ComputeRouterNAT

Property Value
Google Cloud Service Name Compute Engine
Google Cloud Service Documentation /compute/docs/
Google Cloud REST Resource Name v1.routers
Google Cloud REST Resource Documentation /compute/docs/reference/rest/v1/routers
Config Connector Resource Short Names gcpcomputerouternat
gcpcomputerouternats
computerouternat
Config Connector Service Name compute.googleapis.com
Config Connector Resource Fully Qualified Name computerouternats.compute.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember No
Config Connector Default Average Reconcile Interval In Seconds 600

Custom Resource Definition Properties

Annotations

Fields
cnrm.cloud.google.com/project-id

Spec

Schema

drainNatIps:
- external: string
  name: string
  namespace: string
enableDynamicPortAllocation: boolean
enableEndpointIndependentMapping: boolean
icmpIdleTimeoutSec: integer
logConfig:
  enable: boolean
  filter: string
maxPortsPerVm: integer
minPortsPerVm: integer
natIpAllocateOption: string
natIps:
- external: string
  name: string
  namespace: string
region: string
resourceID: string
routerRef:
  external: string
  name: string
  namespace: string
rules:
- action:
    sourceNatActiveIpsRefs:
    - external: string
      name: string
      namespace: string
    sourceNatDrainIpsRefs:
    - external: string
      name: string
      namespace: string
  description: string
  match: string
  ruleNumber: integer
sourceSubnetworkIpRangesToNat: string
subnetwork:
- secondaryIpRangeNames:
  - string
  sourceIpRangesToNat:
  - string
  subnetworkRef:
    external: string
    name: string
    namespace: string
tcpEstablishedIdleTimeoutSec: integer
tcpTimeWaitTimeoutSec: integer
tcpTransitoryIdleTimeoutSec: integer
udpIdleTimeoutSec: integer
Fields

drainNatIps

Optional

list (object)

drainNatIps[]

Optional

object

A list of IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT.

drainNatIps[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

drainNatIps[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

drainNatIps[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

enableDynamicPortAllocation

Optional

boolean

Enable Dynamic Port Allocation. If minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32. If minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config. If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm. If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config. Mutually exclusive with enableEndpointIndependentMapping.

enableEndpointIndependentMapping

Optional

boolean

Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs).

icmpIdleTimeoutSec

Optional

integer

Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.

logConfig

Optional

object

Configuration for logging on NAT.

logConfig.enable

Required*

boolean

Indicates whether or not to export logs.

logConfig.filter

Required*

string

Specifies the desired filtering of logs on this NAT. Possible values: ["ERRORS_ONLY", "TRANSLATIONS_ONLY", "ALL"].

maxPortsPerVm

Optional

integer

Maximum number of ports allocated to a VM from this NAT. This field can only be set when enableDynamicPortAllocation is enabled.

minPortsPerVm

Optional

integer

Minimum number of ports allocated to a VM from this NAT.

natIpAllocateOption

Required

string

How external IPs should be allocated for this NAT. Valid values are 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"].

natIps

Optional

list (object)

natIps[]

Optional

object

NAT IPs. Only valid if natIpAllocateOption is set to MANUAL_ONLY.

natIps[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

natIps[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

natIps[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

region

Required

string

Immutable. Region where the router and NAT reside.

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

routerRef

Required

object

The Cloud Router in which this NAT will be configured.

routerRef.external

Optional

string

Allowed value: The `name` field of a `ComputeRouter` resource.

routerRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

routerRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules

Optional

list (object)

A list of rules associated with this NAT.

rules[]

Optional

object

rules[].action

Optional

object

The action to be enforced for traffic that matches this rule.

rules[].action.sourceNatActiveIpsRefs

Optional

list (object)

rules[].action.sourceNatActiveIpsRefs[]

Optional

object

A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.

rules[].action.sourceNatActiveIpsRefs[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

rules[].action.sourceNatActiveIpsRefs[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

rules[].action.sourceNatActiveIpsRefs[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules[].action.sourceNatDrainIpsRefs

Optional

list (object)

rules[].action.sourceNatDrainIpsRefs[]

Optional

object

A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.

rules[].action.sourceNatDrainIpsRefs[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

rules[].action.sourceNatDrainIpsRefs[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

rules[].action.sourceNatDrainIpsRefs[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules[].description

Optional

string

An optional description of this rule.

rules[].match

Required*

string

CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding action is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == 'https://networkconnectivity.googleapis.com/v1alpha1/projects/my-project/global/hub/hub-1'".

rules[].ruleNumber

Required*

integer

An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.

sourceSubnetworkIpRangesToNat

Required

string

How NAT should be configured per Subnetwork. If 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the IP ranges in every Subnetwork are allowed to Nat. If 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP ranges in every Subnetwork are allowed to Nat. 'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat (specified in the field subnetwork below). Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"].

subnetwork

Optional

list (object)

One or more subnetwork NAT configurations. Only used if 'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS'.

subnetwork[]

Optional

object

subnetwork[].secondaryIpRangeNames

Optional

list (string)

List of the secondary ranges of the subnetwork that are allowed to use NAT. This can be populated only if 'LIST_OF_SECONDARY_IP_RANGES' is one of the values in sourceIpRangesToNat.

subnetwork[].secondaryIpRangeNames[]

