Adding support for Remote VCN Peering

Author: rcohenma

docs/core/peer_region_for_remote_peerings.md

@@ -0,0 +1,30 @@
+
+# oci_core_peer_region_for_remote_peerings
+
+## PeerRegionForRemotePeering DataSource
+
+Gets a list of peer_region_for_remote_peerings.
+
+### List Operation
+Lists the regions that support remote VCN peering (which is peering across regions).
+For more information, see [VCN Peering](https://docs.us-phoenix-1.oraclecloud.com/Content/Network/Tasks/VCNpeering.htm).
+
+The following arguments are supported:
+
+
+
+The following attributes are exported:
+
+* `peer_region_for_remote_peerings` - The list of peer_region_for_remote_peerings.
+
+### Example Usage
+
+```
+data "oci_core_peer_region_for_remote_peerings" "test_peer_region_for_remote_peerings" {
+}
+```
+### PeerRegionForRemotePeering Reference
+
+The following attributes are exported:
+
+* `name` - The region's name.  Example: `us-phoenix-1` 

docs/core/remote_peering_connections.md

@@ -0,0 +1,94 @@
+# oci_core_remote_peering_connection
+
+## RemotePeeringConnection Resource
+
+### RemotePeeringConnection Reference
+
+The following attributes are exported:
+
+* `compartment_id` - The OCID of the compartment that contains the RPC.
+* `display_name` - A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. 
+* `drg_id` - The OCID of the DRG that this RPC belongs to.
+* `id` - The OCID of the RPC.
+* `is_cross_tenancy_peering` - Whether the VCN at the other end of the peering is in a different tenancy.  Example: `false` 
+* `peer_id` - If this RPC is peered, this value is the OCID of the other RPC. 
+* `peer_region_name` - If this RPC is peered, this value is the region that contains the other RPC.  Example: `us-ashburn-1` 
+* `peer_tenancy_id` - If this RPC is peered, this value is the OCID of the other RPC's tenancy. 
+* `peering_status` - Whether the RPC is peered with another RPC. `NEW` means the RPC has not yet been peered. `PENDING` means the peering is being established. `REVOKED` means the RPC at the other end of the peering has been deleted. 
+* `state` - The RPC's current lifecycle state.
+* `time_created` - The date and time the RPC was created, in the format defined by RFC3339.  Example: `2016-08-25T21:10:29.600Z` 
+
+
+
+### Create Operation
+Creates a new remote peering connection (RPC) for the specified DRG.
+
+* Specifying a `peer_id` and a `peer_region_name` creates a connection to the specified RPC ID. Both `peer_id` and `peer_region_name` are required for the connection to succeed.
+* If the specified peer_id is also a resource in the terraform config you will have do a `terraform refresh` after the `terraform apply` in order to get the latest connection information on that resource.
+* To disconnect the peering connection at least one of the RPC resources in the connection will have to be destroyed, however in terraform we recommend that when one RPC is destroyed the peer should also be destroyed. If one of them is not destroyed it will have a `REVOKED` peering_status. If another RPC resource tries to connect to this RPC resource the peering_status on the requestor will be `INVALID`. To solve this you will have to run `terraform taint oci_core_remote_peering_connection.test_remote_peering_connection` on the acceptor resource or target delete it `terraform destroy -target="oci_core_remote_peering_connection.test_remote_peering_connection"`.
+
+The following arguments are supported:
+
+* `compartment_id` - (Required) The OCID of the compartment to contain the RPC.
+* `display_name` - (Optional) A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. 
+* `drg_id` - (Required) The OCID of the DRG the RPC belongs to.
+* `peer_id` - (Optional) The OCID of the RPC you want to peer with.
+* `peer_region_name` - (Optional) The name of the region that contains the RPC you want to peer with.  Example: `us-ashburn-1`
+
+### Update Operation
+Updates the specified remote peering connection (RPC).
+
+
+The following arguments support updates:
+* `display_name` - A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information. 
+
+
+** IMPORTANT **
+Any change to a property that does not support update will force the destruction and recreation of the resource with the new property values
+
+### Example Usage
+
+```
+resource "oci_core_remote_peering_connection" "test_remote_peering_connection" {
+	#Required
+	compartment_id = "${var.compartment_id}"
+	drg_id = "${oci_core_drg.test_drg.id}"
+
+	#Optional
+	display_name = "${var.remote_peering_connection_display_name}"
+	peer_id = "${oci_core_remote_peering_connection.test_remote_peering_connection2.id}"
+	peer_region_name = "${var.remote_peering_connection_peer_region_name}"
+}
+```
+
+# oci_core_remote_peering_connections
+
+## RemotePeeringConnection DataSource
+
+Gets a list of remote_peering_connections.
+
+### List Operation
+Lists the remote peering connections (RPCs) for the specified DRG and compartment
+(the RPC's compartment).
+
+The following arguments are supported:
+
+* `compartment_id` - (Required) The OCID of the compartment.
+* `drg_id` - (Optional) The OCID of the DRG.
+
+
+The following attributes are exported:
+
+* `remote_peering_connections` - The list of remote_peering_connections.
+
+### Example Usage
+
+```
+data "oci_core_remote_peering_connections" "test_remote_peering_connections" {
+	#Required
+	compartment_id = "${var.compartment_id}"
+
+	#Optional
+	drg_id = "${oci_core_drg.test_drg.id}"
+}
+```

