From 17a2a231ffb71d65ce70b52a95e612dc1c54336d Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Mon, 29 Sep 2025 13:28:30 +0530 Subject: [PATCH] feat: added local and ip_version attributes for the security group rule --- README.md | 10 ++-- .../security_groups/security_groups.tf | 40 ++++++++----- patterns/vsi-extension/variables.tf | 8 ++- security_groups.tf | 10 ++-- variables.tf | 56 ++++++++++++------- 5 files changed, 76 insertions(+), 48 deletions(-) diff --git a/README.md b/README.md index 5f0cc90e5..cd2adf404 100644 --- a/README.md +++ b/README.md @@ -920,13 +920,13 @@ module "cluster_pattern" { | [enable\_transit\_gateway](#input\_enable\_transit\_gateway) | Create transit gateway | `bool` | `true` | no | | [existing\_vpc\_cbr\_zone\_id](#input\_existing\_vpc\_cbr\_zone\_id) | ID of the existing CBR (Context-based restrictions) network zone, with context set to the VPC. This zone is used in a CBR rule, which allows traffic to flow only from the landing zone VPCs to specific cloud services. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/patterns/DA-cbr-tutorial.md). | `string` | `null` | no | | [f5\_template\_data](#input\_f5\_template\_data) | Data for all f5 templates | 
object({
    tmos_admin_password     = optional(string)
    license_type            = optional(string)
    byol_license_basekey    = optional(string)
    license_host            = optional(string)
    license_username        = optional(string)
    license_password        = optional(string)
    license_pool            = optional(string)
    license_sku_keyword_1   = optional(string)
    license_sku_keyword_2   = optional(string)
    license_unit_of_measure = optional(string)
    do_declaration_url      = optional(string)
    as3_declaration_url     = optional(string)
    ts_declaration_url      = optional(string)
    phone_home_url          = optional(string)
    template_source         = optional(string)
    template_version        = optional(string)
    app_id                  = optional(string)
    tgactive_url            = optional(string)
    tgstandby_url           = optional(string)
    tgrefresh_url           = optional(string)
  })
| 
{
  "license_type": "none"
}
| no | -| [f5\_vsi](#input\_f5\_vsi) | A list describing F5 VSI workloads to create | 
list(
    object({
      name                   = string
      vpc_name               = string
      primary_subnet_name    = string
      secondary_subnet_names = list(string)
      secondary_subnet_security_group_names = list(
        object({
          group_name     = string
          interface_name = string
        })
      )
      ssh_keys                        = list(string)
      f5_image_name                   = string
      machine_type                    = string
      resource_group                  = optional(string)
      enable_management_floating_ip   = optional(bool)
      enable_external_floating_ip     = optional(bool)
      security_groups                 = optional(list(string))
      boot_volume_encryption_key_name = optional(string)
      hostname                        = string
      domain                          = string
      access_tags                     = optional(list(string), [])
      security_group = optional(
        object({
          name = string
          rules = list(
            object({
              name      = string
              direction = string
              source    = string
              tcp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              udp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              icmp = optional(
                object({
                  type = number
                  code = number
                })
              )
            })
          )
        })
      )
      block_storage_volumes = optional(list(
        object({
          name           = string
          profile        = string
          capacity       = optional(number)
          iops           = optional(number)
          encryption_key = optional(string)
        })
      ))
      load_balancers = optional(list(
        object({
          name                    = string
          type                    = string
          listener_port           = number
          listener_protocol       = string
          connection_limit        = number
          algorithm               = string
          protocol                = string
          health_delay            = number
          health_retries          = number
          health_timeout          = number
          health_type             = string
          pool_member_port        = string
          idle_connection_timeout = optional(number)
          security_group = optional(
            object({
              name = string
              rules = list(
                object({
                  name      = string
                  direction = string
                  source    = string
                  tcp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  udp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  icmp = optional(
                    object({
                      type = number