Optional

string

subnetwork[].sourceIpRangesToNat

Required*

list (string)

List of options for which source IPs in the subnetwork should have NAT enabled. Supported values include: 'ALL_IP_RANGES', 'LIST_OF_SECONDARY_IP_RANGES', 'PRIMARY_IP_RANGE'.

subnetwork[].sourceIpRangesToNat[]

Required*

string

subnetwork[].subnetworkRef

Required*

object

The subnetwork to NAT.

subnetwork[].subnetworkRef.external

Optional

string

Allowed value: The `selfLink` field of a `ComputeSubnetwork` resource.

subnetwork[].subnetworkRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

subnetwork[].subnetworkRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

tcpEstablishedIdleTimeoutSec

Optional

integer

Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.

tcpTimeWaitTimeoutSec

Optional

integer

Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.

tcpTransitoryIdleTimeoutSec

Optional

integer

Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.

udpIdleTimeoutSec

Optional

integer

Timeout (in seconds) for UDP connections. Defaults to 30s if not set.

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
observedGeneration: integer
Fields
conditions

list (object)

Conditions represent the latest available observation of the resource's current state.
conditions[]

object
conditions[].lastTransitionTime

string

Last time the condition transitioned from one status to another.
conditions[].message

string

Human-readable message indicating details about last transition.
conditions[].reason

string

Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status

string

Status is the status of the condition. Can be True, False, Unknown.
conditions[].type

string

Type is the type of the condition.
observedGeneration

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

Sample YAML(s)

Router Nat For All Subnets

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouterNAT
metadata:
  name: computerouternat-sample-forallsubnets
spec:
  region: us-west1
  routerRef:
    name: computerouternat-dep-forallsubnets
  natIpAllocateOption: AUTO_ONLY
  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeNetwork
metadata:
  labels:
    label-one: "value-one"
  name: computerouternat-dep-forallsubnets
spec:
  routingMode: REGIONAL
  autoCreateSubnetworks: false
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouter
metadata:
  name: computerouternat-dep-forallsubnets
spec:
  description: example router description
  region: us-west1
  networkRef:
    name: computerouternat-dep-forallsubnets

Router Nat For List Of Subnets

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouterNAT
metadata:
  name: computerouternat-sample-forlistofsubnets
spec:
  region: us-west1
  natIpAllocateOption: AUTO_ONLY
  routerRef:
    name: computerouternat-dep-forlistofsubnets
  sourceSubnetworkIpRangesToNat: LIST_OF_SUBNETWORKS
  subnetwork:
  - subnetworkRef:
      name: computerouternat-dep-forlistofsubnets
    sourceIpRangesToNat:
    - ALL_IP_RANGES
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeNetwork
metadata:
  labels:
    label-one: "value-one"
  name: computerouternat-dep-forlistofsubnets
spec:
  routingMode: REGIONAL
  autoCreateSubnetworks: false
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouter
metadata:
  name: computerouternat-dep-forlistofsubnets
spec:
  description: example router description
  region: us-west1
  networkRef:
    name: computerouternat-dep-forlistofsubnets
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSubnetwork
metadata:
  labels:
    label-one: "value-one"
  name: computerouternat-dep-forlistofsubnets
spec:
  description: My subnet
  ipCidrRange: 10.1.0.0/16
  region: us-west1
  networkRef:
    name: computerouternat-dep-forlistofsubnets

Router Nat With Manual Nat Ips

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouterNAT
metadata:
  name: computerouternat-sample-withmanualnatips
spec:
  region: us-west1
  routerRef:
    name: computerouternat-dep-withmanualnatips
  natIpAllocateOption: MANUAL_ONLY
  natIps:
  - name: computerouternat-dep-withmanualnatips
  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: computerouternat-dep-withmanualnatips
spec:
  location: us-west1
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeNetwork
metadata:
  labels:
    label-one: "value-one"
  name: computerouternat-dep-withmanualnatips
spec:
  routingMode: REGIONAL
  autoCreateSubnetworks: false
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouter
metadata:
  name: computerouternat-dep-withmanualnatips
spec:
  description: example router description
  region: us-west1
  networkRef:
    name: computerouternat-dep-withmanualnatips

Router Nat With Rules

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouterNAT
metadata:
  name: computerouternat-sample-withrules
spec:
  region: us-west1
  routerRef:
    name: computerouternat-dep-withrules
  natIpAllocateOption: MANUAL_ONLY
  natIps:
  - name: computerouternat-dep1-withrules
  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES
  rules:
    - ruleNumber: 100
      description: nat rule examples
      match: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')"
      action:
        sourceNatActiveIpsRefs:
          - name: computerouternat-dep2-withrules
          - name: computerouternat-dep3-withrules
  enableEndpointIndependentMapping: false
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: computerouternat-dep1-withrules
spec:
  location: us-west1
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: computerouternat-dep2-withrules
spec:
  location: us-west1
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: computerouternat-dep3-withrules
spec:
  location: us-west1
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeNetwork
metadata:
  name: computerouternat-dep-withrules
spec:
  routingMode: REGIONAL
  autoCreateSubnetworks: false
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouter
metadata:
  name: computerouternat-dep-withrules
spec:
  description: example router
  region: us-west1
  networkRef:
    name: computerouternat-dep-withrules