Skip to content

Commit

Permalink
fix(examples): Prefer instance specific bootstrap options to common (#48
Browse files Browse the repository at this point in the history 
)
  • Loading branch information
@michalbil
michalbil authored Oct 24, 2024
1 parent 9b1487a commit 73cd8f3
Show file tree
Hide file tree
Showing 26 changed files with 202 additions and 167 deletions.
2 changes: 1 addition & 1 deletion examples/multi_nic_common/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -217,7 +217,7 @@ please see https://cloud.google.com/iap/docs/using-tcp-forwarding#increasing_the
| <a name="input_routes"></a> [routes](#input\_routes) | A map containing each route setting. Note that you can only add routes using a next-hop type of internal load-balance rule.<br><br>Example of variable deployment :<pre>routes = {<br> "default-route-trust" = {<br> name = "fw-default-trust"<br> destination_range = "0.0.0.0/0"<br> vpc_network_key = "fw-trust-vpc"<br> lb_internal_name = "internal-lb"<br> }<br>}</pre>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_service_accounts"></a> [service\_accounts](#input\_service\_accounts) | A map containing each service account setting.<br><br>Example of variable deployment :<pre>service_accounts = {<br> "sa-vmseries-01" = {<br> service_account_id = "sa-vmseries-01"<br> display_name = "VM-Series SA"<br> roles = [<br> "roles/compute.networkViewer",<br> "roles/logging.logWriter",<br> "roles/monitoring.metricWriter",<br> "roles/monitoring.viewer",<br> "roles/viewer"<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/iam_service_account#Inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_vmseries"></a> [vmseries](#input\_vmseries) | A map containing each individual vmseries setting.<br><br>Example of variable deployment :<pre>vmseries = {<br> "fw-vmseries-01" = {<br> name = "fw-vmseries-01"<br> zone = "us-east1-b"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> tags = ["vmseries"]<br> service_account_key = "sa-vmseries-01"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> bootstrap_bucket_key = "vmseries-bootstrap-bucket-01"<br> bootstrap_options = {<br> panorama-server = "1.1.1.1"<br> dns-primary = "8.8.8.8"<br> dns-secondary = "8.8.4.4"<br> }<br> bootstrap_template_map = {<br> trust_gcp_router_ip = "10.10.12.1"<br> untrust_gcp_router_ip = "10.10.11.1"<br> private_network_cidr = "192.168.0.0/16"<br> untrust_loopback_ip = "1.1.1.1/32" #This is placeholder IP - you must replace it on the vmseries config with the LB public IP address after the infrastructure is deployed<br> trust_loopback_ip = "10.10.12.5/32"<br> }<br> named_ports = [<br> {<br> name = "http"<br> port = 80<br> },<br> {<br> name = "https"<br> port = 443<br> }<br> ]<br> network_interfaces = [<br> {<br> vpc_network_key = "fw-untrust-vpc"<br> subnetwork_key = "fw-untrust-sub"<br> private_ip = "10.10.11.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-mgmt-vpc"<br> subnetwork_key = "fw-mgmt-sub"<br> private_ip = "10.10.10.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-trust-vpc"<br> subnetwork_key = "fw-trust-sub"<br> private_ip = "10.10.12.2"<br> },<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vmseries#inputs)<br><br>The bootstrap\_template\_map contains variables that will be applied to the bootstrap template. Each firewall Day 0 bootstrap will be parametrised based on these inputs.<br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries setting.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Bootstrap options can be moved between vmseries individual instance variable (`vmseries`) and this common vmserie variable (`vmseries_common`). | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries settings.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | `{}` | no |
| <a name="input_vpc_peerings"></a> [vpc\_peerings](#input\_vpc\_peerings) | A map containing each VPC peering setting.<br><br>Example of variable deployment :<pre>vpc_peerings = {<br> "trust-to-spoke1" = {<br> local_network_key = "fw-trust-vpc"<br> peer_network_key = "fw-spoke1-vpc"<br><br> local_export_custom_routes = true<br> local_import_custom_routes = true<br> local_export_subnet_routes_with_public_ip = true<br> local_import_subnet_routes_with_public_ip = true<br><br> peer_export_custom_routes = true<br> peer_import_custom_routes = true<br> peer_export_subnet_routes_with_public_ip = true<br> peer_import_subnet_routes_with_public_ip = true<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc-peering#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |

### Outputs
Expand Down
15 changes: 9 additions & 6 deletions examples/multi_nic_common/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ module "vmseries" {
ssh_keys = try(each.value.ssh_keys, var.vmseries_common.ssh_keys)
vmseries_image = try(each.value.vmseries_image, var.vmseries_common.vmseries_image)
machine_type = try(each.value.machine_type, var.vmseries_common.machine_type)
min_cpu_platform = try(each.value.min_cpu_platform, var.vmseries_common.min_cpu_platform, "Intel Cascade Lake")
min_cpu_platform = try(each.value.min_cpu_platform, var.vmseries_common.min_cpu_platform)
tags = try(each.value.tags, var.vmseries_common.tags, [])
service_account = try(module.iam_service_account[each.value.service_account_key].email, module.iam_service_account[var.vmseries_common.service_account_key].email)
scopes = try(each.value.scopes, var.vmseries_common.scopes, [])
Expand All @@ -128,11 +128,13 @@ module "vmseries" {
bootstrap_options = try(
merge(
{ vmseries-bootstrap-gce-storagebucket = "${module.bootstrap[each.value.bootstrap_bucket_key].bucket_name}/${each.key}/" },
var.vmseries_common.bootstrap_options),
var.vmseries_common.bootstrap_options
),
merge(
try(each.value.bootstrap_options, {}),
try(var.vmseries_common.bootstrap_options, {})
))
try(var.vmseries_common.bootstrap_options, {}),
try(each.value.bootstrap_options, {})
)
)

named_ports = try(each.value.named_ports, [])

Expand All @@ -142,7 +144,8 @@ module "vmseries" {
private_ip = v.private_ip
create_public_ip = try(v.create_public_ip, false)
public_ip = try(v.public_ip, null)
}]
}
]
}

data "google_compute_image" "my_image" {
Expand Down
21 changes: 12 additions & 9 deletions examples/multi_nic_common/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,19 +4,20 @@ variable "project" {
type = string
default = null
}

variable "region" {
description = "The region into which to deploy the infrastructure in to."
type = string
default = "us-central1"
}

variable "name_prefix" {
description = "A string to prefix resource namings."
type = string
default = "example-"
}

#Service Account

# Service Account
variable "service_accounts" {
description = <<-EOF
A map containing each service account setting.
Expand Down Expand Up @@ -46,7 +47,7 @@ variable "service_accounts" {
default = {}
}

#Bootstrap bucket
# Bootstrap bucket

variable "bootstrap_buckets" {
description = <<-EOF
Expand All @@ -73,7 +74,7 @@ variable "bootstrap_buckets" {
default = {}
}

#VPC
# VPC

variable "networks" {
description = <<-EOF
Expand Down Expand Up @@ -173,11 +174,11 @@ variable "routes" {
default = {}
}

