Skip to content

Commit 6148fc2

Browse files
vburckhardtvburckhardt
authored
feat: customer acl rules(#360)
* feat: give option to append or prepend ibm rules * feat: add a deny all as last element of the list (this is a best practice, and not mandatory as implicit - but absence typically raise questions) * feat: add prefix "ibmflow-" to ibm rules BREAKING CHANGE: The interface of the `network_acls` input variable has changed. If your code is setting this variable explicitly, this change requires to add a few extra optional parameters: `add_ibm_cloud_internal_rules`, `add_vpc_connectivity_rules`, `prepend_ibm_rules` . The parameter `add_cluster_rules` has been renamed `add_ibm_cloud_internal_rules`
1 parent c0abc72 commit 6148fc2

File tree

6 files changed

+107
-71
lines changed

6 files changed

+107
-71
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ You need the following permissions to run this module.
104104
| <a name="input_default_routing_table_name"></a> [default\_routing\_table\_name](#input\_default\_routing\_table\_name) | OPTIONAL - Name of the Default Routing Table. If null, a name will be automatically generated | `string` | `null` | no |
105105
| <a name="input_default_security_group_name"></a> [default\_security\_group\_name](#input\_default\_security\_group\_name) | OPTIONAL - Name of the Default Security Group. If null, a name will be automatically generated | `string` | `null` | no |
106106
| <a name="input_name"></a> [name](#input\_name) | Name for VPC | `string` | n/a | yes |
107-
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL. | <pre>list(<br> object({<br> name = string<br> network_connections = optional(list(string))<br> add_cluster_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_cluster_rules": true,<br> "name": "vpc-acl",<br> "rules": [<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "inbound",<br> "name": "allow-all-inbound",<br> "source": "0.0.0.0/0"<br> },<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "outbound",<br> "name": "allow-all-outbound",<br> "source": "0.0.0.0/0"<br> }<br> ]<br> }<br>]</pre> | no |
107+
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL. | <pre>list(<br> object({<br> name = string<br> network_connections = optional(list(string))<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "vpc-acl",<br> "prepend_ibm_rules": true,<br> "rules": [<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "inbound",<br> "name": "allow-all-443-inbound",<br> "source": "0.0.0.0/0",<br> "tcp": {<br> "port_max": 443,<br> "port_min": 443<br> }<br> },<br> {<br> "action": "allow",<br> "destination": "0.0.0.0/0",<br> "direction": "outbound",<br> "name": "allow-all-443-outbound",<br> "source": "0.0.0.0/0",<br> "tcp": {<br> "source_port_max": 443,<br> "source_port_min": 443<br> }<br> }<br> ]<br> }<br>]</pre> | no |
108108
| <a name="input_network_cidr"></a> [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no |
109109
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | n/a | yes |
110110
| <a name="input_region"></a> [region](#input\_region) | The region to which to deploy the VPC | `string` | n/a | yes |

