-
Notifications
You must be signed in to change notification settings - Fork 0
/
variables.tf
411 lines (357 loc) · 12.6 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
##############################################################################
# Account Variables
##############################################################################
variable "resource_group_id" {
description = "ID of resource group to create VSI and block storage volumes. If you wish to create the block storage volumes in a different resource group, you can optionally set that directly in the 'block_storage_volumes' variable."
type = string
}
variable "prefix" {
description = "The IBM Cloud platform API key needed to deploy IAM enabled resources"
type = string
validation {
error_message = "Prefix must begin and end with a letter and contain only letters, numbers, and - characters."
condition = can(regex("^([A-z]|[a-z][-a-z0-9]*[a-z0-9])$", var.prefix))
}
}
variable "tags" {
description = "List of tags to apply to resources created by this module."
type = list(string)
default = []
}
variable "access_tags" {
type = list(string)
description = "A list of access tags to apply to the VSI resources created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial."
default = []
validation {
condition = alltrue([
for tag in var.access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128
])
error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\". For more information, see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits."
}
}
##############################################################################
##############################################################################
# VPC Variables
##############################################################################
variable "vpc_id" {
description = "ID of VPC"
type = string
}
variable "subnets" {
description = "A list of subnet IDs where VSI will be deployed"
type = list(
object({
name = string
id = string
zone = string
cidr = optional(string)
})
)
}
##############################################################################
##############################################################################
# VSI Variables
##############################################################################
variable "image_id" {
description = "Image ID used for VSI. Run 'ibmcloud is images' to find available images in a region"
type = string
}
variable "ssh_key_ids" {
description = "ssh key ids to use in creating vsi"
type = list(string)
}
variable "machine_type" {
description = "VSI machine type. Run 'ibmcloud is instance-profiles' to get a list of regional profiles"
type = string
}
variable "vsi_per_subnet" {
description = "Number of VSI instances for each subnet"
type = number
}
variable "user_data" {
description = "User data to initialize VSI deployment"
type = string
}
variable "boot_volume_encryption_key" {
description = "CRN of boot volume encryption key"
default = null
type = string
}
variable "existing_kms_instance_guid" {
description = "The GUID of the Hyper Protect Crypto Services instance in which the key specified in var.boot_volume_encryption_key is coming from."
type = string
default = null
}
variable "enable_floating_ip" {
description = "Create a floating IP for each virtual server created"
type = bool
default = false
}
variable "allow_ip_spoofing" {
description = "Allow IP spoofing on the primary network interface"
type = bool
default = false
}
variable "create_security_group" {
description = "Create security group for VSI. If this is passed as false, the default will be used"
type = bool
}
variable "placement_group_id" {
description = "Unique Identifier of the Placement Group for restricting the placement of the instance, default behaviour is placement on any host"
type = string
default = null
}
variable "security_group" {
description = "Security group created for VSI"
type = object({
name = string
rules = list(
object({
name = string
direction = string
source = string
tcp = optional(
object({
port_max = number
port_min = number
})
)
udp = optional(
object({
port_max = number
port_min = number
})
)
icmp = optional(
object({
type = number
code = number
})
)
})
)
})
validation {
error_message = "Each security group rule must have a unique name."
condition = (
var.security_group == null
? true
: length(distinct(var.security_group.rules[*].name)) == length(var.security_group.rules[*].name)
)
}
validation {
error_message = "Security group rule direction can only be `inbound` or `outbound`."
condition = var.security_group == null ? true : length(
distinct(
flatten([
for rule in var.security_group.rules :
false if !contains(["inbound", "outbound"], rule.direction)
])
)
) == 0
}
default = null
}
variable "security_group_ids" {
description = "IDs of additional security groups to be added to VSI deployment primary interface. A VSI interface can have a maximum of 5 security groups."
type = list(string)
default = []
validation {
error_message = "Security group IDs must be unique."
condition = length(var.security_group_ids) == length(distinct(var.security_group_ids))
}
validation {
error_message = "No more than 5 security groups can be added to a VSI deployment."
condition = length(var.security_group_ids) <= 5
}
}
variable "kms_encryption_enabled" {
type = bool
description = "Set this to true to control the encryption keys used to encrypt the data that for the block storage volumes for VPC. If set to false, the data is encrypted by using randomly generated keys. For more info on encrypting block storage volumes, see https://cloud.ibm.com/docs/vpc?topic=vpc-creating-instances-byok"
default = false
}
variable "skip_iam_authorization_policy" {
type = bool
description = "Set to true to skip the creation of an IAM authorization policy that permits all Storage Blocks to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the existing_kms_instance_guid variable. In addition, no policy is created if var.kms_encryption_enabled is set to false."
