Skip to content
This repository was archived by the owner on Aug 12, 2024. It is now read-only.

Commit 01dbc82

Browse files
author
Sean Sundberg
authored
Updates handling of acl-rules (#38)
- Uses same logic to create acl-rules as vpc-vsi module (semaphore and values provided as JSON) - Removes direct dependency on VPC module in metadata - Fixes acl rules setup logic Signed-off-by: Sean Sundberg <[email protected]>
1 parent 3b7bedd commit 01dbc82

File tree

5 files changed

+213
-31
lines changed

5 files changed

+213
-31
lines changed

‎main.tf‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,19 @@ locals {
5858
]
5959
login = var.login ? var.login : !var.disable_public_endpoint
6060
cluster_config = local.login ? data.ibm_container_cluster_config.cluster[0].config_file_path : ""
61+
acl_rules = [{
62+
name = "allow-all-ingress"
63+
action = "allow"
64+
direction = "inbound"
65+
source = "0.0.0.0/0"
66+
destination = "0.0.0.0/0"
67+
}, {
68+
name = "allow-all-egress"
69+
action = "allow"
70+
direction = "outbound"
71+
source = "0.0.0.0/0"
72+
destination = "0.0.0.0/0"
73+
}]
6174
}
6275

6376
resource null_resource create_dirs {
@@ -129,14 +142,15 @@ data ibm_is_subnet vpc_subnet {
129142
identifier = local.vpc_subnets[count.index].id
130143
}
131144

132-
resource null_resource open_acl_rules {
145+
resource null_resource setup_acl_rules {
133146
count = !var.exists && var.vpc_subnet_count > 0 ? 1 : 0
134147

135148
provisioner "local-exec" {
136-
command = "${path.module}/scripts/open-acl-rules.sh '${data.ibm_is_subnet.vpc_subnet[0].network_acl}' '${var.region}' '${var.resource_group_name}'"
149+
command = "${path.module}/scripts/setup-acl-rules.sh '${data.ibm_is_subnet.vpc_subnet[0].network_acl}' '${var.region}' '${var.resource_group_name}'"
137150

138151
environment = {
139152
IBMCLOUD_API_KEY = var.ibmcloud_api_key
153+
ACL_RULES = jsonencode(local.acl_rules)
140154
}
141155
}
142156
}
@@ -182,7 +196,7 @@ resource ibm_is_security_group_rule default_inbound_https {
182196

183197
resource ibm_container_vpc_cluster cluster {
184198
count = !var.exists ? 1 : 0
185-
depends_on = [null_resource.print_resources, null_resource.open_acl_rules]
199+
depends_on = [null_resource.print_resources, null_resource.setup_acl_rules]
186200

187201
name = local.cluster_name
188202
vpc_id = local.vpc_id

‎module.yaml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,10 @@ versions:
1818
refs:
1919
- source: github.com/cloud-native-toolkit/terraform-ibm-object-storage
2020
version: ">= 2.1.0"
21-
- id: vpc
22-
refs:
23-
- source: github.com/cloud-native-toolkit/terraform-ibm-vpc
24-
version: ">= 1.0.0"
2521
- id: subnets
2622
refs:
2723
- source: github.com/cloud-native-toolkit/terraform-ibm-vpc-subnets
28-
version: ">= 1.0.0"
24+
version: ">= 1.8.0"
2925
- id: kms_key
3026
refs:
3127
- source: github.com/cloud-native-toolkit/terraform-ibm-kms-key
@@ -38,8 +34,8 @@ versions:
3834
output: name
3935
- name: vpc_name
4036
moduleRef:
41-
id: vpc
42-
output: name
37+
id: subnets
38+
output: vpc_name
4339
- name: vpc_subnet_count
4440
moduleRef:
4541
id: subnets

