Skip to content
This repository was archived by the owner on Oct 31, 2019. It is now read-only.

Commit 0a206d7

Browse files
author
srirg
committed
ability to create bastion instances for sod.
1 parent 11a75b2 commit 0a206d7

File tree

8 files changed

+415
-22
lines changed

8 files changed

+415
-22
lines changed

‎k8s-oci.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,13 @@ module "vcn" {
5656
nat_instance_ad3_enabled = "${var.nat_instance_ad3_enabled}"
5757
nat_instance_ssh_public_key_openssh = "${module.k8s-tls.ssh_public_key_openssh}"
5858
dedicated_nat_subnets = "${var.dedicated_nat_subnets}"
59+
bastion_instance_oracle_linux_image_name = "${var.bastion_ol_image_name}"
60+
bastion_instance_shape = "${var.bastionInstanceShape}"
61+
bastion_instance_ad1_enabled = "${var.bastion_instance_ad1_enabled}"
62+
bastion_instance_ad2_enabled = "${var.bastion_instance_ad2_enabled}"
63+
bastion_instance_ad3_enabled = "${var.bastion_instance_ad3_enabled}"
64+
bastion_instance_ssh_public_key_openssh = "${module.k8s-tls.ssh_public_key_openssh}"
65+
dedicated_bastion_subnets = "${var.dedicated_bastion_subnets}"
5966
worker_ssh_ingress = "${var.worker_ssh_ingress}"
6067
worker_nodeport_ingress = "${var.worker_nodeport_ingress}"
6168
master_nodeport_ingress = "${var.master_nodeport_ingress}"

‎network/vcn/bastioninstance.tf‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/**
2+
* The Bastion instances will be used by instances in private subnets for network security best practices.
3+
*/
4+
5+
resource "oci_core_instance" "BastionInstanceAD1" {
6+
count = "${(var.control_plane_subnet_access == "private") && (var.bastion_instance_ad1_enabled == "true") ? "1" : "0"}"
7+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[0],"name")}"
8+
compartment_id = "${(var.bastion_compartment_ocid != "") ? var.bastion_compartment_ocid : var.compartment_ocid}"
9+
display_name = "${var.label_prefix}bastion-ad1"
10+
image = "${lookup(data.oci_core_images.ImageOCID.images[0], "id")}"
11+
shape = "${var.bastion_instance_shape}"
12+
13+
create_vnic_details {
14+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_bastion_subnets == "true") ? "${element(concat(oci_core_subnet.BastionSubnetAD1.*.id,list("")),0)}" : "${oci_core_subnet.PublicSubnetAD1.id}"}"
15+
}
16+
17+
metadata {
18+
ssh_authorized_keys = "${var.bastion_instance_ssh_public_key_openssh}"
19+
}
20+
21+
timeouts {
22+
create = "10m"
23+
}
24+
}
25+
26+
resource "oci_core_instance" "BastionInstanceAD2" {
27+
count = "${(var.control_plane_subnet_access == "private") && (var.bastion_instance_ad2_enabled == "true") ? "1" : "0"}"
28+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[1],"name")}"
29+
compartment_id = "${(var.bastion_compartment_ocid != "") ? var.bastion_compartment_ocid : var.compartment_ocid}"
30+
display_name = "${var.label_prefix}bastion-ad2"
31+
image = "${lookup(data.oci_core_images.ImageOCID.images[0], "id")}"
32+
shape = "${var.bastion_instance_shape}"
33+
34+
create_vnic_details {
35+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_bastion_subnets == "true") ? "${element(concat(oci_core_subnet.BastionSubnetAD2.*.id,list("")),0)}" : "${oci_core_subnet.PublicSubnetAD2.id}"}"
36+
}
37+
38+
metadata {
39+
ssh_authorized_keys = "${var.bastion_instance_ssh_public_key_openssh}"
40+
}
41+
42+
timeouts {
43+
create = "10m"
44+
}
45+
}
46+
47+
resource "oci_core_instance" "BastionInstanceAD3" {
48+
count = "${(var.control_plane_subnet_access == "private") && (var.bastion_instance_ad3_enabled == "true") ? "1" : "0"}"
49+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[2],"name")}"
50+
compartment_id = "${(var.bastion_compartment_ocid != "") ? var.bastion_compartment_ocid : var.compartment_ocid}"
51+
display_name = "${var.label_prefix}bastion-ad3"
52+
image = "${lookup(data.oci_core_images.ImageOCID.images[0], "id")}"
53+
shape = "${var.bastion_instance_shape}"
54+
55+
create_vnic_details {
56+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_bastion_subnets == "true") ? "${element(concat(oci_core_subnet.BastionSubnetAD3.*.id,list("")),0)}" : "${element(concat(oci_core_subnet.PublicSubnetAD3.*.id,list("")),0)}"}"
57+
}
58+
59+
metadata {
60+
ssh_authorized_keys = "${var.bastion_instance_ssh_public_key_openssh}"
61+
}
62+
63+
timeouts {
64+
create = "10m"
65+
}
66+
}

