Skip to content

Commit a17b643

Browse files
vburckhardtvburckhardt
authored
fix: remove invalid multi-tenant VPE references (#393)
fix: remove invalid multi-tenant VPE references fix: ensure idempotent of existing VPEs BREAKING CHANGE: Upon apply all existing VPE created in previous version of this module will be deleted and immediately re-created, which may result in a network termination. The IP of the VPE may change as part of this process.
1 parent 77f786d commit a17b643

File tree

12 files changed

+151
-49
lines changed

12 files changed

+151
-49
lines changed

‎.secrets.baseline‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2023-06-27T03:41:24Z",
6+
"generated_at": "2023-09-21T11:21:48Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ The module supports the following actions:
1919
* [terraform-ibm-vpe-gateway](#terraform-ibm-vpe-gateway)
2020
* [Examples](./examples)
2121
* [End-to-end example](./examples/default)
22+
* [Every multi-tenant VPE](./examples/every-mt-vpe)
2223
* [Contributing](#contributing)
2324

2425
## terraform-ibm-vpe-gateway

‎common-dev-assets‎

‎examples/every-mt-vpe/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Every multi-tenant VPE
2+
3+
This example creates every multi-tenant VPE supported by this module. This example does not follow a real-world scenario, but rather, can be used to quickly experiment with this module. It is also used in regression testing for the module.

‎examples/every-mt-vpe/main.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
4+
module "resource_group" {
5+
source = "terraform-ibm-modules/resource-group/ibm"
6+
version = "1.0.6"
7+
# if an existing resource group is not set (null) create a new one using prefix
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
9+
existing_resource_group_name = var.resource_group
10+
}
11+
12+
##############################################################################
13+
# Create a VPC for this example using defaults from terraform-ibm-landing-zone-vpc
14+
# ( 3 subnets across the 3 AZs in the region )
15+
##############################################################################
16+
17+
module "vpc" {
18+
source = "terraform-ibm-modules/landing-zone-vpc/ibm"
19+
version = "7.5.0"
20+
resource_group_id = module.resource_group.resource_group_id
21+
region = var.region
22+
prefix = var.prefix
23+
name = "vpc"
24+
}
25+
26+
##############################################################################
27+
# Create every multi-tenant VPEs in the VPC
28+
##############################################################################
29+
module "vpes" {
30+
source = "../../"
31+
region = var.region
32+
prefix = var.prefix
33+
vpc_name = module.vpc.vpc_name
34+
vpc_id = module.vpc.vpc_id
35+
#subnet_zone_list = module.vpc.subnet_zone_list
36+
resource_group_id = module.resource_group.resource_group_id
37+
cloud_services = ["account-management",
38+
"billing",
39+
"cloud-object-storage",
40+
"codeengine",
41+
#"container-registry", # to fix in https://github.com/terraform-ibm-modules/terraform-ibm-vpe-gateway/issues/390
42+
"directlink",
43+
"dns-svcs",
44+
"enterprise",
45+
"global-search-tagging",
46+
"globalcatalog",
47+
"hs-crypto",
48+
"hyperp-dbaas-mongodb",
49+
"hyperp-dbaas-postgresql",
50+
"iam-svcs",
51+
"is",
52+
"kms",
53+
"resource-controller",
54+
"transit",
55+
"user-management"]
56+
}
57+
58+
59+
##############################################################################

‎examples/every-mt-vpe/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "vpe_ips" {
2+
description = "The endpoint gateway reserved ips"
3+
value = module.vpes.vpe_ips
4+
}
5+
6+
output "crn" {
7+
description = "The CRN of the endpoint gateway"
8+
value = module.vpes.crn
9+
}

‎examples/every-mt-vpe/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎examples/every-mt-vpe/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
variable "ibmcloud_api_key" {
2+
type = string
3+
description = "The IBM Cloud API Key"
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
description = "The region where VPC and services are deployed"
9+
type = string
10+
default = "us-south"
11+
}
12+
13+
variable "prefix" {
14+
description = "The prefix that you would like to append to your resources"
15+
type = string
16+
default = "vpe"
17+
}
18+
19+
variable "resource_group" {
20+
type = string
21+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
22+
default = null
23+
}

‎examples/every-mt-vpe/versions.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
##############################################################################
2+
# Terraform Providers
3+
##############################################################################
4+
5+
terraform {
6+
required_version = ">= 1.3.0"
7+
required_providers {
8+
ibm = {
9+
source = "IBM-Cloud/ibm"
10+
# pin above lowest vesion, required for postgresql and IAM auth policy
11+
version = ">= 1.54.0"
12+
}
13+
}
14+
}
15+
16+
##############################################################################

‎main.tf‎

Lines changed: 27 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -53,33 +53,25 @@ locals {
5353

