From ec1efbb4cedb98eb0fb5c1f6288b74840fa6643c Mon Sep 17 00:00:00 2001 From: Todd Giguere Date: Mon, 26 Feb 2024 12:00:28 -0500 Subject: [PATCH 1/5] feat: option to disable auto addr prefix for subnets --- README.md | 2 +- dynamic_values/subnet.tf | 1 + subnet.tf | 3 ++- variables.tf | 54 ++++++++++++++++++++++------------------ 4 files changed, 34 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 180f1d7d..4dc07288 100644 --- a/README.md +++ b/README.md @@ -180,7 +180,7 @@ To attach access management tags to resources in this module, you need the follo | [routing\_table\_name](#input\_routing\_table\_name) | The name to give the provisioned routing tables. If not set, the module generates a name based on the `prefix` and `name` variables. | `string` | `null` | no | | [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty) | 
list(
    object({
      name      = string
      direction = string
      remote    = string
      tcp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      udp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      icmp = optional(
        object({
          type = optional(number)
          code = optional(number)
        })
      )
    })
  )
| `[]` | no | | [skip\_custom\_resolver\_hub\_creation](#input\_skip\_custom\_resolver\_hub\_creation) | Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable\_hub is set to true. | `bool` | `false` | no | -| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "name": "subnet-b",
      "public_gateway": true
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "name": "subnet-c",
      "public_gateway": false
    }
  ]
}
| no | +| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created | 
object({
    zone-1 = list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    }))
    zone-2 = optional(list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
    zone-3 = optional(list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-a",
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-b",
      "public_gateway": true
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-c",
      "public_gateway": false
    }
  ]
}
| no | | [tags](#input\_tags) | List of Tags for the resource created | `list(string)` | `null` | no | | [update\_delegated\_resolver](#input\_update\_delegated\_resolver) | If set to true, and if the vpc is configured to be a spoke for DNS resolution (enable\_hub\_vpc\_crn or enable\_hub\_vpc\_id set), then the spoke VPC resolver will be updated to a delegated resolver. | `bool` | `false` | no | | [use\_existing\_dns\_instance](#input\_use\_existing\_dns\_instance) | Whether to use an existing dns instance. If true, existing\_dns\_instance\_id must be set. | `bool` | `false` | no | diff --git a/dynamic_values/subnet.tf b/dynamic_values/subnet.tf index 2d25c17c..783101c1 100644 --- a/dynamic_values/subnet.tf +++ b/dynamic_values/subnet.tf @@ -16,6 +16,7 @@ locals { zone = index(keys(var.subnets), zone) + 1 # Zone 1, 2, or 3 zone_name = "${var.region}-${index(keys(var.subnets), zone) + 1}" # Contains region and zone cidr = value.cidr # CIDR Block + no_prefix = value.disable_auto_addr_prefix # If true will not create addr prefix for subnet under any circumstance count = index(var.subnets[zone], value) + 1 # Count of the subnet within the zone acl = value.acl_name # Public gateway ID diff --git a/subnet.tf b/subnet.tf index df1d9a5e..57429d99 100644 --- a/subnet.tf +++ b/subnet.tf @@ -17,7 +17,8 @@ locals { resource "ibm_is_vpc_address_prefix" "subnet_prefix" { # Address prefixes replace subnet prefixes - for_each = length(local.address_prefixes) > 0 || !var.create_subnets ? {} : local.subnet_object + # Only create prefix if creating subnets, flag not set to disable prefix creation, and no specific prefixes were supplied + for_each = { for k, v in local.subnet_object : k => v if(v.no_prefix == false && var.create_subnets == true && length(local.address_prefixes) == 0) } name = each.value.prefix_name zone = each.value.zone_name vpc = local.vpc_id diff --git a/variables.tf b/variables.tf index 133d9dd1..8abc4106 100644 --- a/variables.tf +++ b/variables.tf @@ -320,48 +320,54 @@ variable "subnets" { description = "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created" type = object({ zone-1 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true })) zone-2 = optional(list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) zone-3 = optional(list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) }) default = { zone-1 = [ { - name = "subnet-a" - cidr = "10.10.10.0/24" - public_gateway = true - acl_name = "vpc-acl" + name = "subnet-a" + cidr = "10.10.10.0/24" + public_gateway = true + acl_name = "vpc-acl" + disable_auto_addr_prefix = false } ], zone-2 = [ { - name = "subnet-b" - cidr = "10.20.10.0/24" - public_gateway = true - acl_name = "vpc-acl" + name = "subnet-b" + cidr = "10.20.10.0/24" + public_gateway = true + acl_name = "vpc-acl" + disable_auto_addr_prefix = false } ], zone-3 = [ { - name = "subnet-c" - cidr = "10.30.10.0/24" - public_gateway = false - acl_name = "vpc-acl" + name = "subnet-c" + cidr = "10.30.10.0/24" + public_gateway = false + acl_name = "vpc-acl" + disable_auto_addr_prefix = false } ] } From a2d5e913ccea9f904e8fee9393fc0ee323aa2885 Mon Sep 17 00:00:00 2001 From: Todd Giguere Date: Mon, 26 Feb 2024 13:22:20 -0500 Subject: [PATCH 2/5] fix: add new subnet property to dynamic values module --- dynamic_values/variables.tf | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/dynamic_values/variables.tf b/dynamic_values/variables.tf index bfb39b79..307bd01b 100644 --- a/dynamic_values/variables.tf +++ b/dynamic_values/variables.tf @@ -183,22 +183,25 @@ variable "subnets" { description = "direct reference to network acls" type = object({ zone-1 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) })) zone-2 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) })) zone-3 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + disable_auto_addr_prefix = optional(bool, false) })) }) } From e71d38039237697eb1dc97bb0b22f2fc4653cd49 Mon Sep 17 00:00:00 2001 From: Todd Giguere Date: Mon, 26 Feb 2024 14:41:00 -0500 Subject: [PATCH 3/5] refactor: rename new property to no_addr_prefix --- README.md | 2 +- dynamic_values/subnet.tf | 2 +- dynamic_values/variables.tf | 30 +++++++++---------- variables.tf | 60 ++++++++++++++++++------------------- 4 files changed, 47 insertions(+), 47 deletions(-) diff --git a/README.md b/README.md index 4dc07288..4f748098 100644 --- a/README.md +++ b/README.md @@ -180,7 +180,7 @@ To attach access management tags to resources in this module, you need the follo | [routing\_table\_name](#input\_routing\_table\_name) | The name to give the provisioned routing tables. If not set, the module generates a name based on the `prefix` and `name` variables. | `string` | `null` | no | | [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty) | 
list(
    object({
      name      = string
      direction = string
      remote    = string
      tcp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      udp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      icmp = optional(
        object({
          type = optional(number)
          code = optional(number)
        })
      )
    })
  )
| `[]` | no | | [skip\_custom\_resolver\_hub\_creation](#input\_skip\_custom\_resolver\_hub\_creation) | Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable\_hub is set to true. | `bool` | `false` | no | -| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created | 
object({
    zone-1 = list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    }))
    zone-2 = optional(list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
    zone-3 = optional(list(object({
      name                     = string
      cidr                     = string
      public_gateway           = optional(bool)
      acl_name                 = string
      disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-a",
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-b",
      "public_gateway": true
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "disable_auto_addr_prefix": false,
      "name": "subnet-c",
      "public_gateway": false
    }
  ]
}
| no | +| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "name": "subnet-b",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "name": "subnet-c",
      "no_addr_prefix": false,
      "public_gateway": false
    }
  ]
}
| no | | [tags](#input\_tags) | List of Tags for the resource created | `list(string)` | `null` | no | | [update\_delegated\_resolver](#input\_update\_delegated\_resolver) | If set to true, and if the vpc is configured to be a spoke for DNS resolution (enable\_hub\_vpc\_crn or enable\_hub\_vpc\_id set), then the spoke VPC resolver will be updated to a delegated resolver. | `bool` | `false` | no | | [use\_existing\_dns\_instance](#input\_use\_existing\_dns\_instance) | Whether to use an existing dns instance. If true, existing\_dns\_instance\_id must be set. | `bool` | `false` | no | diff --git a/dynamic_values/subnet.tf b/dynamic_values/subnet.tf index 783101c1..8701de03 100644 --- a/dynamic_values/subnet.tf +++ b/dynamic_values/subnet.tf @@ -16,7 +16,7 @@ locals { zone = index(keys(var.subnets), zone) + 1 # Zone 1, 2, or 3 zone_name = "${var.region}-${index(keys(var.subnets), zone) + 1}" # Contains region and zone cidr = value.cidr # CIDR Block - no_prefix = value.disable_auto_addr_prefix # If true will not create addr prefix for subnet under any circumstance + no_prefix = value.no_addr_prefix # If true will not create addr prefix for subnet under any circumstance count = index(var.subnets[zone], value) + 1 # Count of the subnet within the zone acl = value.acl_name # Public gateway ID diff --git a/dynamic_values/variables.tf b/dynamic_values/variables.tf index 307bd01b..1763ad91 100644 --- a/dynamic_values/variables.tf +++ b/dynamic_values/variables.tf @@ -183,25 +183,25 @@ variable "subnets" { description = "direct reference to network acls" type = object({ zone-1 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) })) zone-2 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) })) zone-3 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) })) }) } diff --git a/variables.tf b/variables.tf index 8abc4106..260c0649 100644 --- a/variables.tf +++ b/variables.tf @@ -320,54 +320,54 @@ variable "subnets" { description = "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created" type = object({ zone-1 = list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true })) zone-2 = optional(list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) zone-3 = optional(list(object({ - name = string - cidr = string - public_gateway = optional(bool) - acl_name = string - disable_auto_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true + name = string + cidr = string + public_gateway = optional(bool) + acl_name = string + no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) }) default = { zone-1 = [ { - name = "subnet-a" - cidr = "10.10.10.0/24" - public_gateway = true - acl_name = "vpc-acl" - disable_auto_addr_prefix = false + name = "subnet-a" + cidr = "10.10.10.0/24" + public_gateway = true + acl_name = "vpc-acl" + no_addr_prefix = false } ], zone-2 = [ { - name = "subnet-b" - cidr = "10.20.10.0/24" - public_gateway = true - acl_name = "vpc-acl" - disable_auto_addr_prefix = false + name = "subnet-b" + cidr = "10.20.10.0/24" + public_gateway = true + acl_name = "vpc-acl" + no_addr_prefix = false } ], zone-3 = [ { - name = "subnet-c" - cidr = "10.30.10.0/24" - public_gateway = false - acl_name = "vpc-acl" - disable_auto_addr_prefix = false + name = "subnet-c" + cidr = "10.30.10.0/24" + public_gateway = false + acl_name = "vpc-acl" + no_addr_prefix = false } ] } From 37155ea294a4af93fc2f8810fad51014b375dd05 Mon Sep 17 00:00:00 2001 From: Todd Giguere Date: Mon, 26 Feb 2024 15:31:46 -0500 Subject: [PATCH 4/5] fix: if no addr prefix set remove depend on addr prefix value --- subnet.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subnet.tf b/subnet.tf index 57429d99..3f3625a7 100644 --- a/subnet.tf +++ b/subnet.tf @@ -38,7 +38,7 @@ resource "ibm_is_subnet" "subnet" { name = each.key zone = each.value.zone_name resource_group = var.resource_group_id - ipv4_cidr_block = length(keys(local.address_prefixes)) == 0 ? ibm_is_vpc_address_prefix.subnet_prefix[each.value.prefix_name].cidr : each.value.cidr + ipv4_cidr_block = length(keys(local.address_prefixes)) == 0 && !each.value.no_addr_prefix ? ibm_is_vpc_address_prefix.subnet_prefix[each.value.prefix_name].cidr : each.value.cidr network_acl = ibm_is_network_acl.network_acl[each.value.acl].id public_gateway = each.value.public_gateway tags = var.tags From f9894191ff98fb146c1d0bd7daef60f95758ea0e Mon Sep 17 00:00:00 2001 From: Todd Giguere Date: Mon, 26 Feb 2024 15:33:17 -0500 Subject: [PATCH 5/5] fix: use correct property name for subnet no prefix --- subnet.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subnet.tf b/subnet.tf index 3f3625a7..e64f59db 100644 --- a/subnet.tf +++ b/subnet.tf @@ -38,7 +38,7 @@ resource "ibm_is_subnet" "subnet" { name = each.key zone = each.value.zone_name resource_group = var.resource_group_id - ipv4_cidr_block = length(keys(local.address_prefixes)) == 0 && !each.value.no_addr_prefix ? ibm_is_vpc_address_prefix.subnet_prefix[each.value.prefix_name].cidr : each.value.cidr + ipv4_cidr_block = length(keys(local.address_prefixes)) == 0 && !each.value.no_prefix ? ibm_is_vpc_address_prefix.subnet_prefix[each.value.prefix_name].cidr : each.value.cidr network_acl = ibm_is_network_acl.network_acl[each.value.acl].id public_gateway = each.value.public_gateway tags = var.tags