-
Notifications
You must be signed in to change notification settings - Fork 13
/
variables.tf
645 lines (563 loc) · 21.7 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
##############################################################################
# Module Level Variables
##############################################################################
variable "create_vpc" {
description = "Indicates whether user wants to use an existing vpc or create a new one. Set it to true to create a new vpc"
type = bool
default = true
}
variable "existing_vpc_id" {
description = "The ID of the existing vpc. Required if 'create_vpc' is false."
type = string
default = null
}
variable "resource_group_id" {
description = "The resource group ID where the VPC to be created"
type = string
}
variable "region" {
description = "The region to which to deploy the VPC"
type = string
}
variable "tags" {
description = "List of Tags for the resource created"
type = list(string)
default = null
}
variable "access_tags" {
type = list(string)
description = "A list of access tags to apply to the VPC resources created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial."
default = []
validation {
condition = alltrue([
for tag in var.access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128
])
error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\". For more information, see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits."
}
}
##############################################################################
# Naming Variables
##############################################################################
variable "prefix" {
description = "The value that you would like to prefix to the name of the resources provisioned by this module. Explicitly set to null if you do not wish to use a prefix. This value is ignored if using one of the optional variables for explicit control over naming."
type = string
default = null
}
variable "name" {
description = "Used for the naming of the VPC (if create_vpc is set to true), as well as in the naming for any resources created inside the VPC (unless using one of the optional variables for explicit control over naming)."
type = string
}
variable "dns_binding_name" {
description = "The name to give the provisioned VPC DNS resolution binding. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
variable "dns_instance_name" {
description = "The name to give the provisioned DNS instance. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
variable "dns_custom_resolver_name" {
description = "The name to give the provisioned DNS custom resolver instance. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
variable "routing_table_name" {
description = "The name to give the provisioned routing tables. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
variable "public_gateway_name" {
description = "The name to give the provisioned VPC public gateways. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
variable "vpc_flow_logs_name" {
description = "The name to give the provisioned VPC flow logs. If not set, the module generates a name based on the `prefix` and `name` variables."
type = string
default = null
}
##############################################################################
##############################################################################
# Optional VPC Variables
##############################################################################
variable "network_cidrs" {
description = "List of Network CIDRs for the VPC. This is used to manage network ACL rules for cluster provisioning."
type = list(string)
default = ["10.0.0.0/8"]
}
variable "classic_access" {
description = "OPTIONAL - Classic Access to the VPC"
type = bool
default = false
}
variable "default_network_acl_name" {
description = "OPTIONAL - Name of the Default ACL. If null, a name will be automatically generated"
type = string
default = null
}
variable "default_security_group_name" {
description = "OPTIONAL - Name of the Default Security Group. If null, a name will be automatically generated"
type = string
default = null
}
variable "default_routing_table_name" {
description = "OPTIONAL - Name of the Default Routing Table. If null, a name will be automatically generated"
type = string
default = null
}
variable "address_prefixes" {
description = "OPTIONAL - IP range that will be defined for the VPC for a certain location. Use only with manual address prefixes"
type = object({
zone-1 = optional(list(string))
zone-2 = optional(list(string))
zone-3 = optional(list(string))
})
default = {
zone-1 = null
zone-2 = null
zone-3 = null
}
validation {
error_message = "Keys for `use_public_gateways` must be in the order `zone-1`, `zone-2`, `zone-3`."
condition = var.address_prefixes == null ? true : (
(length(var.address_prefixes) == 1 && keys(var.address_prefixes)[0] == "zone-1") ||
(length(var.address_prefixes) == 2 && keys(var.address_prefixes)[0] == "zone-1" && keys(var.address_prefixes)[1] == "zone-2") ||
(length(var.address_prefixes) == 3 && keys(var.address_prefixes)[0] == "zone-1" && keys(var.address_prefixes)[1] == "zone-2") && keys(var.address_prefixes)[2] == "zone-3"
)
}
}
##############################################################################
##############################################################################
# Network ACLs
##############################################################################
variable "network_acls" {
description = "The list of ACLs to create. Provide at least one rule for each ACL."
type = list(
object({
name = string
add_ibm_cloud_internal_rules = optional(bool)
add_vpc_connectivity_rules = optional(bool)
prepend_ibm_rules = optional(bool)
rules = list(
object({
name = string
action = string
destination = string
direction = string
source = string
tcp = optional(
object({
port_max = optional(number)
port_min = optional(number)
source_port_max = optional(number)
source_port_min = optional(number)
})
)
udp = optional(
object({
port_max = optional(number)
port_min = optional(number)
source_port_max = optional(number)
source_port_min = optional(number)
})
)
icmp = optional(
object({
type = optional(number)
code = optional(number)
})
)
})
)
})
)
default = [
{
name = "vpc-acl"
add_ibm_cloud_internal_rules = true
add_vpc_connectivity_rules = true
prepend_ibm_rules = true
rules = [
## The below rules may be added to easily provide network connectivity for a loadbalancer
## Note that opening 0.0.0.0/0 is not FsCloud compliant
# {
# name = "allow-all-443-inbound"
# action = "allow"
# direction = "inbound"
# tcp = {
# port_min = 443
# port_max = 443
# source_port_min = 1024
# source_port_max = 65535
# }
# destination = "0.0.0.0/0"
# source = "0.0.0.0/0"
# },
# {
# name = "allow-all-443-outbound"
# action = "allow"
# direction = "outbound"
# tcp = {
# source_port_min = 443
# source_port_max = 443
# port_min = 1024
# port_max = 65535
# }
# destination = "0.0.0.0/0"
# source = "0.0.0.0/0"
# }
]
}
]
validation {
error_message = "ACL rule actions can only be `allow` or `deny`."
