Skip to content

Commit 21afe2a

Browse files
linoy-zoaretzlinoy-zoaretz
committed
working with simple main.tf file deploys a vm
1 parent a8d3c43 commit 21afe2a

File tree

8 files changed

+162
-162
lines changed

8 files changed

+162
-162
lines changed

.github/workflows/terraform.yml renamed to .github/workflows/terraform-plan.yml

File renamed without changes.

‎main.tf‎

Lines changed: 0 additions & 162 deletions
Original file line numberDiff line numberDiff line change
@@ -1,162 +0,0 @@
1-
locals {
2-
resource_prefix = var.deployment_name != "" ? var.deployment_name : random_string.resource_prefix[0].result
3-
waf_image_url = "${module.commons.constants.gcp.image_url_prefix}${module.commons.builds[var.waf_version]}"
4-
mgt_network = var.vpc_network
5-
mx_tag = "${local.resource_prefix}-mx"
6-
mx_fw_rules = merge(
7-
length(var.ui_access_source_ranges) > 0 ? {
8-
UI = {
9-
name = "${local.resource_prefix}-mx-ui-access"
10-
direction = "INGRESS"
11-
network = local.mgt_network
12-
source_ranges = var.ui_access_source_ranges
13-
source_tags = []
14-
target_tags = [
15-
local.mx_tag
16-
]
17-
allow = [
18-
{
19-
protocol = "tcp"
20-
ports = [
21-
"8083"
22-
]
23-
}
24-
]
25-
}
26-
} : {},
27-
length(var.ssh_access_source_ranges) > 0 ? {
28-
SSH = {
29-
name = "${local.resource_prefix}-mx-ssh-access"
30-
direction = "INGRESS"
31-
network = local.mgt_network
32-
source_ranges = var.ssh_access_source_ranges
33-
source_tags = []
34-
target_tags = [
35-
local.mx_tag
36-
]
37-
allow = [
38-
{
39-
protocol = "tcp"
40-
ports = [
41-
"22"
42-
]
43-
}
44-
]
45-
}
46-
} : {}
47-
)
48-
mx_secret_id = google_secret_manager_secret.mx_admin_secret.secret_id
49-
management_ip = google_compute_instance.mx_instance.network_interface[0].network_ip
50-
}
51-
52-
data "google_client_config" "this" {}
53-
54-
data "google_compute_subnetwork" "data_mx_subnet" {
55-
name = var.subnet_name
56-
region = data.google_client_config.this.region
57-
}
58-
59-
module "commons" {
60-
source = "imperva/wafgateway-commons/google"
61-
version = "1.2.2"
62-
}
63-
64-
resource "random_string" "resource_prefix" {
65-
count = var.deployment_name != "" ? 0 : 1
66-
length = 4
67-
special = false
68-
upper = false
69-
numeric = false
70-
}
71-
72-
resource "google_service_account" "deployment_service_account" {
73-
account_id = "${local.resource_prefix}-mx-svc-acc"
74-
}
75-
76-
resource "google_secret_manager_secret" "mx_admin_secret" {
77-
secret_id = "${local.resource_prefix}-mx-secret"
78-
replication {
79-
auto {}
