Skip to content

Commit 4a57e96

Browse files
sgtojsgtoj
authored
Merge pull request #16 from cruxstack/dev
feat: support user-defined cirds
2 parents 683260b + d2a211f commit 4a57e96

File tree

4 files changed

+135
-116
lines changed

4 files changed

+135
-116
lines changed

‎main.tf‎

Lines changed: 33 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -76,16 +76,17 @@ module "auth_servers" {
7676

7777
experimental = local.teleport_experimental_mode
7878

79-
dns_parent_zone_id = var.dns_parent_zone_id
80-
dns_parent_zone_name = var.dns_parent_zone_name
81-
artifacts_bucket_name = local.artifacts_bucket_name
82-
logs_bucket_name = local.logs_bucket_name
83-
vpc_id = var.vpc_id
84-
vpc_private_subnet_ids = var.vpc_private_subnet_ids
85-
vpc_public_subnet_ids = var.vpc_public_subnet_ids
86-
aws_account_id = local.aws_account_id
87-
aws_kv_namespace = local.aws_kv_namespace
88-
aws_region_name = local.aws_region_name
79+
dns_parent_zone_id = var.dns_parent_zone_id
80+
dns_parent_zone_name = var.dns_parent_zone_name
81+
artifacts_bucket_name = local.artifacts_bucket_name
82+
logs_bucket_name = local.logs_bucket_name
83+
vpc_id = var.vpc_id
84+
vpc_private_subnet_ids = var.vpc_private_subnet_ids
85+
vpc_public_subnet_ids = var.vpc_public_subnet_ids
86+
vpc_security_group_allowed_cirds = local.instance_config.auth.allowed_cirds
87+
aws_account_id = local.aws_account_id
88+
aws_kv_namespace = local.aws_kv_namespace
89+
aws_region_name = local.aws_region_name
8990

9091
context = module.teleport_cluster_label.context
9192
}
@@ -111,16 +112,17 @@ module "proxy_servers" {
111112

112113
experimental = local.teleport_experimental_mode
113114

114-
dns_parent_zone_id = var.dns_parent_zone_id
115-
dns_parent_zone_name = var.dns_parent_zone_name
116-
artifacts_bucket_name = local.artifacts_bucket_name # todo - create bucket with module
117-
logs_bucket_name = local.logs_bucket_name
118-
vpc_id = var.vpc_id
119-
vpc_private_subnet_ids = var.vpc_private_subnet_ids
120-
vpc_public_subnet_ids = var.vpc_public_subnet_ids
121-
aws_account_id = local.aws_account_id
122-
aws_kv_namespace = local.aws_kv_namespace
123-
aws_region_name = local.aws_region_name
115+
dns_parent_zone_id = var.dns_parent_zone_id
116+
dns_parent_zone_name = var.dns_parent_zone_name
117+
artifacts_bucket_name = local.artifacts_bucket_name # todo - create bucket with module
118+
logs_bucket_name = local.logs_bucket_name
119+
vpc_id = var.vpc_id
120+
vpc_private_subnet_ids = var.vpc_private_subnet_ids
121+
vpc_public_subnet_ids = var.vpc_public_subnet_ids
122+
vpc_security_group_allowed_cirds = local.instance_config.proxy.allowed_cirds
123+
aws_account_id = local.aws_account_id
124+
aws_kv_namespace = local.aws_kv_namespace
125+
aws_region_name = local.aws_region_name
124126

125127
context = module.teleport_cluster_label.context
126128
}
@@ -146,16 +148,17 @@ module "node_servers" {
146148

