Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# IBM Secure Landing Zone VPC module
# IBM Secure Landing Zone VPC Module

[![Graduated (Supported)](https://img.shields.io/badge/status-Graduated%20(Supported)-brightgreen?style=plastic)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
Expand All @@ -12,11 +12,11 @@ This module creates the following IBM Cloud® Virtual Private Cloud (VPC) net
- Public gateways: Optionally create public gateways in the VPC in each of the three zones of the VPC's region.
- Subnets: Create one to three zones in the [subnet.tf](subnet.tf) file.
- Network ACLs: Create network ACLs with multiple rules. By default, VPC network ACLs can have no more than 25 rules.
- VPN gateways: Create VPN gateways on your subnets by using the `vpn_gateways` variable. For more information about VPN gateways on VPC, see [About site-to-site VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) in the IBM Cloud docs.
- VPN gateways: Create VPN gateways on your subnets by using the `vpn_gateways` variable. For more information about VPN gateways on VPC, see [About site-to-site VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) in the IBM Cloud documentation.
- VPN gateway connections: Add connections to a VPN gateway.
- Hub and spoke DNS-sharing model: Optionally create a hub or spoke VPC, with associated custom resolver and DNS resolution binding. See [About DNS sharing for VPE gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model) in the IBM Cloud docs for details.
- Hub and spoke DNS-sharing model: Optionally create a hub or spoke VPC, with associated custom resolver and DNS resolution binding. See [About DNS sharing for VPE gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model) in the IBM Cloud documentation for details.

![vpc-module](https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/.docs/vpc-module.png)
![VPC Module](https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/.docs/vpc-module.png)

<!-- Below content is automatically populated via pre-commit hook -->
<!-- BEGIN OVERVIEW HOOK -->
Expand Down Expand Up @@ -60,7 +60,7 @@ module vpc {

### Resource naming

The module automatically generates names for the all provisioned VPC resources using the `var.prefix` input variable. You can selectively override this behavior by giving explicit names through the following input variables: `name` (for VPC name), `dns_binding_name`, `dns_instance_name`, `dns_custom_resolver_name`, `routing_table_name`, `public_gateway_name`, and `vpc_flow_logs_name`.
The module automatically generates names for all provisioned VPC resources using the `var.prefix` input variable. You can selectively override this behavior by providing explicit names through the following input variables: `name` (for VPC name), `dns_binding_name`, `dns_instance_name`, `dns_custom_resolver_name`, `routing_table_name`, `public_gateway_name`, and `vpc_flow_logs_name`.

### Subnets

Expand Down Expand Up @@ -207,6 +207,6 @@ To attach access management tags to resources in this module, you need the follo

## Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See [Report an issue or request a feature](https://github.com/terraform-ibm-modules/.github/blob/main/.github/SUPPORT.md).
You can report issues and request features for this module in GitHub issues in the module repository. See [Report an issue or request a feature](https://github.com/terraform-ibm-modules/.github/blob/main/.github/SUPPORT.md).

To set up your local development environment, see [Local development setup](https://terraform-ibm-modules.github.io/documentation/#/local-dev-setup) in the project documentation.
To set up your local development environment, see [Local Development Setup](https://terraform-ibm-modules.github.io/documentation/#/local-dev-setup) in the project documentation.
2 changes: 1 addition & 1 deletion examples/default/README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Default Example

An end to end example using the module's default variable values.
An end-to-end example using the module's default variable values.
2 changes: 1 addition & 1 deletion examples/existing_vpc/README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Existing VPC and subnets Example
# Existing VPC and Subnets Example

An example of calling the module with an existing VPC and subnets.
13 changes: 7 additions & 6 deletions examples/hub-spoke-delegated-resolver/README.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
# Hub and Spoke VPC Example

This example demonstrates how to deploy hub and spoke VPCs, inclusive of enabling DNS-sharing. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model for details.
- The 2 VPCs are connected through a transit gateway.

- The two VPCs are connected through a transit gateway.
- The hub VPC is configured with a custom resolver.
- The spoke VPC is configured with a delegated DNS resolver. DNS requests are resolved by the hub VPC.
- A DNS resolution binding relationship is configured to enable the hub VPC to DNS resolve VPE in the spoke VPC.


:exclamation: **Important**: Due to a limitation in the IBM Cloud terraform provider (1.59), there is a need to perform 2 applies as follows to end up with the desired topology:
1. The first terraform apply lay down all of the topology, but does not configure the DNS resolver to delegated in the spoke
2. The second terraform apply should have the update_delegated_resolver variable to true to configure the DNS resolver to be delegated ```terraform apply -var=update_delegated_resolver=true```
:exclamation: **Important**: Due to a limitation in the IBM Cloud terraform provider (1.59), there is a need to perform two applies as follows to end up with the desired topology:
1. The first terraform apply lays down all of the topology but does not configure the DNS resolver to delegated in the spoke
2. The second terraform apply should have the update_delegated_resolver variable set to true to configure the DNS resolver to be delegated ```terraform apply -var=update_delegated_resolver=true```

