refactor!: Upgrade minimum version to Terraform 1.0.0 (#33)

hyder · web-flow · commit f756f24e5709 · 2021-07-09T19:32:13.000+10:00
* refactor!: renamed operator_enabled to create_operator; minimum Terraform version is 1.0.0

BREAKING CHANGE: refactor to  rename variable operator enabled to create_operator and set minimum Terraform version to 1.0.0

* removed unused security list
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
@@ -10,7 +10,10 @@ The format is based on {uri-changelog}[Keep a Changelog].
 = Unreleased
 
 == New features
+* Set minimum Terraform version to 1.0.0
+* Renamed var.operator_enabled --> var.create_operator
 * New variable (`operator_state`) to specify state of operator host
+* Removed security list and using NSG instead
 
 == Changes
 * Set default shape to E4.Flex
diff --git a/LICENSE b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2019, 2020 Oracle and/or its affiliates. 
+Copyright (c) 2019, 2021 Oracle and/or its affiliates. 
 
 The Universal Permissive License (UPL), Version 1.0
 
diff --git a/cloudinit/operator.template.yaml b/cloudinit/operator.template.yaml
@@ -1,4 +1,4 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021, Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 #cloud-config
diff --git a/compute.tf b/compute.tf
@@ -1,4 +1,4 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 resource "oci_core_instance" "operator" {
@@ -12,11 +12,11 @@ resource "oci_core_instance" "operator" {
   freeform_tags  = var.tags
 
   create_vnic_details {
-    assign_public_ip = false
-    display_name     = var.label_prefix == "none" ? "operator-vnic" : "${var.label_prefix}-operator-vnic"
-    hostname_label   = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
-    nsg_ids          = var.nsg_ids
-    subnet_id        = oci_core_subnet.operator[0].id
+    assign_public_ip          = false
+    display_name              = var.label_prefix == "none" ? "operator-vnic" : "${var.label_prefix}-operator-vnic"
+    hostname_label            = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
+    nsg_ids                   = concat(var.nsg_ids,[oci_core_network_security_group.operator[0].id])
+    subnet_id                 = oci_core_subnet.operator[0].id
   }
 
   display_name = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
@@ -25,7 +25,7 @@ resource "oci_core_instance" "operator" {
     boot_volume_type = "PARAVIRTUALIZED"
     network_type     = "PARAVIRTUALIZED"
   }
-  
+
   # prevent the operator from destroying and recreating itself if the image ocid changes 
   lifecycle {
     ignore_changes = [source_details[0].source_id]
@@ -36,10 +36,10 @@ resource "oci_core_instance" "operator" {
     user_data           = data.template_cloudinit_config.operator[0].rendered
   }
 
-  shape = lookup(var.operator_shape, "shape", "VM.Standard.E2.2")
+  shape = lookup(var.operator_shape, "shape", "VM.Standard.E4.Flex")
 
   dynamic "shape_config" {
-    for_each = length(regexall("Flex", lookup(var.operator_shape, "shape", "VM.Standard.E3.Flex"))) > 0 ? [1] : []
+    for_each = length(regexall("Flex", lookup(var.operator_shape, "shape", "VM.Standard.E4.Flex"))) > 0 ? [1] : []
     content {
       ocpus         = max(1, lookup(var.operator_shape, "ocpus", 1))
       memory_in_gbs = (lookup(var.operator_shape, "memory", 4) / lookup(var.operator_shape, "ocpus", 1)) > 64 ? (lookup(var.operator_shape, "ocpus", 1) * 4) : lookup(var.operator_shape, "memory", 4)
@@ -57,5 +57,5 @@ resource "oci_core_instance" "operator" {
     create = "60m"
   }
 
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
diff --git a/datasources.tf b/datasources.tf
@@ -1,6 +1,14 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
+data "oci_core_services" "all_oci_services" {
+  filter {
+    name   = "name"
+    values = ["All .* Services In Oracle Services Network"]
+    regex  = true
+  }
+}
+
 data "oci_identity_availability_domains" "ad_list" {
   compartment_id = var.tenancy_id
 }
@@ -33,7 +41,7 @@ data "template_file" "oracle_template" {
     ol = var.operating_system_version
   }
 