default = false
}
variable "block_storage_volumes" {
description = "List describing the block storage volumes that will be attached to each vsi"
type = list(
object({
name = string
profile = string
capacity = optional(number)
iops = optional(number)
encryption_key = optional(string)
resource_group_id = optional(string)
})
)
default = []
validation {
error_message = "Each block storage volume must have a unique name."
condition = length(distinct(var.block_storage_volumes[*].name)) == length(var.block_storage_volumes)
}
}
variable "load_balancers" {
description = "Load balancers to add to VSI"
type = list(
object({
name = string
type = string
listener_port = number
listener_protocol = string
connection_limit = number
algorithm = string
protocol = string
health_delay = number
health_retries = number
health_timeout = number
health_type = string
pool_member_port = string
profile = optional(string)
dns = optional(
object({
instance_crn = string
zone_id = string
})
)
security_group = optional(
object({
name = string
rules = list(
object({
name = string
direction = string
source = string
tcp = optional(
object({
port_max = number
port_min = number
})
)
udp = optional(
object({
port_max = number
port_min = number
})
)
icmp = optional(
object({
type = number
code = number
})
)
})
)
})
)
})
)
default = []
validation {
error_message = "Load balancer names must match the regex pattern ^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$."
condition = length(distinct(
flatten([
# Check through rules
for load_balancer in var.load_balancers :
# Return false if direction is not valid
false if !can(regex("^([a-z]|[a-z][-a-z0-9]*[a-z0-9])$", load_balancer.name))
])
)) == 0
}
validation {
error_message = "Load Balancer Pool algorithm can only be `round_robin`, `weighted_round_robin`, or `least_connections`."
condition = length(
flatten([
for load_balancer in var.load_balancers :
true if !contains(["round_robin", "weighted_round_robin", "least_connections"], load_balancer.algorithm)
])
) == 0
}
validation {
error_message = "Load Balancer Pool Protocol can only be `http`, `https`, or `tcp`."
condition = length(
flatten([
for load_balancer in var.load_balancers :
true if !contains(["http", "https", "tcp"], load_balancer.protocol)
])
) == 0
}
validation {
error_message = "Pool health delay must be greater than the timeout."
condition = length(
flatten([
for load_balancer in var.load_balancers :
true if load_balancer.health_delay < load_balancer.health_timeout
])
) == 0
}
validation {
error_message = "Load Balancer Pool Health Check Type can only be `http`, `https`, or `tcp`."
condition = length(
flatten([
for load_balancer in var.load_balancers :
true if !contains(["http", "https", "tcp"], load_balancer.health_type)
])
) == 0
}
validation {
error_message = "Each load balancer must have a unique name."
condition = length(distinct(var.load_balancers[*].name)) == length(var.load_balancers[*].name)
}
}
##############################################################################
##############################################################################
# Secondary Interface Variables
##############################################################################
variable "secondary_subnets" {
description = "List of secondary network interfaces to add to vsi secondary subnets must be in the same zone as VSI. This is only recommended for use with a deployment of 1 VSI."
type = list(
object({
name = string
id = string
zone = string
cidr = optional(string)
})
)
default = []
}
variable "secondary_use_vsi_security_group" {
description = "Use the security group created by this module in the secondary interface"
type = bool
default = false
}
variable "secondary_security_groups" {
description = "The security group IDs to add to the VSI deployment secondary interfaces (5 maximum). Use the same value for interface_name as for name in secondary_subnets to avoid applying the default VPC security group on the secondary network interface."
type = list(
object({
security_group_id = string
interface_name = string
})
)
default = []
validation {
error_message = "Security group IDs must be unique."
condition = length(var.secondary_security_groups) == length(distinct(var.secondary_security_groups))
}
validation {
error_message = "No more than 5 security groups can be added to a VSI deployment."
condition = length(var.secondary_security_groups) <= 5
}
}
variable "secondary_floating_ips" {
description = "List of secondary interfaces to add floating ips"
type = list(string)
default = []
validation {
error_message = "Secondary floating IPs must contain a unique list of interfaces."
condition = length(var.secondary_floating_ips) == length(distinct(var.secondary_floating_ips))
}
}
variable "secondary_allow_ip_spoofing" {
description = "Allow IP spoofing on additional network interfaces"
type = bool
default = false
}
##############################################################################