docs/examples/networking/remote_vcn_peering_full/README.md

@@ -0,0 +1,17 @@
+# Remote VCN Peering Example
+
+This example demonstrates how to do a VCN remote peering connection using Remote Peering Connection (RPC) resources when you have different administrators of the VCNs in the connection.
+
+** IMPORTANT **
+You would not want to use this example the way it is written as it uses multiple users. This example is there to demonstrate the workflow of establishing a remote peering connection when the 2 VCNs are administered by different users.
+
+This example creates policies so it should be run in the home region of your tenancy.
+
+One of the users will have the `requestor` RPC that will request a remote peering connection to the `acceptor` RPC that is managed by a different user. See [Remote VCN Peering](https://docs.us-phoenix-1.oraclecloud.com/Content/Network/Tasks/remoteVCNpeering.htm) for more details.
+
+* policies.tf show the policies that are needed for each of the users.
+* requestor.tf shows what the requestor config would look like, including the RPC, the Route Table and the Security List.
+* acceptor.tf shows what the acceptor config would look like, including the RPC, the Route Table and the Security List.
+
+An instance is created on the requestor side and the acceptor side so that you can test the connection. 
+You can SSH to one of the instances using its public IP and try to PING from there the other instance using its Private IP.

docs/examples/networking/remote_vcn_peering_full/acceptor.tf

@@ -0,0 +1,141 @@
+variable "user_acceptor" {}
+variable "compartment_ocid_acceptor" {}
+variable "compartment_name_acceptor" {}
+variable "fingerprint_acceptor" {}
+variable "private_key_path_acceptor" {}
+
+variable "acceptor_region" { default = "us-ashburn-1"}
+
+variable "acceptor_cidr" {
+	default = "10.1.0.0/16"
+}
+
+provider "oci" {
+  alias = "acceptor"
+  region = "${var.acceptor_region}"
+  tenancy_ocid = "${var.tenancy_ocid}"
+  user_ocid = "${var.user_acceptor}"
+  fingerprint = "${var.fingerprint_acceptor}"
+  private_key_path = "${var.private_key_path_acceptor}"
+}
+
+resource "oci_core_vcn" "acceptor_vcn" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  display_name = "acceptor_vcn"
+  dns_label = "acceptorvcn"
+  cidr_block = "${var.acceptor_cidr}"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+}
+
+resource "oci_core_drg" "acceptor_drg" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+}
+
+resource "oci_core_drg_attachment" "acceptor_drg_attachment" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  drg_id = "${oci_core_drg.acceptor_drg.id}"
+  vcn_id = "${oci_core_vcn.acceptor_vcn.id}"
+}
+
+resource "oci_core_remote_peering_connection" "acceptor" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  drg_id = "${oci_core_drg.acceptor_drg.id}"
+  display_name = "remotePeeringConnectionAcceptor"
+}
+
+resource "oci_core_internet_gateway" "acceptor_internet_gateway" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  display_name = "acceptor_internet_gateway"
+  vcn_id = "${oci_core_vcn.acceptor_vcn.id}"
+}
+
+resource "oci_core_route_table" "acceptor_route_table" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  vcn_id = "${oci_core_vcn.acceptor_vcn.id}"
+  display_name = "acceptorRouteTable"
+  route_rules {
+    cidr_block = "${var.requestor_cidr}"
