rage.fail

gcp-ncc-active-vpn-spoke-routes-to-onprem

explicit gcp emits RoutesTo

match (record)

{ "api": "networkconnectivity.projects.locations.spokes.list", "field": "state", "resource_type": "networkconnectivity.googleapis.com/Spoke", "value": "ACTIVE" }

where

spoke.linkedVpnTunnels[].uri is set (VPN spoke)

emit

source type	`TransitGateway`
target type	`Subnet`
source	`<NCC Hub (TransitGateway) referenced by spoke.hub>`
target	`<CIDR ranges announced via BGP by the VPN tunnel (external on-premises networks)>`

Narrative

NCC Hub {hub.name} routes to on-premises CIDR prefixes via ACTIVE VPN spoke {spoke.name}. All other ACTIVE spokes on {hub.name} can route to these BGP-announced prefixes, subject to on-premises firewall rules at the far end of the VPN tunnel.

Raw rule rules/explicit/gcp-ncc.yaml

id: gcp-ncc-active-vpn-spoke-routes-to-onprem
emits: RoutesTo
applies_to:
- gcp
match_record:
  api: networkconnectivity.projects.locations.spokes.list
  resource_type: networkconnectivity.googleapis.com/Spoke
  field: state
  value: ACTIVE
where:
- spoke.linkedVpnTunnels[].uri is set (VPN spoke)
emit:
  source_type: TransitGateway
  target_type: Subnet
  source: <NCC Hub (TransitGateway) referenced by spoke.hub>
  target: <CIDR ranges announced via BGP by the VPN tunnel (external on-premises networks)>
  api_source: networkconnectivity.projects.locations.spokes.list + compute.vpnTunnels.get
  evidence_field: spoke.linkedVpnTunnels[].uri + spoke.state=ACTIVE
  narrative: NCC Hub {hub.name} routes to on-premises CIDR prefixes via ACTIVE VPN spoke {spoke.name}.
    All other ACTIVE spokes on {hub.name} can route to these BGP-announced prefixes, subject to on-premises
    firewall rules at the far end of the VPN tunnel.