Skip to content

Commit a6b7a5f

Browse files
vburckhardtvburckhardt
authored
feat: introduce allow dns resolution binding (#429)
BREAKING CHANGE: Significant review of the interface of this module as part of the introduction of DNS resolution binding. Note that you can upgrade to this version without impacting existing resources.
1 parent 5175cb4 commit a6b7a5f

File tree

11 files changed

+180
-176
lines changed

11 files changed

+180
-176
lines changed

‎README.md‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,12 +58,18 @@ module "vpes" {
5858
]
5959
resource_group_id = "00ae4b38253f43a3acd14619dd385632" # pragma: allowlist secret
6060
security_group_ids = ["r014-2d4f8cd6-6g3s-4ab5-ac3f-8fc717ce2a1f"]
61-
cloud_services = ["kms", "cloud-object-storage"]
62-
cloud_service_by_crn = [
61+
cloud_services = [
6362
{
64-
name = "subnet-1"
65-
crn = "crn:v1:bluemix:public:kms:au-syd:a/abac0df06b644a9cabc6e44f55b3880e:12d2244b-g3d3-4978-7s3f-81b60a1fb7a4::"
63+
service_name = "kms"
6664
},
65+
{
66+
service_name = "cloud-object-storage"
67+
}
68+
]
69+
cloud_service_by_crn = [
70+
{
71+
crn = "crn:v1:bluemix:public:databases-for-postgresql:us-south:a/abac0df06b644a9cabc6e44f55b3880d:93f97b1a-fe35-4f17-a8be-ecf197a36bed::"
72+
}
6773
]
6874
service_endpoints = "private"
6975
}
@@ -85,7 +91,7 @@ You need the following permissions to run this module.
8591
| Name | Version |
8692
|------|---------|
8793
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.3, <1.6.0 |
88-
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.52.0 |
94+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.58.0 |
8995

9096
### Modules
9197

@@ -104,8 +110,8 @@ No modules.
104110

105111
| Name | Description | Type | Default | Required |
106112
|------|-------------|------|---------|:--------:|
107-
| <a name="input_cloud_service_by_crn"></a> [cloud\_service\_by\_crn](#input\_cloud\_service\_by\_crn) | List of cloud service CRNs. Each CRN will have a unique endpoint gateways created. For a list of supported services, see the docs [here](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services). | <pre>list(<br> object({<br> name = string # service name<br> crn = string # service crn<br> })<br> )</pre> | `[]` | no |
108-
| <a name="input_cloud_services"></a> [cloud\_services](#input\_cloud\_services) | List of cloud services to create an endpoint gateway. | `list(string)` | <pre>[<br> "kms",<br> "cloud-object-storage"<br>]</pre> | no |
113+
| <a name="input_cloud_service_by_crn"></a> [cloud\_service\_by\_crn](#input\_cloud\_service\_by\_crn) | List of cloud service CRNs. The keys are the CRN. The values (all optional) give some level of control on the created VPEs. Each CRN will have a unique endpoint gateways created. For a list of supported services, see the docs [here](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services). | <pre>set(<br> object({<br> crn = string<br> vpe_name = optional(string) # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.<br> service_name = optional(string) # Name of the service used to compute the name of the VPE. If not specified, the service name will be obtained from the crn.<br> allow_dns_resolution_binding = optional(bool, true)<br> })<br> )</pre> | `[]` | no |
114+
| <a name="input_cloud_services"></a> [cloud\_services](#input\_cloud\_services) | List of cloud services to create an endpoint gateway. The keys are the service names, the values (all optional) give some level of control on the created VPEs. | <pre>set(object({<br> service_name = string<br> vpe_name = optional(string), # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.<br> allow_dns_resolution_binding = optional(bool, false)<br> }))</pre> | n/a | yes |
109115
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | `"vpe"` | no |
110116
| <a name="input_region"></a> [region](#input\_region) | The region where VPC and services are deployed | `string` | `"us-south"` | no |
111117
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | ID of the resource group where endpoint gateways will be provisioned | `string` | `null` | no |
@@ -114,7 +120,6 @@ No modules.
114120
| <a name="input_subnet_zone_list"></a> [subnet\_zone\_list](#input\_subnet\_zone\_list) | List of subnets in the VPC where gateways and reserved IPs will be provisioned. This value is intended to use the `subnet_zone_list` output from the Landing Zone VPC Subnet Module (https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc) or from templates using that module for subnet creation. | <pre>list(<br> object({<br> name = string<br> id = string<br> zone = optional(string)<br> cidr = optional(string)<br> })<br> )</pre> | `[]` | no |
115121
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | ID of the VPC where the Endpoint Gateways will be created | `string` | `null` | no |
116122
| <a name="input_vpc_name"></a> [vpc\_name](#input\_vpc\_name) | Name of the VPC where the Endpoint Gateways will be created. This value is used to dynamically generate VPE names. | `string` | `"vpc"` | no |
117-
| <a name="input_vpe_names"></a> [vpe\_names](#input\_vpe\_names) | A map whose keys are the service(s) you are overriding the name of and the values are the names you want the gateways for those services to have. | `map(string)` | `{}` | no |
118123

