|
| 1 | +module "vcn" { |
| 2 | + source = "github.com/oracle-quickstart/terraform-oci-networking//modules/vcn?ref=0.1.2" |
| 3 | + |
| 4 | + # Oracle Cloud Infrastructure Tenancy and Compartment OCID |
| 5 | + compartment_ocid = var.compartment_ocid |
| 6 | + |
| 7 | + # Deployment Tags + Freeform Tags + Defined Tags |
| 8 | + vcn_tags = local.oci_tag_values |
| 9 | + |
| 10 | + # Virtual Cloud Network (VCN) arguments |
| 11 | + create_new_vcn = false |
| 12 | + existent_vcn_ocid = var.existent_vcn_ocid |
| 13 | +} |
| 14 | + |
| 15 | +module "subnets" { |
| 16 | + for_each = { for map in local.subnets : map.subnet_name => map } |
| 17 | + source = "github.com/oracle-quickstart/terraform-oci-networking//modules/subnet?ref=0.1.2" |
| 18 | + |
| 19 | + # Oracle Cloud Infrastructure Tenancy and Compartment OCID |
| 20 | + compartment_ocid = var.compartment_ocid |
| 21 | + vcn_id = module.vcn.vcn_id |
| 22 | + |
| 23 | + # Deployment Tags + Freeform Tags + Defined Tags |
| 24 | + subnet_tags = local.oci_tag_values |
| 25 | + |
| 26 | + # Subnet arguments |
| 27 | + create_subnet = true |
| 28 | + subnet_name = each.value.subnet_name |
| 29 | + cidr_block = each.value.cidr_block |
| 30 | + display_name = each.value.display_name # If null, is autogenerated |
| 31 | + dns_label = each.value.dns_label # If null, is autogenerated |
| 32 | + prohibit_public_ip_on_vnic = each.value.prohibit_public_ip_on_vnic |
| 33 | + prohibit_internet_ingress = each.value.prohibit_internet_ingress |
| 34 | + route_table_id = each.value.route_table_id # If null, the VCN's default route table is used |
| 35 | + dhcp_options_id = each.value.dhcp_options_id # If null, the VCN's default set of DHCP options is used |
| 36 | + security_list_ids = each.value.security_list_ids # If null, the VCN's default security list is used |
| 37 | + ipv6cidr_block = each.value.ipv6cidr_block # If null, no IPv6 CIDR block is assigned |
| 38 | +} |
| 39 | +locals { |
| 40 | + subnets = [ |
| 41 | + { |
| 42 | + subnet_name = "api_gw_fn_subnet" |
| 43 | + cidr_block = lookup(local.network_cidrs, "APIGW-FN-REGIONAL-SUBNET-CIDR") |
| 44 | + display_name = "API Gateway and Fn subnet (${local.deploy_id})" |
| 45 | + dns_label = "apigwfn${local.deploy_id}" |
| 46 | + prohibit_public_ip_on_vnic = false |
| 47 | + prohibit_internet_ingress = false |
| 48 | + route_table_id = module.route_tables["apigw_fn_public"].route_table_id # TODO: implement data.oci_core_route_tables to get existent |
| 49 | + dhcp_options_id = module.vcn.default_dhcp_options_id |
| 50 | + security_list_ids = [module.security_lists["apigw_fn_security_list"].security_list_id] |
| 51 | + ipv6cidr_block = null |
| 52 | + } |
| 53 | + ] |
| 54 | +} |
| 55 | + |
| 56 | +module "route_tables" { |
| 57 | + for_each = { for map in local.route_tables : map.route_table_name => map } |
| 58 | + source = "github.com/oracle-quickstart/terraform-oci-networking//modules/route_table?ref=0.1.2" |
| 59 | + |
| 60 | + # Oracle Cloud Infrastructure Tenancy and Compartment OCID |
| 61 | + compartment_ocid = local.vcn_compartment_ocid |
| 62 | + vcn_id = module.vcn.vcn_id |
| 63 | + |
| 64 | + # Deployment Tags + Freeform Tags + Defined Tags |
| 65 | + route_table_tags = local.oci_tag_values |
| 66 | + |
| 67 | + # Route Table attributes |
| 68 | + create_route_table = true |
| 69 | + route_table_name = each.value.route_table_name |
| 70 | + display_name = each.value.display_name |
| 71 | + route_rules = each.value.route_rules |
| 72 | +} |
| 73 | +locals { |
| 74 | + route_tables = [{ |
| 75 | + route_table_name = "apigw_fn_public" |
| 76 | + display_name = "API Gateway and Fn Gatw Route Table (${local.deploy_id})" |
| 77 | + route_rules = [ |
| 78 | + { |
| 79 | + description = "Traffic to/from internet" |
| 80 | + destination = lookup(local.network_cidrs, "ALL-CIDR") |
| 81 | + destination_type = "CIDR_BLOCK" |
| 82 | + network_entity_id = (var.existent_internet_gateway_ocid == "") ? module.gateways.internet_gateway_id : var.existent_internet_gateway_ocid |
| 83 | + }] |
| 84 | + }] |
| 85 | +} |
| 86 | + |
| 87 | +module "gateways" { |
| 88 | + source = "github.com/oracle-quickstart/terraform-oci-networking//modules/gateways?ref=0.1.2" |
