feat: added 1 egress rule to operator subnet so users can use OCI bastion service to ssh to operator (#46)

Signed-off-by: Ali Mukadam <[email protected]>

Author: hyder

compute.tf

@@ -23,8 +23,8 @@ resource "oci_core_instance" "operator" {
     assign_public_ip = false
     display_name     = var.label_prefix == "none" ? "operator-vnic" : "${var.label_prefix}-operator-vnic"
     hostname_label   = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
-    nsg_ids          = concat(var.nsg_ids, [oci_core_network_security_group.operator[0].id])
-    subnet_id        = oci_core_subnet.operator[0].id
+    nsg_ids          = concat(var.nsg_ids, [oci_core_network_security_group.operator.id])
+    subnet_id        = oci_core_subnet.operator.id
   }
 
   display_name = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
@@ -41,7 +41,7 @@ resource "oci_core_instance" "operator" {
 
   metadata = {
     ssh_authorized_keys = var.ssh_public_key != "" ? var.ssh_public_key : file(var.ssh_public_key_path)
-    user_data           = data.cloudinit_config.operator[0].rendered
+    user_data           = data.cloudinit_config.operator.rendered
   }
 
   shape = lookup(var.operator_shape, "shape", "VM.Standard.E4.Flex")
@@ -64,6 +64,4 @@ resource "oci_core_instance" "operator" {
   timeouts {
     create = "60m"
   }
-
-  count = var.create_operator == true ? 1 : 0
 }

datasources.tf

@@ -30,7 +30,7 @@ data "oci_core_images" "oracle_images" {
   shape                    = lookup(var.operator_shape, "shape", "VM.Standard.E4.Flex")
   sort_by                  = "TIMECREATED"
 
-  count = (var.create_operator == true && var.operator_image_id == "Oracle") ? 1 : 0
+  count = var.operator_image_id == "Oracle" ? 1 : 0
 }
 
 # cloud init for operator
@@ -49,30 +49,23 @@ data "cloudinit_config" "operator" {
       }
     )
   }
-  count = var.create_operator == true ? 1 : 0
 }
 
 # Gets a list of VNIC attachments on the operator instance
 data "oci_core_vnic_attachments" "operator_vnics_attachments" {
   availability_domain = data.oci_identity_availability_domain.ad.name
   compartment_id      = var.compartment_id
   depends_on          = [oci_core_instance.operator]
-  instance_id         = oci_core_instance.operator[0].id
-
-  count = var.create_operator == true ? 1 : 0
+  instance_id         = oci_core_instance.operator.id
 }
 
 # Gets the OCID of the first (default) VNIC on the operator instance
 data "oci_core_vnic" "operator_vnic" {
   depends_on = [oci_core_instance.operator]
-  vnic_id    = lookup(data.oci_core_vnic_attachments.operator_vnics_attachments[0].vnic_attachments[0], "vnic_id")
-
-  count = var.create_operator == true ? 1 : 0
+  vnic_id    = lookup(data.oci_core_vnic_attachments.operator_vnics_attachments.vnic_attachments[0], "vnic_id")
 }
 
 data "oci_core_instance" "operator" {
   depends_on  = [oci_core_instance.operator]
-  instance_id = oci_core_instance.operator[0].id
-
-  count = var.create_operator == true ? 1 : 0
+  instance_id = oci_core_instance.operator.id
 }

instance_principal.tf

@@ -14,7 +14,7 @@ resource "oci_identity_dynamic_group" "operator_instance_principal" {
   matching_rule = "ALL {instance.id = '${join(",", data.oci_core_instance.operator.*.id)}'}"
   name          = "operator-instance-principal-${substr(uuid(), 0, 8)}"
 
-  count = var.create_operator == true && var.operator_instance_principal == true ? 1 : 0
+  count = var.operator_instance_principal == true ? 1 : 0
 }
 
 resource "oci_identity_policy" "operator_instance_principal" {
@@ -25,5 +25,5 @@ resource "oci_identity_policy" "operator_instance_principal" {
   name           = var.label_prefix == "none" ? "operator-instance-principal" : "${var.label_prefix}-operator-instance-principal"
   statements     = ["Allow dynamic-group ${oci_identity_dynamic_group.operator_instance_principal[0].name} to manage all-resources in compartment id ${var.compartment_id}"]
 
