如何通过terraform描述共享VPC并在GCP中定义其子网

Question

我为我的组织创建了两个共享的VPCs，一个用于prod，另一个用于非prod使用。

对于这些共享的VPC，我想要创建一个描述并定义子网，但是我无法为这些元素找到正确的terraform条目。

下面是我如何定义资源块来指定主机项目(并创建一个共享的VPC)：

resource "google_compute_shared_vpc_host_project" "dev-shared-shared-vpc-host" {
  provider = google.as_network_admin
  project  = google_project.dev-shared-vpc-host.project_id
}

现在，当我尝试创建子网时：

resource "google_compute_subnetwork" "dev-subnetwork" {
  provider      = google.as_network_admin
  name          = var.vpc_and_subnet_info.for_dev_env.subnetwork.name
  ip_cidr_range = var.vpc_and_subnet_info.for_dev_env.subnetwork.ip_cidr_range
  region        = var.region
  secondary_ip_range {
    range_name    = var.vpc_and_subnet_info.for_dev_env.subnetwork.secondary_ip_range.name
    ip_cidr_range = var.vpc_and_subnet_info.for_dev_env.subnetwork.secondary_ip_range.ip_cidr_range
  }
  network = google_compute_shared_vpc_host_project.dev-shared-shared-vpc-host.id
  project = google_project.dev-shared-vpc-host.id
}

我遇到了一个错误

╷
│ Error: Error creating Subnetwork: googleapi: Error 400: Invalid value for field 'resource.network': 'projects/projects/<redacted_project_id>/global/networks/<redacted_project_id>'. The URL is malformed., invalid
│
│   with google_compute_subnetwork.dev-subnetwork,
│   on networking.tf line 5, in resource "google_compute_subnetwork" "dev-subnetwork":
│    5: resource "google_compute_subnetwork" "dev-subnetwork" {
│

显然，projects/projects/..扰乱了网络参数，但在项目中，除了id之外，没有任何其他输出。对于输入参数，不存在description。但是，当我尝试手动创建共享VPC时，我可以输入一个描述，并创建一个子网。

请注意，创建常规VPCs的网络已经有了很好的文档记录，并且我上面定义的子网与它很好地工作。

编辑：

将project参数固定到project = google_project.dev-shared-vpc-host.project_id而不是id中将删除projects/projects/...网络错误，但会给出此错误：

╷
│ Error: Error creating Subnetwork: googleapi: Error 404: The resource 'projects/<redacted_project_id>/global/networks/<redacted_project_id>' was not found, notFound
│
│   with google_compute_subnetwork.dev-subnetwork,
│   on networking.tf line 5, in resource "google_compute_subnetwork" "dev-subnetwork":
│    5: resource "google_compute_subnetwork" "dev-subnetwork" {
│
╵

Answer 1

我似乎误解了通过google_compute_shared_vpc_host_project创建共享VPC，这并不是创建vpc perse，而是指定一个项目作为宿主项目，因此共享(必须预先存在的vpc )。

因此，我应该事先创建一个google_compute_network，这里是实现我在问题中想要的东西所必需的HCL：

resource "google_compute_network" "dev-vpc-network" {
  provider                = google.as_network_admin
  name                    = var.vpc_and_subnet_info.for_dev_env.vpc.name
  auto_create_subnetworks = var.vpc_and_subnet_info.for_dev_env.vpc.auto_create_subnetworks
  project                 = google_project.dev-shared-vpc-host.project_id
  description             = var.vpc_and_subnet_info.for_dev_env.vpc.description
}
resource "google_compute_shared_vpc_host_project" "dev-shared-shared-vpc-host" {
  provider = google.as_network_admin
  project  = google_project.dev-shared-vpc-host.project_id
}
resource "google_compute_subnetwork" "dev-subnetwork" {
  provider      = google.as_network_admin
  name          = var.vpc_and_subnet_info.for_dev_env.subnetwork.name
  ip_cidr_range = var.vpc_and_subnet_info.for_dev_env.subnetwork.ip_cidr_range
  region        = var.region
  secondary_ip_range {
    range_name    = var.vpc_and_subnet_info.for_dev_env.subnetwork.secondary_ip_range.name
    ip_cidr_range = var.vpc_and_subnet_info.for_dev_env.subnetwork.secondary_ip_range.ip_cidr_range
  }
  network = google_compute_network.dev-vpc-network.id
  project = google_project.dev-shared-vpc-host.project_id
}

当然，在这些示例中，我使用了在.tfvars中声明的变量来填充名称和资源块中需要的其他参数。