5454
# Map of Services to endpoints
5555
service_to_endpoint_map = {
56-
account-management = "crn:v1:bluemix:public:account-management:global:::endpoint:${var.service_endpoints}.accounts.cloud.ibm.com"
57-
billing = "crn:v1:bluemix:public:billing:global:::endpoint:${var.service_endpoints}.billing.cloud.ibm.com"
58-
cloud-object-storage = "crn:v1:bluemix:public:cloud-object-storage:global:::endpoint:s3.direct.${var.region}.cloud-object-storage.appdomain.cloud"
59-
codeengine = "crn:v1:bluemix:public:codeengine:${var.region}:::endpoint:${var.service_endpoints}.${var.region}.codeengine.cloud.ibm.com"
60-
container-registry = "crn:v1:bluemix:public:container-registry:${var.region}:::endpoint:vpe.${var.region}.container-registry.cloud.ibm.com"
61-
databases-for-cassandra = "crn:v1:bluemix:public:databases-for-cassandra:${var.region}:::endpoint:${var.service_endpoints}.databases-for-cassandra.cloud.ibm.com"
62-
databases-for-elasticsearch = "crn:v1:bluemix:public:databases-for-elasticsearch:${var.region}:::endpoint:${var.service_endpoints}.databases-for-elasticsearch.cloud.ibm.com"
63-
databases-for-enterprisedb = "crn:v1:bluemix:public:databases-for-enterprisedb:${var.region}:::${var.service_endpoints}.databases-for-enterprisedb.cloud.ibm.com"
64-
databases-for-mongodb = "crn:v1:bluemix:public:databases-for-mongodb:${var.region}:::endpoint:${var.service_endpoints}.databases-for-mongodb.cloud.ibm.com"
65-
databases-for-postgresql = "crn:v1:bluemix:public:databases-for-postgresql:${var.region}:::endpoint:${var.service_endpoints}.databases-for-postgresql.cloud.ibm.com"
66-
databases-for-redis = "crn:v1:bluemix:public:databases-for-redis:${var.region}:::endpoint:${var.service_endpoints}.databases-for-redis.cloud.ibm.com"
67-
directlink = "crn:v1:bluemix:public:directlink:global:::endpoint:${var.service_endpoints}.directlink.cloud.ibm.com"
68-
dns-svcs = "crn:v1:bluemix:public:dns-svcs:global::::"
69-
enterprise = "crn:v1:bluemix:public:enterprise:global:::endpoint:${var.service_endpoints}.enterprise.cloud.ibm.com"
70-
global-search-tagging = "crn:v1:bluemix:public:global-search-tagging:global:::endpoint:api.${var.service_endpoints}.global-search-tagging.cloud.ibm.com"
71-
globalcatalog = "crn:v1:bluemix:public:globalcatalog:global:::endpoint:${var.service_endpoints}.globalcatalog.cloud.ibm.com"
72-
hs-crypto = "crn:v1:bluemix:public:hs-crypto:${var.region}:::endpoint:api.${var.service_endpoints}.${var.region}.hs-crypto.cloud.ibm.com"
73-
hyperp-dbaas-mongodb = "crn:v1:bluemix:public:hyperp-dbaas-mongodb:${var.region}:::endpoint:dbaas900-mongodb.${var.service_endpoints}.hyperp-dbaas.cloud.ibm.com"
74-
hyperp-dbaas-postgresql = "crn:v1:bluemix:public:hyperp-dbaas-postgresql:${var.region}:::endpoint:dbaas900-postgresql.${var.service_endpoints}.hyperp-dbaas.cloud.ibm.com"
75-
iam-identity = "crn:v1:bluemix:public:iam-identity:global:::endpoint:${var.service_endpoints}.iam.cloud.ibm.com"
76-
iam-svcs = "crn:v1:bluemix:public:iam-svcs:global:::endpoint:${var.service_endpoints}.iam.cloud.ibm.com"
77-
is = "crn:v1:bluemix:public:is:${var.region}:::endpoint:${var.region}.${var.service_endpoints}.iaas.cloud.ibm.com"
78-
kms = "crn:v1:bluemix:public:kms:${var.region}:::endpoint:${var.service_endpoints}.${var.region}.kms.cloud.ibm.com"
79-
resource-controller = "crn:v1:bluemix:public:resource-controller:global:::endpoint:${var.service_endpoints}.resource-controller.cloud.ibm.com"
80-
secrets-manager = "crn:v1:bluemix:public:secrets-manager:${var.region}:::endpoint:${var.service_endpoints}.secrets-manager.cloud.ibm.com"
81-
transit = "crn:v1:bluemix:public:transit:global:::endpoint:${var.service_endpoints}.transit.cloud.ibm.com"
82-
user-management = "crn:v1:bluemix:public:user-management:global:::endpoint:${var.service_endpoints}.user-management.cloud.ibm.com"
56+
account-management = "crn:v1:bluemix:public:account-management:global:::endpoint:${var.service_endpoints}.accounts.cloud.ibm.com"
57+
billing = "crn:v1:bluemix:public:billing:global:::endpoint:${var.service_endpoints}.billing.cloud.ibm.com"
58+
cloud-object-storage = "crn:v1:bluemix:public:cloud-object-storage:global:::endpoint:s3.direct.${var.region}.cloud-object-storage.appdomain.cloud"
59+
codeengine = "crn:v1:bluemix:public:codeengine:${var.region}:::endpoint:${var.service_endpoints}.${var.region}.codeengine.cloud.ibm.com"
60+
container-registry = "crn:v1:bluemix:public:container-registry:${var.region}:::endpoint:${var.region}.icr.io"
61+
directlink = "crn:v1:bluemix:public:directlink:global:::endpoint:${var.service_endpoints}.directlink.cloud.ibm.com"
62+
dns-svcs = "crn:v1:bluemix:public:dns-svcs:global::::"
63+
enterprise = "crn:v1:bluemix:public:enterprise:global:::endpoint:${var.service_endpoints}.enterprise.cloud.ibm.com"
64+
global-search-tagging = "crn:v1:bluemix:public:global-search-tagging:global:::endpoint:api.${var.service_endpoints}.global-search-tagging.cloud.ibm.com"
65+
globalcatalog = "crn:v1:bluemix:public:globalcatalog:global:::endpoint:${var.service_endpoints}.globalcatalog.cloud.ibm.com"
66+
hs-crypto = "crn:v1:bluemix:public:hs-crypto:${var.region}:::endpoint:api.${var.service_endpoints}.${var.region}.hs-crypto.cloud.ibm.com"
67+
hyperp-dbaas-mongodb = "crn:v1:bluemix:public:hyperp-dbaas-mongodb:${var.region}:::endpoint:dbaas900-mongodb.${var.service_endpoints}.hyperp-dbaas.cloud.ibm.com"
68+
hyperp-dbaas-postgresql = "crn:v1:bluemix:public:hyperp-dbaas-postgresql:${var.region}:::endpoint:dbaas900-postgresql.${var.service_endpoints}.hyperp-dbaas.cloud.ibm.com"
69+
iam-svcs = "crn:v1:bluemix:public:iam-svcs:global:::endpoint:${var.service_endpoints}.iam.cloud.ibm.com"
70+
is = "crn:v1:bluemix:public:is:${var.region}:::endpoint:${var.region}.${var.service_endpoints}.iaas.cloud.ibm.com"
71+
kms = "crn:v1:bluemix:public:kms:${var.region}:::endpoint:${var.service_endpoints}.${var.region}.kms.cloud.ibm.com"
72+
resource-controller = "crn:v1:bluemix:public:resource-controller:global:::endpoint:${var.service_endpoints}.resource-controller.cloud.ibm.com"
73+
transit = "crn:v1:bluemix:public:transit:global:::endpoint:${var.service_endpoints}.transit.cloud.ibm.com"
74+
user-management = "crn:v1:bluemix:public:user-management:global:::endpoint:${var.service_endpoints}.user-management.cloud.ibm.com"
8375
}
8476
}
8577

