You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+19-3Lines changed: 19 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,7 @@ This module creates the following IBM Cloud® Virtual Private Cloud (VPC) net
14
14
- Network ACLs: Create network ACLs with multiple rules. By default, VPC network ACLs can have no more than 25 rules.
15
15
- VPN gateways: Create VPN gateways on your subnets by using the `vpn_gateways` variable. For more information about VPN gateways on VPC, see [About site-to-site VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) in the IBM Cloud docs.
16
16
- VPN gateway connections: Add connections to a VPN gateway.
17
+
- Hub and spoke DNS-sharing model: Optionally create a hub or spoke VPC, with associated custom resolver and DNS resolution binding. See [About DNS sharing for VPE gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model) in the IBM Cloud docs for details.
17
18
18
19
19
20
@@ -82,6 +83,8 @@ To attach access management tags to resources in this module, you need the follo
82
83
83
84
-[ Basic Example](examples/basic)
84
85
-[ Default Example](examples/default)
86
+
-[ Hub and Spoke VPC with manual DNS resolver Example](examples/hub-spoke-manual-resolver)
87
+
-[ Hub and Spoke VPC Example](examples/hub-spoke)
85
88
-[ Landing Zone example](examples/landing_zone)
86
89
-[ No Prefix Example](examples/no-prefix)
87
90
<!-- END EXAMPLES HOOK -->
@@ -93,7 +96,7 @@ To attach access management tags to resources in this module, you need the follo
|[ibm_is_vpc_address_prefixes.get_address_prefixes](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_vpc_address_prefixes)| data source |
125
130
@@ -135,31 +140,42 @@ To attach access management tags to resources in this module, you need the follo
135
140
| <aname="input_default_network_acl_name"></a> [default\_network\_acl\_name](#input\_default\_network\_acl\_name)| OPTIONAL - Name of the Default ACL. If null, a name will be automatically generated |`string`|`null`| no |
136
141
| <aname="input_default_routing_table_name"></a> [default\_routing\_table\_name](#input\_default\_routing\_table\_name)| OPTIONAL - Name of the Default Routing Table. If null, a name will be automatically generated |`string`|`null`| no |
137
142
| <aname="input_default_security_group_name"></a> [default\_security\_group\_name](#input\_default\_security\_group\_name)| OPTIONAL - Name of the Default Security Group. If null, a name will be automatically generated |`string`|`null`| no |
143
+
| <aname="input_dns_location"></a> [dns\_location](#input\_dns\_location)| The target location or environment for the DNS instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable\_hub is true and skip\_custom\_resolver\_hub\_creation is false (defaults). |`string`|`"global"`| no |
144
+
| <aname="input_dns_plan"></a> [dns\_plan](#input\_dns\_plan)| The plan for the DNS resource instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable\_hub is true and skip\_custom\_resolver\_hub\_creation is false (defaults). |`string`|`"standard-dns"`| no |
138
145
| <aname="input_enable_hub"></a> [enable\_hub](#input\_enable\_hub)| Indicates whether this VPC is enabled as a DNS name resolution hub. |`bool`|`false`| no |
146
+
| <aname="input_enable_hub_vpc_crn"></a> [enable\_hub\_vpc\_crn](#input\_enable\_hub\_vpc\_crn)| Indicates whether Hub VPC CRN is passed. |`bool`|`false`| no |
147
+
| <aname="input_enable_hub_vpc_id"></a> [enable\_hub\_vpc\_id](#input\_enable\_hub\_vpc\_id)| Indicates whether Hub VPC ID is passed. |`bool`|`false`| no |
139
148
| <aname="input_enable_vpc_flow_logs"></a> [enable\_vpc\_flow\_logs](#input\_enable\_vpc\_flow\_logs)| Flag to enable vpc flow logs. If true, flow log collector will be created |`bool`|`false`| no |
140
149
| <aname="input_existing_cos_instance_guid"></a> [existing\_cos\_instance\_guid](#input\_existing\_cos\_instance\_guid)| GUID of the COS instance to create Flow log collector |`string`|`null`| no |