+    network_entity_id = "${oci_core_drg.acceptor_drg.id}"
+  }
+  route_rules {
+    cidr_block = "0.0.0.0/0"
+    network_entity_id = "${oci_core_internet_gateway.acceptor_internet_gateway.id}"	
+  }
+}
+
+resource "oci_core_security_list" "acceptor_security_list" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  vcn_id = "${oci_core_vcn.acceptor_vcn.id}"
+  display_name = "AcceptorSecurityList"
+
+  egress_security_rules {
+    destination = "${var.requestor_cidr}"
+    protocol = "all"
+  }
+
+  ingress_security_rules {
+    protocol = "all" 
+    source = "${var.requestor_cidr}"
+  }
+
+  ingress_security_rules {
+    protocol = "${var.tcp_protocol}"
+    source = "0.0.0.0/0"
+	tcp_options {
+      max = "${var.ssh_port}"
+      min = "${var.ssh_port}"
+	}
+  }
+}
+
+data "oci_identity_availability_domains" "acceptor_ads" {
+  provider = "oci.acceptor"
+  compartment_id = "${var.tenancy_ocid}"
+}
+
+resource "oci_core_subnet" "acceptor_subnet" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  availability_domain = "${lookup(data.oci_identity_availability_domains.acceptor_ads.availability_domains[0],"name")}"
+  cidr_block = "${cidrsubnet("${var.acceptor_cidr}", 4, 0)}"
+  display_name = "AcceptorSubnet"
+  dns_label = "acceptorsubnet"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  vcn_id = "${oci_core_vcn.acceptor_vcn.id}"
+  security_list_ids = ["${oci_core_security_list.acceptor_security_list.id}"]
+  route_table_id = "${oci_core_route_table.acceptor_route_table.id}"
+  dhcp_options_id = "${oci_core_vcn.acceptor_vcn.default_dhcp_options_id}"
+}
+
+resource "oci_core_instance" "acceptor_instance" {
+  depends_on = ["oci_identity_policy.acceptor_policy", "oci_identity_user_group_membership.acceptor_user_group_membership"]
+  provider = "oci.acceptor"
+  availability_domain = "${lookup(data.oci_identity_availability_domains.acceptor_ads.availability_domains[0],"name")}"
+  compartment_id = "${var.compartment_ocid_acceptor}"
+  display_name = "acceptorInstance"
+  image = "${var.InstanceImageOCID[var.acceptor_region]}"
+  shape = "${var.InstanceShape}"
+
+  create_vnic_details {
+    subnet_id = "${oci_core_subnet.acceptor_subnet.id}"
+    display_name = "primaryvnic"
+    assign_public_ip = true
+    hostname_label = "acceptorinstance"
+  },
+
+  metadata {
+    ssh_authorized_keys = "${var.ssh_public_key}"
+  }
+}

docs/examples/networking/remote_vcn_peering_full/common.tf

@@ -0,0 +1,31 @@
+variable "ssh_public_key" {}
+
+variable "InstanceShape" {
+  default = "VM.Standard1.2"
+}
+
+variable "InstanceImageOCID" {
+  type = "map"
+  default = {
+    // See https://docs.us-phoenix-1.oraclecloud.com/images/
+    // Oracle-provided image "Oracle-Linux-7.4-2018.02.21-1"
+    us-phoenix-1 = "ocid1.image.oc1.phx.aaaaaaaaupbfz5f5hdvejulmalhyb6goieolullgkpumorbvxlwkaowglslq"
+    us-ashburn-1 = "ocid1.image.oc1.iad.aaaaaaaajlw3xfie2t5t52uegyhiq2npx7bqyu4uvi2zyu3w3mqayc2bxmaa"
+    eu-frankfurt-1 = "ocid1.image.oc1.eu-frankfurt-1.aaaaaaaa7d3fsb6272srnftyi4dphdgfjf6gurxqhmv6ileds7ba3m2gltxq"
+    uk-london-1 = "ocid1.image.oc1.uk-london-1.aaaaaaaaa6h6gj6v4n56mqrbgnosskq63blyv2752g36zerymy63cfkojiiq"
+  }
+}
+
+variable "tcp_protocol" {
+  default = "6"
+}
+
+variable "ssh_port" {
+  default = "22"
+}
+
+data "oci_identity_availability_domains" "ADs" {
+  provider = "oci.admin"
+  compartment_id = "${var.tenancy_ocid}"
+}
+