119124
### Outputs
120125

‎common-dev-assets‎

‎examples/default/main.tf‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,3 @@
1-
### randomising the custom vpe names
2-
locals {
3-
vpe_names = {
4-
for k, v in var.vpe_names :
5-
k => "${var.prefix}-${v}"
6-
}
7-
}
8-
91
##############################################################################
102
# Resource Group
113
##############################################################################
@@ -79,29 +71,36 @@ module "postgresql_db" {
7971
region = var.region
8072
}
8173

82-
locals {
83-
cloud_service_by_crn = concat([{
84-
name = "postgresql" # name of the vpe
85-
crn = module.postgresql_db.crn }
86-
], var.cloud_service_by_crn)
87-
}
8874

8975
##############################################################################
9076
# Create VPEs in the VPC
9177
##############################################################################
9278
module "vpes" {
93-
source = "../../"
94-
region = var.region
95-
prefix = var.prefix
96-
vpc_name = var.vpc_name
97-
vpc_id = var.vpc_id != null ? var.vpc_id : module.vpc[0].vpc_id
98-
subnet_zone_list = var.vpc_id != null ? var.subnet_zone_list : module.vpc[0].subnet_zone_list
99-
resource_group_id = module.resource_group.resource_group_id
100-
security_group_ids = var.security_group_ids != null ? var.security_group_ids : [module.vpe_security_group.security_group_id]
101-
cloud_services = var.cloud_services
102-
cloud_service_by_crn = local.cloud_service_by_crn
103-
service_endpoints = var.service_endpoints
104-
vpe_names = local.vpe_names
79+
source = "../../"
80+
region = var.region
81+
prefix = var.prefix
82+
vpc_name = var.vpc_name
83+
vpc_id = var.vpc_id != null ? var.vpc_id : module.vpc[0].vpc_id
84+
subnet_zone_list = var.vpc_id != null ? var.subnet_zone_list : module.vpc[0].subnet_zone_list
85+
resource_group_id = module.resource_group.resource_group_id
86+
security_group_ids = var.security_group_ids != null ? var.security_group_ids : [module.vpe_security_group.security_group_id]
87+
cloud_services = [
88+
{
89+
service_name = "kms"
90+
},
91+
{
92+
service_name = "cloud-object-storage"
93+
}
94+
95+
]
96+
cloud_service_by_crn = [
97+
{
98+
crn = (module.postgresql_db.crn)
99+
service_name = "postgresql" # Optional - with this set, the service name would be derived from the crn which would be database-for-postgresql. service_name is used in this example to maintain backward compatibility with version <= 3.1.0 of the module
100+
}
101+
]
102+
service_endpoints = var.service_endpoints
103+
#vpe_names = local.vpe_names
105104
# See comments below (resource "time_sleep" "sleep_time") for explaination on why this is needed.
106105
depends_on = [time_sleep.sleep_time]
107106
}

‎examples/default/variables.tf‎

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -63,23 +63,6 @@ variable "security_group_ids" {
6363
default = null
6464
}
6565

66-
variable "cloud_services" {
67-
description = "List of cloud services to create an endpoint gateway."
68-
type = list(string)
69-
default = ["kms", "cloud-object-storage"]
70-
}
71-
72-
variable "cloud_service_by_crn" {
73-
description = "List of cloud service CRNs. Each CRN will have a unique endpoint gateways created. For a list of supported services, see the docs [here](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services)."
74-
type = list(
75-
object({
76-
name = string # service name
77-
crn = string # service crn
78-
})
79-
)
80-
default = []
81-
}
82-
8366
variable "service_endpoints" {
8467
description = "Service endpoints to use to create endpoint gateways. Can be `public`, or `private`."
8568
type = string
@@ -91,12 +74,6 @@ variable "service_endpoints" {
9174
}
9275
}
9376