condition = length(distinct(
flatten([
# Check through rules
for rule in flatten([var.network_acls[*].rules]) :
# Return false action is not valid
false if !contains(["allow", "deny"], rule.action)
])
)) == 0
}
validation {
error_message = "ACL rule direction can only be `inbound` or `outbound`."
condition = length(distinct(
flatten([
# Check through rules
for rule in flatten([var.network_acls[*].rules]) :
# Return false if direction is not valid
false if !contains(["inbound", "outbound"], rule.direction)
])
)) == 0
}
validation {
error_message = "ACL rule names must match the regex pattern ^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$."
condition = length(distinct(
flatten([
# Check through rules
for rule in flatten([var.network_acls[*].rules]) :
# Return false if direction is not valid
false if !can(regex("^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$", rule.name))
])
)) == 0
}
}
##############################################################################
##############################################################################
# Public Gateways
##############################################################################
variable "use_public_gateways" {
description = "Create a public gateway in any of the three zones with `true`."
type = object({
zone-1 = optional(bool)
zone-2 = optional(bool)
zone-3 = optional(bool)
})
default = {
zone-1 = true
zone-2 = false
zone-3 = false
}
validation {
error_message = "Keys for `use_public_gateways` must be in the order `zone-1`, `zone-2`, `zone-3`."
condition = (
(length(var.use_public_gateways) == 1 && keys(var.use_public_gateways)[0] == "zone-1") ||
(length(var.use_public_gateways) == 2 && keys(var.use_public_gateways)[0] == "zone-1" && keys(var.use_public_gateways)[1] == "zone-2") ||
(length(var.use_public_gateways) == 3 && keys(var.use_public_gateways)[0] == "zone-1" && keys(var.use_public_gateways)[1] == "zone-2") && keys(var.use_public_gateways)[2] == "zone-3"
)
}
}
##############################################################################
##############################################################################
# Subnets
##############################################################################
variable "subnets" {
description = "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created"
type = object({
zone-1 = list(object({
name = string
cidr = string
public_gateway = optional(bool)
acl_name = string
no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
}))
zone-2 = optional(list(object({
name = string
cidr = string
public_gateway = optional(bool)
acl_name = string
no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
})))
zone-3 = optional(list(object({
name = string
cidr = string
public_gateway = optional(bool)
acl_name = string
no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
})))
})
default = {
zone-1 = [
{
name = "subnet-a"
cidr = "10.10.10.0/24"
public_gateway = true
acl_name = "vpc-acl"
no_addr_prefix = false
}
],
zone-2 = [
{
name = "subnet-b"
cidr = "10.20.10.0/24"
public_gateway = true
acl_name = "vpc-acl"
no_addr_prefix = false
}
],
zone-3 = [
{
name = "subnet-c"
cidr = "10.30.10.0/24"
public_gateway = false
acl_name = "vpc-acl"
no_addr_prefix = false
}
]
}
validation {
error_message = "Keys for `subnets` must be in the order `zone-1`, `zone-2`, `zone-3`. "
condition = (
(length(var.subnets) == 1 && keys(var.subnets)[0] == "zone-1") ||
(length(var.subnets) == 2 && keys(var.subnets)[0] == "zone-1" && keys(var.subnets)[1] == "zone-2") ||
(length(var.subnets) == 3 && keys(var.subnets)[0] == "zone-1" && keys(var.subnets)[1] == "zone-2") && keys(var.subnets)[2] == "zone-3"
)
}
}
variable "create_subnets" {
description = "Indicates whether user wants to use existing subnets or create new. Set it to true to create new subnets."
type = bool
default = true
}
variable "existing_subnets" {
description = "The detail of the existing subnets and required mappings to other resources. Required if 'create_subnets' is false."
type = list(object({
id = string
public_gateway = optional(bool, false)
}))
default = []
nullable = false
}
##############################################################################
##############################################################################
# Default Security Group Rules
##############################################################################
variable "security_group_rules" {
description = "A list of security group rules to be added to the default vpc security group (default empty)"
default = []
type = list(
object({
name = string
direction = string
remote = string
tcp = optional(
object({
port_max = optional(number)
port_min = optional(number)
})
)
udp = optional(
object({
port_max = optional(number)
port_min = optional(number)
})
)
icmp = optional(
object({
type = optional(number)
code = optional(number)
})
)
})
)
validation {
error_message = "Security group rule direction can only be `inbound` or `outbound`."
