Support fixed IP addresses for nodes

docs/production.md

@@ -134,22 +134,9 @@ and referenced from the `site` and `production` environments, e.g.:
 
 - Consider whether having (read-only) access to Grafana without login is OK. If not, remove `grafana_auth_anonymous` in `environments/$ENV/inventory/group_vars/all/grafana.yml`
 
-- Modify `environments/site/tofu/nodes.tf` to provide fixed IPs for at least
-  the control node, and (if not using FIPs) the login node(s):
-
-    ```
-    resource "openstack_networking_port_v2" "control" {
-        ...
-        fixed_ip {
-            subnet_id = data.openstack_networking_subnet_v2.cluster_subnet.id
-            ip_address = var.control_ip_address
-        }
-    }
-    ```
-
-  Note the variable `control_ip_address` is new.
-
-  Using fixed IPs will require either using admin credentials or policy changes.
+- If fixed IP(s) are required for the control node, set the OpenTofu variable
+  `control_ip_addresses`. This will require either using admin credentials or
+  policy changes.
 
 - If floating IPs are required for login nodes, modify the OpenTofu configurations
   appropriately.

environments/skeleton/{{cookiecutter.environment}}/tofu/control.tf

@@ -24,7 +24,8 @@ resource "openstack_networking_port_v2" "control" {
   admin_state_up = "true"
 
   fixed_ip {
-    subnet_id = data.openstack_networking_subnet_v2.cluster_subnet[each.key].id
+    subnet_id  = data.openstack_networking_subnet_v2.cluster_subnet[each.key].id
+    ip_address = lookup(var.control_ip_addresses, each.key, null)
   }
 
   no_security_groups = lookup(each.value, "no_security_groups", false)

environments/skeleton/{{cookiecutter.environment}}/tofu/variables.tf

@@ -24,6 +24,20 @@ variable "key_pair" {
     description = "Name of an existing keypair in OpenStack"
 }
 
+variable "control_ip_addresses" {
+    type        = map(string)
+    description = <<-EOT
+        Mapping of fixed IP addresses for control node, keyed by network name.
+        The default means the cloud will select an address.
+    EOT
+    default     = {}
+    validation {
+        # check all keys are network names in cluster_networks
+        condition = length(setsubtract(keys(var.control_ip_addresses), [for n in var.cluster_networks: n.network])) == 0
+        error_message = "keys in var.control_ip_addresses must match network names in var.cluster_networks"
+    }
+}
+
 variable "control_node_flavor" {
     type = string
     description = "Flavor name for control node"