80-
}
81-
}
82-
83-
resource "google_secret_manager_secret_version" "mx_admin_secret_version" {
84-
secret = google_secret_manager_secret.mx_admin_secret.id
85-
secret_data = var.mx_password
86-
}
87-
88-
resource "google_secret_manager_secret_iam_member" "mx_admin_secret_iam_member" {
89-
secret_id = local.mx_secret_id
90-
role = "roles/secretmanager.secretAccessor"
91-
member = "serviceAccount:${google_service_account.deployment_service_account.email}"
92-
}
93-
94-
resource "google_compute_instance" "mx_instance" {
95-
depends_on = [
96-
google_secret_manager_secret_version.mx_admin_secret_version
97-
]
98-
name = "${local.resource_prefix}-mx"
99-
description = "Imperva WAF Management Server (Deployment ID: ${local.resource_prefix})"
100-
zone = var.zone
101-
deletion_protection = var.enable_termination_protection
102-
tags = [
103-
local.mx_tag
104-
]
105-
machine_type = var.instance_type
106-
boot_disk {
107-
initialize_params {
108-
image = local.waf_image_url
109-
}
110-
}
111-
network_interface {
112-
subnetwork = var.subnet_name
113-
network_ip = var.private_ip_address
114-
dynamic "access_config" {
115-
for_each = var.external_ip_address != "" || var.external_ip_network_tier != "" ? [1] : []
116-
content {
117-
nat_ip = var.external_ip_address
118-
network_tier = var.external_ip_network_tier
119-
}
120-
}
121-
}
122-
metadata = {
123-
startup-script = data.template_cloudinit_config.mx_gcp_deploy.rendered
124-
block-project-ssh-keys = var.block_project_ssh_keys
125-
}
126-
service_account {
127-
email = google_service_account.deployment_service_account.email
128-
scopes = [
129-
"cloud-platform"
130-
]
131-
}
132-
lifecycle {
133-
precondition {
134-
condition = data.google_compute_subnetwork.data_mx_subnet.private_ip_google_access
135-
error_message = module.commons.validation.gcp.subnet.private_google_access.error_message
136-
}
137-
}
138-
}
139-
140-
resource "time_sleep" "await_mx_ftl" {
141-
depends_on = [
142-
google_compute_instance.mx_instance
143-
]
144-
create_duration = "20m"
145-
}
146-
147-
resource "google_compute_firewall" "mx_firewall" {
148-
for_each = local.mx_fw_rules
149-
name = each.value.name
150-
network = each.value.network
151-
direction = each.value.direction
152-
source_ranges = each.value.source_ranges
153-
source_tags = each.value.source_tags
154-
target_tags = each.value.target_tags
155-
dynamic "allow" {
156-
for_each = each.value.allow
157-
content {
158-
protocol = allow.value.protocol
159-
ports = allow.value.ports
160-
}
161-
}
162-
}