‎scripts/open-acl-rules.sh‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎scripts/setup-acl-rules.sh‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
#!/usr/bin/env bash
2+
3+
NETWORK_ACL="$1"
4+
REGION="$2"
5+
RESOURCE_GROUP="$3"
6+
7+
if [[ -z "${NETWORK_ACL}" ]] || [[ -z "${REGION}" ]] || [[ -z "${RESOURCE_GROUP}" ]]; then
8+
echo "Usage: open-acl-rules.sh NETWORK_ACL REGION RESOURCE_GROUP"
9+
exit 1
10+
fi
11+
12+
if [[ -z "${IBMCLOUD_API_KEY}" ]]; then
13+
echo "IBMCLOUD_API_KEY environment variable must be set"
14+
exit 1
15+
fi
16+
17+
if [[ -n "${ACL_RULES}" ]] || [[ -n "${SG_RULES}" ]]; then
18+
echo "ACL_RULES or SG_RULES provided"
19+
else
20+
echo "ACL_RULES or SG_RULES environment variable must be set"
21+
exit 0
22+
fi
23+
24+
SEMAPHORE="acl_rules.semaphore"
25+
26+
while true; do
27+
echo "Checking for semaphore"
28+
if [[ ! -f "${SEMAPHORE}" ]]; then
29+
echo -n "${NETWORK_ACL}" > "${SEMAPHORE}"
30+
31+
if [[ $(cat ${SEMAPHORE}) == "${NETWORK_ACL}" ]]; then
32+
echo "Got the semaphore. Creating acl rules"
33+
break
34+
fi
35+
fi
36+
37+
SLEEP_TIME=$((1 + $RANDOM % 10))
38+
echo " Waiting $SLEEP_TIME seconds for semaphore"
39+
sleep $SLEEP_TIME
40+
done
41+
42+
function finish {
43+
rm "${SEMAPHORE}"
44+
}
45+
46+
trap finish EXIT
47+
48+
if ! ibmcloud account show 1> /dev/null 2> /dev/null; then
49+
ibmcloud login --apikey "${IBMCLOUD_API_KEY}" -g "${RESOURCE_GROUP}" -r "${REGION}"
50+
fi
51+
52+
# Install jq if not available
53+
JQ=$(command -v jq || command -v ./bin/jq)
54+
55+
if [[ -z "${JQ}" ]]; then
56+
echo "jq missing. Installing"
57+
mkdir -p ./bin && curl -Lo ./bin/jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64
58+
JQ="${PWD}/bin/jq"
59+
fi
60+
61+
## TODO more sophisticated logic needed to 1) test for existing rules and 2) place this rule in the right order
62+
63+
echo "Processing ACL_RULES"
64+
echo "${ACL_RULES}" | ${JQ} -c '.[]' | \
65+
while read rule;
66+
do
67+
name=$(echo "${rule}" | ${JQ} -r '.name')
68+
action=$(echo "${rule}" | ${JQ} -r '.action')
69+
direction=$(echo "${rule}" | ${JQ} -r '.direction')
70+
source=$(echo "${rule}" | ${JQ} -r '.source')
71+
destination=$(echo "${rule}" | ${JQ} -r '.destination')
72+
73+
tcp=$(echo "${rule}" | ${JQ} -c '.tcp // empty')
74+
udp=$(echo "${rule}" | ${JQ} -c '.udp // empty')
75+
icmp=$(echo "${rule}" | ${JQ} -c '.icmp // empty')
76+
77+
if [[ -n "${tcp}" ]] || [[ -n "${udp}" ]]; then
78+
if [[ -n "${tcp}" ]]; then
79+
type="tcp"
80+
config="${tcp}"
81+
else
82+
type="udp"
83+
config="${udp}"
84+
fi
85+
86+
source_port_min=$(echo "${config}" | ${JQ} -r '.source_port_min')
87+
source_port_max=$(echo "${config}" | ${JQ} -r '.source_port_max')
88+
port_min=$(echo "${config}" | ${JQ} -r '.port_min')
89+
port_max=$(echo "${config}" | ${JQ} -r '.port_max')
90+
91+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" "${type}" "${source}" "${destination}" \
92+
--name "${name}" \
93+
--source-port-min "${source_port_min}" \
94+
--source-port-max "${source_port_max}" \
95+
--destination-port-min "${port_min}" \
96+
--destination-port-max "${port_max}" \
97+
|| exit 1
98+
elif [[ -n "${icmp}" ]]; then
99+
icmp_type=$(echo "${icmp}" | ${JQ} -r '.type // empty')
100+
icmp_code=$(echo "${icmp}" | ${JQ} -r '.code // empty')
