Skip to content

Commit 60b38f0

Browse files
toddgigueretoddgiguere
authored
feat: enable usage of existing VPC/Subnets feature (#666)
Added the following optional properties to the configuration map for `vpcs` in order to support deployment of landing-zone into existing VPCs and Subnets. * `existing_vpc_id` (string) * `existing_subnet_ids` (list(string))
1 parent fcf261e commit 60b38f0

File tree

7 files changed

+39
-29
lines changed

7 files changed

+39
-29
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,7 @@ module "cluster_pattern" {
855855
| <a name="module_placement_group_map"></a> [placement\_group\_map](#module\_placement\_group\_map) | ./dynamic_values/config_modules/list_to_map | n/a |
856856
| <a name="module_ssh_keys"></a> [ssh\_keys](#module\_ssh\_keys) | ./ssh_key | n/a |
857857
| <a name="module_teleport_config"></a> [teleport\_config](#module\_teleport\_config) | ./teleport_config | n/a |
858-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-ibm-modules/landing-zone-vpc/ibm | 7.13.2 |
858+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-ibm-modules/landing-zone-vpc/ibm | 7.13.3 |
859859
| <a name="module_vsi"></a> [vsi](#module\_vsi) | terraform-ibm-modules/landing-zone-vsi/ibm | 3.0.0 |
860860