init.tf renamed to old-tf-files/init.tf

File renamed without changes.

‎old-tf-files/main.tf‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
locals {
2+
resource_prefix = var.deployment_name != "" ? var.deployment_name : random_string.resource_prefix[0].result
3+
waf_image_url = "${module.commons.constants.gcp.image_url_prefix}${module.commons.builds[var.waf_version]}"
4+
mgt_network = var.vpc_network
5+
mx_tag = "${local.resource_prefix}-mx"
6+
mx_fw_rules = merge(
7+
length(var.ui_access_source_ranges) > 0 ? {
8+
UI = {
9+
name = "${local.resource_prefix}-mx-ui-access"
10+
direction = "INGRESS"
11+
network = local.mgt_network
12+
source_ranges = var.ui_access_source_ranges
13+
source_tags = []
14+
target_tags = [
15+
local.mx_tag
16+
]
17+
allow = [
18+
{
19+
protocol = "tcp"
20+
ports = [
21+
"8083"
22+
]
23+
}
24+
]
25+
}
26+
} : {},
27+
length(var.ssh_access_source_ranges) > 0 ? {
28+
SSH = {
29+
name = "${local.resource_prefix}-mx-ssh-access"
30+
direction = "INGRESS"
31+
network = local.mgt_network
32+
source_ranges = var.ssh_access_source_ranges
33+
source_tags = []
34+
target_tags = [
35+
local.mx_tag
36+
]
37+
allow = [
38+
{
39+
protocol = "tcp"
40+
ports = [
41+
"22"
42+
]
43+
}
44+
]
45+
}
46+
} : {}
47+
)
48+
mx_secret_id = google_secret_manager_secret.mx_admin_secret.secret_id
49+
management_ip = google_compute_instance.mx_instance.network_interface[0].network_ip
50+
}
51+
52+
data "google_client_config" "this" {}
53+
54+
data "google_compute_subnetwork" "data_mx_subnet" {
55+
name = var.subnet_name
56+
region = data.google_client_config.this.region
57+
}
58+
59+
module "commons" {
60+
source = "imperva/wafgateway-commons/google"
61+
version = "1.2.2"
62+
}
63+
64+
resource "random_string" "resource_prefix" {
65+
count = var.deployment_name != "" ? 0 : 1
66+
length = 4
67+
special = false
68+
upper = false
69+
numeric = false
70+
}
71+
72+
resource "google_service_account" "deployment_service_account" {
73+
account_id = "${local.resource_prefix}-mx-svc-acc"
74+
}
75+
76+
resource "google_secret_manager_secret" "mx_admin_secret" {
77+
secret_id = "${local.resource_prefix}-mx-secret"
78+
replication {
79+
auto {}
80+
}
81+
}
82+
83+
resource "google_secret_manager_secret_version" "mx_admin_secret_version" {
84+
secret = google_secret_manager_secret.mx_admin_secret.id
85+
secret_data = var.mx_password
86+
}
87+
88+
resource "google_secret_manager_secret_iam_member" "mx_admin_secret_iam_member" {
89+
secret_id = local.mx_secret_id
90+
role = "roles/secretmanager.secretAccessor"
91+
member = "serviceAccount:${google_service_account.deployment_service_account.email}"
92+
}
93+
94+
resource "google_compute_instance" "mx_instance" {
95+
depends_on = [
96+
google_secret_manager_secret_version.mx_admin_secret_version
97+
]
98+
name = "${local.resource_prefix}-mx"
99+
description = "Imperva WAF Management Server (Deployment ID: ${local.resource_prefix})"
100+
zone = var.zone
101+
deletion_protection = var.enable_termination_protection
102+
tags = [
103+
local.mx_tag
104+
]
105+
machine_type = var.instance_type
106+
boot_disk {
107+
initialize_params {
108+
image = local.waf_image_url
109+
}
110+
}
111+
network_interface {
112+
subnetwork = var.subnet_name
113+
network_ip = var.private_ip_address
114+
dynamic "access_config" {
115+
for_each = var.external_ip_address != "" || var.external_ip_network_tier != "" ? [1] : []
116+
content {
117+
nat_ip = var.external_ip_address
118+
network_tier = var.external_ip_network_tier
119+
}
120+
}
121+
}
122+
metadata = {
123+
startup-script = data.template_cloudinit_config.mx_gcp_deploy.rendered
124+
block-project-ssh-keys = var.block_project_ssh_keys
125+
}
126+
service_account {
127+
email = google_service_account.deployment_service_account.email
128+
scopes = [
129+
"cloud-platform"
130+
]
131+
}
132+
lifecycle {
133+
precondition {
134+
condition = data.google_compute_subnetwork.data_mx_subnet.private_ip_google_access
135+
error_message = module.commons.validation.gcp.subnet.private_google_access.error_message
136+
}
137+
}
138+
}
139+
140+
resource "time_sleep" "await_mx_ftl" {
141+
depends_on = [
142+
google_compute_instance.mx_instance
143+
]
144+
create_duration = "20m"
145+
}
146+
147+
resource "google_compute_firewall" "mx_firewall" {
148+
for_each = local.mx_fw_rules
149+
name = each.value.name
150+
network = each.value.network
151+
direction = each.value.direction
152+
source_ranges = each.value.source_ranges
153+
source_tags = each.value.source_tags
154+
target_tags = each.value.target_tags
155+
dynamic "allow" {
156+
for_each = each.value.allow
157+
content {
158+
protocol = allow.value.protocol
159+
ports = allow.value.ports
160+
}
161+
}
162+
}

outputs.tf renamed to old-tf-files/outputs.tf

File renamed without changes.

provider.tf renamed to old-tf-files/provider.tf

File renamed without changes.

variables.tf renamed to old-tf-files/variables.tf

File renamed without changes.

versions.tf renamed to old-tf-files/versions.tf

File renamed without changes.

0 commit comments

Comments
 (0)