Skip to content

Commit 5f11656

Browse files
imprateekshimprateeksh
authored
fix: Added example to add rules to security groups (#110)
1 parent dc20882 commit 5f11656

File tree

8 files changed

+476
-0
lines changed

8 files changed

+476
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,7 @@ You need the following permissions to run this module.
115115
<!-- BEGIN EXAMPLES HOOK -->
116116
## Examples
117117

118+
- [ Add Rules to Security Groups Example](examples/add_rules_to_sg)
118119
- [ Apply Taints Example](examples/apply_taints)
119120
- [ Existing COS](examples/existing_cos)
120121
- [ 2 MZR clusters in same VPC](examples/multiple_mzr_clusters)

‎examples/add_rules_to_sg/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Add Rules to Security Groups Example
2+
3+
This example will add security rules to the `kube-<vpcid>` and `kube-<clusterId>` security groups

‎examples/add_rules_to_sg/main.tf‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
##############################################################################
2+
# Provision an OCP cluster with one extra worker pool inside a VPC
3+
##############################################################################
4+
5+
module "resource_group" {
6+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-resource-group.git?ref=v1.0.5"
7+
# if an existing resource group is not set (null) create a new one using prefix
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
9+
existing_resource_group_name = var.resource_group
10+
}
11+
12+
###############################################################################
13+
# VPC
14+
###############################################################################
15+
16+
module "vpc" {
17+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc.git?ref=v5.0.1"
18+
resource_group_id = module.resource_group.resource_group_id
19+
region = var.region
20+
prefix = var.prefix
21+
tags = var.resource_tags
22+
name = var.vpc_name
23+
address_prefixes = var.addresses
24+
subnets = var.subnets
25+
use_public_gateways = var.public_gateway
26+
}
27+
28+
29+
##############################################################################
30+
# Security Group Rules addition.
31+
##############################################################################
32+
33+
# Kube-<vpc id> Security Group
34+
data "ibm_is_security_group" "kube_vpc_sg" {
35+
name = "kube-${module.ocp_base.vpc_id}"
36+
}
37+
38+
resource "ibm_is_security_group_rule" "kube_vpc_rules" {
39+
40+
for_each = { for rule in var.sg_rules_vpc : rule.name => rule }
41+
group = data.ibm_is_security_group.kube_vpc_sg.id
42+
direction = each.value.direction
43+
remote = each.value.remote
44+
45+
dynamic "tcp" {
46+
for_each = each.value.tcp == null ? [] : [each.value]
47+
content {
48+
port_min = each.value.tcp.port_min
49+
port_max = each.value.tcp.port_max
50+
}
51+
}
52+
53+
dynamic "udp" {
54+
for_each = each.value.udp == null ? [] : [each.value]
55+
content {
56+
port_min = each.value.udp.port_min
57+
port_max = each.value.udp.port_max
58+
}
59+
}
60+
61+
dynamic "icmp" {
62+
for_each = each.value.icmp == null ? [] : [each.value]
63+
content {
64+
type = lookup(each.value.icmp, "type", null)
65+
code = lookup(each.value.icmp, "code", null)
66+
}
67+
}
68+
}
69+
70+
# Kube-<cluster id> Security Group
71+
data "ibm_is_security_group" "kube_cluster_sg" {
72+
name = "kube-${module.ocp_base.cluster_id}"
73+
}
74+
75+
resource "ibm_is_security_group_rule" "kube_cluster_rules" {
76+
77+
for_each = { for rule in var.sg_rules_cluster : rule.name => rule }
78+
group = data.ibm_is_security_group.kube_cluster_sg.id
79+
direction = each.value.direction
80+
remote = each.value.remote
81+
82+
dynamic "tcp" {
83+
for_each = each.value.tcp == null ? [] : [each.value]
84+
content {
85+
port_min = each.value.tcp.port_min
86+
port_max = each.value.tcp.port_max
87+
}
88+
}
89+
90+
dynamic "udp" {
91+
for_each = each.value.udp == null ? [] : [each.value]
92+
content {
93+
port_min = each.value.udp.port_min
94+
port_max = each.value.udp.port_max
95+
}
96+
}
97+
98+
dynamic "icmp" {
99+
for_each = each.value.icmp == null ? [] : [each.value]
100+
content {
101+
type = lookup(each.value.icmp, "type", null)
102+
code = lookup(each.value.icmp, "code", null)
103+
}
104+
}
105+
}
106+
107+
##############################################################################
108+
# Key Protect
109+
##############################################################################
110+
111+
module "kp_all_inclusive" {
112+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-key-protect-all-inclusive.git?ref=v4.0.0"
113+
key_protect_instance_name = "${var.prefix}-kp-instance"
114+
resource_group_id = module.resource_group.resource_group_id
115+
region = var.region
116+
resource_tags = var.resource_tags
117+
key_map = { "ocp" = ["${var.prefix}-cluster-key"] }
118+
}
119+
120+
##############################################################################
121+
# Base OCP Cluster
122+
##############################################################################
123+
124+
module "ocp_base" {
125+
source = "../.."
126+
cluster_name = var.prefix
127+
ibmcloud_api_key = var.ibmcloud_api_key
128+
resource_group_id = module.resource_group.resource_group_id
129+
region = var.region
130+
force_delete_storage = true
131+
vpc_id = module.vpc.vpc_id
132+
vpc_subnets = module.vpc.subnet_detail_map
133+
worker_pools = var.worker_pools
134+
ocp_version = var.ocp_version
135+
tags = var.resource_tags
136+
kms_config = {
137+
instance_id = module.kp_all_inclusive.key_protect_guid
138+
crk_id = module.kp_all_inclusive.keys["ocp.${var.prefix}-cluster-key"].key_id
139+
}
140+
}
141+
142+
##############################################################################

‎examples/add_rules_to_sg/outputs.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "cluster_name" {
6+
value = module.ocp_base.cluster_name
7+
description = "The name of the provisioned cluster."
8+
}
9+
10+
11+
output "kube_vpc_rule_id" {
12+
description = "The kube-vpc-id security group rule ids"
13+
value = join(",", [for rule in data.ibm_is_security_group.kube_vpc_sg.rules : rule.rule_id])
14+
}
15+
16+
17+
output "kube_cluster_rule_id" {
18+
description = "The kube-cluster-id security group rule ids"
19+
value = join(",", [for rule in data.ibm_is_security_group.kube_cluster_sg.rules : rule.rule_id])
20+
}
21+
22+
##############################################################################

‎examples/add_rules_to_sg/provider.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
##############################################################################
2+
# Terraform providers
3+
##############################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}
9+
10+
##############################################################################

0 commit comments

Comments
 (0)