Skip to content
This repository was archived by the owner on Oct 31, 2019. It is now read-only.

Commit 6290bf5

Browse files
jlamillanjlamillan
committed
Merge branch 'nat'
2 parents f0d752d + 8db4ad3 commit 6290bf5

File tree

11 files changed

+170
-10
lines changed

11 files changed

+170
-10
lines changed

‎docs/input-variables.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,7 @@ The following input variables are used to configure the inbound security rules f
135135

136136
name | default | description
137137
------------------------------------|-------------------------|------------
138+
dedicated_nat_subnets | "true" | whether to provision dedicated subnets in each AD that are only used by NAT instance(s) (separate subnets = separate control)
138139
public_subnet_ssh_ingress | 0.0.0.0/0 | A CIDR notation IP range that is allowed to SSH to instances in the public subnet (including NAT instances)
139140
public_subnet_http_ingress | 0.0.0.0/0 | A CIDR notation IP range that is allowed access to port 80 on instances in the public subnet
140141
public_subnet_https_ingress | 0.0.0.0/0 | A CIDR notation IP range that is allowed access to port 443 on instances in the public subnet

‎k8s-oci.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ module "vcn" {
5555
nat_instance_ad2_enabled = "${var.nat_instance_ad2_enabled}"
5656
nat_instance_ad3_enabled = "${var.nat_instance_ad3_enabled}"
5757
nat_instance_ssh_public_key_openssh = "${module.k8s-tls.ssh_public_key_openssh}"
58+
dedicated_nat_subnets = "${var.dedicated_nat_subnets}"
5859
worker_ssh_ingress = "${var.worker_ssh_ingress}"
5960
worker_nodeport_ingress = "${var.worker_nodeport_ingress}"
6061
external_icmp_ingress = "${var.external_icmp_ingress}"

‎network/vcn/natinstance.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ resource "oci_core_instance" "NATInstanceAD1" {
1111
shape = "${var.nat_instance_shape}"
1212

1313
create_vnic_details {
14-
subnet_id = "${oci_core_subnet.PublicSubnetAD1.id}"
14+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "${element(concat(oci_core_subnet.NATSubnetAD1.*.id,list("")),0)}" : "${oci_core_subnet.PublicSubnetAD1.id}"}"
1515

1616
# Skip the source/destination check so that the VNIC will forward traffic.
1717
skip_source_dest_check = true
@@ -38,7 +38,7 @@ resource "oci_core_instance" "NATInstanceAD2" {
3838
shape = "${var.nat_instance_shape}"
3939

4040
create_vnic_details {
41-
subnet_id = "${oci_core_subnet.PublicSubnetAD2.id}"
41+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "${element(concat(oci_core_subnet.NATSubnetAD2.*.id,list("")),0)}" : "${oci_core_subnet.PublicSubnetAD2.id}"}"
4242

4343
# Skip the source/destination check so that the VNIC will forward traffic.
4444
skip_source_dest_check = true
@@ -63,7 +63,7 @@ resource "oci_core_instance" "NATInstanceAD3" {
6363
shape = "${var.nat_instance_shape}"
6464

6565
create_vnic_details {
66-
subnet_id = "${oci_core_subnet.PublicSubnetAD3.id}"
66+
subnet_id = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "${element(concat(oci_core_subnet.NATSubnetAD3.*.id,list("")),0)}" : "${oci_core_subnet.PublicSubnetAD3.id}"}"
6767

6868
# Skip the source/destination check so that the VNIC will forward traffic.
6969
skip_source_dest_check = true

‎network/vcn/outputs.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,18 @@ output "public_subnet_ad3_id" {
5050
value = "${oci_core_subnet.PublicSubnetAD3.*.id}"
5151
}
5252

53+
output "nat_subnet_ad1_id" {
54+
value = "${oci_core_subnet.NATSubnetAD1.*.id}"
55+
}
56+
57+
output "nat_subnet_ad2_id" {
58+
value = "${oci_core_subnet.NATSubnetAD2.*.id}"
59+
}
60+
61+
output "nat_subnet_ad3_id" {
62+
value = "${oci_core_subnet.NATSubnetAD3.*.id}"
63+
}
64+
5365
output "ccmlb_subnet_ad1_id" {
5466
value = "${oci_core_subnet.k8sCCMLBSubnetAD1.*.id}"
5567
}

