Enable Non-RFC 1918 Addresses in 100.64.0.0/10

[spirrello]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

It would be great to allow for creating VPC subnets on the 100.64.0.0/10 (non-rfc 1918) address space. This is a private reserved address space that can be used for internal use cases.

Error message

Error: Error creating Subnetwork: googleapi: Error 400: Invalid value for field 'resource.secondaryIpRanges[0].ipCidrRange': '100.64.0.0/22'. IpCidrRange must specify a range contained in RFC 1918 spaces., invalid

  on .terraform/modules/network-1/terraform-google-network-2.3.0/modules/subnets/main.tf line 28, in resource "google_compute_subnetwork" "subnetwork":
  28: resource "google_compute_subnetwork" "subnetwork" {

New or Affected Resource(s)

• google_compute_network

Potential Terraform Configuration

module "network-1" {
  source = "terraform-google-modules/network/google//modules/subnets-beta"
  project_id   = var.project_name
  network_name = "network-1"
  routing_mode = "REGIONAL"


  subnets = [
    {
      subnet_name               = "gke-2"
      subnet_ip                 = "10.0.2.0/24"
      subnet_region             = "us-central1"
      subnet_private_access     = "true"
      description               = "subnet for GKE"
      subnet_flow_logs          = "true"
      subnet_flow_logs_interval = "INTERVAL_10_MIN"
      subnet_flow_logs_sampling = 0.7
      subnet_flow_logs_metadata = "INCLUDE_ALL_METADATA"
    },
  ]

  secondary_ranges = {

    gke-1 = [
      {
        range_name    = "pods-1"
        ip_cidr_range = "100.64.0.0/22"
      },
      {
        range_name    = "services-1"
        ip_cidr_range = "100.64.4.0/23"
      },
    ]
  }
}

References

• #0000

[danawillow]

@spirrello do you have any pointers to docs that state this is possible in GCP today? https://cloud.google.com/vpc/docs/vpc#manually_created_subnet_ip_ranges and https://cloud.google.com/vpc/docs/using-vpc#subnet-rules both state that the subnet IP address needs to be RFC-1918.

[spirrello]

I don't have any documentation to point to but it's possible through the UI.

[danawillow]

Hey @spirrello, I'm pretty sure this should work as-is as long as you're using the beta provider (since this is a beta feature). Can you give that a try and let me know? If you do try it and it doesn't work, would you mind showing me debug logs (the API request/response is all I need) from a failed run?

[skydalriol]

FYI:

documentation is here: https://cloud.google.com/architecture/configuring-privately-used-public-ips-for-GKE

From a network point of view, it is now possible to add secondary ranges even if non RFC-1918 compliant (eg:1.1.0.0/23 for Pods on a GKE cluster).

[megan07]

I'm going to close this as it appears to be working now. If you experience any issues, please feel free to open a new issue. Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.