‎common-dev-assets‎

‎module-metadata.json‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -92,26 +92,36 @@
9292
},
9393
"network_acls": {
9494
"name": "network_acls",
95-
"type": "list(\n object({\n name = string\n network_connections = optional(list(string))\n add_cluster_rules = optional(bool)\n rules = list(\n object({\n name = string\n action = string\n destination = string\n direction = string\n source = string\n tcp = optional(\n object({\n port_max = optional(number)\n port_min = optional(number)\n source_port_max = optional(number)\n source_port_min = optional(number)\n })\n )\n udp = optional(\n object({\n port_max = optional(number)\n port_min = optional(number)\n source_port_max = optional(number)\n source_port_min = optional(number)\n })\n )\n icmp = optional(\n object({\n type = optional(number)\n code = optional(number)\n })\n )\n })\n )\n })\n )",
95+
"type": "list(\n object({\n name = string\n network_connections = optional(list(string))\n add_ibm_cloud_internal_rules = optional(bool)\n add_vpc_connectivity_rules = optional(bool)\n prepend_ibm_rules = optional(bool)\n rules = list(\n object({\n name = string\n action = string\n destination = string\n direction = string\n source = string\n tcp = optional(\n object({\n port_max = optional(number)\n port_min = optional(number)\n source_port_max = optional(number)\n source_port_min = optional(number)\n })\n )\n udp = optional(\n object({\n port_max = optional(number)\n port_min = optional(number)\n source_port_max = optional(number)\n source_port_min = optional(number)\n })\n )\n icmp = optional(\n object({\n type = optional(number)\n code = optional(number)\n })\n )\n })\n )\n })\n )",
9696
"description": "List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL.",
9797
"default": [
9898
{
99-
"add_cluster_rules": true,
99+
"add_ibm_cloud_internal_rules": true,
100+
"add_vpc_connectivity_rules": true,
100101
"name": "vpc-acl",
102+
"prepend_ibm_rules": true,
101103
"rules": [
102104
{
103105
"action": "allow",
104106
"destination": "0.0.0.0/0",
105107
"direction": "inbound",
106-
"name": "allow-all-inbound",
107-
"source": "0.0.0.0/0"
108+
"name": "allow-all-443-inbound",
109+
"source": "0.0.0.0/0",
110+
"tcp": {
111+
"port_max": 443,
112+
"port_min": 443
113+
}
108114
},
109115
{
110116
"action": "allow",
111117
"destination": "0.0.0.0/0",
112118
"direction": "outbound",
113-
"name": "allow-all-outbound",
114-
"source": "0.0.0.0/0"
119+
"name": "allow-all-443-outbound",
120+
"source": "0.0.0.0/0",
121+
"tcp": {
122+
"source_port_max": 443,
123+
"source_port_min": 443
124+
}
115125
}
116126
]
117127
}
@@ -202,7 +212,7 @@
202212
],
203213
"pos": {
204214
"filename": "variables.tf",
205-
"line": 362
215+
"line": 374
206216
}
207217
},
208218
"security_group_rules": {
@@ -221,7 +231,7 @@
221231
],
222232
"pos": {
223233
"filename": "variables.tf",
224-
"line": 296
234+
"line": 308
225235
}
226236
},
227237
"subnets": {
@@ -259,7 +269,7 @@
259269
],
260270
"pos": {
261271
"filename": "variables.tf",
262-
"line": 233
272+
"line": 245
263273
}
264274
},
265275
"tags": {
@@ -312,7 +322,7 @@
312322
],
313323
"pos": {
314324
"filename": "variables.tf",
315-
"line": 207
325+
"line": 219
316326
}
317327
}
318328
},
@@ -419,7 +429,7 @@
419429
},
420430
"pos": {
421431
"filename": "network_acls.tf",
422-
"line": 121
432+
"line": 133
423433
}
424434
},
425435
"ibm_is_public_gateway.gateway": {

‎network_acls.tf‎

Lines changed: 59 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
##############################################################################
44

55
locals {
6-
cluster_rules = [
7-
# Cluster Rules
6+
ibm_cloud_internal_rules = [
7+
# IaaS and PaaS Rules. Note that this coarse grained list will be narrowed in upcoming releases.
88
{
9-
name = "roks-create-worker-nodes-inbound"
9+
name = "ibmflow-iaas-inbound"
1010
action = "allow"
1111
source = "161.26.0.0/16"
1212
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
@@ -16,7 +16,7 @@ locals {
1616
icmp = null
1717
},
1818
{
19-
name = "roks-create-worker-nodes-outbound"
19+
name = "ibmflow-iaas-outbound"
2020
action = "allow"
2121
destination = "161.26.0.0/16"
2222
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
@@ -26,7 +26,7 @@ locals {
2626
icmp = null
2727
},
2828
{
29-
name = "roks-nodes-to-service-inbound"
29+
name = "ibmflow-paas-inbound"
3030
action = "allow"
3131
source = "166.8.0.0/14"
3232
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
@@ -36,67 +36,62 @@ locals {
3636
icmp = null
3737
},
3838
{
39-
name = "roks-nodes-to-service-outbound"
39+
name = "ibmflow-paas-outbound"
4040
action = "allow"
4141
destination = "166.8.0.0/14"
4242
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
4343
direction = "outbound"
4444
tcp = null
4545
udp = null
4646
icmp = null
47-
},
48-
# App Rules
47+
}
48+
]
49+
50+
vpc_connectivity_rules = [
51+
# All connectivity across any subnet within VPC
52+
# TODO: narrow down to VPC address spaces
4953
{
50-
name = "allow-app-incoming-traffic-requests"
54+
name = "ibmflow-allow-vpc-connectivity-inbound"
5155
action = "allow"
5256
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
5357
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
5458
direction = "inbound"
55-
tcp = {
56-
source_port_min = 30000
57-
source_port_max = 32767
58-
}
59-
udp = null
60-
icmp = null
59+
tcp = null
60+
udp = null
61+
icmp = null
6162
},
6263
{
63-
name = "allow-app-outgoing-traffic-requests"
64+
name = "ibmflow-allow-vpc-connectivity-outbound"
6465
action = "allow"
6566
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
6667
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
6768
direction = "outbound"
68-
tcp = {
69-
port_min = 30000
70-
port_max = 32767
71-
}
72-
udp = null
73-
icmp = null
74-
},
69+
tcp = null
70+
udp = null
71+
icmp = null
72+
}
73+
]
74+
75+
deny_all_rules = [
7576
{
76-
name = "allow-lb-incoming-traffic-requests"
77-
action = "allow"
78-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
79-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
77+
name = "ibmflow-deny-all-inbound"
78+
action = "deny"
79+
source = "0.0.0.0/0"
80+
destination = "0.0.0.0/0"
8081
direction = "inbound"
81-
tcp = {
82-
port_min = 443
83-
port_max = 443
84-
}
85-
udp = null
86-
icmp = null
82+
tcp = null
83+
udp = null
84+
icmp = null
8785
},
8886
{
89-
name = "allow-lb-outgoing-traffic-requests"
90-
action = "allow"
91-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
92-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
87+
name = "ibmflow-deny-all-outbound"
88+
action = "deny"
89+
source = "0.0.0.0/0"
90+
destination = "0.0.0.0/0"
9391
direction = "outbound"
94-
tcp = {
95-
source_port_min = 443
96-
source_port_max = 443
97-
}
98-
udp = null
99-
icmp = null
92+
tcp = null
93+
udp = null
94+
icmp = null
10095
}
10196
]
10297

