Skip to content

Commit 6718c01

Browse files
Aashiq-JAashiq-J
authored
feat: Enable creating network acls for disjoint ip address spaces (#542)
* feat: Enable creating network acls for disjoint ip address spaces * test: ignore vpc-acl * test: update variable description * test: update test for network_cidr * fix: update the looping logic * fix: update variable description
1 parent d0b9fdd commit 6718c01

File tree

18 files changed

+134
-77
lines changed

18 files changed

+134
-77
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ To attach access management tags to resources in this module, you need the follo
141141
| <a name="input_is_flow_log_collector_active"></a> [is\_flow\_log\_collector\_active](#input\_is\_flow\_log\_collector\_active) | Indicates whether the collector is active. If false, this collector is created in inactive mode. | `bool` | `true` | no |
142142
| <a name="input_name"></a> [name](#input\_name) | Name for VPC | `string` | n/a | yes |
143143
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | The list of ACLs to create. Provide at least one rule for each ACL. | <pre>list(<br> object({<br> name = string<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "vpc-acl",<br> "prepend_ibm_rules": true,<br> "rules": []<br> }<br>]</pre> | no |
144-
| <a name="input_network_cidr"></a> [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no |
144+
| <a name="input_network_cidrs"></a> [network\_cidrs](#input\_network\_cidrs) | List of Network CIDRs for the VPC. This is used to manage network ACL rules for cluster provisioning. | `list(string)` | <pre>[<br> "10.0.0.0/8"<br>]</pre> | no |
145145
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | n/a | yes |
146146
| <a name="input_region"></a> [region](#input\_region) | The region to which to deploy the VPC | `string` | n/a | yes |
147147
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the VPC to be created | `string` | n/a | yes |

‎dynamic_values.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ module "dynamic_values" {
1010
routes = var.routes
1111
use_public_gateways = var.use_public_gateways
1212
security_group_rules = var.security_group_rules
13-
network_cidr = var.network_cidr
13+
network_cidrs = var.network_cidrs
1414
network_acls = var.network_acls
1515
subnets = var.subnets
1616
public_gateways = ibm_is_public_gateway.gateway
@@ -54,7 +54,7 @@ module "unit_tests" {
5454
name = "test-rule"
5555
}
5656
]
57-
network_cidr = "1.2.3.4/5"
57+
network_cidrs = ["1.2.3.4/5"]
5858
network_acls = [
5959
{
6060
name = "acl"

‎dynamic_values.unit_tests.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ locals {
6666
# tflint-ignore: terraform_unused_declarations
6767
assert_cluster_rule_exists_in_position_0 = regex("roks-create-worker-nodes-inbound", module.unit_tests.acl_map["acl"].rules[0].name)
6868
# tflint-ignore: terraform_unused_declarations
69-
assert_cluster_rule_uses_network_cidr = regex("1.2.3.4/5", module.unit_tests.acl_map["acl"].rules[0].destination)
69+
assert_cluster_rule_uses_network_cidr = regex("0.0.0.0/0", module.unit_tests.acl_map["acl"].rules[0].destination)
7070
# tflint-ignore: terraform_unused_declarations
7171
assert_acl_rule_exists_in_last_position = regex("test-rule", module.unit_tests.acl_map["acl"].rules[length(module.unit_tests.acl_map["acl"].rules) - 1].name)
7272
# tflint-ignore: terraform_unused_declarations