                      code = number
                    })
                  )
                })
              )
            })
          )
        })
      ))
    })
  )
| `[]` | no | +| [f5\_vsi](#input\_f5\_vsi) | A list describing F5 VSI workloads to create | 
list(
    object({
      name                   = string
      vpc_name               = string
      primary_subnet_name    = string
      secondary_subnet_names = list(string)
      secondary_subnet_security_group_names = list(
        object({
          group_name     = string
          interface_name = string
        })
      )
      ssh_keys                        = list(string)
      f5_image_name                   = string
      machine_type                    = string
      resource_group                  = optional(string)
      enable_management_floating_ip   = optional(bool)
      enable_external_floating_ip     = optional(bool)
      security_groups                 = optional(list(string))
      boot_volume_encryption_key_name = optional(string)
      hostname                        = string
      domain                          = string
      access_tags                     = optional(list(string), [])
      security_group = optional(
        object({
          name = string
          rules = list(
            object({
              name       = string
              direction  = string
              source     = string
              local      = optional(string)
              ip_version = optional(string)
              tcp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              udp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              icmp = optional(
                object({
                  type = number
                  code = number
                })
              )
            })
          )
        })
      )
      block_storage_volumes = optional(list(
        object({
          name           = string
          profile        = string
          capacity       = optional(number)
          iops           = optional(number)
          encryption_key = optional(string)
        })
      ))
      load_balancers = optional(list(
        object({
          name                    = string
          type                    = string
          listener_port           = number
          listener_protocol       = string
          connection_limit        = number
          algorithm               = string
          protocol                = string
          health_delay            = number
          health_retries          = number
          health_timeout          = number
          health_type             = string
          pool_member_port        = string
          idle_connection_timeout = optional(number)
          security_group = optional(
            object({
              name = string
              rules = list(
                object({
                  name       = string
                  direction  = string
                  source     = string
                  local      = optional(string)
                  ip_version = optional(string)
                  tcp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  udp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  icmp = optional(
                    object({
                      type = number
                      code = number
                    })
                  )
                })
              )
            })
          )
        })
      ))
    })
  )
| `[]` | no | | [key\_management](#input\_key\_management) | Key Protect instance variables | 
object({
    name              = optional(string)
    resource_group    = optional(string)
    use_data          = optional(bool)
    use_hs_crypto     = optional(bool)
    access_tags       = optional(list(string), [])
    service_endpoints = optional(string, "public-and-private")
    keys = optional(
      list(
        object({
          name             = string
          root_key         = optional(bool)
          payload          = optional(string)
          key_ring         = optional(string) # Any key_ring added will be created
          force_delete     = optional(bool)
          existing_key_crn = optional(string) # CRN of an existing key in the same or different account.
          endpoint         = optional(string) # can be public or private
          iv_value         = optional(string) # (Optional, Forces new resource, String) Used with import tokens. The initialization vector (IV) that is generated when you encrypt a nonce. The IV value is required to decrypt the encrypted nonce value that you provide when you make a key import request to the service. To generate an IV, encrypt the nonce by running ibmcloud kp import-token encrypt-nonce. Only for imported root key.
          encrypted_nonce  = optional(string) # The encrypted nonce value that verifies your request to import a key to Key Protect. This value must be encrypted by using the key that you want to import to the service. To retrieve a nonce, use the ibmcloud kp import-token get command. Then, encrypt the value by running ibmcloud kp import-token encrypt-nonce. Only for imported root key.