In order to perform a successful destroy, please set to the resolver to "system" in the spoke VPC through the UI before issuing the terraform destroy - see https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-configure-dns-resolver&interface=ui
To successfully destroy, set the resolver to "system" in the spoke VPC through the UI before issuing the terraform destroy - see https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-configure-dns-resolver&interface=ui

You may also be interested in the [Hub and Spoke VPC with manual DNS resolver Example](../hub-spoke-manual-resolver/) which does not exhibit those issues.
You may also be interested in the [Hub and Spoke VPC with Manual DNS Resolver Example](../hub-spoke-manual-resolver/) which does not exhibit those issues.
8 changes: 4 additions & 4 deletions examples/hub-spoke-manual-resolver/README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Hub and Spoke VPC with manual DNS resolver Example
# Hub and Spoke VPC with Manual DNS Resolver Example

This example demostrates how to deploy hub and spoke VPCs, inclusive of enabling DNS-sharing using a manual DNS resolver in the spoke VPC (as opposed to a delegated resolver).
This example demonstrates how to deploy hub and spoke VPCs, inclusive of enabling DNS-sharing using a manual DNS resolver in the spoke VPC (as opposed to a delegated resolver).

Caveat: Using a manual resolver, as opposed to a delegated resolver requires to ensure that the custom resolver IPs in the hub VPC do not change outside the terraform lifecycle (which should be the case if you follow a proper IaC approach).
Caveat: Using a manual resolver, as opposed to a delegated resolver, requires ensuring that the custom resolver IPs in the hub VPC do not change outside the Terraform lifecycle (which should be the case if you follow a proper IaC approach).

Refer to the documentation [here](../hub-spoke-delegated-resolver/) if you are new to hub-spoke dns-sharing VPC topology.
Refer to the documentation [here](../hub-spoke-delegated-resolver/) if you are new to hub-spoke DNS-sharing VPC topology.
6 changes: 3 additions & 3 deletions examples/landing_zone/README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Landing Zone example
# Landing Zone Example

This example demonstrates how to use the management and workload VPC [modules](../../landing-zone-submodule/) to create a network VPC topology that is aligned with the network segregation key principles of the IBM Cloud [Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview).
This example demonstrates how to use the management and workload VPC [modules](../../landing-zone-submodule/) to create a network VPC topology that aligns with the network segregation key principles of the IBM Cloud [Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview).

The example shows how to use the base modules to create the following topology:
- A management VPC
- A workload VPC
- A transit gateway that connects the two VPCs
- A transit gateway connecting the two VPCs

:exclamation: **Important:** The topology created in this example does not meet all compliance controls for the IBM Cloud Framework for Financial Services. Use the [terraform-ibm-landing-zone](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone) module to create a fully compliant stack.
4 changes: 2 additions & 2 deletions examples/no-prefix/README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# No Prefix Example
## No Prefix Example

An example similar to the default example except in this example the prefix is hard-coded to be null.
An example similar to the default example, but in this case, the prefix is hardcoded to be null.
4 changes: 2 additions & 2 deletions landing-zone-submodule/management-vpc/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Landing Zone management VPC (standalone)
# Landing Zone Management VPC (Standalone)

This specialized submodule calls the root [landing-zone-vpc module](../..) with a preset configuration that results in a management VPC with a topology that is identical to the management VPC that is created by the [terraform-ibm-landing-zone module](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main).
This specialized submodule calls the root [landing-zone-vpc module](../..) with a preset configuration that results in a management VPC with a topology that is identical to the management VPC created by the [terraform-ibm-landing-zone module](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main).

You can use this submodule when you need more modularity to create your topology than the terraform-ibm-landing-zone module provides. This submodule provides one of the building blocks for this topology.

Expand Down
4 changes: 2 additions & 2 deletions landing-zone-submodule/workload-vpc/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Landing Zone workload VPC (standalone)
# Landing Zone Workload VPC (Standalone)

This specialized submodule calls the root [landing-zone-vpc module](../..) with a preset configuration that results in a workload VPC with a topology that is identical to the workload VPC that is created by the [terraform-ibm-landing-zone module](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main).
This specialized submodule calls the root [landing-zone-vpc module](../..) with a preset configuration that results in a workload VPC with a topology that is identical to the workload VPC created by the [terraform-ibm-landing-zone module](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main).

You can use this submodule when you need more modularity to create your topology than the terraform-ibm-landing-zone module provides. This submodule provides one of the building blocks for this topology.

Expand Down
2 changes: 1 addition & 1 deletion tests/README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Tests

For information about how to create and run tests, see [Validation tests](https://terraform-ibm-modules.github.io/documentation/#/tests) in the project documentation.
For information about how to create and run tests, see [Validation Tests](https://terraform-ibm-modules.github.io/documentation/#/tests) in the project documentation.

<!-- Add any more steps that are specific to testing this module and that are not in the docs. -->
2 changes: 1 addition & 1 deletion tests/existing-resources/README.md
Original file line number Diff line number Diff line change
@@ -1 +1 @@
The terraform code in this directory is used by the tests to provision a VPC and a subnet which is required by the Existing VPC example.
The Terraform code in this directory is utilized by the tests to provision a VPC and a subnet, which is required by the Existing VPC example.