is a reusable configuration inside a folder. You will use this module for all VM instances of this lab.
- To create a new folder inside tfnet, select the tfnet folder, and then click File > New Folder.
- Name the new folder instance.
- To create a new file inside instance, select the instance folder, and then click File > New File.
- Name the new file main.tf, and then open it.
You should have the following folder structure in Cloud Shell:
- Copy the following base code into main.tf:
- In main.tf, replace
[RESOURCE_TYPE]
with"google_compute_instance"
.
- In main.tf, replace
[RESOURCE_NAME]
withvar.instance_name
.
Because you will be using this module for all VM instances, you are defining the instance name as an input variable. This allows you to control the name of the variable from managementnet.tf. For more information about input variables, refer to the Define Input Variables documentation.
- Add the following properties to main.tf:
These properties define the zone and machine type of the instance as input variables.
- Add the following properties to main.tf:
This property defines the boot disk to use the Debian 11 OS image. Because all four VM instances will use the same image, you can hard-code this property in the module.
- Add the following properties to main.tf:
This property defines the network interface by providing the subnetwork name as an input variable and the access configuration. Leaving the access configuration empty results in an ephemeral external IP address. For more information, see the Terraform documentation.
- Define the 4 input variables at the top of main.tf and verify that main.tf looks like this, including brackets
{}
:
By giving instance_type a default value, the variable is optional. The instance_name, instance_zone, and instance_subnetwork are required, and you will define them in managementnet.tf.
- To save main.tf, click File > Save.
- Add the following VM instance to managementnet.tf:
This resource is leveraging the module in the instance folder and provides the name, zone, and network as inputs. Because this instance depends on a VPC network, you are using the google_compute_subnetwork.managementsubnet-us.self_link reference to instruct Terraform to resolve these resources in a dependent order. In this case, the subnet is created before the instance.
- To save managementnet.tf, click File > Save.
Create managementnet and its resources
It's time to apply the managementnet configuration.
- Rewrite the Terraform configurations files to a canonical format and style by running the following command:
- Initialize Terraform by running the following command:
The output should look like this:
- Create an execution plan by running the following command:
The output should look like this:
Terraform determined that the following 4 resources need to be added:
Name | Description |
---|---|
managementnet | VPC network |
managementsubnet-us | Subnet of managementnet in |
managementnet_allow_http_ssh_rdp_icmp | Firewall rule to allow HTTP, SSH, RDP and ICMP |
managementnet-us-vm | VM instance in |
- Apply the desired changes by running the following command:
- Confirm the planned actions by typing:
The output should look like this:
Notice that when the VPC network is created, the firewall rule and subnet are created. After the subnet is created, the VM instance is created. That's because the firewall rule and subnet relied on the network, and the VM instance relied on the subnet through self_link
references.
Verify managementnet and its resources
In the Cloud Console, verify that the resources were created.
- In the Cloud Console, select Navigation menu > VPC network > VPC networks.
- View the managementnet VPC network with its subnetwork.
- In the left pane, click Firewall.
- View the managementnet_allow_http_ssh_rdp_icmp firewall rule for the VPC network that was created.
- Select Navigation menu > Compute Engine > VM instances.
- Note the managementnet-us-vm instance.
- Return to Cloud Shell.
Click Check my progress to verify the objective.
Task 3. Create privatenet and its resources
Create the custom-mode network privatenet along with its firewall rule and VM instance (privatenet-us-vm).
Configure privatenet
Create a new configuration and define privatenet.
- To create a new file in the tfnet folder, click File > New File.
- Name the new file privatenet.tf, and then open it.
You should have the following folder structure in Cloud Shell:
- Add the VPC network by copying the following code into privatenet.tf:
- Add the privatesubnet-us subnet resource to privatenet.tf:
- Add the privatesubnet-second-subnet subnet resource to privatenet.tf:
- To save privatenet.tf, click File > Save.
Configure the firewall rule
Define a firewall rule to allow HTTP, SSH, and RDP traffic on privatenet.
- Add the firewall resource to privatenet.tf:
- To save privatenet.tf, click File > Save.
Configure the VM instance
Use the instance module to configure privatenet-us-vm.
- Add the VM instance resource to privatenet.tf:
- To save privatenet.tf, click File > Save.
Create privatenet and its resources
It's time to apply the privatenet configuration.