          policies = optional(
            object({
              rotation = optional(
                object({
                  interval_month = number
                })
              )
              dual_auth_delete = optional(
                object({
                  enabled = bool
                })
              )
            })
          )
        })
      )
    )
  })
| n/a | yes | | [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no | | [prefix](#input\_prefix) | A unique identifier for resources that is prepended to resources that are provisioned. Must begin with a lowercase letter and end with a lowercase letter or number. Must be 16 or fewer characters. | `string` | n/a | yes | | [region](#input\_region) | Region where VPC will be created. To find your VPC region, use `ibmcloud is regions` command to find available regions. | `string` | n/a | yes | | [resource\_groups](#input\_resource\_groups) | Object describing resource groups to create or reference | 
list(
    object({
      name       = string
      create     = optional(bool)
      use_prefix = optional(bool)
    })
  )
| n/a | yes | -| [security\_groups](#input\_security\_groups) | Security groups for VPC | 
list(
    object({
      name           = string
      vpc_name       = string
      resource_group = optional(string)
      access_tags    = optional(list(string), [])
      rules = list(
        object({
          name      = string
          direction = string
          source    = string
          tcp = optional(
            object({
              port_max = number
              port_min = number
            })
          )
          udp = optional(
            object({
              port_max = number
              port_min = number
            })
          )
          icmp = optional(
            object({
              type = number
              code = number
            })
          )
        })
      )
    })
  )
| `[]` | no | +| [security\_groups](#input\_security\_groups) | Security groups for VPC | 
list(
    object({
      name           = string
      vpc_name       = string
      resource_group = optional(string)
      access_tags    = optional(list(string), [])
      rules = list(
        object({
          name       = string
          direction  = string
          source     = string
          local      = optional(string)
          ip_version = optional(string)
          tcp = optional(
            object({
              port_max = number
              port_min = number
            })
          )
          udp = optional(
            object({
              port_max = number
              port_min = number
            })
          )
          icmp = optional(
            object({
              type = number
              code = number
            })
          )
        })
      )
    })
  )
| `[]` | no | | [service\_endpoints](#input\_service\_endpoints) | Service endpoints for the App ID resource when created by the module. Can be `public`, `private`, or `public-and-private` | `string` | `"public-and-private"` | no | | [skip\_all\_s2s\_auth\_policies](#input\_skip\_all\_s2s\_auth\_policies) | Whether to skip the creation of all of the service-to-service authorization policies. If setting to true, policies must be in place on the account before provisioning. | `bool` | `false` | no | | [skip\_kms\_block\_storage\_s2s\_auth\_policy](#input\_skip\_kms\_block\_storage\_s2s\_auth\_policy) | Whether to skip the creation of a service-to-service authorization policy between block storage and the key management service. | `bool` | `false` | no | @@ -934,15 +934,15 @@ module "cluster_pattern" { | [ssh\_keys](#input\_ssh\_keys) | SSH keys to use to provision a VSI. Must be an RSA key with a key size of either 2048 bits or 4096 bits (recommended). If `public_key` is not provided, the named key will be looked up from data. If a resource group name is added, it must be included in `var.resource_groups`. See https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys. | 
list(
    object({
      name           = string
      public_key     = optional(string)
      resource_group = optional(string)
    })
  )
| n/a | yes | | [tags](#input\_tags) | List of resource tags to apply to resources created by this module. | `list(string)` | `[]` | no | | [teleport\_config\_data](#input\_teleport\_config\_data) | Teleport config data. This is used to create a single template for all teleport instances to use. Creating a single template allows for values to remain sensitive | 
object({
    teleport_license   = optional(string)
    https_cert         = optional(string)
    https_key          = optional(string)
    domain             = optional(string)
    cos_bucket_name    = optional(string)
    cos_key_name       = optional(string)
    teleport_version   = optional(string)
    message_of_the_day = optional(string)
    hostname           = optional(string)
    app_id_key_name    = optional(string)
    claims_to_roles = optional(
      list(
        object({
          email = string
          roles = list(string)
        })
      )
    )
  })
| `null` | no | -| [teleport\_vsi](#input\_teleport\_vsi) | A list of teleport vsi deployments | 
list(
    object(
      {
        name                            = string
        vpc_name                        = string
        resource_group                  = optional(string)
        subnet_name                     = string
        ssh_keys                        = list(string)
        boot_volume_encryption_key_name = string
        image_name                      = string
        machine_type                    = string
        access_tags                     = optional(list(string), [])
        security_groups                 = optional(list(string))
        security_group = optional(
          object({
            name = string
            rules = list(
              object({