861861
### Resources
@@ -931,7 +931,7 @@ module "cluster_pattern" {
931931
| <a name="input_transit_gateway_resource_group"></a> [transit\_gateway\_resource\_group](#input\_transit\_gateway\_resource\_group) | Name of resource group to use for transit gateway. Must be included in `var.resource_group` | `string` | n/a | yes |
932932
| <a name="input_virtual_private_endpoints"></a> [virtual\_private\_endpoints](#input\_virtual\_private\_endpoints) | Object describing VPE to be created | <pre>list(<br> object({<br> service_name = string<br> service_type = string<br> resource_group = optional(string)<br> access_tags = optional(list(string), [])<br> vpcs = list(<br> object({<br> name = string<br> subnets = list(string)<br> security_group_name = optional(string)<br> })<br> )<br> })<br> )</pre> | n/a | yes |
933933
| <a name="input_vpc_placement_groups"></a> [vpc\_placement\_groups](#input\_vpc\_placement\_groups) | List of VPC placement groups to create | <pre>list(<br> object({<br> access_tags = optional(list(string), [])<br> name = string<br> resource_group = optional(string)<br> strategy = string<br> })<br> )</pre> | `[]` | no |
934-
| <a name="input_vpcs"></a> [vpcs](#input\_vpcs) | A map describing VPCs to be created in this repo. | <pre>list(<br> object({<br> prefix = string # VPC prefix<br> resource_group = optional(string) # Name of the group where VPC will be created<br> access_tags = optional(list(string), [])<br> classic_access = optional(bool)<br> default_network_acl_name = optional(string)<br> default_security_group_name = optional(string)<br> clean_default_sg_acl = optional(bool, false)<br> default_security_group_rules = optional(<br> list(<br> object({<br> name = string<br> direction = string<br> remote = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> )<br> default_routing_table_name = optional(string)<br> flow_logs_bucket_name = optional(string)<br> address_prefixes = optional(<br> object({<br> zone-1 = optional(list(string))<br> zone-2 = optional(list(string))<br> zone-3 = optional(list(string))<br> })<br> )<br> network_acls = list(<br> object({<br> name = string<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )<br> use_public_gateways = object({<br> zone-1 = optional(bool)<br> zone-2 = optional(bool)<br> zone-3 = optional(bool)<br> })<br> subnets = object({<br> zone-1 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-2 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-3 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> })<br> })<br> )</pre> | n/a | yes |
934+
| <a name="input_vpcs"></a> [vpcs](#input\_vpcs) | A map describing VPCs to be created in this repo. | <pre>list(<br> object({<br> prefix = string # VPC prefix<br> existing_vpc_id = optional(string)<br> existing_subnet_ids = optional(list(string))<br> resource_group = optional(string) # Name of the group where VPC will be created<br> access_tags = optional(list(string), [])<br> classic_access = optional(bool)<br> default_network_acl_name = optional(string)<br> default_security_group_name = optional(string)<br> clean_default_sg_acl = optional(bool, false)<br> default_security_group_rules = optional(<br> list(<br> object({<br> name = string<br> direction = string<br> remote = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> )<br> default_routing_table_name = optional(string)<br> flow_logs_bucket_name = optional(string)<br> address_prefixes = optional(<br> object({<br> zone-1 = optional(list(string))<br> zone-2 = optional(list(string))<br> zone-3 = optional(list(string))<br> })<br> )<br> network_acls = list(<br> object({<br> name = string<br> add_ibm_cloud_internal_rules = optional(bool)<br> add_vpc_connectivity_rules = optional(bool)<br> prepend_ibm_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )<br> use_public_gateways = object({<br> zone-1 = optional(bool)<br> zone-2 = optional(bool)<br> zone-3 = optional(bool)<br> })<br> subnets = optional(object({<br> zone-1 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-2 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-3 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> }))<br> })<br> )</pre> | n/a | yes |
935935
| <a name="input_vpn_gateways"></a> [vpn\_gateways](#input\_vpn\_gateways) | List of VPN Gateways to create. | <pre>list(<br> object({<br> name = string<br> vpc_name = string<br> subnet_name = string # Do not include prefix, use same name as in `var.subnets`<br> mode = optional(string)<br> resource_group = optional(string)<br> access_tags = optional(list(string), [])<br> })<br> )</pre> | n/a | yes |
936936
| <a name="input_vsi"></a> [vsi](#input\_vsi) | A list describing VSI workloads to create | <pre>list(<br> object({<br> name = string<br> vpc_name = string<br> subnet_names = list(string)<br> ssh_keys = list(string)<br> image_name = string<br> machine_type = string<br> vsi_per_subnet = number<br> user_data = optional(string)<br> resource_group = optional(string)<br> enable_floating_ip = optional(bool)<br> security_groups = optional(list(string))<br> boot_volume_encryption_key_name = optional(string)<br> access_tags = optional(list(string), [])<br> security_group = optional(<br> object({<br> name = string<br> rules = list(<br> object({<br> name = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = number<br> port_min = number<br> })<br> )<br> udp = optional(<br> object({<br> port_max = number<br> port_min = number<br> })<br> )<br> icmp = optional(<br> object({<br> type = number<br> code = number<br> })<br> )<br> })<br> )<br> })<br> )<br> block_storage_volumes = optional(list(<br> object({<br> name = string<br> profile = string<br> capacity = optional(number)<br> iops = optional(number)<br> encryption_key = optional(string)<br> })<br> ))<br> load_balancers = optional(list(<br> object({<br> name = string<br> type = string<br> listener_port = number<br> listener_protocol = string<br> connection_limit = number<br> algorithm = string<br> protocol = string<br> health_delay = number<br> health_retries = number<br> health_timeout = number<br> health_type = string<br> pool_member_port = string<br> idle_connection_timeout = optional(number)<br> security_group = optional(<br> object({<br> name = string<br> rules = list(<br> object({<br> name = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = number<br> port_min = number<br> })<br> )<br> udp = optional(<br> object({<br> port_max = number<br> port_min = number<br> })<br> )<br> icmp = optional(<br> object({<br> type = number<br> code = number<br> })<br> )<br> })<br> )<br> })<br> )<br> })<br> ))<br> })<br> )</pre> | n/a | yes |
937937
| <a name="input_wait_till"></a> [wait\_till](#input\_wait\_till) | To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, and `IngressReady` | `string` | `"IngressReady"` | no |

‎dynamic_values/config_modules/bastion_vsi_list_to_map/bastion_vsi_list_to_map.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ module "vsi_subnets" {
3636
source = "../get_subnets"
3737
for_each = module.vsi_list_to_map.value
3838
subnet_zone_list = var.vpc_modules[each.value.vpc_name].subnet_zone_list
39-
regex = "${var.prefix}-${each.value.vpc_name}-${each.value.subnet_name}"
39+
regex = each.value.subnet_name
4040
}
4141

4242
##############################################################################

‎dynamic_values/config_modules/f5/f5.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ module "f5_primary_subnets" {
1717
source = "../get_subnets"
1818
for_each = module.f5_vsi_map.value
1919
subnet_zone_list = var.vpc_modules[each.value.vpc_name].subnet_zone_list
20-
regex = "${var.prefix}-${each.value.vpc_name}-${each.value.primary_subnet_name}"
20+
regex = each.value.primary_subnet_name
2121
}
2222

2323
##############################################################################

