This page describes how to add a tunnel from one VPN gateway to another.
Generate a PSK
A PSK (Pre-Shared Key) is a shared secret password that is used to authenticate and encrypt communication between two devices. It is a form of symmetric encryption.
Use the following methods to generate a strong 32-character pre-shared key.
OpenSSL
For more information about OpenSSL, see https://www.openssl.org/. On a Linux or macOS system, run the following OpenSSL command:
openssl rand -base64 24
/dev/urandom
On a Linux or macOS system, you can also use /dev/urandom as a pseudorandom
source to generate a pre-shared key:
On Linux or macOS, send the random input to
base64:head -c 24 /dev/urandom | base64
Pass the random input through a hashing function, such as
sha256:On Linux:
head -c 4096 /dev/urandom | sha256sum | cut -b1-32
On macOS:
head -c 4096 /dev/urandom | openssl sha256 | cut -b1-32
JavaScript
Generate the pre-shared key directly in a document by using JavaScript with the W3C Web Cryptography API. For more information, see https://www.w3.org/TR/WebCryptoAPI/#Crypto-method-getRandomValues
This API uses the
Crypto.getRandomValues() method detailed here: https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
which provides a cryptographically sound way of generating a pre-shared key.
The following code creates an array of 24 random bytes, and then base64 encodes those bytes to produce a random 32-character string:
var a = new Uint8Array(24); window.crypto.getRandomValues(a); console.log(btoa(String.fromCharCode.apply(null, a)));
Create the secret
Create a secret with a PSK key:
kubectl --kubeconfig ORG_ADMIN_CLUSTER_KUBECONFIG create secret -n platform generic PSK_NAME --from-literal=psk=PSK
Replace the following:
ORG_ADMIN_CLUSTER_KUBECONFIG: the org admin cluster's kubeconfig path.PSK_NAME: The name of the PSK key.PSK: The value of the PSK key.
Create a VPN tunnel
Reference the VPNGateway, PeerGateway, VPNBGPPeer, and Secret resources
created in the previous steps to create the tunnel.
kubectl --kubeconfig ORG_ADMIN_CLUSTER_KUBECONFIG create -n platform -f - <<EOF
apiVersion: networking.gdc.goog/v1
kind: VPNTunnel
metadata:
name: VPN_TUNNEL_NAME
spec:
vpnInterface:
name: VPN_GW_NAME
namespace: platform
interface: VPN_INTERFACE_NAME
peerInterface:
name: PEER_GW_NAME
namespace: platform
interface: PEER_INTERFACE_NAME
vpnBGPPeer:
name: VPN_BGP_PEER_NAME
namespace: platform
ikeKey:
name: PSK_NAME
namespace: platform
EOF
Replace the following:
ORG_ADMIN_CLUSTER_KUBECONFIG: the org admin cluster's kubeconfig path.VPN_TUNNEL_NAME: the name of the VPN tunnel being used.VPN_GW_NAME: the name of the VPN gateway.VPN_INTERFACE_NAME: the name of the VPN interface.PEER_GW_NAME: the name of the peer VPN gateway.PEER_INTERFACE_NAME: the name of the peer VPN gateway interface.VPN_BGP_PEER_NAME: the name of the VPN BGP peer. For more information, see Create a VPN BGP session.PSK_NAME: the name of the PSK you created in Generate a PSK.
Verify that the VPN_TUNNEL_NAME object was correctly reconciled by examining the Status field.
Get the details of the VPN tunnel:
kubectl --kubeconfig ORG_ADMIN_CLUSTER_KUBECONFIG describe -n platform vpntunnel VPN_TUNNEL_NAME
Examine the output, it must look similar to the following example:
Status:
Conditions:
Last Transition Time: 2024-05-10T00:33:31Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: Reconciled
Last Transition Time: 2024-05-10T00:33:31Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: Ready
Last Transition Time: 2024-05-10T00:33:31Z
Message: Tunnel is established.
Observed Generation: 1
Reason: Ready
Status: True
Type: TunnelEstablished
State: Established
The VPNGateway, PeerGateway, and VPNBGPPeer objects must have updated statuses after being referenced by a VPNTunnel. For example, if you verify that the VPNBGPPeer was correctly reconciled again, you should see updated status values:
Get the details of the VPNBGPPeer object:
kubectl --kubeconfig ORG_ADMIN_CLUSTER_KUBECONFIG describe -n platform vpnbgppeer VPN_BGP_PEER_NAME
Examine the output, the status values should now be updated:
Status:
Advertised:
Prefix: 10.0.0.16/28
Prefix: 10.0.1.32/27
Prefix: 172.16.0.0/14
Prefix: 172.20.0.0/17
Prefix: 172.20.128.0/17
Prefix: 2002:4860:100e:fa00::/58
Conditions:
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: ValidIPs
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: TunnelsAttached
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: Reconciled
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: AdvertisedRoutesReady
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: ReceivedRoutesValid
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: ReceivedRoutesReady
Last Transition Time: 2024-05-10T00:36:38Z
Message: Ready
Observed Generation: 1
Reason: Ready
Status: True
Type: Ready
Received:
Prefix: 192.168.100.0/24
Prefix: 193.188.200.0/24
State: Established