‎network/vcn/outputs.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,42 @@ output "nat_instance_ad3_public_ips" {
100100
value = ["${oci_core_instance.NATInstanceAD3.*.public_ip}"]
101101
}
102102

103+
output "bastion_subnet_ad1_id" {
104+
value = "${oci_core_subnet.BastionSubnetAD1.*.id}"
105+
}
106+
107+
output "bastion_subnet_ad2_id" {
108+
value = "${oci_core_subnet.BastionSubnetAD2.*.id}"
109+
}
110+
111+
output "bastion_subnet_ad3_id" {
112+
value = "${oci_core_subnet.BastionSubnetAD3.*.id}"
113+
}
114+
115+
output "bastion_instance_ad1_private_ips" {
116+
value = ["${oci_core_instance.BastionInstanceAD1.*.private_ip}"]
117+
}
118+
119+
output "bastion_instance_ad1_public_ips" {
120+
value = ["${oci_core_instance.BastionInstanceAD1.*.public_ip}"]
121+
}
122+
123+
output "bastion_instance_ad2_private_ips" {
124+
value = ["${oci_core_instance.BastionInstanceAD2.*.private_ip}"]
125+
}
126+
127+
output "bastion_instance_ad2_public_ips" {
128+
value = ["${oci_core_instance.BastionInstanceAD2.*.public_ip}"]
129+
}
130+
131+
output "bastion_instance_ad3_private_ips" {
132+
value = ["${oci_core_instance.BastionInstanceAD3.*.private_ip}"]
133+
}
134+
135+
output "bastion_instance_ad3_public_ips" {
136+
value = ["${oci_core_instance.BastionInstanceAD3.*.public_ip}"]
137+
}
138+
103139
output "control_plane_subnet_access" {
104140
value = "${var.control_plane_subnet_access}"
105141
}

