u/aws2gcp

The NIMBY is strong with this one

Oh funny. I had a zipper on a carry-on fixed in Portland, and the guy running the shop was definitely Polish.

Yeah, I would recommend focusing on specific things. This really reads as someone who stumbled in tech and did “this and that”. it would be difficult to pick out the strong points, and other candidates will likely look more appealing

I don’t think there’s any interoperability between Cloud NAT and VPN. Cloud NAT can only NAT traffic from the local VPC to Internet.

You’d probably have to implement a third-party network appliance (ie Palo Alto) to do VPN termination and Nat on the same device

Yeah, I wish this was explained better for beginners. Basically, looping over any resource needs a key defined. Count simply uses the index in the array, while for_each requires you to define one.

It’s entirely possible to accidentally delete resources with for_each if the keying hasn’t been handled properly. Like I’ll see people use a VM name as key, which doesn’t take into account scenarios where two VMs are same name but different zone

That sounds like one of the mistakes I did too early on: storing the state file in the repo, because I wasn’t quite sure how to use repeatable code when the state file is in object storage. That very much went along with not using workspaces, although I quickly learned those in the certification process

Terraform is very comparable to a Jinja template - it’s really at the end of the day a config file with some basic programming logic to handle conditional or repeatable statements.

Yeah, and just understanding the whole count vs for_each dilemna

Understanding the state file was an issue for me. With Ansible, the state is whatever the server/device is in. There’s no concept of a “cache”, which basically what a terraform state file basically is.

I didn’t recognize him in once upon a time. Granted he was 60 and anyone looks bad compared to Brad and Leo

Interesting out of all the stores listed there, only Walgreens still exists really

Just had this happen on an iPad Pro. Latest iOS, coming off fresh re-install. It had been previously enrolled. Fixed by re-installing Company Portal app.

Yep, can do this to build and push to Container Registry, though not sure if custom Dockerfile is supported

gcloud builds submit --tag gcr.io/$(PROJECT_ID)/$(IMAGE_NAME) .

Oh OK, I think what you're saying is it must still be enabled on the subnet the PSC client VM is on when accessing Google APIs, whether using the default range of 199.36.153.x or a custom global address attached to the VPC. That is correct.

To clarify though: the problem from the original question had nothing to do with Private Google Access though or accessing Google APIs. It's a PSC between two different customers in GCP.

Hmm are you sure? I always thought of Private Service Connect and Private Google Access as two different things.

Granted, the lines blur when using a PSC forwarding rule to connect to Google APIs but in those cases the IP address is actually global and wouldn't be part of any subnet

Ahh thanks. If anything, I would have assumed the opposite, but "more consistent" is extremely vague (wasn't sure if that mean "more even" or "better disruption handling"). It's the latter.

That's not the issue. I'm using this Terraform and it works fine:

https://github.com/aws2gcp/gcp-network-terraform/tree/main/psc-endpoint

The issue is on the producer side. They want to limit access to project and network of the consumer.

Adjust routing to what?

I think he means set routes on the VM itself for certain destination IPs. That can be tricky in GCP because the default subnet mask is 255.255.255.255.

I'd suggest one of two solutions, or both:

1) global load balancer so the VMs don't need external IPs to being with

2) outbound proxy server for certain types of traffic

but unless your NAT is in a different region than the VMs

That won't work anyway; Cloud NATs is regional and by design will only accept traffic from the same region.

Routes are global, but can leverage network tags to set different next hops for different regions.

> but, if I create a VM with external IP, all outgoing traffic will, naturally, go over that IP. Can I route only some traffic, i.e. specific IPs and/or network ranges over the myrouter and the rest over the VMs external IP

Short answer is 'no'. When an external IP is assigned to an instance NIC, Cloud NAT is essentially irrelevant to that instance NIC. The route is to 'default-internet-gateway' either way.