-  count = (var.operator_enabled == true) ? 1 : 0
+  count = (var.create_operator == true) ? 1 : 0
 }
 
 data "template_file" "oracle_cloud_init_file" {
@@ -45,15 +53,17 @@ data "template_file" "oracle_cloud_init_file" {
     timezone            = var.timezone
   }
 
-  count = (var.operator_enabled == true) ? 1 : 0
+  count = (var.create_operator == true) ? 1 : 0
 }
 
 data "oci_core_images" "oracle_images" {
   compartment_id           = var.compartment_id
   operating_system         = "Oracle Linux"
   operating_system_version = var.operating_system_version
-  shape                    = lookup(var.operator_shape, "shape", "VM.Standard.E2.2")
+  shape                    = lookup(var.operator_shape, "shape", "VM.Standard.E4.Flex")
   sort_by                  = "TIMECREATED"
+
+  count = (var.create_operator == true && var.operator_image_id == "Oracle") ? 1 : 0
 }
 
 # cloud init for operator
@@ -66,7 +76,7 @@ data "template_cloudinit_config" "operator" {
     content_type = "text/cloud-config"
     content      = data.template_file.oracle_cloud_init_file[0].rendered
   }
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
 
 # Gets a list of VNIC attachments on the operator instance
@@ -76,20 +86,20 @@ data "oci_core_vnic_attachments" "operator_vnics_attachments" {
   depends_on          = [oci_core_instance.operator]
   instance_id         = oci_core_instance.operator[0].id
 
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
 
 # Gets the OCID of the first (default) VNIC on the operator instance
 data "oci_core_vnic" "operator_vnic" {
   depends_on = [oci_core_instance.operator]
   vnic_id    = lookup(data.oci_core_vnic_attachments.operator_vnics_attachments[0].vnic_attachments[0], "vnic_id")
 
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
 
 data "oci_core_instance" "operator" {
   depends_on  = [oci_core_instance.operator]
   instance_id = oci_core_instance.operator[0].id
 
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
diff --git a/docs/quickstart.adoc b/docs/quickstart.adoc
@@ -76,7 +76,7 @@ provider "oci" {
 * `nat_route_id`
 * `vcn_id`
 * 1 of `ssh_public_key` or `ssh_public_key_path`
-* `operator_enabled`
+* `create_operator`
 
 . Optional parameters to override:
 
diff --git a/docs/terraformoptions.adoc b/docs/terraformoptions.adoc
@@ -128,7 +128,7 @@ Ensure you review the {uri-terraform-dependencies}[dependencies].
 |Values
 |Default
 
-|`operator_enabled`
+|`create_operator`
 |whether to create the operator
 | true/false
 |true
diff --git a/instance_principal.tf b/instance_principal.tf
@@ -1,4 +1,4 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
 # create a home region provider for identity operations
@@ -24,7 +24,7 @@ resource "oci_identity_dynamic_group" "operator_instance_principal" {
   matching_rule  = "ALL {instance.id = '${join(",", data.oci_core_instance.operator.*.id)}'}"
   name           = var.label_prefix == "none" ? "operator-instance-principal-${substr(uuid(),0,8)}" : "${var.label_prefix}-operator-instance-principal-${substr(uuid(),0,8)}"
 
-  count = var.operator_enabled == true && var.operator_instance_principal == true ? 1 : 0
+  count = var.create_operator == true && var.operator_instance_principal == true ? 1 : 0
 }
 
 resource "oci_identity_policy" "operator_instance_principal" {
@@ -35,5 +35,5 @@ resource "oci_identity_policy" "operator_instance_principal" {
   name           = var.label_prefix == "none" ? "operator-instance-principal" : "${var.label_prefix}-operator-instance-principal"
   statements     = ["Allow dynamic-group ${oci_identity_dynamic_group.operator_instance_principal[0].name} to manage all-resources in compartment id ${var.compartment_id}"]
 