150
+
| <aname="input_existing_dns_instance_id"></a> [existing\_dns\_instance\_id](#input\_existing\_dns\_instance\_id)| Id of an existing dns instance in which the custom resolver is created. Only relevant if enable\_hub is set to true. |`string`|`null`| no |
141
151
| <aname="input_existing_storage_bucket_name"></a> [existing\_storage\_bucket\_name](#input\_existing\_storage\_bucket\_name)| Name of the COS bucket to collect VPC flow logs |`string`|`null`| no |
142
-
| <aname="input_hub_vpc_crn"></a> [hub\_vpc\_crn](#input\_hub\_vpc\_crn)|Hub VPC CRN|`string`|`null`| no |
143
-
| <aname="input_hub_vpc_id"></a> [hub\_vpc\_id](#input\_hub\_vpc\_id)|Hub VPC ID|`string`|`null`| no |
152
+
| <aname="input_hub_vpc_crn"></a> [hub\_vpc\_crn](#input\_hub\_vpc\_crn)|Indicates the crn of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub\_vpc\_id.|`string`|`null`| no |
153
+
| <aname="input_hub_vpc_id"></a> [hub\_vpc\_id](#input\_hub\_vpc\_id)|Indicates the id of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub\_vpc\_crn.|`string`|`null`| no |
144
154
| <aname="input_ibmcloud_api_visibility"></a> [ibmcloud\_api\_visibility](#input\_ibmcloud\_api\_visibility)| IBM Cloud API visibility used by scripts run in this module. Must be 'public', 'private', or 'public-and-private' |`string`|`"public"`| no |
145
155
| <aname="input_is_flow_log_collector_active"></a> [is\_flow\_log\_collector\_active](#input\_is\_flow\_log\_collector\_active)| Indicates whether the collector is active. If false, this collector is created in inactive mode. |`bool`|`true`| no |
156
+
| <aname="input_manual_servers"></a> [manual\_servers](#input\_manual\_servers)| The DNS server addresses to use for the VPC, replacing any existing servers. All the entries must either have a unique zone\_affinity, or not have a zone\_affinity. | <pre>list(object({<br> address = string<br> zone_affinity = optional(string)<br> }))</pre> |`[]`| no |
146
157
| <aname="input_name"></a> [name](#input\_name)| Name for VPC |`string`| n/a | yes |
147
158
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | The list of ACLs to create. Provide at least one rule for each ACL. | <pre>list(<br> object({<br> name = string<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "vpc-acl",<br> "prepend_ibm_rules": true,<br> "rules": []<br> }<br>]</pre> | no |
148
159
| <aname="input_network_cidrs"></a> [network\_cidrs](#input\_network\_cidrs)| List of Network CIDRs for the VPC. This is used to manage network ACL rules for cluster provisioning. |`list(string)`| <pre>[<br> "10.0.0.0/8"<br>]</pre> | no |
149
160
| <aname="input_prefix"></a> [prefix](#input\_prefix)| The prefix that you would like to append to your resources. Explicitly set to null if you do not wish to use a prefix. |`string`| n/a | yes |
150
161
| <aname="input_region"></a> [region](#input\_region)| The region to which to deploy the VPC |`string`| n/a | yes |
162
+
| <aname="input_resolver_type"></a> [resolver\_type](#input\_resolver\_type)| Resolver type. Can be system or manual. For delegated resolver type, see the update\_delegated\_resolver variable instead. |`string`|`null`| no |
151
163
| <aname="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id)| The resource group ID where the VPC to be created |`string`| n/a | yes |
152
164
| <aname="input_routes"></a> [routes](#input\_routes)| OPTIONAL - Allows you to specify the next hop for packets based on their destination address | <pre>list(<br> object({<br> name = string<br> route_direct_link_ingress = optional(bool)<br> route_transit_gateway_ingress = optional(bool)<br> route_vpc_zone_ingress = optional(bool)<br> routes = optional(<br> list(<br> object({<br> action = optional(string)<br> zone = number<br> destination = string<br> next_hop = string<br> })<br> ))<br> })<br> )</pre> |`[]`| no |
153
165