147149
experimental = local.teleport_experimental_mode
148150

149-
dns_parent_zone_id = var.dns_parent_zone_id
150-
dns_parent_zone_name = var.dns_parent_zone_name
151-
artifacts_bucket_name = local.artifacts_bucket_name # todo - create bucket with module
152-
logs_bucket_name = local.logs_bucket_name
153-
vpc_id = var.vpc_id
154-
vpc_private_subnet_ids = var.vpc_private_subnet_ids
155-
vpc_public_subnet_ids = var.vpc_public_subnet_ids
156-
aws_account_id = local.aws_account_id
157-
aws_kv_namespace = local.aws_kv_namespace
158-
aws_region_name = local.aws_region_name
151+
dns_parent_zone_id = var.dns_parent_zone_id
152+
dns_parent_zone_name = var.dns_parent_zone_name
153+
artifacts_bucket_name = local.artifacts_bucket_name # todo - create bucket with module
154+
logs_bucket_name = local.logs_bucket_name
155+
vpc_id = var.vpc_id
156+
vpc_private_subnet_ids = var.vpc_private_subnet_ids
157+
vpc_public_subnet_ids = var.vpc_public_subnet_ids
158+
vpc_security_group_allowed_cirds = local.instance_config.node.allowed_cirds
159+
aws_account_id = local.aws_account_id
160+
aws_kv_namespace = local.aws_kv_namespace
161+
aws_region_name = local.aws_region_name
159162

160163
context = module.teleport_cluster_label.context
161164
}

‎modules/teleport-node/main.tf‎

Lines changed: 87 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,7 @@ module "security_group" {
411411
preserve_security_group_id = true
412412
allow_all_egress = true
413413

414-
rules = [{
414+
rules = compact([{
415415
key = "group"
416416
type = "ingress"
417417
from_port = 0
@@ -422,84 +422,92 @@ module "security_group" {
422422
ipv6_cidr_blocks = []
423423
source_security_group_id = null
424424
self = true
425-
}, {
426-
key = "auth"
427-
type = "ingress"
428-
from_port = 3025
429-
to_port = 3025
430-
protocol = "tcp"
431-
description = "allow auth traffic"
432-
cidr_blocks = ["0.0.0.0/0"]
433-
ipv6_cidr_blocks = []
434-
source_security_group_id = null
435-
self = null
436-
}, {
437-
key = "node-ssh"
438-
type = "ingress"
439-
from_port = 3022
440-
to_port = 3022
441-
protocol = "tcp"
442-
description = "allow teleport node ssh"
443-
cidr_blocks = ["0.0.0.0/0"]
444-
ipv6_cidr_blocks = []
445-
source_security_group_id = null
446-
self = null
447-
}, {
448-
key = "proxy-ssh"
449-
type = "ingress"
450-
from_port = 3023
451-
to_port = 3023
452-
protocol = "tcp"
453-
description = "allow teleport proxy ssh"
454-
cidr_blocks = ["0.0.0.0/0"]
455-
ipv6_cidr_blocks = []
456-
source_security_group_id = null
457-
self = null
458-
}, {
459-
key = "proxy-reverse-ssh"
460-
type = "ingress"
461-
from_port = 3024
462-
to_port = 3024
463-
protocol = "tcp"
464-
description = "allow teleport proxy reverse-ssh"
465-
cidr_blocks = ["0.0.0.0/0"]
466-
ipv6_cidr_blocks = []
467-
source_security_group_id = null
468-
self = null
469-
}, {
470-
key = "proxy-https"
471-
type = "ingress"
472-
from_port = 443
473-
to_port = 443
474-
protocol = "tcp"
475-
description = "allow teleport proxy https"
476-
cidr_blocks = ["0.0.0.0/0"]
477-
ipv6_cidr_blocks = []
478-
source_security_group_id = null
479-
self = null
480-
}, {
481-
key = "proxy-web"
482-
type = "ingress"
483-
from_port = 3080
484-
to_port = 3080
485-
protocol = "tcp"
486-
description = "allow teleport proxy https"
487-
cidr_blocks = ["0.0.0.0/0"]
488-
ipv6_cidr_blocks = []
489-
source_security_group_id = null
490-
self = null
491-
}, {
492-
key = "node-mysql"
493-
type = "ingress"
494-
from_port = 3036
495-
to_port = 3036
496-
protocol = "tcp"
497-
description = "allow teleport proxy https"
498-
cidr_blocks = ["0.0.0.0/0"]
499-
ipv6_cidr_blocks = []
500-
source_security_group_id = null
501-
self = null
502-
}]
425+
},
426+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
427+
key = "auth"
428+
type = "ingress"
429+
from_port = 3025
430+
to_port = 3025
431+
protocol = "tcp"
432+
description = "allow auth traffic"
433+
cidr_blocks = var.vpc_security_group_allowed_cirds
434+
ipv6_cidr_blocks = []
435+
source_security_group_id = null
436+
self = null
437+
} : null,
438+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
439+
key = "node-ssh"
440+
type = "ingress"
441+
from_port = 3022
442+
to_port = 3022
443+
protocol = "tcp"
444+
description = "allow teleport node ssh"
445+
cidr_blocks = var.vpc_security_group_allowed_cirds
446+
ipv6_cidr_blocks = []
447+
source_security_group_id = null
448+
self = null
449+
} : null,
450+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
451+
key = "proxy-ssh"
452+
type = "ingress"
453+
from_port = 3023
454+
to_port = 3023
455+
protocol = "tcp"
456+
description = "allow teleport proxy ssh"
457+
cidr_blocks = var.vpc_security_group_allowed_cirds
458+
ipv6_cidr_blocks = []
459+
source_security_group_id = null
460+
self = null
461+
} : null,
462+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
463+
key = "proxy-reverse-ssh"
464+
type = "ingress"
465+
from_port = 3024
466+
to_port = 3024
467+
protocol = "tcp"
468+
description = "allow teleport proxy reverse-ssh"
469+
cidr_blocks = var.vpc_security_group_allowed_cirds
470+
ipv6_cidr_blocks = []
471+
source_security_group_id = null
472+
self = null
473+
} : null,
474+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
475+
key = "proxy-https"
476+
type = "ingress"
477+
from_port = 443
478+
to_port = 443
479+
protocol = "tcp"
480+
description = "allow teleport proxy https"
481+
cidr_blocks = var.vpc_security_group_allowed_cirds
482+
ipv6_cidr_blocks = []
483+
source_security_group_id = null
484+
self = null
485+
} : null,
486+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
487+
key = "proxy-web"
488+
type = "ingress"
489+
from_port = 3080
490+
to_port = 3080
491+
protocol = "tcp"
492+
description = "allow teleport proxy (alternative) https"
493+
cidr_blocks = var.vpc_security_group_allowed_cirds
494+
ipv6_cidr_blocks = []
495+
source_security_group_id = null
496+
self = null
497+
} : null,
498+
length(var.vpc_security_group_allowed_cirds) > 0 ? {
499+
key = "proxy-mysql"
500+
type = "ingress"
501+
from_port = 3036
502+
to_port = 3036
503+
protocol = "tcp"
504+
description = "allow teleport proxy db connections"
505+
cidr_blocks = var.vpc_security_group_allowed_cirds
506+
ipv6_cidr_blocks = []
507+
source_security_group_id = null
508+
self = null
509+
} : null,
510+
])
503511

