Use all potential bastion tag instead of only the first match

Author: cmd-ntrf

aws/infrastructure.tf

@@ -24,7 +24,7 @@ module "configuration" {
   sudoer_username = var.sudoer_username
   public_keys     = var.public_keys
   domain_name     = module.design.domain_name
-  bastion_tag     = module.design.bastion_tag
+  bastion_tags    = module.design.bastion_tags
   cluster_name    = var.cluster_name
   guest_passwd    = var.guest_passwd
   nb_users        = var.nb_users

azure/infrastructure.tf

@@ -24,7 +24,7 @@ module "configuration" {
   sudoer_username = var.sudoer_username
   public_keys     = var.public_keys
   domain_name     = module.design.domain_name
-  bastion_tag     = module.design.bastion_tag
+  bastion_tags    = module.design.bastion_tags
   cluster_name    = var.cluster_name
   guest_passwd    = var.guest_passwd
   nb_users        = var.nb_users

common/configuration/main.tf

@@ -24,7 +24,7 @@ variable "public_keys" {}
 
 variable "skip_upgrade" {}
 variable "puppetfile" {}
-variable "bastion_tag" {}
+variable "bastion_tags" {}
 
 resource "tls_private_key" "ssh" {
   algorithm = "ED25519"
@@ -162,7 +162,7 @@ output "ssh_key" {
 output "bastions" {
   value = {
     for host, values in local.final_inventory : host => values
-    if contains(values.tags, var.bastion_tag) && contains(values.tags, "public") && (!contains(values.tags, "pool"))
+    if length(setintersection(values.tags, var.bastion_tags)) > 0 && contains(values.tags, "public") && (!contains(values.tags, "pool"))
   }
 }
 

common/design/main.tf

@@ -52,20 +52,11 @@ locals {
 
   volume_per_instance = transpose({ for key, value in local.instance_per_volume : key => value["instances"] })
 
-  # We look for a firewall rule that allow SSH connection from the Terraform agent's ip
-  # and we memorize the corresponding tag so we can determine which instances can be used as a
+  # We look for firewall rules that allow SSH connection from the Terraform agent's ip
+  # and we memorize the corresponding tags so we can determine which instances can be used as a
   # first hop when transferring files or executing remote commands with Terraform.
-  # There are room for improvements, but we don't expect users to be very creative with
-  # firewall rules, so we are keeping the algorithm simple for now. One aspect
-  #  that could be improved:
-  # 1. We don't validate if the tag is actually present in any instance, we simply take the
-  # first value, so if there are more than one firewall rules that matches the criteria
-  # but only one that is actually active, we might select the wrong tag. It would be better
-  # to keep all firewall tags that match the criteria, then identify the intersection with
-  # instance tags and select any tag that matches.
   agent_ip = chomp(data.http.agent_ip.response_body)
-  bastion_tag = try(
-    element([
+  bastion_tags = try([
       for rule, values in var.firewall_rules :
       values.tag
       if values.ethertype == "IPv4" &&
@@ -75,9 +66,8 @@ locals {
         tonumber(split(".", strcontains(values.cidr, "/") ? cidrhost(values.cidr, 0) : values.cidr)[i]) <= tonumber(v) &&
         tonumber(split(".", strcontains(values.cidr, "/") ? cidrhost(values.cidr, -1) : values.cidr)[i]) >= tonumber(v)
       ])
-      ],
-    0),
-  "")
+    ],
+  [])
 }
 
 check "disk_space_per_tag" {

common/design/outputs.tf

@@ -18,6 +18,6 @@ output "domain_name" {
   value = local.domain_name
 }
 
-output "bastion_tag" {
-  value = local.bastion_tag
+output "bastion_tags" {
+  value = local.bastion_tags
 }

gcp/infrastructure.tf

@@ -23,7 +23,7 @@ module "configuration" {
   sudoer_username = var.sudoer_username
   public_keys     = var.public_keys
   domain_name     = module.design.domain_name
-  bastion_tag     = module.design.bastion_tag
+  bastion_tags    = module.design.bastion_tags
   cluster_name    = var.cluster_name
   guest_passwd    = var.guest_passwd
   nb_users        = var.nb_users

incus/infrastructure.tf

@@ -19,7 +19,7 @@ module "configuration" {
   sudoer_username = var.sudoer_username
   public_keys     = var.public_keys
   domain_name     = module.design.domain_name
-  bastion_tag     = module.design.bastion_tag
+  bastion_tags    = module.design.bastion_tags
   cluster_name    = var.cluster_name
   guest_passwd    = var.guest_passwd
   nb_users        = var.nb_users

openstack/infrastructure.tf

@@ -19,7 +19,7 @@ module "configuration" {
   sudoer_username = var.sudoer_username
   public_keys     = var.public_keys
   domain_name     = module.design.domain_name
-  bastion_tag     = module.design.bastion_tag
+  bastion_tags    = module.design.bastion_tags
   cluster_name    = var.cluster_name
   guest_passwd    = var.guest_passwd
   nb_users        = var.nb_users