‎network/vcn/securitylists.tf‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,91 @@ resource "oci_core_security_list" "PublicSecurityList" {
300300
]
301301
}
302302

303+
resource "oci_core_security_list" "NatSecurityList" {
304+
count = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "1" : "0"}"
305+
compartment_id = "${var.compartment_ocid}"
306+
display_name = "nat_security_list"
307+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
308+
309+
egress_security_rules = [{
310+
protocol = "all"
311+
destination = "0.0.0.0/0"
312+
}]
313+
314+
ingress_security_rules = [
315+
{
316+
protocol = "1"
317+
source = "${var.external_icmp_ingress}"
318+
319+
icmp_options {
320+
"type" = 3
321+
"code" = 4
322+
}
323+
},
324+
{
325+
protocol = "1"
326+
source = "${var.internal_icmp_ingress}"
327+
328+
icmp_options {
329+
"type" = 3
330+
"code" = 4
331+
}
332+
},
333+
{
334+
# Allow LBaaS
335+
protocol = "6"
336+
source = "${lookup(var.bmc_ingress_cidrs, "LBAAS-PHOENIX-1-CIDR")}"
337+
},
338+
{
339+
protocol = "6"
340+
source = "${lookup(var.bmc_ingress_cidrs, "LBAAS-ASHBURN-1-CIDR")}"
341+
},
342+
{
343+
# Allow internal VCN traffic
344+
protocol = "all"
345+
source = "${lookup(var.bmc_ingress_cidrs, "VCN-CIDR")}"
346+
},
347+
{
348+
# Access to SSH port to instances on the public network (like the NAT instance or a user-defined LB)
349+
protocol = "6"
350+
source = "${var.public_subnet_ssh_ingress}"
351+
352+
tcp_options {
353+
"min" = 22
354+
"max" = 22
355+
}
356+
},
357+
{
358+
# Access to port 80 and 443 to instances on the public network (like the NAT instance or a user-defined LB)
359+
protocol = "6"
360+
source = "${var.public_subnet_http_ingress}"
361+
362+
tcp_options {
363+
"min" = 80
364+
"max" = 80
365+
}
366+
},
367+
{
368+
protocol = "6"
369+
source = "${var.public_subnet_https_ingress}"
370+
371+
tcp_options {
372+
"min" = 443
373+
"max" = 443
374+
}
375+
},
376+
{
377+
protocol = "6"
378+
source = "${var.etcd_cluster_ingress}"
379+
380+
tcp_options {
381+
"min" = 2379
382+
"max" = 2380
383+
}
384+
},
385+
]
386+
}
387+
303388
resource "oci_core_security_list" "K8SCCMLBSubnet" {
304389
compartment_id = "${var.compartment_ocid}"
305390
display_name = "${var.label_prefix}k8sCCM_security_list"

‎network/vcn/subnets.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,43 @@ resource "oci_core_subnet" "PublicSubnetAD3" {
3737
dhcp_options_id = "${oci_core_virtual_network.CompleteVCN.default_dhcp_options_id}"
3838
}
3939