94-
variable "vpe_names" {
95-
description = "A Map to specify custom names for endpoint gateways whose keys are services and values are names to use for that service's endpoint gateway. Each name will be prefixed with prefix value for isolated testing purposes."
96-
type = map(string)
97-
default = {}
98-
}
99-
10077
variable "resource_tags" {
10178
type = list(string)
10279
description = "Optional list of tags to be added to created resources"

‎examples/every-mt-vpe/main.tf‎

Lines changed: 105 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -27,47 +27,113 @@ module "vpc" {
2727
# Create every multi-tenant VPEs in the VPC
2828
##############################################################################
2929
module "vpes" {
30-
source = "../../"
31-
region = var.region
32-
prefix = var.prefix
33-
vpc_name = module.vpc.vpc_name
34-
vpc_id = module.vpc.vpc_id
35-
#subnet_zone_list = module.vpc.subnet_zone_list
30+
source = "../../"
31+
region = var.region
32+
prefix = var.prefix
33+
vpc_name = module.vpc.vpc_name
34+
vpc_id = module.vpc.vpc_id
35+
subnet_zone_list = module.vpc.subnet_zone_list
3636
resource_group_id = module.resource_group.resource_group_id
3737
cloud_services = [
38-
"account-management",
39-
"billing",
40-
"cloud-object-storage",
41-
"cloud-object-storage-config",
42-
"codeengine",
43-
"container-registry",
44-
"containers-kubernetes",
45-
"context-based-restrictions",
46-
"directlink",
47-
"dns-svcs",
48-
"enterprise",
49-
"global-search-tagging",
50-
"globalcatalog",
51-
"hs-crypto",
52-
"hs-crypto-cert-mgr",
53-
"hs-crypto-ep11",
54-
"hs-crypto-ep11-az1",
55-
"hs-crypto-ep11-az2",
56-
"hs-crypto-ep11-az3",
57-
"hs-crypto-kmip",
58-
"hs-crypto-tke",
59-
"hyperp-dbaas-mongodb",
60-
"hyperp-dbaas-postgresql",
61-
"iam-svcs",
62-
"is",
63-
"kms",
64-
"messaging",
65-
"resource-controller",
66-
"support-center",
67-
"transit",
68-
"user-management",
69-
"vmware",
70-
"ntp",
38+
{
39+
service_name = "account-management"
40+
},
41+
{
42+
service_name = "billing"
43+
},
44+
{
45+
service_name = "cloud-object-storage"
46+
},
47+
{
48+
service_name = "cloud-object-storage-config"
49+
},
50+
{
51+
service_name = "codeengine"
52+
},
53+
{
54+
service_name = "container-registry"
55+
},
56+
{
57+
service_name = "containers-kubernetes"
58+
},
59+
{
60+
service_name = "context-based-restrictions"
61+
},
62+
{
63+
service_name = "directlink"
64+
},
65+
{
66+
service_name = "dns-svcs"
67+
},
68+
{
69+
service_name = "enterprise"
70+
},
71+
{
72+
service_name = "global-search-tagging"
73+
},
74+
{
75+
service_name = "globalcatalog"
76+
},
77+
{
78+
service_name = "hs-crypto"
79+
},
80+
{
81+
service_name = "hs-crypto-cert-mgr"
82+
},
83+
{
84+
service_name = "hs-crypto-ep11"
85+
},
86+
{
87+
service_name = "hs-crypto-ep11-az1"
88+
},
89+
{
90+
service_name = "hs-crypto-ep11-az2"
91+
},
92+
{
93+
service_name = "hs-crypto-ep11-az3"
94+
},
95+
{
96+
service_name = "hs-crypto-kmip"
97+
},
98+
{
99+
service_name = "hs-crypto-tke"
100+
},
101+
{
102+
service_name = "hyperp-dbaas-mongodb"
103+
},
104+
{
105+
service_name = "hyperp-dbaas-postgresql"
106+
},
107+
{
108+
service_name = "iam-svcs"
109+
},
110+
{
111+
service_name = "is"
112+
},
113+
{
114+
service_name = "kms"
115+
},
116+
{
117+
service_name = "messaging"
118+
},
119+
{
120+
service_name = "resource-controller"
121+
},
122+
{
123+
service_name = "support-center"
124+
},
125+
{
126+
service_name = "transit"
127+
},
128+
{
129+
service_name = "user-management"
130+
},
131+
{
132+
service_name = "vmware"
133+
},
134+
{
135+
service_name = "ntp"
136+
}
71137
]
72138
}
73139