‎network/vcn/securitylists.tf‎

Lines changed: 160 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,6 @@ resource "oci_core_security_list" "EtcdSubnet" {
6666
command = "sleep 5"
6767
}
6868
}
69-
7069
resource "oci_core_security_list" "K8SMasterSubnet" {
7170
compartment_id = "${var.compartment_ocid}"
7271
display_name = "${var.label_prefix}k8sMaster_security_list"
@@ -405,3 +404,163 @@ resource "oci_core_security_list" "K8SCCMLBSubnet" {
405404
ingress_security_rules = [
406405
]
407406
}
407+
408+
resource "oci_core_security_list" "BastionSecurityList" {
409+
count = "${(var.control_plane_subnet_access == "private") && (var.dedicated_bastion_subnets == "true") ? "1" : "0"}"
410+
compartment_id = "${var.compartment_ocid}"
411+
display_name = "bastion_security_list"
412+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
413+
egress_security_rules = [{
414+
protocol = "all"
415+
destination = "0.0.0.0/0"
416+
}]
417+
ingress_security_rules = [
418+
]
419+
420+
ingress_security_rules = [
421+
{
422+
protocol = "1"
423+
source = "${var.external_icmp_ingress}"
424+
425+
icmp_options {
426+
"type" = 3
427+
"code" = 4
428+
}
429+
},
430+
{
431+
protocol = "1"
432+
source = "${var.internal_icmp_ingress}"
433+
434+
icmp_options {
435+
"type" = 3
436+
"code" = 4
437+
}
438+
},
439+
{
440+
# Allow LBaaS
441+
protocol = "6"
442+
source = "${lookup(var.bmc_ingress_cidrs, "LBAAS-PHOENIX-1-CIDR")}"
443+
},
444+
{
445+
protocol = "6"
446+
source = "${lookup(var.bmc_ingress_cidrs, "LBAAS-ASHBURN-1-CIDR")}"
447+
},
448+
{
449+
# Allow internal VCN traffic
450+
protocol = "all"
451+
source = "${lookup(var.bmc_ingress_cidrs, "VCN-CIDR")}"
452+
},
453+
{
454+
# Access to SSH port to instances on the public network (like the NAT instance or a user-defined LB)
455+
protocol = "6"
456+
source = "${var.public_subnet_ssh_ingress}"
457+
458+
tcp_options {
459+
"min" = 22
460+
"max" = 22
461+
}
462+
},
463+
{
464+
# Access to port 80 and 443 to instances on the public network (like the NAT instance or a user-defined LB)
465+
protocol = "6"
466+
source = "${var.public_subnet_http_ingress}"
467+
468+
tcp_options {
469+
"min" = 80
470+
"max" = 80
471+
}
472+
},
473+
{
474+
protocol = "6"
475+
source = "${var.public_subnet_https_ingress}"
476+
477+
tcp_options {
478+
"min" = 443
479+
"max" = 443
480+
}
481+
},
482+
{
483+
protocol = "6"
484+
source = "${var.etcd_cluster_ingress}"
485+
486+
tcp_options {
487+
"min" = 2379
488+
"max" = 2380
489+
}
490+
},
491+
]
492+
}
493+
494+
resource "oci_core_security_list" "GlobalSecurityList" {
495+
compartment_id = "${(var.network_compartment_ocid != "") ? var.network_compartment_ocid : var.compartment_ocid}"
496+
display_name = "${var.label_prefix}global_security_list"
497+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
498+
499+
egress_security_rules = [
500+
{
501+
destination = "0.0.0.0/0"
502+
protocol = "all"
503+
},
504+
]
505+
506+
ingress_security_rules = [
507+
{
508+
tcp_options {
509+
"max" = 22
510+
"min" = 22
511+
}
512+
513+
protocol = "6"
514+
source = "10.0.16.0/24"
515+
},
516+
{
517+
tcp_options {
518+
"max" = 22
519+
"min" = 22
520+
}
521+
522+
protocol = "6"
523+
source = "10.0.17.0/24"
524+
},
525+
{
526+
tcp_options {
527+
"max" = 22
528+
"min" = 22
529+
}
530+
531+
protocol = "6"
532+
source = "10.0.18.0/24"
533+
},
534+
{
535+
protocol = "1"
536+
source = "10.0.16.0/24"
537+
538+
icmp_options {
539+
"type" = 3
540+
"code" = 4
541+
}
542+
},
543+
{
544+
protocol = "1"
545+
source = "10.0.17.0/24"
546+
547+
icmp_options {
548+
"type" = 3
549+
"code" = 4
550+
}
551+
},
552+
{
553+
protocol = "1"
554+
source = "10.0.18.0/24"
555+
556+
icmp_options {
557+
"type" = 3
558+
"code" = 4
559+
}
560+
},
561+
]
562+
563+
provisioner "local-exec" {
564+
command = "sleep 5"
565+
}
566+
}

0 commit comments

Comments
 (0)