ComputeRouterNAT

Property Value
Google Cloud Service Name Compute Engine
Google Cloud Service Documentation /compute/docs/
Google Cloud REST Resource Name v1.routers
Google Cloud REST Resource Documentation /compute/docs/reference/rest/v1/routers
Config Connector Resource Short Names gcpcomputerouternat
gcpcomputerouternats
computerouternat
Config Connector Service Name compute.googleapis.com
Config Connector Resource Fully Qualified Name computerouternats.compute.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember No
Config Connector Default Average Reconcile Interval In Seconds 600

Custom Resource Definition Properties

Annotations

Fields
cnrm.cloud.google.com/project-id

Spec

Schema

drainNatIps: - external: string  name: string  namespace: string enableDynamicPortAllocation: boolean enableEndpointIndependentMapping: boolean icmpIdleTimeoutSec: integer logConfig:  enable: boolean  filter: string maxPortsPerVm: integer minPortsPerVm: integer natIpAllocateOption: string natIps: - external: string  name: string  namespace: string region: string resourceID: string routerRef:  external: string  name: string  namespace: string rules: - action:  sourceNatActiveIpsRefs:  - external: string  name: string  namespace: string  sourceNatDrainIpsRefs:  - external: string  name: string  namespace: string  description: string  match: string  ruleNumber: integer sourceSubnetworkIpRangesToNat: string subnetwork: - secondaryIpRangeNames:  - string  sourceIpRangesToNat:  - string  subnetworkRef:  external: string  name: string  namespace: string tcpEstablishedIdleTimeoutSec: integer tcpTimeWaitTimeoutSec: integer tcpTransitoryIdleTimeoutSec: integer udpIdleTimeoutSec: integer
Fields

drainNatIps

Optional

list (object)

drainNatIps[]

Optional

object

A list of IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT.

drainNatIps[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

drainNatIps[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

drainNatIps[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

enableDynamicPortAllocation

Optional

boolean

Enable Dynamic Port Allocation. If minPortsPerVm is set, minPortsPerVm must be set to a power of two greater than or equal to 32. If minPortsPerVm is not set, a minimum of 32 ports will be allocated to a VM from this NAT config. If maxPortsPerVm is set, maxPortsPerVm must be set to a power of two greater than minPortsPerVm. If maxPortsPerVm is not set, a maximum of 65536 ports will be allocated to a VM from this NAT config. Mutually exclusive with enableEndpointIndependentMapping.

enableEndpointIndependentMapping

Optional

boolean

Specifies if endpoint independent mapping is enabled. This is enabled by default. For more information see the [official documentation](https://cloud.google.com/nat/docs/overview#specs-rfcs).

icmpIdleTimeoutSec

Optional

integer

Timeout (in seconds) for ICMP connections. Defaults to 30s if not set.

logConfig

Optional

object

Configuration for logging on NAT.

logConfig.enable

Required*

boolean

Indicates whether or not to export logs.

logConfig.filter

Required*

string

Specifies the desired filtering of logs on this NAT. Possible values: ["ERRORS_ONLY", "TRANSLATIONS_ONLY", "ALL"].

maxPortsPerVm

Optional

integer

Maximum number of ports allocated to a VM from this NAT. This field can only be set when enableDynamicPortAllocation is enabled.

minPortsPerVm

Optional

integer

Minimum number of ports allocated to a VM from this NAT.

natIpAllocateOption

Required

string

How external IPs should be allocated for this NAT. Valid values are 'AUTO_ONLY' for only allowing NAT IPs allocated by Google Cloud Platform, or 'MANUAL_ONLY' for only user-allocated NAT IP addresses. Possible values: ["MANUAL_ONLY", "AUTO_ONLY"].

natIps

Optional

list (object)

natIps[]

Optional

object

NAT IPs. Only valid if natIpAllocateOption is set to MANUAL_ONLY.

natIps[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

natIps[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

natIps[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

region

Required

string

Immutable. Region where the router and NAT reside.