‎main.tf‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,19 @@ locals {
1010
# Create object for each service
1111
for service in var.cloud_services :
1212
{
13-
name = lookup(var.vpe_names, service, "${var.prefix}-${var.vpc_name}-${service}")
14-
service = service
15-
crn = local.service_to_endpoint_map[service]
13+
name = service.vpe_name != null ? service.vpe_name : "${var.prefix}-${var.vpc_name}-${service.service_name}"
14+
service = service.service_name
15+
crn = local.service_to_endpoint_map[service.service_name]
16+
allow_dns_resolution_binding = service.allow_dns_resolution_binding
1617
}
1718
],
1819
[
1920
for service in var.cloud_service_by_crn :
2021
{
21-
name = lookup(var.vpe_names, service.name, "${var.prefix}-${var.vpc_name}-${service.name}")
22-
service = null
23-
crn = service.crn
22+
name = service.vpe_name != null ? service.vpe_name : "${var.prefix}-${var.vpc_name}-${service.service_name != null ? service.service_name : element(split(":", service.crn), 4)}" # service-name part of crn - see https://cloud.ibm.com/docs/account?topic=account-crn
23+
service = null
24+
crn = service.crn
25+
allow_dns_resolution_binding = service.allow_dns_resolution_binding
2426
}
2527
]
2628
)
@@ -32,17 +34,17 @@ locals {
3234
concat([
3335
for service in var.cloud_services :
3436
{
35-
ip_name = "${subnet.name}-${service}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip"
37+
ip_name = "${subnet.name}-${service.service_name}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip"
3638
subnet_id = subnet.id
37-
gateway_name = lookup(var.vpe_names, service, "${var.prefix}-${var.vpc_name}-${service}")
39+
gateway_name = service.vpe_name != null ? service.vpe_name : "${var.prefix}-${var.vpc_name}-${service.service_name}"
3840
}
3941
],
4042
[
4143
for service in var.cloud_service_by_crn :
4244
{
43-
ip_name = "${subnet.name}-${service.name}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip"
45+
ip_name = service.vpe_name != null ? "${subnet.name}-${service.vpe_name}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip" : "${subnet.name}-${service.service_name != null ? service.service_name : element(split(":", service.crn), 4)}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip"
4446
subnet_id = subnet.id
45-
gateway_name = lookup(var.vpe_names, service.name, "${var.prefix}-${var.vpc_name}-${service.name}")
47+
gateway_name = service.vpe_name != null ? service.vpe_name : "${var.prefix}-${var.vpc_name}-${service.service_name != null ? service.service_name : element(split(":", service.crn), 4)}"
4648
}
4749
])
4850
])
@@ -67,6 +69,7 @@ resource "ibm_is_subnet_reserved_ip" "ip" {
6769
for gateway_ip in local.endpoint_ip_list :
6870
(gateway_ip.ip_name) => gateway_ip
6971
}
72+
# name # Tracked at https://github.com/terraform-ibm-modules/terraform-ibm-vpe-gateway/issues/435
7073
subnet = each.value.subnet_id
7174
}
7275

@@ -92,6 +95,7 @@ resource "ibm_is_virtual_endpoint_gateway" "vpe" {
9295
crn = length(regexall("crn:v1:([^:]*:){6}", each.value.crn)) > 0 ? each.value.crn : null
9396
resource_type = length(regexall("crn:v1:([^:]*:){6}", each.value.crn)) > 0 ? "provider_cloud_service" : "provider_infrastructure_service"
9497
}
98+
allow_dns_resolution_binding = each.value.allow_dns_resolution_binding
9599
}
96100

97101
##############################################################################

0 commit comments

Comments
 (0)