                name      = string
                direction = string
                source    = string
                tcp = optional(
                  object({
                    port_max = number
                    port_min = number
                  })
                )
                udp = optional(
                  object({
                    port_max = number
                    port_min = number
                  })
                )
                icmp = optional(
                  object({
                    type = number
                    code = number
                  })
                )
              })
            )
          })
        )


      }
    )
  )
| `[]` | no | +| [teleport\_vsi](#input\_teleport\_vsi) | A list of teleport vsi deployments | 
list(
    object(
      {
        name                            = string
        vpc_name                        = string
        resource_group                  = optional(string)
        subnet_name                     = string
        ssh_keys                        = list(string)
        boot_volume_encryption_key_name = string
        image_name                      = string
        machine_type                    = string
        access_tags                     = optional(list(string), [])
        security_groups                 = optional(list(string))
        security_group = optional(
          object({
            name = string
            rules = list(
              object({
                name       = string
                direction  = string
                source     = string
                local      = optional(string)
                ip_version = optional(string)
                tcp = optional(
                  object({
                    port_max = number
                    port_min = number
                  })
                )
                udp = optional(
                  object({
                    port_max = number
                    port_min = number
                  })
                )
                icmp = optional(
                  object({
                    type = number
                    code = number
                  })
                )
              })
            )
          })
        )


      }
    )
  )
| `[]` | no | | [transit\_gateway\_connections](#input\_transit\_gateway\_connections) | Transit gateway vpc connections. Will only be used if transit gateway is enabled. | `list(string)` | n/a | yes | | [transit\_gateway\_global](#input\_transit\_gateway\_global) | Connect to the networks outside the associated region. Will only be used if transit gateway is enabled. | `bool` | `false` | no | | [transit\_gateway\_resource\_group](#input\_transit\_gateway\_resource\_group) | Name of resource group to use for transit gateway. Must be included in `var.resource_group` | `string` | n/a | yes | | [virtual\_private\_endpoints](#input\_virtual\_private\_endpoints) | Object describing VPE to be created | 
list(
    object({
      service_name   = string
      service_type   = string
      resource_group = optional(string)
      access_tags    = optional(list(string), [])
      vpcs = list(
        object({
          name                = string
          subnets             = list(string)
          security_group_name = optional(string)
        })
      )
    })
  )
| n/a | yes | | [vpc\_placement\_groups](#input\_vpc\_placement\_groups) | List of VPC placement groups to create | 
list(
    object({
      access_tags    = optional(list(string), [])
      name           = string
      resource_group = optional(string)
      strategy       = string
    })
  )
| `[]` | no | -| [vpcs](#input\_vpcs) | A map describing VPCs to be created in this repo. | 
list(
    object({
      prefix          = string # VPC prefix
      existing_vpc_id = optional(string)
      existing_subnets = optional(
        list(
          object({
            id             = string
            public_gateway = optional(bool, false)
          })
        )
      )
      resource_group              = optional(string) # Name of the group where VPC will be created
      access_tags                 = optional(list(string), [])
      default_network_acl_name    = optional(string)
      default_security_group_name = optional(string)
      clean_default_sg_acl        = optional(bool, false)
      dns_binding_name            = optional(string, null)
      dns_instance_name           = optional(string, null)
      dns_custom_resolver_name    = optional(string, null)
      dns_location                = optional(string, "global")
      dns_plan                    = optional(string, "standard-dns")
      dns_zone_name               = optional(string, null)
      dns_zone_description        = optional(string, null)
      dns_zone_label              = optional(string, null)
      dns_records = optional(list(object({
        name       = string
        type       = string
        ttl        = number
        rdata      = string
        preference = optional(number, null)
        service    = optional(string, null)
        protocol   = optional(string, null)
        priority   = optional(number, null)
        weight     = optional(number, null)
        port       = optional(number, null)
      })), [])
      existing_dns_instance_id          = optional(string, null)
      use_existing_dns_instance         = optional(bool, false)
      enable_hub                        = optional(bool, false)
      skip_spoke_auth_policy            = optional(bool, false)
      hub_account_id                    = optional(string, null)
      enable_hub_vpc_id                 = optional(bool, false)
      hub_vpc_id                        = optional(string, null)
      enable_hub_vpc_crn                = optional(bool, false)
      hub_vpc_crn                       = optional(string, null)
      update_delegated_resolver         = optional(bool, false)