@@ -105,13 +97,16 @@ resource "ibm_is_subnet_reserved_ip" "ip" {
10597
##############################################################################
10698

10799
resource "ibm_is_virtual_endpoint_gateway" "vpe" {
108-
count = length(local.gateway_list)
109-
name = local.gateway_list[count.index].name
100+
for_each = { # Create a map based on gateway name
101+
for gateway in local.gateway_list :
102+
(gateway.name) => gateway
103+
}
104+
name = each.key
110105
vpc = var.vpc_id
111106
resource_group = var.resource_group_id
112107
security_groups = var.security_group_ids
113108
target {
114-
crn = local.gateway_list[count.index].service == null ? local.gateway_list[count.index].crn : local.service_to_endpoint_map[local.gateway_list[count.index].service]
109+
crn = each.value.service == null ? each.value.crn : local.service_to_endpoint_map[each.value.service]
115110
resource_type = "provider_cloud_service"
116111
}
117112
}
@@ -140,6 +135,6 @@ resource "ibm_is_virtual_endpoint_gateway_ip" "endpoint_gateway_ip" {
140135

141136
data "ibm_is_virtual_endpoint_gateway" "vpe" {
142137
depends_on = [ibm_is_virtual_endpoint_gateway_ip.endpoint_gateway_ip]
143-
count = length(ibm_is_virtual_endpoint_gateway.vpe)
144-
name = ibm_is_virtual_endpoint_gateway.vpe[count.index].name
138+
for_each = ibm_is_virtual_endpoint_gateway.vpe
139+
name = each.key
145140
}

0 commit comments

Comments
 (0)