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

routerRef

Required

object

The Cloud Router in which this NAT will be configured.

routerRef.external

Optional

string

Allowed value: The `name` field of a `ComputeRouter` resource.

routerRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

routerRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules

Optional

list (object)

A list of rules associated with this NAT.

rules[]

Optional

object

rules[].action

Optional

object

The action to be enforced for traffic that matches this rule.

rules[].action.sourceNatActiveIpsRefs

Optional

list (object)

rules[].action.sourceNatActiveIpsRefs[]

Optional

object

A list of URLs of the IP resources used for this NAT rule. These IP addresses must be valid static external IP addresses assigned to the project. This field is used for public NAT.

rules[].action.sourceNatActiveIpsRefs[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

rules[].action.sourceNatActiveIpsRefs[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

rules[].action.sourceNatActiveIpsRefs[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules[].action.sourceNatDrainIpsRefs

Optional

list (object)

rules[].action.sourceNatDrainIpsRefs[]

Optional

object

A list of URLs of the IP resources to be drained. These IPs must be valid static external IPs that have been assigned to the NAT. These IPs should be used for updating/patching a NAT rule only. This field is used for public NAT.

rules[].action.sourceNatDrainIpsRefs[].external

Optional

string

Allowed value: The `selfLink` field of a `ComputeAddress` resource.

rules[].action.sourceNatDrainIpsRefs[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

rules[].action.sourceNatDrainIpsRefs[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

rules[].description

Optional

string

An optional description of this rule.

rules[].match

Required*

string

CEL expression that specifies the match condition that egress traffic from a VM is evaluated against. If it evaluates to true, the corresponding action is enforced. The following examples are valid match expressions for public NAT: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')" "destination.ip == '1.1.0.1' || destination.ip == '8.8.8.8'" The following example is a valid match expression for private NAT: "nexthop.hub == 'https://networkconnectivity.googleapis.com/v1alpha1/projects/my-project/global/hub/hub-1'".

rules[].ruleNumber

Required*

integer

An integer uniquely identifying a rule in the list. The rule number must be a positive value between 0 and 65000, and must be unique among rules within a NAT.

sourceSubnetworkIpRangesToNat

Required

string

How NAT should be configured per Subnetwork. If 'ALL_SUBNETWORKS_ALL_IP_RANGES', all of the IP ranges in every Subnetwork are allowed to Nat. If 'ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES', all of the primary IP ranges in every Subnetwork are allowed to Nat. 'LIST_OF_SUBNETWORKS': A list of Subnetworks are allowed to Nat (specified in the field subnetwork below). Note that if this field contains ALL_SUBNETWORKS_ALL_IP_RANGES or ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, then there should not be any other RouterNat section in any Router for this network in this region. Possible values: ["ALL_SUBNETWORKS_ALL_IP_RANGES", "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES", "LIST_OF_SUBNETWORKS"].

subnetwork

Optional

list (object)

One or more subnetwork NAT configurations. Only used if 'source_subnetwork_ip_ranges_to_nat' is set to 'LIST_OF_SUBNETWORKS'.

subnetwork[]

Optional

object

subnetwork[].secondaryIpRangeNames

Optional

list (string)

List of the secondary ranges of the subnetwork that are allowed to use NAT. This can be populated only if 'LIST_OF_SECONDARY_IP_RANGES' is one of the values in sourceIpRangesToNat.

subnetwork[].secondaryIpRangeNames[]

Optional

string

subnetwork[].sourceIpRangesToNat

Required*

list (string)

List of options for which source IPs in the subnetwork should have NAT enabled. Supported values include: 'ALL_IP_RANGES', 'LIST_OF_SECONDARY_IP_RANGES', 'PRIMARY_IP_RANGE'.

subnetwork[].sourceIpRangesToNat[]

Required*

string

subnetwork[].subnetworkRef

Required*

object

The subnetwork to NAT.

subnetwork[].subnetworkRef.external

Optional

string

Allowed value: The `selfLink` field of a `ComputeSubnetwork` resource.

subnetwork[].subnetworkRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

subnetwork[].subnetworkRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

tcpEstablishedIdleTimeoutSec

Optional

integer

Timeout (in seconds) for TCP established connections. Defaults to 1200s if not set.

tcpTimeWaitTimeoutSec

Optional

integer

Timeout (in seconds) for TCP connections that are in TIME_WAIT state. Defaults to 120s if not set.

tcpTransitoryIdleTimeoutSec

Optional

integer

Timeout (in seconds) for TCP transitory connections. Defaults to 30s if not set.

udpIdleTimeoutSec

Optional

integer

Timeout (in seconds) for UDP connections. Defaults to 30s if not set.