      skip_custom_resolver_hub_creation = optional(bool, false)
      resolver_type                     = optional(string, null)
      manual_servers = optional(list(object({
        address       = string
        zone_affinity = optional(string)
      })), [])
      default_security_group_rules = optional(
        list(
          object({
            name      = string
            direction = string
            remote    = string
            tcp = optional(
              object({
                port_max = optional(number)
                port_min = optional(number)
              })
            )
            udp = optional(
              object({
                port_max = optional(number)
                port_min = optional(number)
              })
            )
            icmp = optional(
              object({
                type = optional(number)
                code = optional(number)
              })
            )
          })
        )
      )
      default_routing_table_name = optional(string)
      flow_logs_bucket_name      = optional(string)
      address_prefixes = optional(
        object({
          zone-1 = optional(list(string))
          zone-2 = optional(list(string))
          zone-3 = optional(list(string))
        })
      )
      network_acls = list(
        object({
          name                         = string
          add_ibm_cloud_internal_rules = optional(bool)
          add_vpc_connectivity_rules   = optional(bool)
          prepend_ibm_rules            = optional(bool)
          rules = list(
            object({
              name        = string
              action      = string
              destination = string
              direction   = string
              source      = string
              tcp = optional(
                object({
                  port_max        = optional(number)
                  port_min        = optional(number)
                  source_port_max = optional(number)
                  source_port_min = optional(number)
                })
              )
              udp = optional(
                object({
                  port_max        = optional(number)
                  port_min        = optional(number)
                  source_port_max = optional(number)
                  source_port_min = optional(number)
                })
              )
              icmp = optional(
                object({
                  type = optional(number)
                  code = optional(number)
                })
              )
            })
          )
        })
      )
      use_public_gateways = object({
        zone-1 = optional(bool)
        zone-2 = optional(bool)
        zone-3 = optional(bool)
      })
      subnets = optional(object({
        zone-1 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
        zone-2 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
        zone-3 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
      }))
    })
  )
| n/a | yes | +| [vpcs](#input\_vpcs) | A map describing VPCs to be created in this repo. | 
list(
    object({
      prefix          = string # VPC prefix
      existing_vpc_id = optional(string)
      existing_subnets = optional(
        list(
          object({
            id             = string
            public_gateway = optional(bool, false)
          })
        )
      )
      resource_group              = optional(string) # Name of the group where VPC will be created
      access_tags                 = optional(list(string), [])
      default_network_acl_name    = optional(string)
      default_security_group_name = optional(string)
      clean_default_sg_acl        = optional(bool, false)
      dns_binding_name            = optional(string, null)
      dns_instance_name           = optional(string, null)
      dns_custom_resolver_name    = optional(string, null)
      dns_location                = optional(string, "global")
      dns_plan                    = optional(string, "standard-dns")
      dns_zone_name               = optional(string, null)
      dns_zone_description        = optional(string, null)
      dns_zone_label              = optional(string, null)
      dns_records = optional(list(object({
        name       = string
        type       = string
        ttl        = number
        rdata      = string
        preference = optional(number, null)
        service    = optional(string, null)
        protocol   = optional(string, null)
        priority   = optional(number, null)
        weight     = optional(number, null)
        port       = optional(number, null)
      })), [])
      existing_dns_instance_id          = optional(string, null)
      use_existing_dns_instance         = optional(bool, false)
      enable_hub                        = optional(bool, false)
      skip_spoke_auth_policy            = optional(bool, false)
      hub_account_id                    = optional(string, null)
      enable_hub_vpc_id                 = optional(bool, false)
      hub_vpc_id                        = optional(string, null)
      enable_hub_vpc_crn                = optional(bool, false)
      hub_vpc_crn                       = optional(string, null)
      update_delegated_resolver         = optional(bool, false)
      skip_custom_resolver_hub_creation = optional(bool, false)
      resolver_type                     = optional(string, null)
      manual_servers = optional(list(object({
        address       = string
        zone_affinity = optional(string)
      })), [])
      default_security_group_rules = optional(
        list(
          object({
            name       = string
            direction  = string
            remote     = string
            local      = optional(string)
            ip_version = optional(string)
            tcp = optional(
              object({
                port_max = optional(number)