-  count = var.operator_enabled == true && var.operator_instance_principal == true ? 1 : 0
+  count = var.create_operator == true && var.operator_instance_principal == true ? 1 : 0
 }
diff --git a/locals.tf b/locals.tf
@@ -1,15 +1,16 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 # Protocols are specified as protocol numbers.
 # https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
 
 locals {
-  all_protocols    = "all"
-  ad_names         = data.template_file.ad_names.*.rendered
-  anywhere         = "0.0.0.0/0"
-  ssh_port         = 22
-  tcp_protocol     = 6
-  operator_image_id = var.operator_image_id == "Oracle" ? data.oci_core_images.oracle_images.images.0.id : var.operator_image_id
-  vcn_cidr         = data.oci_core_vcn.vcn.cidr_block
+  all_protocols     = "all"
+  ad_names          = data.template_file.ad_names.*.rendered
+  anywhere          = "0.0.0.0/0"
+  ssh_port          = 22
+  tcp_protocol      = 6
+  operator_image_id = var.operator_image_id == "Oracle" ? data.oci_core_images.oracle_images[0].images.0.id : var.operator_image_id
+  osn               = lookup(data.oci_core_services.all_oci_services.services[0], "cidr_block")
+  vcn_cidr          = data.oci_core_vcn.vcn.cidr_block
 }
diff --git a/outputs.tf b/outputs.tf
@@ -1,10 +1,10 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
 output "operator_private_ip" {
   value = join(",", data.oci_core_vnic.operator_vnic.*.private_ip_address)
 }
 
 output "operator_instance_principal_group_name" {
-  value = var.operator_enabled == true && var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null
+  value = var.create_operator == true && var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null
 }
diff --git a/scripts/operator.template.sh b/scripts/operator.template.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 if [ ${ol} = 8 ]; then
diff --git a/security.tf b/security.tf
@@ -1,27 +1,66 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
-resource "oci_core_security_list" "operator" {
+# operator nsg and rule
+resource "oci_core_network_security_group" "operator" {
   compartment_id = var.compartment_id
-  display_name   = var.label_prefix == "none" ? "operator" : "${var.label_prefix}-operator"
-  freeform_tags  = var.tags
+  display_name   = "${var.label_prefix}-operator"
+  vcn_id         = var.vcn_id
 
-  egress_security_rules {
-    protocol    = local.all_protocols
-    destination = local.anywhere
+  count = var.create_operator == true ? 1 : 0
+}
+
+resource "oci_core_network_security_group_security_rule" "operator_egress_anywhere" {
+  network_security_group_id = oci_core_network_security_group.operator[0].id
+  description               = "allow operator to egress to anywhere"
+  destination               = local.anywhere
+  destination_type          = "CIDR_BLOCK"
+  direction                 = "EGRESS"
+  protocol                  = local.all_protocols
+  stateless                 = false
+
+  lifecycle {
+    ignore_changes = [direction, protocol, source, source_type, tcp_options]
+  }
+
+  count = var.create_operator == true ? 1 : 0
+}
+
+resource "oci_core_network_security_group_security_rule" "operator_egress_osn" {
+  network_security_group_id = oci_core_network_security_group.operator[0].id
+  description               = "allow operator to egress to osn"
+  destination               = local.osn
+  destination_type          = "SERVICE_CIDR_BLOCK"
+  direction                 = "EGRESS"
+  protocol                  = local.all_protocols
+  stateless                 = false
+
+  lifecycle {
+    ignore_changes = [direction, protocol, source, source_type, tcp_options]
   }
 