@@ -106,13 +101,30 @@ locals {
106101
network_acl.name => {
107102
name = network_acl.name
108103
rules = flatten([
104+
# Prepend ibm rules
109105
[
110106
# These rules cannot be added in a conditional operator due to inconsistant typing
111-
# This will add all cluster rules if the acl object contains add_cluster rules
112-
for rule in local.cluster_rules :
113-
rule if network_acl.add_cluster_rules == true
107+
# This will add all internal rules if the acl object contains add_ibm_cloud_internal_rules rules
108+
for rule in local.ibm_cloud_internal_rules :
109+
rule if network_acl.add_ibm_cloud_internal_rules == true && network_acl.prepend_ibm_rules == true
110+
],
111+
[
112+
for rule in local.vpc_connectivity_rules :
113+
rule if network_acl.add_vpc_connectivity_rules == true && network_acl.prepend_ibm_rules == true
114+
],
115+
# Customer rules
116+
network_acl.rules,
117+
# Append ibm rules
118+
[
119+
for rule in local.ibm_cloud_internal_rules :
120+
rule if network_acl.add_ibm_cloud_internal_rules == true && network_acl.prepend_ibm_rules != true
121+
],
122+
[
123+
for rule in local.vpc_connectivity_rules :
124+
rule if network_acl.add_vpc_connectivity_rules == true && network_acl.prepend_ibm_rules != true
114125
],
115-
network_acl.rules
126+
# Best practice to add deny all at the end of ACL
127+
local.deny_all_rules
116128
])
117129
}
118130
}

‎tests/pr_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ func TestRunBasicExample(t *testing.T) {
3232
}
3333

3434
func TestRunUpgradeBasicExample(t *testing.T) {
35+
// Breaking change in this PR leading to next major version - skip upgrade test
36+
t.Skip()
3537
t.Parallel()
3638

3739
options := setupOptions(t, "slz-vpc-upg")

‎variables.tf‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,11 @@ variable "network_acls" {
9999
description = "List of ACLs to create. Rules can be automatically created to allow inbound and outbound traffic from a VPC tier by adding the name of that tier to the `network_connections` list. Rules automatically generated by these network connections will be added at the beginning of a list, and will be web-tierlied to traffic first. At least one rule must be provided for each ACL."
100100
type = list(
101101
object({
102-
name = string
103-
network_connections = optional(list(string))
104-
add_cluster_rules = optional(bool)
102+
name = string
103+
network_connections = optional(list(string))
104+
add_ibm_cloud_internal_rules = optional(bool)
105+
add_vpc_connectivity_rules = optional(bool)
106+
prepend_ibm_rules = optional(bool)
105107
rules = list(
106108
object({
107109
name = string
@@ -138,20 +140,30 @@ variable "network_acls" {
138140

139141
default = [
140142
{
141-
name = "vpc-acl"
142-
add_cluster_rules = true
143+
name = "vpc-acl"
144+
add_ibm_cloud_internal_rules = true
145+
add_vpc_connectivity_rules = true
146+
prepend_ibm_rules = true
143147
rules = [
144148
{
145-
name = "allow-all-inbound"
146-
action = "allow"
147-
direction = "inbound"
149+
name = "allow-all-443-inbound"
150+
action = "allow"
151+
direction = "inbound"
152+
tcp = {
153+
port_min = 443
154+
port_max = 443
155+
}
148156
destination = "0.0.0.0/0"
149157
source = "0.0.0.0/0"
150158
},
151159
{
152-
name = "allow-all-outbound"
153-
action = "allow"
154-
direction = "outbound"
160+
name = "allow-all-443-outbound"
161+
action = "allow"
162+
direction = "outbound"
163+
tcp = {
164+
source_port_min = 443
165+
source_port_max = 443
166+
}
155167
destination = "0.0.0.0/0"
156168
source = "0.0.0.0/0"
157169
}

0 commit comments

Comments
 (0)