                port_min = optional(number)
              })
            )
            udp = optional(
              object({
                port_max = optional(number)
                port_min = optional(number)
              })
            )
            icmp = optional(
              object({
                type = optional(number)
                code = optional(number)
              })
            )
          })
        )
      )
      default_routing_table_name = optional(string)
      flow_logs_bucket_name      = optional(string)
      address_prefixes = optional(
        object({
          zone-1 = optional(list(string))
          zone-2 = optional(list(string))
          zone-3 = optional(list(string))
        })
      )
      network_acls = list(
        object({
          name                         = string
          add_ibm_cloud_internal_rules = optional(bool)
          add_vpc_connectivity_rules   = optional(bool)
          prepend_ibm_rules            = optional(bool)
          rules = list(
            object({
              name        = string
              action      = string
              destination = string
              direction   = string
              source      = string
              tcp = optional(
                object({
                  port_max        = optional(number)
                  port_min        = optional(number)
                  source_port_max = optional(number)
                  source_port_min = optional(number)
                })
              )
              udp = optional(
                object({
                  port_max        = optional(number)
                  port_min        = optional(number)
                  source_port_max = optional(number)
                  source_port_min = optional(number)
                })
              )
              icmp = optional(
                object({
                  type = optional(number)
                  code = optional(number)
                })
              )
            })
          )
        })
      )
      use_public_gateways = object({
        zone-1 = optional(bool)
        zone-2 = optional(bool)
        zone-3 = optional(bool)
      })
      subnets = optional(object({
        zone-1 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
        zone-2 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
        zone-3 = list(object({
          name           = string
          cidr           = string
          public_gateway = optional(bool)
          acl_name       = string
          no_addr_prefix = optional(bool, false)
        }))
      }))
    })
  )
| n/a | yes | | [vpn\_gateways](#input\_vpn\_gateways) | List of VPN Gateways to create. | 
list(
    object({
      name           = string
      vpc_name       = string
      subnet_name    = string # Do not include prefix, use same name as in `var.subnets`
      mode           = optional(string)
      resource_group = optional(string)
      access_tags    = optional(list(string), [])
    })
  )
| n/a | yes | -| [vsi](#input\_vsi) | A list describing VSI workloads to create | 
list(
    object({
      name                            = string
      vpc_name                        = string
      subnet_names                    = list(string)
      ssh_keys                        = list(string)
      image_name                      = string
      machine_type                    = string
      vsi_per_subnet                  = number
      user_data                       = optional(string)
      resource_group                  = optional(string)
      enable_floating_ip              = optional(bool)
      allow_ip_spoofing               = optional(bool)
      security_groups                 = optional(list(string))
      boot_volume_encryption_key_name = optional(string)
      primary_vni_additional_ip_count = optional(number)
      use_legacy_network_interface    = optional(bool)
      access_tags                     = optional(list(string), [])
      security_group = optional(
        object({
          name = string
          rules = list(
            object({
              name      = string
              direction = string
              source    = string
              tcp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              udp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              icmp = optional(
                object({
                  type = number
                  code = number
                })
              )
            })
          )
        })
      )
      block_storage_volumes = optional(list(
        object({
          name           = string
          profile        = string
          capacity       = optional(number)
          iops           = optional(number)
          encryption_key = optional(string)
        })
      ))
      load_balancers = optional(list(
        object({
          name                       = string
          type                       = string
          listener_port              = optional(number)
          listener_port_max          = optional(number)
          listener_port_min          = optional(number)
          listener_protocol          = string
          connection_limit           = optional(number)
          idle_connection_timeout    = optional(number)
          algorithm                  = string
          protocol                   = string
          health_delay               = number
          health_retries             = number
          health_timeout             = number
          health_type                = string
          pool_member_port           = string
          profile                    = optional(string)
          accept_proxy_protocol      = optional(bool)
          subnet_id_to_provision_nlb = optional(string) # Required for Network Load Balancer. If no value is provided, the first one from the VPC subnet list will be selected.