‎dynamic_values/network_acls.tf‎

Lines changed: 43 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ locals {
1010
[
1111
# These rules cannot be added in a conditional operator due to inconsistant typing
1212
# This will add all cluster_rules if the acl object contains prepend_ibm_rules as true
13-
for rule in local.cluster_rules :
13+
for rule in local.rules :
1414
rule if network_acl.prepend_ibm_rules == true
1515
],
1616
network_acl.rules
@@ -33,7 +33,7 @@ locals {
3333
name = "roks-create-worker-nodes-inbound"
3434
action = "allow"
3535
source = "161.26.0.0/16"
36-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
36+
destination = "0.0.0.0/0"
3737
direction = "inbound"
3838
tcp = null
3939
udp = null
@@ -43,7 +43,7 @@ locals {
4343
name = "roks-create-worker-nodes-outbound"
4444
action = "allow"
4545
destination = "161.26.0.0/16"
46-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
46+
source = "0.0.0.0/0"
4747
direction = "outbound"
4848
tcp = null
4949
udp = null
@@ -53,7 +53,7 @@ locals {
5353
name = "roks-nodes-to-service-inbound"
5454
action = "allow"
5555
source = "166.8.0.0/14"
56-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
56+
destination = "0.0.0.0/0"
5757
direction = "inbound"
5858
tcp = null
5959
udp = null
@@ -63,18 +63,31 @@ locals {
6363
name = "roks-nodes-to-service-outbound"
6464
action = "allow"
6565
destination = "166.8.0.0/14"
66-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
66+
source = "0.0.0.0/0"
6767
direction = "outbound"
6868
tcp = null
6969
udp = null
7070
icmp = null
71-
},
72-
# App Rules
71+
}
72+
]
73+
74+
cluster_rules_list = flatten([
75+
for rules in local.cluster_rules : [
76+
for index, cidrs in var.network_cidrs != null ? var.network_cidrs : ["0.0.0.0/0"] :
77+
merge(rules, {
78+
name = "${rules.name}-${index}"
79+
source = cidrs
80+
})
81+
]
82+
])
83+
84+
# App Rules
85+
app_rules = [
7386
{
7487
name = "allow-app-incoming-traffic-requests"
7588
action = "allow"
76-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
77-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
89+
source = "0.0.0.0/0"
90+
destination = "0.0.0.0/0"
7891
direction = "inbound"
7992
tcp = {
8093
source_port_min = 30000
@@ -86,8 +99,8 @@ locals {
8699
{
87100
name = "allow-app-outgoing-traffic-requests"
88101
action = "allow"
89-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
90-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
102+
source = "0.0.0.0/0"
103+
destination = "0.0.0.0/0"
91104
direction = "outbound"
92105
tcp = {
93106
port_min = 30000
@@ -99,8 +112,8 @@ locals {
99112
{
100113
name = "allow-lb-incoming-traffic-requests"
101114
action = "allow"
102-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
103-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
115+
source = "0.0.0.0/0"
116+
destination = "0.0.0.0/0"
104117
direction = "inbound"
105118
tcp = {
106119
port_min = 443
@@ -112,8 +125,8 @@ locals {
112125
{
113126
name = "allow-lb-outgoing-traffic-requests"
114127
action = "allow"
115-
source = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
116-
destination = var.network_cidr != null ? var.network_cidr : "0.0.0.0/0"
128+
source = "0.0.0.0/0"
129+
destination = "0.0.0.0/0"
117130
direction = "outbound"
118131
tcp = {
119132
source_port_min = 443
@@ -123,6 +136,21 @@ locals {
123136
icmp = null
124137
}
125138
]
139+
140+
141+
app_rules_list = flatten([
142+
for rules in local.app_rules : [
143+
for index, cidrs in var.network_cidrs != null ? var.network_cidrs : ["0.0.0.0/0"] :
144+
merge(rules, {
145+
name = "${rules.name}-${index}"
146+
source = cidrs
147+
destination = cidrs
148+
})
149+
]
150+
])
151+
152+
rules = concat(local.cluster_rules_list, local.app_rules_list)
153+
126154
}
127155

128156
##############################################################################

‎dynamic_values/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ output "security_group_rules" {
4848

4949
output "cluster_rules" {
5050
description = "Cluster creation ACL allow rules"
51-
value = local.cluster_rules
51+
value = local.rules
5252
}
5353

5454
##############################################################################

‎dynamic_values/variables.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,9 +108,9 @@ variable "security_group_rules" {
108108
# Network CIDR
109109
##############################################################################
110110

111-
variable "network_cidr" {
112-
description = "direct reference to network cidr"
113-
type = string
111+
variable "network_cidrs" {
112+
description = "direct reference to network cidrs"
113+
type = list(string)
114114
}
115115

116116
##############################################################################

‎examples/default/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,4 +54,5 @@ module "slz_vpc" {
5454
existing_cos_instance_guid = ibm_resource_instance.cos_instance[0].guid
5555
existing_storage_bucket_name = ibm_cos_bucket.cos_bucket[0].bucket_name
5656
address_prefixes = var.address_prefixes
57+
network_cidrs = var.network_cidrs
5758
}

‎examples/default/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,9 @@ variable "address_prefixes" {
8585
condition = var.address_prefixes == null ? true : (keys(var.address_prefixes)[0] == "zone-1" && keys(var.address_prefixes)[1] == "zone-2" && keys(var.address_prefixes)[2] == "zone-3")
8686
}
8787
}
88+
89+
variable "network_cidrs" {
90+
description = "List of Network CIDRs for the VPC. This is used to manage network ACL rules for cluster provisioning."
91+
type = list(string)
92+
default = ["10.0.0.0/8", "164.0.0.0/8"]
93+
}

‎landing-zone-submodule/management-vpc/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ No resources.
4343
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | IBM Cloud API Key that will be used for authentication in scripts run in this module. Only required if certain options are chosen, such as the 'clean\_default\_*' variables being 'true'. | `string` | `null` | no |
4444
| <a name="input_ibmcloud_api_visibility"></a> [ibmcloud\_api\_visibility](#input\_ibmcloud\_api\_visibility) | IBM Cloud API visibility used by scripts run in this module. Must be 'public', 'private', or 'public-and-private' | `string` | `"public"` | no |
4545
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of network ACLs to create with VPC | <pre>list(<br> object({<br> name = string<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "management-acl",<br> "prepend_ibm_rules": true,<br> "rules": []<br> }<br>]</pre> | no |
46-
| <a name="input_network_cidr"></a> [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no |
46+
| <a name="input_network_cidrs"></a> [network\_cidrs](#input\_network\_cidrs) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `list(string)` | <pre>[<br> "10.0.0.0/8"<br>]</pre> | no |
4747
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | `"management"` | no |
4848
| <a name="input_region"></a> [region](#input\_region) | The region to which to deploy the VPC | `string` | `"au-syd"` | no |
4949
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the VPC to be created | `string` | n/a | yes |

‎landing-zone-submodule/management-vpc/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ module "management_vpc" {
1010
resource_group_id = var.resource_group_id
1111
region = var.region
1212
prefix = var.prefix
13-
network_cidr = var.network_cidr
13+
network_cidrs = var.network_cidrs
1414
classic_access = var.classic_access
1515
default_network_acl_name = var.default_network_acl_name
1616
default_security_group_name = var.default_security_group_name

0 commit comments

Comments
 (0)