ayurishchevandClaude Sonnet 5
1ef4b12143
private_supernet/private_subnet_prefix_length/private_interface_count
(which auto-derived per-router-per-role micro-subnets via cidrsubnet())
are replaced by a single required variable, private_network_cidrs: one
CIDR per shared private network that router VMs get an interface into,
supplied explicitly by the admin - no auto-carving. Each router gets its
own port/IP inside every listed network (cidrhost(cidr, router_index+2)),
closer to the original lan_net design but generalized to N networks and
N routers. network-init.sh.tpl needed no changes - it already matches
interfaces by CIDR membership regardless of whether the CIDR is shared.
Also fixes a testing gap found along the way: `terraform validate` does
not enforce variable validation{} blocks for externally-supplied values
in this terraform version - only `plan`/`apply` do. The test suite now
exercises those validations for real via `terraform plan` against an
isolated, provider-free copy of variables.tf.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hXR2ftXZZhJ4Y3XuSoR8r
287 lines
8.1 KiB
Terraform
287 lines
8.1 KiB
Terraform
data "vkcs_images_image" "ubuntu24" {
|
|
visibility = "public"
|
|
most_recent = true
|
|
properties = {
|
|
mcs_os_distro = "ubuntu"
|
|
mcs_os_version = "24.04"
|
|
}
|
|
}
|
|
|
|
data "vkcs_networking_network" "extnet" {
|
|
name = "internet"
|
|
sdn = "sprut"
|
|
}
|
|
|
|
# LAN Network
|
|
resource "vkcs_networking_network" "lan_net" {
|
|
name = "router-lan-net"
|
|
sdn = "sprut"
|
|
admin_state_up = true
|
|
}
|
|
|
|
resource "vkcs_networking_subnet" "lan_subnet" {
|
|
network_id = vkcs_networking_network.lan_net.id
|
|
name = "router-lan-subnet"
|
|
cidr = "10.200.10.0/24"
|
|
gateway_ip = "10.200.10.1"
|
|
dns_nameservers = ["8.8.8.8", "1.1.1.1"]
|
|
sdn = "sprut"
|
|
|
|
allocation_pool {
|
|
start = "10.200.10.100"
|
|
end = "10.200.10.200"
|
|
}
|
|
}
|
|
|
|
# Security Groups
|
|
resource "vkcs_networking_secgroup" "router_sg" {
|
|
name = "router-sg"
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup" "private_sg" {
|
|
name = "private-sg"
|
|
sdn = "sprut"
|
|
}
|
|
|
|
# Private SG rules
|
|
resource "vkcs_networking_secgroup_rule" "from_rfc_net192_in" {
|
|
direction = "ingress"
|
|
remote_ip_prefix = "192.168.0.0/16"
|
|
security_group_id = vkcs_networking_secgroup.private_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup_rule" "from_rfc_net172_in" {
|
|
direction = "ingress"
|
|
remote_ip_prefix = "172.16.0.0/12"
|
|
security_group_id = vkcs_networking_secgroup.private_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup_rule" "from_rfc_net10_in" {
|
|
direction = "ingress"
|
|
remote_ip_prefix = "10.0.0.0/8"
|
|
security_group_id = vkcs_networking_secgroup.private_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
# Router SG rules
|
|
resource "vkcs_networking_secgroup_rule" "router_ssh" {
|
|
direction = "ingress"
|
|
protocol = "tcp"
|
|
port_range_min = 22
|
|
port_range_max = 22
|
|
remote_ip_prefix = "0.0.0.0/0"
|
|
security_group_id = vkcs_networking_secgroup.router_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup_rule" "router_icmp" {
|
|
direction = "ingress"
|
|
protocol = "icmp"
|
|
remote_ip_prefix = "0.0.0.0/0"
|
|
security_group_id = vkcs_networking_secgroup.router_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup_rule" "router_ipsec_ike" {
|
|
direction = "ingress"
|
|
protocol = "udp"
|
|
port_range_min = 500
|
|
port_range_max = 500
|
|
remote_ip_prefix = "0.0.0.0/0"
|
|
security_group_id = vkcs_networking_secgroup.router_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_secgroup_rule" "router_ipsec_nat_t" {
|
|
direction = "ingress"
|
|
protocol = "udp"
|
|
port_range_min = 4500
|
|
port_range_max = 4500
|
|
remote_ip_prefix = "0.0.0.0/0"
|
|
security_group_id = vkcs_networking_secgroup.router_sg.id
|
|
sdn = "sprut"
|
|
}
|
|
|
|
# Per-router private interfaces: one shared private network per admin-supplied
|
|
# CIDR in private_network_cidrs (no shared LAN with the priv_srv_* segment,
|
|
# no VRRP), each router getting its own port/IP inside every such network.
|
|
locals {
|
|
private_roles = [for idx in range(length(var.private_network_cidrs)) : "priv${idx + 1}"]
|
|
|
|
private_network_cidr = {
|
|
for idx, cidr in var.private_network_cidrs :
|
|
"priv${idx + 1}" => cidr
|
|
}
|
|
}
|
|
|
|
resource "vkcs_networking_network" "router_priv_net" {
|
|
for_each = local.private_network_cidr
|
|
name = "router-${each.key}-net"
|
|
sdn = "sprut"
|
|
admin_state_up = true
|
|
}
|
|
|
|
resource "vkcs_networking_subnet" "router_priv_subnet" {
|
|
for_each = local.private_network_cidr
|
|
network_id = vkcs_networking_network.router_priv_net[each.key].id
|
|
name = "router-${each.key}-subnet"
|
|
cidr = each.value
|
|
gateway_ip = cidrhost(each.value, 1)
|
|
sdn = "sprut"
|
|
}
|
|
|
|
resource "vkcs_networking_port" "router_priv_port" {
|
|
for_each = {
|
|
for pair in setproduct(range(var.router_count), local.private_roles) :
|
|
"router${pair[0] + 1}-${pair[1]}" => {
|
|
router_index = pair[0]
|
|
role = pair[1]
|
|
}
|
|
}
|
|
name = "router-${each.key}-port"
|
|
network_id = vkcs_networking_network.router_priv_net[each.value.role].id
|
|
admin_state_up = true
|
|
port_security_enabled = false
|
|
full_security_groups_control = true
|
|
security_group_ids = []
|
|
sdn = "sprut"
|
|
fixed_ip {
|
|
subnet_id = vkcs_networking_subnet.router_priv_subnet[each.value.role].id
|
|
ip_address = cidrhost(local.private_network_cidr[each.value.role], each.value.router_index + 2)
|
|
}
|
|
}
|
|
|
|
resource "vkcs_compute_instance" "router" {
|
|
count = var.router_count
|
|
name = "router${count.index + 1}"
|
|
image_id = data.vkcs_images_image.ubuntu24.id
|
|
flavor_name = "STD3-4-4"
|
|
availability_zone = element(var.router_availability_zones, count.index % length(var.router_availability_zones))
|
|
key_pair = var.ssh_key_name
|
|
|
|
security_group_ids = [
|
|
vkcs_networking_secgroup.router_sg.id,
|
|
"d479b4d7-55b3-4ff1-bf8d-24d826a38f11"
|
|
]
|
|
|
|
config_drive = true
|
|
|
|
# Configure persistent networking using script: WAN via heuristic public-IP
|
|
# detection, private interfaces matched by their expected CIDR.
|
|
user_data = templatefile("${path.module}/scripts/network-init.sh.tpl", {
|
|
private_interfaces = [
|
|
for role in local.private_roles : {
|
|
name = "eth${index(local.private_roles, role) + 1}"
|
|
cidr = local.private_network_cidr[role]
|
|
}
|
|
]
|
|
})
|
|
|
|
# WAN: dynamically created port
|
|
network {
|
|
uuid = data.vkcs_networking_network.extnet.id
|
|
}
|
|
|
|
# Private: one pre-created port per role, into that role's shared network
|
|
dynamic "network" {
|
|
for_each = local.private_roles
|
|
content {
|
|
port = vkcs_networking_port.router_priv_port["router${count.index + 1}-${network.value}"].id
|
|
}
|
|
}
|
|
|
|
block_device {
|
|
uuid = data.vkcs_images_image.ubuntu24.id
|
|
source_type = "image"
|
|
volume_size = 20
|
|
boot_index = 0
|
|
destination_type = "volume"
|
|
volume_type = "ceph-ssd"
|
|
delete_on_termination = true
|
|
}
|
|
}
|
|
|
|
resource "vkcs_compute_instance" "priv_srv_01" {
|
|
name = "Priv-SRV-01"
|
|
image_id = data.vkcs_images_image.ubuntu24.id
|
|
flavor_name = "STD3-4-4"
|
|
availability_zone = "ME1"
|
|
key_pair = var.ssh_key_name
|
|
|
|
security_group_ids = [
|
|
vkcs_networking_secgroup.private_sg.id,
|
|
"d479b4d7-55b3-4ff1-bf8d-24d826a38f11"
|
|
]
|
|
|
|
network {
|
|
uuid = vkcs_networking_network.lan_net.id
|
|
}
|
|
|
|
block_device {
|
|
uuid = data.vkcs_images_image.ubuntu24.id
|
|
source_type = "image"
|
|
volume_size = 20
|
|
boot_index = 0
|
|
destination_type = "volume"
|
|
volume_type = "ceph-ssd"
|
|
delete_on_termination = true
|
|
}
|
|
|
|
}
|
|
|
|
resource "vkcs_compute_instance" "priv_srv_02" {
|
|
name = "Priv-SRV-02"
|
|
image_id = data.vkcs_images_image.ubuntu24.id
|
|
flavor_name = "STD3-4-4"
|
|
availability_zone = "ME1"
|
|
key_pair = var.ssh_key_name
|
|
|
|
security_group_ids = [
|
|
vkcs_networking_secgroup.private_sg.id,
|
|
"d479b4d7-55b3-4ff1-bf8d-24d826a38f11"
|
|
]
|
|
|
|
network {
|
|
uuid = vkcs_networking_network.lan_net.id
|
|
}
|
|
|
|
block_device {
|
|
uuid = data.vkcs_images_image.ubuntu24.id
|
|
source_type = "image"
|
|
volume_size = 20
|
|
boot_index = 0
|
|
destination_type = "volume"
|
|
volume_type = "ceph-ssd"
|
|
delete_on_termination = true
|
|
}
|
|
}
|
|
|
|
resource "vkcs_compute_instance" "priv_srv_03" {
|
|
name = "Priv-SRV-03"
|
|
image_id = data.vkcs_images_image.ubuntu24.id
|
|
flavor_name = "STD3-4-4"
|
|
availability_zone = "MS1"
|
|
key_pair = var.ssh_key_name
|
|
|
|
security_group_ids = [
|
|
vkcs_networking_secgroup.private_sg.id,
|
|
"d479b4d7-55b3-4ff1-bf8d-24d826a38f11"
|
|
]
|
|
|
|
network {
|
|
uuid = vkcs_networking_network.lan_net.id
|
|
}
|
|
|
|
block_device {
|
|
uuid = data.vkcs_images_image.ubuntu24.id
|
|
source_type = "image"
|
|
volume_size = 20
|
|
boot_index = 0
|
|
destination_type = "volume"
|
|
volume_type = "ceph-ssd"
|
|
delete_on_termination = true
|
|
}
|
|
} |