| 89 | + |
| 90 | + # Oracle Cloud Infrastructure Tenancy and Compartment OCID |
| 91 | + compartment_ocid = local.vcn_compartment_ocid |
| 92 | + vcn_id = module.vcn.vcn_id |
| 93 | + |
| 94 | + # Deployment Tags + Freeform Tags + Defined Tags |
| 95 | + gateways_tags = local.oci_tag_values |
| 96 | + |
| 97 | + # Internet Gateway |
| 98 | + create_internet_gateway = (var.existent_internet_gateway_ocid == "") ? true : false |
| 99 | + internet_gateway_display_name = "Internet Gateway (${local.deploy_id})" |
| 100 | + internet_gateway_enabled = true |
| 101 | +} |
| 102 | + |
| 103 | +module "security_lists" { |
| 104 | + for_each = { for map in local.security_lists : map.security_list_name => map } |
| 105 | + source = "github.com/oracle-quickstart/terraform-oci-networking//modules/security_list?ref=0.1.2" |
| 106 | + |
| 107 | + # Oracle Cloud Infrastructure Tenancy and Compartment OCID |
| 108 | + compartment_ocid = local.vcn_compartment_ocid |
| 109 | + vcn_id = module.vcn.vcn_id |
| 110 | + |
| 111 | + # Deployment Tags + Freeform Tags + Defined Tags |
| 112 | + security_list_tags = local.oci_tag_values |
| 113 | + |
| 114 | + # Security List attributes |
| 115 | + create_security_list = true |
| 116 | + security_list_name = each.value.security_list_name |
| 117 | + display_name = each.value.display_name |
| 118 | + egress_security_rules = each.value.egress_security_rules |
| 119 | + ingress_security_rules = each.value.ingress_security_rules |
| 120 | +} |
| 121 | +locals { |
| 122 | + security_lists = [ |
| 123 | + { |
| 124 | + security_list_name = "apigw_fn_security_list" |
| 125 | + display_name = "API Gateway and Fn Security List (${local.deploy_id})" |
| 126 | + egress_security_rules = [ |
| 127 | + { |
| 128 | + description = "Allow API Gateway to forward requests to Functions via service conduit" |
| 129 | + destination = lookup(data.oci_core_services.all_services_network.services[0], "cidr_block") |
| 130 | + destination_type = "SERVICE_CIDR_BLOCK" |
| 131 | + protocol = local.security_list_ports.all_protocols |
| 132 | + stateless = false |
| 133 | + tcp_options = { max = -1, min = -1, source_port_range = null } |
| 134 | + udp_options = { max = -1, min = -1, source_port_range = null } |
| 135 | + icmp_options = null |
| 136 | + }] |
| 137 | + ingress_security_rules = [ |
| 138 | + { |
| 139 | + description = "Allow API Gateway to receive requests" |
| 140 | + source = lookup(local.network_cidrs, "ALL-CIDR") |
| 141 | + source_type = "CIDR_BLOCK" |
| 142 | + protocol = local.security_list_ports.tcp_protocol_number |
| 143 | + stateless = false |
| 144 | + tcp_options = { max = local.security_list_ports.https_port_number, min = local.security_list_ports.https_port_number, source_port_range = null } |
| 145 | + udp_options = { max = -1, min = -1, source_port_range = null } |
| 146 | + icmp_options = null |
| 147 | + }] |
| 148 | + } |
| 149 | + ] |
| 150 | + security_list_ports = { |
| 151 | + http_port_number = 80 |
| 152 | + https_port_number = 443 |
| 153 | + k8s_api_endpoint_port_number = 6443 |
| 154 | + k8s_worker_to_control_plane_port_number = 12250 |
| 155 | + ssh_port_number = 22 |
| 156 | + tcp_protocol_number = "6" |
| 157 | + icmp_protocol_number = "1" |
| 158 | + all_protocols = "all" |
| 159 | + } |
| 160 | +} |
| 161 | + |
| 162 | +data "oci_core_services" "all_services_network" { |
| 163 | + filter { |
| 164 | + name = "name" |
| 165 | + values = ["All .* Services In Oracle Services Network"] |
| 166 | + regex = true |
| 167 | + } |
| 168 | +} |
| 169 | + |
| 170 | +locals { |
| 171 | + # vcn_cidr_blocks = split(",", var.vcn_cidr_blocks) |
| 172 | + vcn_compartment_ocid = var.compartment_ocid |
| 173 | + pre_vcn_cidr_blocks = split(",", var.vcn_cidr_blocks) |
| 174 | + vcn_cidr_blocks = contains(module.vcn.cidr_blocks, local.pre_vcn_cidr_blocks[0]) ? distinct(concat([local.pre_vcn_cidr_blocks[0]],module.vcn.cidr_blocks)) : module.vcn.cidr_blocks |
| 175 | + network_cidrs = { |
| 176 | + APIGW-FN-REGIONAL-SUBNET-CIDR = cidrsubnet(local.vcn_cidr_blocks[0], 8, 30) # e.g.: "10.20.30.0/24" = 254 usable IPs (10.20.30.0 - 10.20.30.255) |
| 177 | + ALL-CIDR = "0.0.0.0/0" |
| 178 | + } |
| 179 | +} |
0 commit comments