-  count = var.create_operator == true && var.operator_instance_principal == true ? 1 : 0
+  count = var.operator_instance_principal == true ? 1 : 0
 }

locals.tf

@@ -11,6 +11,7 @@ locals {
 
   operator_image_id = var.operator_image_id == "Oracle" ? data.oci_core_images.oracle_images[0].images.0.id : var.operator_image_id
 
+  operator_subnet = cidrsubnet(local.vcn_cidr, var.newbits, var.netnum) 
   operator_template = "${path.module}/cloudinit/operator.template.yaml"
 
   operator_script_template = base64gzip(

outputs.tf

@@ -6,5 +6,5 @@ output "operator_private_ip" {
 }
 
 output "operator_instance_principal_group_name" {
-  value = var.create_operator == true && var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null
+  value = var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null
 }

security.tf

@@ -6,12 +6,10 @@ resource "oci_core_network_security_group" "operator" {
   compartment_id = var.compartment_id
   display_name   = "${var.label_prefix}-operator"
   vcn_id         = var.vcn_id
-
-  count = var.create_operator == true ? 1 : 0
 }
 
 resource "oci_core_network_security_group_security_rule" "operator_egress_anywhere" {
-  network_security_group_id = oci_core_network_security_group.operator[0].id
+  network_security_group_id = oci_core_network_security_group.operator.id
   description               = "allow operator to egress to anywhere"
   destination               = local.anywhere
   destination_type          = "CIDR_BLOCK"
@@ -22,12 +20,10 @@ resource "oci_core_network_security_group_security_rule" "operator_egress_anywhe
   lifecycle {
     ignore_changes = [direction, protocol, source, source_type, tcp_options]
   }
-
-  count = var.create_operator == true ? 1 : 0
 }
 
 resource "oci_core_network_security_group_security_rule" "operator_egress_osn" {
-  network_security_group_id = oci_core_network_security_group.operator[0].id
+  network_security_group_id = oci_core_network_security_group.operator.id
   description               = "allow operator to egress to osn"
   destination               = local.osn
   destination_type          = "SERVICE_CIDR_BLOCK"
@@ -38,12 +34,10 @@ resource "oci_core_network_security_group_security_rule" "operator_egress_osn" {
   lifecycle {
     ignore_changes = [direction, protocol, source, source_type, tcp_options]
   }
-
-  count = var.create_operator == true ? 1 : 0
 }
 
 resource "oci_core_network_security_group_security_rule" "operator_ingress" {
-  network_security_group_id = oci_core_network_security_group.operator[0].id
+  network_security_group_id = oci_core_network_security_group.operator.id
   description               = "allow ssh access to operator from within vcn"
   direction                 = "INGRESS"
   protocol                  = local.tcp_protocol
@@ -61,6 +55,23 @@ resource "oci_core_network_security_group_security_rule" "operator_ingress" {
   lifecycle {
     ignore_changes = [direction, protocol, source, source_type, tcp_options]
   }
+}
+
+resource "oci_core_security_list" "operator" {
+  compartment_id = var.compartment_id
+  display_name   = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
+  freeform_tags  = var.tags
+
+  # egress rule to the same subnet to allow users to use OCI Bastion service to connect to the operator
+  egress_security_rules {
+    protocol    = local.tcp_protocol
+    destination = local.operator_subnet
+
+    tcp_options {
+      min = local.ssh_port
+      max = local.ssh_port
+    }
+  }
 
-  count = var.create_operator == true ? 1 : 0
+  vcn_id = var.vcn_id
 }

subnets.tf

@@ -2,14 +2,12 @@
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 resource "oci_core_subnet" "operator" {
-  cidr_block                 = cidrsubnet(local.vcn_cidr, var.newbits, var.netnum)
+  cidr_block                 = local.operator_subnet
   compartment_id             = var.compartment_id
   display_name               = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
   dns_label                  = "operator"
   freeform_tags              = var.tags
   prohibit_public_ip_on_vnic = true
   route_table_id             = var.nat_route_id
   vcn_id                     = var.vcn_id
-
-  count = var.create_operator == true ? 1 : 0
 }

variables.tf

@@ -60,12 +60,6 @@ variable "vcn_id" {
 
 # operator host parameters
 
-variable "create_operator" {
-  description = "whether to create the operator"
-  default     = false
-  type        = bool
-}
-
 variable "operator_image_id" {
   description = "Provide a custom image id for the operator host or leave as Oracle."
   default     = "Oracle"