* Field is required when parent field is specified

Status

Schema

conditions: - lastTransitionTime: string  message: string  reason: string  status: string  type: string observedGeneration: integer
Fields
conditions

list (object)

Conditions represent the latest available observation of the resource's current state.
conditions[]

object
conditions[].lastTransitionTime

string

Last time the condition transitioned from one status to another.
conditions[].message

string

Human-readable message indicating details about last transition.
conditions[].reason

string

Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status

string

Status is the status of the condition. Can be True, False, Unknown.
conditions[].type

string

Type is the type of the condition.
observedGeneration

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

Sample YAML(s)

Router Nat For All Subnets

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouterNAT metadata:  name: computerouternat-sample-forallsubnets spec:  region: us-west1  routerRef:  name: computerouternat-dep-forallsubnets  natIpAllocateOption: AUTO_ONLY  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeNetwork metadata:  labels:  label-one: "value-one"  name: computerouternat-dep-forallsubnets spec:  routingMode: REGIONAL  autoCreateSubnetworks: false --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouter metadata:  name: computerouternat-dep-forallsubnets spec:  description: example router description  region: us-west1  networkRef:  name: computerouternat-dep-forallsubnets

Router Nat For List Of Subnets

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouterNAT metadata:  name: computerouternat-sample-forlistofsubnets spec:  region: us-west1  natIpAllocateOption: AUTO_ONLY  routerRef:  name: computerouternat-dep-forlistofsubnets  sourceSubnetworkIpRangesToNat: LIST_OF_SUBNETWORKS  subnetwork:  - subnetworkRef:  name: computerouternat-dep-forlistofsubnets  sourceIpRangesToNat:  - ALL_IP_RANGES --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeNetwork metadata:  labels:  label-one: "value-one"  name: computerouternat-dep-forlistofsubnets spec:  routingMode: REGIONAL  autoCreateSubnetworks: false --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouter metadata:  name: computerouternat-dep-forlistofsubnets spec:  description: example router description  region: us-west1  networkRef:  name: computerouternat-dep-forlistofsubnets --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeSubnetwork metadata:  labels:  label-one: "value-one"  name: computerouternat-dep-forlistofsubnets spec:  description: My subnet  ipCidrRange: 10.1.0.0/16  region: us-west1  networkRef:  name: computerouternat-dep-forlistofsubnets

Router Nat With Manual Nat Ips

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouterNAT metadata:  name: computerouternat-sample-withmanualnatips spec:  region: us-west1  routerRef:  name: computerouternat-dep-withmanualnatips  natIpAllocateOption: MANUAL_ONLY  natIps:  - name: computerouternat-dep-withmanualnatips  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeAddress metadata:  name: computerouternat-dep-withmanualnatips spec:  location: us-west1 --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeNetwork metadata:  labels:  label-one: "value-one"  name: computerouternat-dep-withmanualnatips spec:  routingMode: REGIONAL  autoCreateSubnetworks: false --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouter metadata:  name: computerouternat-dep-withmanualnatips spec:  description: example router description  region: us-west1  networkRef:  name: computerouternat-dep-withmanualnatips

Router Nat With Rules

# Copyright 2020 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouterNAT metadata:  name: computerouternat-sample-withrules spec:  region: us-west1  routerRef:  name: computerouternat-dep-withrules  natIpAllocateOption: MANUAL_ONLY  natIps:  - name: computerouternat-dep1-withrules  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES  rules:  - ruleNumber: 100  description: nat rule examples  match: "inIpRange(destination.ip, '1.1.0.0/16') || inIpRange(destination.ip, '2.2.0.0/16')"  action:  sourceNatActiveIpsRefs:  - name: computerouternat-dep2-withrules  - name: computerouternat-dep3-withrules  enableEndpointIndependentMapping: false --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeAddress metadata:  name: computerouternat-dep1-withrules spec:  location: us-west1 --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeAddress metadata:  name: computerouternat-dep2-withrules spec:  location: us-west1 --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeAddress metadata:  name: computerouternat-dep3-withrules spec:  location: us-west1 --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeNetwork metadata:  name: computerouternat-dep-withrules spec:  routingMode: REGIONAL  autoCreateSubnetworks: false --- apiVersion: compute.cnrm.cloud.google.com/v1beta1 kind: ComputeRouter metadata:  name: computerouternat-dep-withrules spec:  description: example router  region: us-west1  networkRef:  name: computerouternat-dep-withrules