504512
tags = merge(module.node_type_label.tags, { Name = module.node_type_label.id })
505513
context = module.node_type_label.context

‎modules/teleport-node/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,11 @@ variable "vpc_id" {
9090
type = string
9191
}
9292

93+
variable "vpc_security_group_allowed_cirds" {
94+
type = list(string)
95+
default = ["0.0.0.0/0"]
96+
}
97+
9398
variable "vpc_security_group_ids" {
9499
type = list(string)
95100
default = []

‎variables.tf‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,19 +27,22 @@ variable "teleport_experimental_mode" {
2727
variable "instance_config" {
2828
type = object({
2929
auth = optional(object({
30-
count = optional(number, 1)
31-
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
30+
count = optional(number, 1)
31+
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
32+
allowed_cidrs = optional(string, ["0.0.0.0/0"])
3233
}), {})
3334
node = optional(object({
34-
count = optional(number, 1)
35-
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
35+
count = optional(number, 1)
36+
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
37+
allowed_cidrs = optional(string, ["0.0.0.0/0"])
3638
}), {})
3739
proxy = optional(object({
38-
count = optional(number, 1)
39-
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
40+
count = optional(number, 1)
41+
sizes = optional(list(string), ["t3.micro", "t3a.micro"])
42+
allowed_cidrs = optional(string, ["0.0.0.0/0"])
4043
}), {})
4144
})
42-
description = "Configuration for the instances. Each type (`auth`, `node`, `proxy`) contains an object with `count` and `sizes`."
45+
description = "Configuration for the instances. Each type (`auth`, `node`, `proxy`) contains an object with `count`, `sizes`, and `allowed_cidrs`."
4346
default = {}
4447
}
4548

0 commit comments

Comments
 (0)