| <aname="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules)| A list of security group rules to be added to the default vpc security group (default empty) | <pre>list(<br> object({<br> name = string<br> direction = string<br> remote = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )</pre> |`[]`| no |
166
+
| <aname="input_skip_custom_resolver_hub_creation"></a> [skip\_custom\_resolver\_hub\_creation](#input\_skip\_custom\_resolver\_hub\_creation)| Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable\_hub is set to true. |`bool`|`false`| no |
154
167
| <a name="input_subnets"></a> [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created | <pre>object({<br> zone-1 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-2 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-3 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> })</pre> | <pre>{<br> "zone-1": [<br> {<br> "acl_name": "vpc-acl",<br> "cidr": "10.10.10.0/24",<br> "name": "subnet-a",<br> "public_gateway": true<br> }<br> ],<br> "zone-2": [<br> {<br> "acl_name": "vpc-acl",<br> "cidr": "10.20.10.0/24",<br> "name": "subnet-b",<br> "public_gateway": true<br> }<br> ],<br> "zone-3": [<br> {<br> "acl_name": "vpc-acl",<br> "cidr": "10.30.10.0/24",<br> "name": "subnet-c",<br> "public_gateway": false<br> }<br> ]<br>}</pre> | no |
155
168
| <aname="input_tags"></a> [tags](#input\_tags)| List of Tags for the resource created |`list(string)`|`null`| no |
169
+
| <aname="input_update_delegated_resolver"></a> [update\_delegated\_resolver](#input\_update\_delegated\_resolver)| If set to true, and if the vpc is configured to be a spoke for DNS resolution (enable\_hub\_vpc\_crn or enable\_hub\_vpc\_id set), then the spoke VPC resolver will be updated to a delegated resolver. |`bool`|`false`| no |
170
+
| <aname="input_use_existing_dns_instance"></a> [use\_existing\_dns\_instance](#input\_use\_existing\_dns\_instance)| Whether to use an existing dns instance. If true, existing\_dns\_instance\_id must be set. |`bool`|`false`| no |
156
171
| <aname="input_use_public_gateways"></a> [use\_public\_gateways](#input\_use\_public\_gateways)| Create a public gateway in any of the three zones with `true`. | <pre>object({<br> zone-1 = optional(bool)<br> zone-2 = optional(bool)<br> zone-3 = optional(bool)<br> })</pre> | <pre>{<br> "zone-1": true,<br> "zone-2": false,<br> "zone-3": false<br>}</pre> | no |
157
172
158
173
### Outputs
159
174
160
175
| Name | Description |
161
176
|------|-------------|
162
177
| <aname="output_cidr_blocks"></a> [cidr\_blocks](#output\_cidr\_blocks)| List of CIDR blocks present in VPC stack |
178
+
| <aname="output_custom_resolver_hub"></a> [custom\_resolver\_hub](#output\_custom\_resolver\_hub)| The custom resolver created for the hub vpc. Only set if enable\_hub is set and skip\_custom\_resolver\_hub\_creation is false. |
163
179
| <aname="output_network_acls"></a> [network\_acls](#output\_network\_acls)| List of shortnames and IDs of network ACLs |
164
180
| <aname="output_public_gateways"></a> [public\_gateways](#output\_public\_gateways)| Map of public gateways by zone |
165
181
| <aname="output_subnet_detail_list"></a> [subnet\_detail\_list](#output\_subnet\_detail\_list)| A list of subnets containing names, CIDR blocks, and zones. |
# Hub and Spoke VPC with manual DNS resolver Example
2
+
3
+
This example demostrates how to deploy hub and spoke VPCs, inclusive of enabling DNS-sharing using a manual DNS resolver in the spoke VPC (as opposed to a delegated resolver).
4
+
5
+
Caveat: Using a manual resolver, as opposed to a delegated resolver requires to ensure that the custom resolver IPs in the hub VPC do not change outside the terraform lifecycle (which should be the case if you follow a proper IaC approach).
6
+
7
+
Refer to the documentation [here](../hub-spoke/) if you are new to hub-spoke dns-sharing VPC topology.
0 commit comments