From d380680ec8d9e766a1938bcf3ddbe04f367fc396 Mon Sep 17 00:00:00 2001 From: Steve Brasier Date: Thu, 20 Feb 2025 13:26:37 +0000 Subject: [PATCH] support disabling port security --- .../skeleton/{{cookiecutter.environment}}/tofu/control.tf | 3 ++- .../{{cookiecutter.environment}}/tofu/node_group/nodes.tf | 3 ++- .../skeleton/{{cookiecutter.environment}}/tofu/variables.tf | 5 +++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/environments/skeleton/{{cookiecutter.environment}}/tofu/control.tf b/environments/skeleton/{{cookiecutter.environment}}/tofu/control.tf index 0876ce00a..a8a684d31 100644 --- a/environments/skeleton/{{cookiecutter.environment}}/tofu/control.tf +++ b/environments/skeleton/{{cookiecutter.environment}}/tofu/control.tf @@ -14,7 +14,8 @@ resource "openstack_networking_port_v2" "control" { subnet_id = data.openstack_networking_subnet_v2.cluster_subnet[each.key].id } - security_group_ids = [for o in data.openstack_networking_secgroup_v2.nonlogin: o.id] + port_security_enabled = lookup(each.value, "port_security_enabled", true) + security_group_ids = lookup(each.value, "port_security_enabled", true) ? [for o in data.openstack_networking_secgroup_v2.nonlogin: o.id] : [] binding { vnic_type = lookup(var.vnic_types, each.key, "normal") diff --git a/environments/skeleton/{{cookiecutter.environment}}/tofu/node_group/nodes.tf b/environments/skeleton/{{cookiecutter.environment}}/tofu/node_group/nodes.tf index 305b89e62..a6e850136 100644 --- a/environments/skeleton/{{cookiecutter.environment}}/tofu/node_group/nodes.tf +++ b/environments/skeleton/{{cookiecutter.environment}}/tofu/node_group/nodes.tf @@ -45,7 +45,8 @@ resource "openstack_networking_port_v2" "compute" { subnet_id = data.openstack_networking_subnet_v2.subnet[each.value.network].id } - security_group_ids = var.security_group_ids + port_security_enabled = lookup(each.value, "port_security_enabled", true) + security_group_ids = lookup(each.value, "port_security_enabled", true) ? var.security_group_ids : [] binding { vnic_type = lookup(var.vnic_types, each.value.network, "normal") diff --git a/environments/skeleton/{{cookiecutter.environment}}/tofu/variables.tf b/environments/skeleton/{{cookiecutter.environment}}/tofu/variables.tf index a6f398d09..11b5b771d 100644 --- a/environments/skeleton/{{cookiecutter.environment}}/tofu/variables.tf +++ b/environments/skeleton/{{cookiecutter.environment}}/tofu/variables.tf @@ -13,8 +13,9 @@ variable "cluster_networks" { type = list(map(string)) description = <<-EOT List of mappings defining networks. Mapping key/values: - network: Name of existing network - subnet: Name of existing subnet + network: Required. Name of existing network + subnet: Required. Name of existing subnet + port_security_enabled: Optional. Bool, default true EOT }