- Rewrite the Terraform configurations files to a canonical format and style by running the following command:
- Initialize Terraform by running the following command:
The output should look like this:
- Create an execution plan by running the following command:
The output should look like this:
Terraform determined that the following 5 resources need to be added:
Name | Description |
---|---|
privatenet | VPC network |
privatesubnet-us | Subnet of privatenet in |
privatesubnet-second-subnet | Subnet of privatenet in |
privatenet-allow-http-ssh-rdp-icmp | Firewall rule to allow HTTP, SSH, RDP and ICMP |
privatenet-us-vm | VM instance in |
- Apply the desired changes by running the following command:
- Confirm the planned actions by typing:
The output should look like this:
Verify privatenet and its resources
In the Cloud Console, verify that the resources were created.
- In the Cloud Console, select Navigation menu > VPC network > VPC networks.
- View the privatenet VPC network with its subnetworks.
- In the left pane, click VPC network > Firewall.
- View the privatenet_allow_http_ssh_rdp_icmp firewall rule for the VPC network that was created.
- Select Navigation menu > Compute Engine > VM instances.
- Note the internal IP addresses for privatenet-us-vm.
- For managementnet-us-vm, click SSH to launch a terminal and connect.
- To test connectivity to privatenet-us-vm's internal IP address, run the following command in the SSH terminal (replacing privatenet-us-vm's internal IP address with the value noted earlier):
- Return to Cloud Shell.
Click Check my progress to verify the objective.
Task 4. Create mynetwork and its resources
Create the auto-mode network mynetwork along with its firewall rule and two VM instances (mynet_us_vm and mynet_second_vm).
Configure mynetwork
Create a new configuration and define mynetwork.
- To create a new file in the tfnet folder, click File > New File.
- Name the new file mynetwork.tf, and then open it.
You should have the following folder structure in Cloud Shell:
- Copy the following code into mynetwork.tf:
- Add the following property to mynetwork.tf:
By definition, an auto-mode network automatically creates a subnetwork in each region. Therefore, you are setting auto_create_subnetworks to true.
- Verify that mynetwork.tf looks like this:
- To save mynetwork.tf, click File > Save.
Configure the firewall rule
Define a firewall rule to allow HTTP, SSH, and RDP traffic on mynetwork.
- Add the firewall resource to mynetwork.tf:
- To save mynetwork.tf, click File > Save.
Configure the VM instance
Use the instance module to configure mynetwork-us-vm and mynetwork-second-vm.
- Add the following VM instances to mynetwork.tf:
- To save mynetwork.tf, click File > Save.
Create mynetwork and its resources
It's time to apply the mynetwork configuration.
- Rewrite the Terraform configurations files to a canonical format and style by running the following command:
- Initialize Terraform by running the following command:
The output should look like this:
- Create an execution plan by running the following command:
The output should look like this:
Terraform determined that the following 4 resources need to be added:
Name | Description |
---|---|
mynetwork | VPC network |
mynetwork-allow-http-ssh-rdp-icmp | Firewall rule to allow HTTP, SSH, RDP and ICMP |
mynet-us-vm | VM instance in |
mynet-second-vm | VM instance in |
- Apply the desired changes by running the following command:
- Confirm the planned actions by typing:
The output should look like this:
Verify mynetwork and its resources
In the Cloud Console, verify that the resources were created.
- In the Cloud Console, select Navigation menu > VPC network > VPC networks.
- View the mynetwork VPC network with its subnetworks.
- In the left pane, click Firewall.
- View the mynetwork-allow-http-ssh-rdp-icmp firewall rule for the VPC network that was created.
- Select Navigation menu > Compute Engine > VM instances.
- View the mynet-us-vm and mynet-second-vm instances.
- Note the internal IP addresses for mynet-second-vm.
- For mynet-us-vm, click SSH to launch a terminal and connect.
- To test connectivity to mynet-second-vm's internal IP address, run the following command in the SSH terminal (replacing mynet-second-vm's internal IP address with the value noted earlier):
Click Check my progress to verify the objective.
Congratulations!
This concludes this self-paced lab, Automate the Deployment of Networks Using Terraform.
In this lab, you created Terraform configurations and modules to automate the deployment of a custom network. As the configuration changes, Terraform can determine what changed and create incremental execution plans, which allows you to build your overall configuration step-by-step.
The instance module allowed you to re-use the same resource configuration for multiple resources while providing properties as input variables. You can leverage the configurations and modules that you created as a starting point for future deployments.
Google Cloud training and certification
...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.
Manual Last Updated January 19, 2024
Lab Last Tested January 19, 2024
Copyright 2024 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.