Skip to content

feat: support multi-area and regional hub-spoke topologies - #66

Merged
lweberru merged 11 commits into
mainfrom
feat/multi-area-regional-hub-spoke
Sep 25, 2026
Merged

lweberru merged 11 commits into
mainfrom
feat/multi-area-regional-hub-spoke

Conversation

@lweberru

@lweberru lweberru commented Aug 31, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • add stable, explicit network-area selection for connectivity consumers and complete scenario configurations
  • provide regulated/shared, finance/research, and three-tenant isolation examples, with documented private shared-service constraints across SNAs
  • create a dedicated firewall per network area with independent LAN/WAN settings while preserving the legacy single-firewall input
  • add a single-stack eu01/eu02 regional topology with matching connectivity hubs, landing zones, Platform Kubernetes clusters, and aggregated regional outputs
  • document scenarios and provider-region boundaries

Validation

  • STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu test -filter=tests/multi_area.tftest.hcl
  • STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-finance-research.tfvars -no-color
  • STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-tenant-isolation.tfvars -no-color
  • STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-multi-region.tfvars -no-color
  • git diff --check

Closes #63

…nal-hub-spoke

# Conflicts:
#	CODEOWNERS
#	src/main.tf
#	src/modules/connectivity/3-external-network.tf
#	src/modules/connectivity/README.md
@lweberru
lweberru requested a review from dweezl as a code owner September 21, 2026 07:26
@lweberru

Copy link
Copy Markdown
Collaborator Author

Merged current main into this branch and resolved the four conflicts while preserving the multi-area/multi-region implementation. Local validation on commit 40c5346: tofu fmt -check -recursive, all module tofu validate runs, TFLint v0.60.0, all configuration tests (7 passed), and authenticated plans for finance/research, tenant isolation, and multi-region all pass. Generated Terraform documentation was refreshed with terraform-docs v0.24.0.

@lweberru
lweberru enabled auto-merge (squash) September 21, 2026 07:30
LembDo
LembDo previously requested changes Sep 22, 2026
Comment thread src/main.tf Outdated
Comment thread src/main.tf
firewall_admin_password = var.firewall_admin_password
}

module "connectivity_eu01" {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

firewall credentials are missing

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 2264b28. The eu01 connectivity module now receives firewall_admin_endpoint, firewall_admin_username, and firewall_admin_password.

Comment thread src/main.tf
}
}

variable "firewall_admin_endpoint" {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 2264b28. firewall_admin_endpoint is now used for the primary HA configuration and falls back to the firewall public IP when unset.

Comment thread src/modules/connectivity/1-network-area.tf
Comment thread src/main.tf Outdated

owner_email = var.owner_email
naming_pattern = "${var.company_code}-pltfm-hub-prod"
naming_pattern = coalesce(var.connectivity.naming_pattern, "${var.company_code}-pltfm-connectivity")

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was the suffix changed? This will change existing landing zone project names.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 2264b28. Restored the legacy ${company_code}-pltfm-hub-prod fallback and preserved unsuffixed names for the default area. Named multi-area resources continue to use their area suffix.

Comment thread src/modules/connectivity/2-project.tf Outdated
Comment thread src/variables.tf
@lweberru
lweberru requested review from LembDo and removed request for mahauber and simpe00 September 22, 2026 10:04
@lweberru
lweberru dismissed LembDo’s stale review September 25, 2026 08:05

Vorschläge wurden umgesetzt.

@lweberru
lweberru removed the request for review from LembDo September 25, 2026 08:05
@lweberru
lweberru merged commit 2161871 into main Sep 25, 2026
4 checks passed
@lweberru
lweberru deleted the feat/multi-area-regional-hub-spoke branch September 25, 2026 08:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support multi-area firewalls and single-stack multi-region connectivity

2 participants