docs/examples/networking/remote_vcn_peering_full/output.tf

@@ -0,0 +1,18 @@
+# You can test the peering connection by ssh-ing into an instance (using the public_ip) and doing a ping command to the private IP address of the other instance"]
+
+output "requestorInstancePublicIP" {
+    value = ["${oci_core_instance.requestor_instance.public_ip}"]
+}
+
+output "requestorInstancePrivateIP" {
+    value = ["${oci_core_instance.requestor_instance.private_ip}"]
+}
+
+output "acceptorInstancePublicIP" {
+    value = ["${oci_core_instance.acceptor_instance.public_ip}"]
+}
+
+output "acceptorInstancePrivateIP" {
+    value = ["${oci_core_instance.acceptor_instance.private_ip}"]
+}
+

docs/examples/networking/remote_vcn_peering_full/policies.tf

@@ -0,0 +1,58 @@
+variable "fingerprint" {}
+variable "private_key_path" {}
+variable "region" {}
+variable "tenancy_ocid" {}
+variable "user_ocid" {}
+
+provider "oci" {
+  alias = "admin"
+  region = "${var.region}"
+  tenancy_ocid = "${var.tenancy_ocid}"
+  user_ocid = "${var.user_ocid}"
+  fingerprint = "${var.fingerprint}"
+  private_key_path = "${var.private_key_path}"
+}
+
+resource "oci_identity_group" "requestor_group" {
+  provider = "oci.admin"
+  name = "requestorGroup"
+  description = "automated test group"
+}
+
+resource "oci_identity_user_group_membership" "requestor_user_group_membership" {
+  provider = "oci.admin"
+  group_id = "${oci_identity_group.requestor_group.id}"
+  user_id = "${var.user_requestor}"
+}
+
+resource "oci_identity_policy" "requestor_policy" {
+  provider = "oci.admin"
+  name = "requestorPolicy"
+  description = "automated test policy"
+  compartment_id = "${var.tenancy_ocid}"
+  statements = ["Allow group ${oci_identity_group.requestor_group.name} to manage virtual-network-family in compartment ${var.compartment_name_requestor}",
+                "Allow group ${oci_identity_group.requestor_group.name} to manage instance-family in compartment ${var.compartment_name_requestor}",
+				"Allow group ${oci_identity_group.requestor_group.name} to manage remote-peering-from in compartment ${var.compartment_name_requestor}"]
+}
+
+resource "oci_identity_group" "acceptor_group" {
+  provider = "oci.admin"
+  name = "acceptorGroup"
+  description = "automated test group"
+}
+
+resource "oci_identity_user_group_membership" "acceptor_user_group_membership" {
+  provider = "oci.admin"
+  group_id = "${oci_identity_group.acceptor_group.id}"
+  user_id = "${var.user_acceptor}"
+}
+
+resource "oci_identity_policy" "acceptor_policy" {
+  provider = "oci.admin"
+  name = "acceptorPolicy"
+  description = "automated test policy"
+  compartment_id = "${var.tenancy_ocid}"
+  statements = ["Allow group ${oci_identity_group.requestor_group.name} to manage remote-peering-to in compartment ${var.compartment_name_acceptor}",
+                "Allow group ${oci_identity_group.acceptor_group.name} to manage virtual-network-family in compartment ${var.compartment_name_acceptor}",
+				"Allow group ${oci_identity_group.acceptor_group.name} to manage instance-family in compartment ${var.compartment_name_acceptor}"]
+}