GCVE network mode for 2-networking-b-nva stage

[eliamaldini]

Hi Team, this is a draft of a NVA stage change to add GCVE compatibility.

The code is almost ready, I'm working on the Readme file and tests....

Main changes:

• added a variable to manage the network mode
• code adaptations for simple and ncc_ra options to support the new variable
• added two new regional truted VPC
• added a new NVA deployment option to support regional VPCs
• VPC routing

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[ludoo]

I'm not sure we should have a ton of GCVE-specific resources in the network stage. But I have no idea about an alternative. Let's sit down and discuss all together.

[eliamaldini]

I'm not sure we should have a ton of GCVE-specific resources in the network stage. But I have no idea about an alternative. Let's sit down and discuss all together.

An idea could be, instead of referring to GCVE we can call the option in a generic way like "regional_trusted". It would be a design option that can be used not only for GCVE but in all the cases where regional trusted are required

[ludoo]

I'm not sure we should have a ton of GCVE-specific resources in the network stage. But I have no idea about an alternative. Let's sit down and discuss all together.

An idea could be, instead of referring to GCVE we can call the option in a generic way like "regional_trusted". It would be a design option that can be used not only for GCVE but in all the cases where regional trusted are required

Makes a lot of sense, but then would this be an additional net design or a "flavor" of the current one? And how would it combine with ncc-ra support?

[eliamaldini]

I'm not sure we should have a ton of GCVE-specific resources in the network stage. But I have no idea about an alternative. Let's sit down and discuss all together.

An idea could be, instead of referring to GCVE we can call the option in a generic way like "regional_trusted". It would be a design option that can be used not only for GCVE but in all the cases where regional trusted are required

Makes a lot of sense, but then would this be an additional net design or a "flavor" of the current one? And how would it combine with ncc-ra support?

I would leave the net experts to undersatnd if a dedicated stage is better.

GCVE mode cannot be combined with ncc-ra (regional VPC doesn't require ncc/bgp routing) if you see the code, the three net modes (simple, ncc-ra, gcve) are mutually exclusive. you can have just one of them enabled.

[ludoo]

I'm not sure we should have a ton of GCVE-specific resources in the network stage. But I have no idea about an alternative. Let's sit down and discuss all together.

An idea could be, instead of referring to GCVE we can call the option in a generic way like "regional_trusted". It would be a design option that can be used not only for GCVE but in all the cases where regional trusted are required

Makes a lot of sense, but then would this be an additional net design or a "flavor" of the current one? And how would it combine with ncc-ra support?

I would leave the net experts to undersatnd if a dedicated stage is better.

GCVE mode cannot be combined with ncc-ra (regional VPC doesn't require ncc/bgp routing) if you see the code, the three net modes (simple, ncc-ra, gcve) are mutually exclusive. you can have just one of them enabled.

sure, but the point is gcve depends on simple mode, it's not a different net mode so we need different way of expressing this

[sruffilli]

LGTM pending the highlighted changes