‎dynamic_values/config_modules/vpe/vpe.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ module "vpe_ip_map" {
6363
vpc_name = vpcs.name
6464
ip_name = "${vpcs.name}-${service.service_name}-gateway-${subnet}-ip"
6565
gateway_name = "${vpcs.name}-${service.service_name}"
66-
subnet_name = "${var.prefix}-${vpcs.name}-${subnet}"
66+
subnet_name = subnet
6767
}
6868
]
6969
]

‎dynamic_values/config_modules/vpn/vpn.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ module "vpn_subnet_map" {
99
{
1010
name = gateway.name
1111
vpc_name = gateway.vpc_name
12-
vpc_subnet_name = "${var.prefix}-${gateway.vpc_name}-${gateway.subnet_name}"
12+
vpc_subnet_name = gateway.subnet_name
1313
}
1414
]
1515
}

‎main.tf‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,35 @@ locals {
66
vpc_map = module.dynamic_values.vpc_map
77
}
88

9+
# VPC module explicit dependencies (using 'depends_on') have been removed.
10+
# The 'depends_on' option was causing VPC module data blocks to not gather data for existing VPC or subnets during plan time,
11+
# which was causing issues with other modules in LZ.
12+
# Due to existing implicit dependencies we do not think this will be an issue, including auth policies for activity tracker.
913
module "vpc" {
10-
source = "terraform-ibm-modules/landing-zone-vpc/ibm"
11-
version = "7.13.2"
12-
for_each = local.vpc_map
13-
depends_on = [ibm_iam_authorization_policy.policy]
14-
name = each.value.prefix
15-
tags = var.tags
16-
access_tags = each.value.access_tags
17-
resource_group_id = each.value.resource_group == null ? null : local.resource_groups[each.value.resource_group]
18-
region = var.region
19-
prefix = var.prefix
20-
network_cidrs = [var.network_cidr]
21-
classic_access = each.value.classic_access
22-
default_network_acl_name = each.value.default_network_acl_name
23-
default_security_group_name = each.value.default_security_group_name
24-
security_group_rules = each.value.default_security_group_rules == null ? [] : each.value.default_security_group_rules
25-
default_routing_table_name = each.value.default_routing_table_name
26-
address_prefixes = each.value.address_prefixes
27-
network_acls = each.value.network_acls
28-
use_public_gateways = each.value.use_public_gateways
29-
subnets = each.value.subnets
14+
source = "terraform-ibm-modules/landing-zone-vpc/ibm"
15+
version = "7.13.3"
16+
for_each = local.vpc_map
17+
name = each.value.prefix
18+
existing_vpc_id = each.value.existing_vpc_id
19+
create_vpc = each.value.existing_vpc_id == null ? true : false
20+
tags = var.tags
21+
access_tags = each.value.access_tags
22+
resource_group_id = each.value.resource_group == null ? null : local.resource_groups[each.value.resource_group]
23+
region = var.region
24+
prefix = var.prefix
25+
network_cidrs = [var.network_cidr]
26+
classic_access = each.value.classic_access
27+
default_network_acl_name = each.value.default_network_acl_name
28+
default_security_group_name = each.value.default_security_group_name
29+
security_group_rules = each.value.default_security_group_rules == null ? [] : each.value.default_security_group_rules
30+
default_routing_table_name = each.value.default_routing_table_name
31+
address_prefixes = each.value.address_prefixes
32+
network_acls = each.value.network_acls
33+
use_public_gateways = each.value.use_public_gateways
34+
create_subnets = length(coalesce(each.value.existing_subnet_ids, [])) == 0 ? true : false
35+
# NOTE: for existing subnets scenario, current VPC module does not accept null for subnets map, so sending in a map with empty arrays instead
36+
subnets = length(coalesce(each.value.existing_subnet_ids, [])) == 0 ? each.value.subnets : { "zone-1" : [], "zone-2" : [], "zone-3" : [] }
37+
existing_subnet_ids = each.value.existing_subnet_ids
3038
enable_vpc_flow_logs = (each.value.flow_logs_bucket_name != null) ? true : false
3139
create_authorization_policy_vpc_to_cos = false
3240
existing_storage_bucket_name = (each.value.flow_logs_bucket_name != null) ? ibm_cos_bucket.buckets[each.value.flow_logs_bucket_name].bucket_name : null

0 commit comments

Comments
 (0)