101+
102+
if [[ -n "${icmp_type}" ]] && [[ -n "${icmp_code}" ]]; then
103+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
104+
--name "${name}" \
105+
--icmp-type "${icmp_type}" \
106+
--icmp-code "${icmp_code}" \
107+
|| exit 1
108+
elif [[ -n "${icmp_type}" ]]; then
109+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
110+
--name "${name}" \
111+
--icmp-type "${icmp_type}" \
112+
|| exit 1
113+
else
114+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
115+
--name "${name}" \
116+
|| exit 1
117+
fi
118+
else
119+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" all "${source}" "${destination}" \
120+
--name "${name}" \
121+
|| exit 1
122+
fi
123+
done
124+
125+
echo "Processing SG_RULES"
126+
echo "${SG_RULES}" | ${JQ} -c '.[]' | \
127+
while read rule;
128+
do
129+
name=$(echo "${rule}" | ${JQ} -r '.name')
130+
action="allow"
131+
direction=$(echo "${rule}" | ${JQ} -r '.direction')
132+
remote=$(echo "${rule}" | ${JQ} -r '.remote')
133+
134+
if [[ "${direction}" == "inbound" ]]; then
135+
source="${remote}"
136+
destination="0.0.0.0/0"
137+
else
138+
destination="${remote}"
139+
source="0.0.0.0/0"
140+
fi
141+
142+
tcp=$(echo "${rule}" | ${JQ} -c '.tcp // empty')
143+
udp=$(echo "${rule}" | ${JQ} -c '.udp // empty')
144+
icmp=$(echo "${rule}" | ${JQ} -c '.icmp // empty')
145+
146+
RC=0
147+
148+
if [[ -n "${tcp}" ]] || [[ -n "${udp}" ]]; then
149+
if [[ -n "${tcp}" ]]; then
150+
type="tcp"
151+
config="${tcp}"
152+
else
153+
type="udp"
154+
config="${udp}"
155+
fi
156+
157+
port_min=$(echo "${config}" | ${JQ} -r '.port_min')
158+
port_max=$(echo "${config}" | ${JQ} -r '.port_max')
159+
160+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" "${type}" "${source}" "${destination}" \
161+
--name "${name}" \
162+
--source-port-min "${port_min}" \
163+
--source-port-max "${port_max}" \
164+
--destination-port-min "${port_min}" \
165+
--destination-port-max "${port_max}" \
166+
|| exit 1
167+
elif [[ -n "${icmp}" ]]; then
168+
icmp_type=$(echo "${icmp}" | ${JQ} -r '.type // empty')
169+
icmp_code=$(echo "${icmp}" | ${JQ} -r '.code // empty')
170+
171+
if [[ -n "${icmp_type}" ]] && [[ -n "${icmp_code}" ]]; then
172+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
173+
--name "${name}" \
174+
--icmp-type "${icmp_type}" \
175+
--icmp-code "${icmp_code}" \
176+
|| exit 1
177+
elif [[ -n "${icmp_type}" ]]; then
178+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
179+
--name "${name}" \
180+
--icmp-type "${icmp_type}" \
181+
|| exit 1
182+
else
183+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" icmp "${source}" "${destination}" \
184+
--name "${name}" \
185+
|| exit 1
186+
fi
187+
else
188+
ibmcloud is network-acl-rule-add "${NETWORK_ACL}" "${action}" "${direction}" all "${source}" "${destination}" \
189+
--name "${name}" \
190+
|| exit 1
191+
fi
192+
done

‎test/stages/stage2-cluster.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ module "cluster" {
99
ocp_version = var.ocp_version
1010
exists = var.cluster_exists
1111
name_prefix = var.name_prefix
12-
vpc_name = module.vpc.name
12+
vpc_name = module.subnets.vpc_name
1313
vpc_subnets = module.subnets.subnets
1414
vpc_subnet_count = module.subnets.count
1515
cos_id = module.cos.id

0 commit comments

Comments
 (0)