          dns = optional(
            object({
              instance_crn = string
              zone_id      = string
            })
          )
          security_group = optional(
            object({
              name = string
              rules = list(
                object({
                  name      = string
                  direction = string
                  source    = string
                  tcp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  udp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  icmp = optional(
                    object({
                      type = number
                      code = number
                    })
                  )
                })
              )
            })
          )
        })
      ))
    })
  )
| n/a | yes | +| [vsi](#input\_vsi) | A list describing VSI workloads to create | 
list(
    object({
      name                            = string
      vpc_name                        = string
      subnet_names                    = list(string)
      ssh_keys                        = list(string)
      image_name                      = string
      machine_type                    = string
      vsi_per_subnet                  = number
      user_data                       = optional(string)
      resource_group                  = optional(string)
      enable_floating_ip              = optional(bool)
      allow_ip_spoofing               = optional(bool)
      security_groups                 = optional(list(string))
      boot_volume_encryption_key_name = optional(string)
      primary_vni_additional_ip_count = optional(number)
      use_legacy_network_interface    = optional(bool)
      access_tags                     = optional(list(string), [])
      security_group = optional(
        object({
          name = string
          rules = list(
            object({
              name       = string
              direction  = string
              source     = string
              local      = optional(string)
              ip_version = optional(string)
              tcp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              udp = optional(
                object({
                  port_max = number
                  port_min = number
                })
              )
              icmp = optional(
                object({
                  type = number
                  code = number
                })
              )
            })
          )
        })
      )
      block_storage_volumes = optional(list(
        object({
          name           = string
          profile        = string
          capacity       = optional(number)
          iops           = optional(number)
          encryption_key = optional(string)
        })
      ))
      load_balancers = optional(list(
        object({
          name                       = string
          type                       = string
          listener_port              = optional(number)
          listener_port_max          = optional(number)
          listener_port_min          = optional(number)
          listener_protocol          = string
          connection_limit           = optional(number)
          idle_connection_timeout    = optional(number)
          algorithm                  = string
          protocol                   = string
          health_delay               = number
          health_retries             = number
          health_timeout             = number
          health_type                = string
          pool_member_port           = string
          profile                    = optional(string)
          accept_proxy_protocol      = optional(bool)
          subnet_id_to_provision_nlb = optional(string) # Required for Network Load Balancer. If no value is provided, the first one from the VPC subnet list will be selected.
          dns = optional(
            object({
              instance_crn = string
              zone_id      = string
            })
          )
          security_group = optional(
            object({
              name = string
              rules = list(
                object({
                  name       = string
                  direction  = string
                  source     = string
                  local      = optional(string)
                  ip_version = optional(string)
                  tcp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  udp = optional(
                    object({
                      port_max = number
                      port_min = number
                    })
                  )
                  icmp = optional(
                    object({
                      type = number
                      code = number
                    })
                  )
                })
              )
            })
          )
        })
      ))
    })
  )
| n/a | yes | | [wait\_till](#input\_wait\_till) | To avoid long wait times when you run your Terraform code, you can specify the stage when you want Terraform to mark the cluster resource creation as completed. Depending on what stage you choose, the cluster creation might not be fully completed and continues to run in the background. However, your Terraform code can continue to run without waiting for the cluster to be fully created. Supported args are `MasterNodeReady`, `OneWorkerNodeReady`, and `IngressReady` | `string` | `"IngressReady"` | no | ### Outputs diff --git a/patterns/dynamic_values/config_modules/security_groups/security_groups.tf b/patterns/dynamic_values/config_modules/security_groups/security_groups.tf index 8679ea5b8..a12ad9dca 100644 --- a/patterns/dynamic_values/config_modules/security_groups/security_groups.tf +++ b/patterns/dynamic_values/config_modules/security_groups/security_groups.tf @@ -31,9 +31,11 @@ variable "bastion_vsi_rules" { description = "List of rules for F5 External security group." type = list( object({ - name = string - source = string - direction = string + name = string + source = string + direction = string + local = optional(string) + ip_version = optional(string) tcp = object({ port_min = string port_max = string @@ -46,9 +48,11 @@ variable "f5_management_rules" { description = "List of rules for F5 Management security group." type = list( object({ - name = string - source = string - direction = string + name = string + source = string + direction = string + local = optional(string) + ip_version = optional(string) tcp = object({ port_min = string port_max = string @@ -61,9 +65,11 @@ variable "f5_external_rules" { description = "List of rules for F5 External security group." type = list( object({ - name = string - source = string - direction = string + name = string + source = string + direction = string + local = optional(string) + ip_version = optional(string) tcp = object({ port_min = string port_max = string @@ -76,9 +82,11 @@ variable "f5_bastion_rules" { description = "List of rules for F5 External security group." type = list( object({ - name = string - source = string - direction = string + name = string + source = string + direction = string + local = optional(string) + ip_version = optional(string) tcp = object({ port_min = string port_max = string @@ -91,9 +99,11 @@ variable "f5_workload_rules" { description = "List of rules for F5 Workload security group." type = list( object({ - name = string - source = string - direction = string + name = string + source = string + direction = string + local = optional(string) + ip_version = optional(string) tcp = object({ port_min = string port_max = string diff --git a/patterns/vsi-extension/variables.tf b/patterns/vsi-extension/variables.tf index 460daba60..8b1a8f368 100644 --- a/patterns/vsi-extension/variables.tf +++ b/patterns/vsi-extension/variables.tf @@ -167,9 +167,11 @@ variable "load_balancers" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number diff --git a/security_groups.tf b/security_groups.tf index 19eb0057b..66c976a22 100644 --- a/security_groups.tf +++ b/security_groups.tf @@ -31,10 +31,12 @@ resource "ibm_is_security_group" "security_group" { ############################################################################## resource "ibm_is_security_group_rule" "security_group_rules" { - for_each = local.security_group_rules_map - group = ibm_is_security_group.security_group[each.value.sg_name].id - direction = each.value.direction - remote = each.value.source + for_each = local.security_group_rules_map + group = ibm_is_security_group.security_group[each.value.sg_name].id + direction = each.value.direction + remote = each.value.source + local = each.value.local + ip_version = each.value.ip_version ############################################################################## # Dynamicaly create ICMP Block diff --git a/variables.tf b/variables.tf index 3a97208e1..3a6c5c9f7 100644 --- a/variables.tf +++ b/variables.tf @@ -117,9 +117,11 @@ variable "vpcs" { default_security_group_rules = optional( list( object({ - name = string - direction = string - remote = string + name = string + direction = string + remote = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = optional(number) @@ -328,9 +330,11 @@ variable "vsi" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number @@ -393,9 +397,11 @@ variable "vsi" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number @@ -441,9 +447,11 @@ variable "security_groups" { access_tags = optional(list(string), []) rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number @@ -1125,9 +1133,11 @@ variable "teleport_vsi" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number @@ -1200,9 +1210,11 @@ variable "f5_vsi" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number @@ -1254,9 +1266,11 @@ variable "f5_vsi" { name = string rules = list( object({ - name = string - direction = string - source = string + name = string + direction = string + source = string + local = optional(string) + ip_version = optional(string) tcp = optional( object({ port_max = number