40+
resource "oci_core_subnet" "NATSubnetAD1" {
41+
# Provisioned only when k8s instances are in private subnets
42+
count = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "1" : "0"}"
43+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[0],"name")}"
44+
cidr_block = "${lookup(var.network_cidrs, "natSubnetAD1")}"
45+
display_name = "${var.label_prefix}publicNATSubnetAD1"
46+
compartment_id = "${var.compartment_ocid}"
47+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
48+
route_table_id = "${oci_core_route_table.PublicRouteTable.id}"
49+
security_list_ids = ["${concat(list(oci_core_security_list.NatSecurityList.id), var.additional_nat_security_lists_ids)}"]
50+
dhcp_options_id = "${oci_core_virtual_network.CompleteVCN.default_dhcp_options_id}"
51+
}
52+
53+
resource "oci_core_subnet" "NATSubnetAD2" {
54+
count = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "1" : "0"}"
55+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[1],"name")}"
56+
cidr_block = "${lookup(var.network_cidrs, "natSubnetAD2")}"
57+
display_name = "${var.label_prefix}publicNATSubnetAD2"
58+
compartment_id = "${var.compartment_ocid}"
59+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
60+
route_table_id = "${oci_core_route_table.PublicRouteTable.id}"
61+
security_list_ids = ["${concat(list(oci_core_security_list.NatSecurityList.id), var.additional_nat_security_lists_ids)}"]
62+
dhcp_options_id = "${oci_core_virtual_network.CompleteVCN.default_dhcp_options_id}"
63+
}
64+
65+
resource "oci_core_subnet" "NATSubnetAD3" {
66+
count = "${(var.control_plane_subnet_access == "private") && (var.dedicated_nat_subnets == "true") ? "1" : "0"}"
67+
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[2],"name")}"
68+
cidr_block = "${lookup(var.network_cidrs, "natSubnetAD3")}"
69+
display_name = "${var.label_prefix}publicNATSubnetAD3"
70+
compartment_id = "${var.compartment_ocid}"
71+
vcn_id = "${oci_core_virtual_network.CompleteVCN.id}"
72+
route_table_id = "${oci_core_route_table.PublicRouteTable.id}"
73+
security_list_ids = ["${concat(list(oci_core_security_list.NatSecurityList.id), var.additional_nat_security_lists_ids)}"]
74+
dhcp_options_id = "${oci_core_virtual_network.CompleteVCN.default_dhcp_options_id}"
75+
}
76+
4077
resource "oci_core_subnet" "etcdSubnetAD1" {
4178
availability_domain = "${lookup(data.oci_identity_availability_domains.ADs.availability_domains[0],"name")}"
4279
cidr_block = "${lookup(var.network_cidrs, "etcdSubnetAD1")}"

‎network/vcn/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ variable "network_cidrs" {
66
PublicSubnetAD1 = "10.0.10.0/24"
77
PublicSubnetAD2 = "10.0.11.0/24"
88
PublicSubnetAD3 = "10.0.12.0/24"
9+
natSubnetAD1 = "10.0.13.0/24"
10+
natSubnetAD2 = "10.0.14.0/24"
11+
natSubnetAD3 = "10.0.15.0/24"
912
etcdSubnetAD1 = "10.0.20.0/24"
1013
etcdSubnetAD2 = "10.0.21.0/24"
1114
etcdSubnetAD3 = "10.0.22.0/24"
@@ -47,6 +50,11 @@ variable "additional_public_security_lists_ids" {
4750
default = []
4851
}
4952

53+
variable "additional_nat_security_lists_ids" {
54+
type = "list"
55+
default = []
56+
}
57+
5058
# VCN
5159

5260
variable "label_prefix" {
@@ -136,3 +144,7 @@ variable nat_instance_ad2_enabled {
136144
variable nat_instance_ad3_enabled {
137145
default = "false"
138146
}
147+
148+
variable dedicated_nat_subnets {
149+
default = "false"
150+
}

‎outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ output "public_subnet_ids" {
5454
value = ["${module.vcn.public_subnet_ad1_id}", "${module.vcn.public_subnet_ad2_id}", "${module.vcn.public_subnet_ad3_id}", ""]
5555
}
5656

57+
output "nat_subnet_ids" {
58+
value = ["${module.vcn.nat_subnet_ad1_id}", "${module.vcn.nat_subnet_ad2_id}", "${module.vcn.nat_subnet_ad3_id}", ""]
59+
}
60+
5761
output "worker_ssh_ingress_cidr" {
5862
value = "${var.worker_ssh_ingress}"
5963
}

‎tests/resources/frontend-service.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ spec:
3131
lifecycle:
3232
preStop:
3333
exec:
34-
command: ["/usr/sbin/nginx","-s","quit"]
34+
command: ["/usr/sbin/nginx","-s","quit"]

‎tests/resources/hello-service.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ spec:
3030
image: "gcr.io/google-samples/hello-go-gke:1.0"
3131
ports:
3232
- name: http
33-
containerPort: 80
33+
containerPort: 80

0 commit comments

Comments
 (0)