Feature/optional dns resolver #5
Conversation
private dns resolver optional Co-authored-by: Bärisch, Mauricé <[email protected]> Co-authored-by: Müller, Inga <[email protected]>
There was a problem hiding this comment.
It works when the optional parameters are empty. But when I put something in it seems that no network rule collections will be deployed at all and the apply fails.
Can you add an example of more than just required IP groups? And take a look whats happening there. I don't think you can combine static and dynamic network_rule_collection blocks like that. I remember it being a one or the other kind of thing. So either 100% dynamic or 100% static. But I can't find documentation for that :/
See issue: hashicorp/terraform#34933
platform rules for bastion
Co-authored-by: Bärisch, Mauricé <[email protected]>
| ipg_rdp_access_ids: If rdp access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion. | ||
| ipg_ssh_access_ids: If ssh access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion. |
There was a problem hiding this comment.
oooh, I think I got it.
| ipg_rdp_access_ids: If rdp access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion. | |
| ipg_ssh_access_ids: If ssh access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion. | |
| ipg_rdp_access_ids: If rdp access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible via rdp by bastion. | |
| ipg_ssh_access_ids: If ssh access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible via ssh by bastion. |
| network_rule_collection { | ||
| name = "rc-internet_outbound-${var.stage}" | ||
| priority = 120 |
There was a problem hiding this comment.
Change of priority on purpose?
This would make this a breaking change, if someone already uses priority 100
There was a problem hiding this comment.
Priority 100 is reserved by platform. So no collisions there.
Rules were re-ordered because all network rules need to be in front of application rules. Previously we didn't leave any free space so it was not possible to insert a new rule if we wanted to stick to a 10 diff.
We did a 5 diff to allow for more RCs in total and left space between the end of network rules and the start of application rules.
This change causes no downtime.
| protocols = ["Any"] | ||
| source_ip_groups = var.ipg_onpremise_dc_id != null ? [var.ipg_azure_dc_id, var.ipg_onpremise_dc_id] : [var.ipg_azure_dc_id] | ||
| destination_ip_groups = [var.ipg_dnsprivateresolver_id] | ||
| destination_ports = ["*"] |
There was a problem hiding this comment.
Why do we need any port to DNS resolver?
| protocols = ["Any"] | |
| source_ip_groups = var.ipg_onpremise_dc_id != null ? [var.ipg_azure_dc_id, var.ipg_onpremise_dc_id] : [var.ipg_azure_dc_id] | |
| destination_ip_groups = [var.ipg_dnsprivateresolver_id] | |
| destination_ports = ["*"] | |
| protocols = ["Any"] | |
| source_ip_groups = var.ipg_onpremise_dc_id != null ? [var.ipg_azure_dc_id, var.ipg_onpremise_dc_id] : [var.ipg_azure_dc_id] | |
| destination_ip_groups = [var.ipg_dnsprivateresolver_id] | |
| destination_ports = ["53"] |
There was a problem hiding this comment.
Yes. Probably better to do 53 UDP only
| dynamic "rule" { | ||
| for_each = var.bastion_config.ipg_rdp_access_ids | ||
| content { | ||
| name = "allow-bastion-to-${regex(".+\\/(.+)?", rule.value)[0]}-rdp" |
There was a problem hiding this comment.
Get the name of the ip group from its resource ID. Needed to avoid naming collisions.
| dynamic "rule" { | ||
| for_each = var.bastion_config.ipg_ssh_access_ids | ||
| content { | ||
| name = "allow-bastion-to-${regex(".+\\/(.+)?", rule.value)[0]}-ssh" |
There was a problem hiding this comment.
Get the name of the ip group from its resource ID. Needed to avoid naming collisions.
| application_rule_collection { | ||
| name = "rc-application_internet_outbound-${var.stage}" | ||
| priority = 130 | ||
| priority = 150 |
There was a problem hiding this comment.
Change of priority on purpose?
This would make this a breaking change, if someone already uses priority 150
There was a problem hiding this comment.
See above. Not a breaking change. No risk of collision.
Description
As we are not deploying private dns resolver or azure as a standard and not always azure dcs, both network collection groups are now optional. There is also a new option to add rules for azure bastion.
Change overview (tick true):
Version information:
1.1.01.2.0How Has This Been Tested?
Checklist: