magic_castle/openstack/network-2.tf at main · mboisson/magic_castle · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
resource "openstack_networking_secgroup_v2" "global" {
  name        = "${var.cluster_name}-secgroup"
  description = "${var.cluster_name} global security group"
}

resource "openstack_networking_secgroup_rule_v2" "icmp" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "icmp"
  description       = "internal allow all icmp"
  security_group_id = openstack_networking_secgroup_v2.global.id
  remote_group_id   = openstack_networking_secgroup_v2.global.id
}

resource "openstack_networking_secgroup_rule_v2" "tcp" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  description       = "internal allow all tcp"
  security_group_id = openstack_networking_secgroup_v2.global.id
  remote_group_id   = openstack_networking_secgroup_v2.global.id
}

resource "openstack_networking_secgroup_rule_v2" "udp" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "udp"
  description       = "internal allow all udp"
  security_group_id = openstack_networking_secgroup_v2.global.id
  remote_group_id   = openstack_networking_secgroup_v2.global.id
}

locals {
  all_tags   = toset(flatten([for key, value in module.design.instances : value.tags]))
  sec_groups = toset([for name, rule in var.firewall_rules : rule.tag if contains(local.all_tags, rule.tag)])
}

resource "openstack_networking_secgroup_v2" "external" {
  for_each    = local.sec_groups
  name        = "${var.cluster_name}-secgroup-${each.key}"
  description = "${var.cluster_name} external security group for ${each.key} instances"
  tags        = [each.key]
}

resource "openstack_networking_secgroup_rule_v2" "rule" {
  for_each = { for name, rule in var.firewall_rules : name => rule if contains(local.sec_groups, rule.tag) }

  direction         = "ingress"
  ethertype         = each.value.ethertype
  protocol          = each.value.protocol
  port_range_min    = each.value.from_port
  port_range_max    = each.value.to_port
  remote_ip_prefix  = each.value.cidr
  description       = each.key
  security_group_id = openstack_networking_secgroup_v2.external[each.value.tag].id
}

resource "openstack_networking_port_v2" "nic" {
  for_each   = module.design.instances
  name       = format("%s-%s-port", var.cluster_name, each.key)
  network_id = local.network.id
  security_group_ids = concat(
    [
      openstack_networking_secgroup_v2.global.id
    ],
    [
      for tag, value in openstack_networking_secgroup_v2.external : value.id if contains(each.value.tags, tag)
    ]
  )
  fixed_ip {
    subnet_id = local.subnet.id
  }
}