condition = (var.security_group_rules == null || length(var.security_group_rules) == 0) ? true : length(distinct(
flatten([
# Check through rules
for rule in var.security_group_rules :
# Return false if direction is not valid
false if !contains(["inbound", "outbound"], rule.direction)
])
)) == 0
}
validation {
error_message = "Security group rule names must match the regex pattern ^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$."
condition = (var.security_group_rules == null || length(var.security_group_rules) == 0) ? true : length(distinct(
flatten([
# Check through rules
for rule in var.security_group_rules :
# Return false if direction is not valid
false if !can(regex("^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$", rule.name))
])
)) == 0
}
}
variable "clean_default_sg_acl" {
description = "Remove all rules from the default VPC security group and VPC ACL (less permissive)"
type = bool
default = false
}
##############################################################################
##############################################################################
# Add routes to VPC
##############################################################################
variable "routes" {
description = "OPTIONAL - Allows you to specify the next hop for packets based on their destination address"
type = list(
object({
name = string
route_direct_link_ingress = optional(bool)
route_transit_gateway_ingress = optional(bool)
route_vpc_zone_ingress = optional(bool)
routes = optional(
list(
object({
action = optional(string)
zone = number
destination = string
next_hop = string
})
))
})
)
default = []
}
##############################################################################
##############################################################################
# VPC Flow Logs Variables
##############################################################################
variable "enable_vpc_flow_logs" {
description = "Flag to enable vpc flow logs. If true, flow log collector will be created"
type = bool
default = false
}
variable "create_authorization_policy_vpc_to_cos" {
description = "Create authorisation policy for VPC to access COS. Set as false if authorization policy exists already"
type = bool
default = false
}
variable "existing_cos_instance_guid" {
description = "GUID of the COS instance to create Flow log collector"
type = string
default = null
}
variable "existing_storage_bucket_name" {
description = "Name of the COS bucket to collect VPC flow logs"
type = string
default = null
}
variable "is_flow_log_collector_active" {
description = "Indicates whether the collector is active. If false, this collector is created in inactive mode."
type = bool
default = true
}
##############################################################################
##############################################################################
# VPC Hub-Spoke support
##############################################################################
variable "enable_hub" {
description = "Indicates whether this VPC is enabled as a DNS name resolution hub."
type = bool
default = false
}
variable "skip_spoke_auth_policy" {
description = "Set to true to skip the creation of an authorization policy between the DNS resolution spoke and hub, only enable this if a policy already exists between these two VPCs. See https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-dns-sharing-s2s-auth&interface=ui for more details."
type = bool
default = false
}
variable "hub_account_id" {
description = "ID of the hub account for DNS resolution, required if 'skip_spoke_auth_policy' is false."
type = string
default = null
}
variable "enable_hub_vpc_id" {
description = "Indicates whether Hub VPC ID is passed."
type = bool
default = false
}
variable "hub_vpc_id" {
description = "Indicates the id of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub_vpc_crn."
type = string
default = null
}
variable "enable_hub_vpc_crn" {
description = "Indicates whether Hub VPC CRN is passed."
type = bool
default = false
}
variable "hub_vpc_crn" {
description = "Indicates the crn of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub_vpc_id."
type = string
default = null
}
variable "update_delegated_resolver" {
description = "If set to true, and if the vpc is configured to be a spoke for DNS resolution (enable_hub_vpc_crn or enable_hub_vpc_id set), then the spoke VPC resolver will be updated to a delegated resolver."
type = bool
default = false
}
variable "skip_custom_resolver_hub_creation" {
description = "Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable_hub is set to true."
type = bool
default = false
}
variable "existing_dns_instance_id" {
description = "Id of an existing dns instance in which the custom resolver is created. Only relevant if enable_hub is set to true."
type = string
default = null
}
variable "use_existing_dns_instance" {
description = "Whether to use an existing dns instance. If true, existing_dns_instance_id must be set."
type = bool
default = false
}
variable "resolver_type" {
description = "Resolver type. Can be system or manual. For delegated resolver type, see the update_delegated_resolver variable instead. "
type = string
default = null
validation {
condition = anytrue([
var.resolver_type == null,
var.resolver_type == "system",
var.resolver_type == "manual",
])
error_message = "`resolver_type` can either be null, or set to the string 'system' or 'manual'."
}
}
variable "manual_servers" {
description = "The DNS server addresses to use for the VPC, replacing any existing servers. All the entries must either have a unique zone_affinity, or not have a zone_affinity."
type = list(object({
address = string
zone_affinity = optional(string)
}))
default = []
}
variable "dns_location" {
description = "The target location or environment for the DNS instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable_hub is true and skip_custom_resolver_hub_creation is false (defaults). "
type = string
default = "global"
}
variable "dns_plan" {
description = "The plan for the DNS resource instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable_hub is true and skip_custom_resolver_hub_creation is false (defaults)."
type = string
default = "standard-dns"
validation {
condition = anytrue([
var.dns_plan == "standard-dns",
var.dns_plan == "free-plan",
])
error_message = "`dns_plan` can either be standard-dns or free-plan."
}
}