Generates named security group for the rules (#7)

- Updates publish notification destinations as well

Signed-off-by: Sean Sundberg <[email protected]>

Author: Sean Sundberg

.github/workflows/notify.yaml

@@ -6,11 +6,17 @@ jobs:
   notify:
     runs-on: ubuntu-latest
 
+    strategy:
+      matrix:
+        repo:
+          - cloud-native-toolkit/ibm-garage-iteration-zero
+          - cloud-native-toolkit/garage-terraform-modules
+
     steps:
-      - name: Publish repository dispatch
-        uses: ibm-garage-cloud/action-repository-dispatch@main
+      - name: Repository dispatch ${{ matrix.repo }}
+        uses: cloud-native-toolkit/action-repository-dispatch@main
         with:
-          notifyRepo: ibm-garage-cloud/ibm-garage-iteration-zero
+          notifyRepo: ${{ matrix.repo }}
           eventType: released
         env:
           GITHUB_TOKEN: ${{ secrets.TOKEN }}

main.tf

@@ -1,15 +1,15 @@
 
 locals {
-  zone_count       = 3
-  zone_ids         = range(var.subnet_count)
-  vpc_zone_names   = [ for index in local.zone_ids: "${var.region}-${(index % local.zone_count) + 1}" ]
-  prefix_name      = var.name_prefix != "" ? var.name_prefix : var.resource_group_name
-  vpc_name         = lower(replace(var.name != "" ? var.name : "${local.prefix_name}-vpc", "_", "-"))
-  vpc_id           = ibm_is_vpc.vpc.id
-  subnet_ids       = ibm_is_subnet.vpc_subnet[*].id
-  gateway_ids      = var.public_gateway ? ibm_is_public_gateway.vpc_gateway[*].id : [ for val in range(local.zone_count): "" ]
-  security_group   = ibm_is_vpc.vpc.default_security_group
-  ipv4_cidr_blocks = ibm_is_subnet.vpc_subnet[*].ipv4_cidr_block
+  zone_count        = 3
+  zone_ids          = range(var.subnet_count)
+  vpc_zone_names    = [ for index in local.zone_ids: "${var.region}-${(index % local.zone_count) + 1}" ]
+  prefix_name       = var.name_prefix != "" ? var.name_prefix : var.resource_group_name
+  vpc_name          = lower(replace(var.name != "" ? var.name : "${local.prefix_name}-vpc", "_", "-"))
+  vpc_id            = ibm_is_vpc.vpc.id
+  subnet_ids        = ibm_is_subnet.vpc_subnet[*].id
+  gateway_ids       = var.public_gateway ? ibm_is_public_gateway.vpc_gateway[*].id : [ for val in range(local.zone_count): "" ]
+  security_group_id = ibm_is_security_group.security_group.id
+  ipv4_cidr_blocks  = ibm_is_subnet.vpc_subnet[*].ipv4_cidr_block
 }
 
 resource null_resource print_names {
@@ -29,6 +29,12 @@ resource ibm_is_vpc vpc {
   resource_group = data.ibm_resource_group.resource_group.id
 }
 
+resource ibm_is_security_group security_group {
+  name           = "${local.vpc_name}-security-group"
+  vpc            = ibm_is_vpc.vpc.id
+  resource_group = data.ibm_resource_group.resource_group.id
+}
+
 resource ibm_is_public_gateway vpc_gateway {
   count = var.public_gateway ? min(local.zone_count, var.subnet_count) : 0
 
@@ -79,7 +85,7 @@ resource ibm_is_subnet vpc_subnet {
 resource ibm_is_security_group_rule rule_tcp_k8s {
   count     = var.subnet_count
 
-  group     = local.security_group
+  group     = local.security_group_id
   direction = "inbound"
   remote    = local.ipv4_cidr_blocks[count.index]
 
@@ -90,7 +96,7 @@ resource ibm_is_security_group_rule rule_tcp_k8s {
 }
 
 resource ibm_is_security_group_rule rule_icmp_ping {
-  group     = ibm_is_vpc.vpc.default_security_group
+  group     = local.security_group_id
   direction = "inbound"
   remote    = "0.0.0.0/0"
   icmp {
@@ -100,7 +106,7 @@ resource ibm_is_security_group_rule rule_icmp_ping {
 
 # from https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpc
 resource ibm_is_security_group_rule "cse_dns_1" {
-  group     = ibm_is_vpc.vpc.default_security_group
+  group     = local.security_group_id
   direction = "outbound"
   remote    = "161.26.0.10"
   udp {
@@ -110,7 +116,7 @@ resource ibm_is_security_group_rule "cse_dns_1" {
 }
 
 resource ibm_is_security_group_rule cse_dns_2 {
-  group     = ibm_is_vpc.vpc.default_security_group
+  group     = local.security_group_id
   direction = "outbound"
   remote    = "161.26.0.11"
   udp {
@@ -120,7 +126,7 @@ resource ibm_is_security_group_rule cse_dns_2 {
 }
 
 resource ibm_is_security_group_rule private_dns_1 {
-  group     = ibm_is_vpc.vpc.default_security_group
+  group     = local.security_group_id
   direction = "outbound"
   remote    = "161.26.0.7"
   udp {
@@ -130,7 +136,7 @@ resource ibm_is_security_group_rule private_dns_1 {
 }
 
 resource ibm_is_security_group_rule private_dns_2 {
-  group     = ibm_is_vpc.vpc.default_security_group
+  group     = local.security_group_id
   direction = "outbound"
   remote    = "161.26.0.8"
   udp {