#vmseries
# VM-Series

variable "vmseries_common" {
description = <<-EOF
A map containing common vmseries setting.
A map containing common vmseries settings.
Example of variable deployment :
Expand All @@ -195,11 +196,12 @@ variable "vmseries_common" {
}
```
Bootstrap options can be moved between vmseries individual instance variable (`vmseries`) and this common vmserie variable (`vmseries_common`).
Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence.
EOF
type = any
default = {}
}

variable "vmseries" {
description = <<-EOF
A map containing each individual vmseries setting.
Expand Down Expand Up @@ -277,7 +279,7 @@ variable "vmseries" {
default = {}
}

#Load Balancers
# Load Balancers

variable "lbs_internal" {
description = <<-EOF
Expand All @@ -304,6 +306,7 @@ variable "lbs_internal" {
type = map(any)
default = {}
}

variable "lbs_external" {
description = <<-EOF
A map containing each external loadbalancer setting.
Expand Down Expand Up @@ -333,7 +336,7 @@ variable "lbs_external" {
default = {}
}

#Spoke VPCs Linux VMs
# Spoke VPCs Linux VMs

variable "linux_vms" {
description = <<-EOF
Expand Down
2 changes: 1 addition & 1 deletion examples/vmseries_ha/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -271,7 +271,7 @@ Check the succesful inbound and outbound traffic fail-over to and from the spoke
| <a name="input_routes"></a> [routes](#input\_routes) | A map containing each route setting. Note that you can only add routes using a next-hop type of internal load-balance rule.<br><br>Example of variable deployment :<pre>routes = {<br> "default-route-trust" = {<br> name = "fw-default-trust"<br> destination_range = "0.0.0.0/0"<br> vpc_network_key = "fw-trust-vpc"<br> lb_internal_name = "internal-lb"<br> }<br>}</pre>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_service_accounts"></a> [service\_accounts](#input\_service\_accounts) | A map containing each service account setting.<br><br>Example of variable deployment :<pre>service_accounts = {<br> "sa-vmseries-01" = {<br> service_account_id = "sa-vmseries-01"<br> display_name = "VM-Series SA"<br> roles = [<br> "roles/compute.networkViewer",<br> "roles/logging.logWriter",<br> "roles/monitoring.metricWriter",<br> "roles/monitoring.viewer",<br> "roles/viewer"<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/iam_service_account#Inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_vmseries"></a> [vmseries](#input\_vmseries) | A map containing each individual vmseries setting.<br><br>Example of variable deployment :<pre>vmseries = {<br> "fw-vmseries-01" = {<br> name = "fw-vmseries-01"<br> zone = "us-east1-b"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> tags = ["vmseries"]<br> service_account_key = "sa-vmseries-01"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> bootstrap_bucket_key = "vmseries-bootstrap-bucket-01"<br> bootstrap_options = {<br> panorama-server = "1.1.1.1"<br> dns-primary = "8.8.8.8"<br> dns-secondary = "8.8.4.4"<br> }<br> bootstrap_template_map = {<br> trust_gcp_router_ip = "10.10.12.1"<br> untrust_gcp_router_ip = "10.10.11.1"<br> private_network_cidr = "192.168.0.0/16"<br> untrust_loopback_ip = "1.1.1.1/32" #This is placeholder IP - you must replace it on the vmseries config with the LB public IP address after the infrastructure is deployed<br> trust_loopback_ip = "10.10.12.5/32"<br> }<br> named_ports = [<br> {<br> name = "http"<br> port = 80<br> },<br> {<br> name = "https"<br> port = 443<br> }<br> ]<br> network_interfaces = [<br> {<br> vpc_network_key = "fw-untrust-vpc"<br> subnetwork_key = "fw-untrust-sub"<br> private_ip = "10.10.11.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-mgmt-vpc"<br> subnetwork_key = "fw-mgmt-sub"<br> private_ip = "10.10.10.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-trust-vpc"<br> subnetwork_key = "fw-trust-sub"<br> private_ip = "10.10.12.2"<br> },<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vmseries#inputs)<br><br>The bootstrap\_template\_map contains variables that will be applied to the bootstrap template. Each firewall Day 0 bootstrap will be parametrised based on these inputs.<br>Multiple keys can be added and will be deployed by the code. | `any` | n/a | yes |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries setting.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Bootstrap options can be moved between vmseries individual instance variable (`vmseries`) and this common vmserie variable (`vmseries_common`). | `any` | n/a | yes |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries setting.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | n/a | yes |
| <a name="input_vpc_peerings"></a> [vpc\_peerings](#input\_vpc\_peerings) | A map containing each VPC peering setting.<br><br>Example of variable deployment :<pre>vpc_peerings = {<br> "trust-to-spoke1" = {<br> local_network_key = "fw-trust-vpc"<br> peer_network_key = "fw-spoke1-vpc"<br><br> local_export_custom_routes = true<br> local_import_custom_routes = true<br> local_export_subnet_routes_with_public_ip = true<br> local_import_subnet_routes_with_public_ip = true<br><br> peer_export_custom_routes = true<br> peer_import_custom_routes = true<br> peer_export_subnet_routes_with_public_ip = true<br> peer_import_subnet_routes_with_public_ip = true<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc-peering#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |

### Outputs
Expand Down
15 changes: 9 additions & 6 deletions examples/vmseries_ha/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ module "vmseries" {
ssh_keys = try(each.value.ssh_keys, var.vmseries_common.ssh_keys)
vmseries_image = try(each.value.vmseries_image, var.vmseries_common.vmseries_image)
machine_type = try(each.value.machine_type, var.vmseries_common.machine_type)
min_cpu_platform = try(each.value.min_cpu_platform, var.vmseries_common.min_cpu_platform, "Intel Cascade Lake")
min_cpu_platform = try(each.value.min_cpu_platform, var.vmseries_common.min_cpu_platform)
tags = try(each.value.tags, var.vmseries_common.tags, [])
service_account = try(module.iam_service_account[each.value.service_account_key].email, module.iam_service_account[var.vmseries_common.service_account_key].email)
scopes = try(each.value.scopes, var.vmseries_common.scopes, [])
Expand All @@ -132,11 +132,13 @@ module "vmseries" {
bootstrap_options = try(
merge(
{ vmseries-bootstrap-gce-storagebucket = "${module.bootstrap[each.value.bootstrap_bucket_key].bucket_name}/${each.key}/" },
var.vmseries_common.bootstrap_options),
var.vmseries_common.bootstrap_options
),
merge(
try(each.value.bootstrap_options, {}),
try(var.vmseries_common.bootstrap_options, {})
))
try(var.vmseries_common.bootstrap_options, {}),
try(each.value.bootstrap_options, {})
)
)

named_ports = try(each.value.named_ports, [])

Expand All @@ -146,7 +148,8 @@ module "vmseries" {
private_ip = v.private_ip
create_public_ip = try(v.create_public_ip, false)
public_ip = try(v.public_ip, null)
}]
}
]
}

data "google_compute_image" "my_image" {
Expand Down
Loading

0 comments on commit 73cd8f3

Please sign in to comment.