-  ingress_security_rules {
-    # allow ssh
-    protocol = local.tcp_protocol
-    source   = local.vcn_cidr
+  count = var.create_operator == true ? 1 : 0
+}
+
+resource "oci_core_network_security_group_security_rule" "operator_ingress" {
+  network_security_group_id = oci_core_network_security_group.operator[0].id
+  description               = "allow ssh access to operator from within vcn"
+  direction                 = "INGRESS"
+  protocol                  = local.tcp_protocol
+  source                    = local.vcn_cidr
+  source_type               = "CIDR_BLOCK"
+  stateless                 = false
 
-    tcp_options {
+  tcp_options {
+    destination_port_range {
       min = local.ssh_port
       max = local.ssh_port
     }
   }
-  vcn_id = var.vcn_id
 
-  count = var.operator_enabled == true ? 1 : 0
+  lifecycle {
+    ignore_changes = [direction, protocol, source, source_type, tcp_options]
+  }
+
+  count = var.create_operator == true ? 1 : 0
 }
diff --git a/subnets.tf b/subnets.tf
@@ -1,4 +1,4 @@
-# Copyright 2017, 2019, Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 resource "oci_core_subnet" "operator" {
@@ -9,8 +9,7 @@ resource "oci_core_subnet" "operator" {
   freeform_tags              = var.tags
   prohibit_public_ip_on_vnic = true
   route_table_id             = var.nat_route_id
-  security_list_ids          = [oci_core_security_list.operator[0].id]
   vcn_id                     = var.vcn_id
 
-  count = var.operator_enabled == true ? 1 : 0
+  count = var.create_operator == true ? 1 : 0
 }
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
@@ -35,7 +35,7 @@ vcn_id = ""
 
 operating_system_version = "8"
 
-operator_enabled = true
+create_operator = true
 
 operator_image_id = "Oracle"
 
diff --git a/variables.tf b/variables.tf
@@ -1,7 +1,7 @@
-# Copyright (c) 2019, 2020 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2019, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
-# provider identity parameters
+# provider parameters
 variable "api_fingerprint" {
   description = "fingerprint of oci api private key"
   type        = string
@@ -89,7 +89,7 @@ variable "operating_system_version" {
   type        = string
 }
 
-variable "operator_enabled" {
+variable "create_operator" {
   #! Deprecation notice: will be renamed to create_operator at next major release
   description = "whether to create the operator"
   default     = false
diff --git a/versions.tf b/versions.tf
@@ -1,3 +1,6 @@
+# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
+# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
+
 terraform {
   required_providers {
     oci = {
@@ -7,5 +10,5 @@ terraform {
       source = "hashicorp/template"
     }
   }
-  required_version = ">= 0.13"
+  required_version = ">= 1.0.0"
 }

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-Copyright (c) 2019, 2020 Oracle and/or its affiliates.`
	`1`	`+Copyright (c) 2019, 2021 Oracle and/or its affiliates.`
`2`	`2`
`3`	`3`	`The Universal Permissive License (UPL), Version 1.0`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-# Copyright 2017, 2019, Oracle Corporation and/or affiliates. All rights reserved.`
	`1`	`+# Copyright 2017, 2021, Oracle Corporation and/or affiliates. All rights reserved.`
`2`	`2`	`# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/`
`3`	`3`
`4`	`4`	`#cloud-config`
Original file line number	Diff line number	Diff line change
`@@ -1,10 +1,10 @@`
`1`		`-# Copyright 2017, 2019, Oracle Corporation and/or affiliates. All rights reserved.`
	`1`	`+# Copyright 2017, 2021 Oracle Corporation and/or affiliates. All rights reserved.`
`2`	`2`	`# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl`
`3`	`3`
`4`	`4`	`output "operator_private_ip" {`
`5`	`5`	`value = join(",", data.oci_core_vnic.operator_vnic.*.private_ip_address)`
`6`	`6`	`}`
`7`	`7`
`8`	`8`	`output "operator_instance_principal_group_name" {`
`9`		`- value = var.operator_enabled == true && var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null`
	`9`	`+ value = var.create_operator == true && var.operator_instance_principal == true ? oci_identity_dynamic_group.operator_instance_principal[0].name : null`
`10`	`10`	`}`