GCP to OCI VPN Terraform

gcp_oci.tf

locals {
  bgp_subnets = [
    for i in range(2) : cidrsubnet("169.254.125.0/24", 7, i + 1) # skip range 0 to avoid 169.254.125.0
  ]

  bgp_ip_ranges = [
    for net in local.bgp_subnets : {
      net   = net
      addrs = [for i in range(2) : cidrhost(net, i)]
    }
  ]

  gcp_asn      = 64514 # oci vpn generates its ASN
  gcp_ip_index = 0 # oci only supports connecting from a single IP

  active_tunnels = 2
}

module "vpn_gcp_to_oci" {
  source  = "terraform-google-modules/vpn/google//modules/vpn_ha"
  version = "~> 1.2"
  name    = "oke-toronto"

  project_id = data.google_project.project.project_id
  network    = google_compute_network.gke.id
  region     = "us-central1"

  peer_external_gateway = {
    redundancy_type = "TWO_IPS_REDUNDANCY"
    interfaces      = [
      for i, tunnel in data.oci_core_ipsec_connection_tunnels.oci_to_gcp.ip_sec_connection_tunnels :
      {
        id         = i
        ip_address = tunnel.vpn_ip
      }
    ]
  }

  router_asn = local.gcp_asn

  tunnels = {
    for i, oci_tunnel in oci_core_ipsec_connection_tunnel_management.oci_to_gcp :
    "oci-${i}" => {
      bgp_peer = {
        address = local.bgp_ip_ranges[i].addrs[1]
        asn     = oci_tunnel.bgp_session_info[0].oracle_bgp_asn
      }
      bgp_peer_options                = null
      bgp_session_range               = local.bgp_ip_ranges[i].net # GCP also uses the IP provided in the range
      ike_version                     = 2
      vpn_gateway_interface           = local.gcp_ip_index
      peer_external_gateway_interface = i
      shared_secret                   = "" # tf generated secret (module.vpn_gcp_to_oci.random_secret)
    }
  }
}

resource oci_core_cpe oci_to_gcp {
  compartment_id = local.compartment_id
  display_name   = "gke-usce1-gateway-${local.gcp_ip_index}"
  ip_address     = module.vpn_gcp_to_oci.gateway[0].vpn_interfaces[local.gcp_ip_index].ip_address
}

resource "oci_core_ipsec" "oci_to_gcp" {
  display_name   = "gke-usce1"
  compartment_id = local.compartment_id
  cpe_id         = oci_core_cpe.oci_to_gcp.id
  drg_id         = module.oke.drg_id
  static_routes  = ["169.254.255.255/32"] # FIXME: https://github.com/oracle/terraform-provider-oci/issues/1509

}

data "oci_core_ipsec_connection_tunnels" "oci_to_gcp" {
  ipsec_id = oci_core_ipsec.oci_to_gcp.id
}

resource "oci_core_ipsec_connection_tunnel_management" "oci_to_gcp" {
  count     = local.active_tunnels
  ipsec_id  = oci_core_ipsec.oci_to_gcp.id
  tunnel_id = data.oci_core_ipsec_connection_tunnels.oci_to_gcp.ip_sec_connection_tunnels[count.index].id
  routing   = "BGP"

  bgp_session_info {
    customer_bgp_asn      = local.gcp_asn
    customer_interface_ip = "${local.bgp_ip_ranges[count.index].addrs[0]}/31"
    oracle_interface_ip   = "${local.bgp_ip_ranges[count.index].addrs[1]}/31"
  }
  display_name = "gke-${count.index}"

  shared_secret = module.vpn_gcp_to_oci.random_secret
  ike_version   = "V2"
}