cloudnationhq / terraform-azure-vnet Goto Github PK

View Code? Open in Web Editor NEW

1.0 2.0 0.0 270 KB

Terraform module which creates virtual network resources used by workloads and accelerators.

Home Page: https://registry.terraform.io/modules/CloudNationHQ/vnet/azure/latest

License: MIT License

Makefile 1.34% HCL 62.35% Go 36.31%

azure terraform wam

terraform-azure-vnet's Introduction

Virtual Network

This terraform module simplifies the process of creating and managing virtual network resources on azure with configurable options for network topology, subnets, security groups, and more to ensure a secure and efficient environment for resource communication in the cloud.

Goals

The main objective is to create a more logic data structure, achieved by combining and grouping related resources together in a complex object.

The structure of the module promotes reusability. It's intended to be a repeatable component, simplifying the process of building diverse workloads and platform accelerators consistently.

A primary goal is to utilize keys and values in the object that correspond to the REST API's structure. This enables us to carry out iterations, increasing its practical value as time goes on.

A last key goal is to separate logic from configuration in the module, thereby enhancing its scalability, ease of customization, and manageability.

Features

dedicated network security group for each subnet, capable of managing multiple rules
support for multiple service endpoints and delegations, including actions
utilization of terratest for robust validation
route table support with multiple user defined routes
association of multiple subnets with a single route table
optional virtual hub connections for enhanced network integration

Requirements

Name	Version
terraform	~> 1.0
azurerm	~> 3.61
random	~> 3.5.1

Providers

Name	Version
azurerm	~> 3.61

Resources

Name	Type
azurerm_virtual_network	resource
azurerm_virtual_network_dns_servers	resource
azurerm_subnet	resource
azurerm_network_security_group	resource
azurerm_subnet_network_security_group_association	resource
azurerm_route_table	resource
azurerm_subnet_route_table_association	resource
azurerm_virtual_hub_connection	resource
azurerm_subscription	data source
azurerm_virtual_hub	data source
time_sleep	resource

Inputs

Name	Description	Type	Required
`vnet`	describes vnet related configuration	object	yes
`naming`	contains naming convention	string	yes
`location`	default azure region tho be used	string	no
`resourcegroup`	default resource group to be used	string	no
`tags`	tags to be added to the resources	map(string)	no

Outputs

Name	Description
`vnet`	vnet setup details
`subnets`	subnet configuration specifics
`subscriptionId`	contains the current subsriptionId

Testing

As a prerequirement, please ensure that both go and terraform are properly installed on your system.

The Makefile includes two distinct variations of tests. The first one is designed to deploy different usage scenarios of the module. These tests are executed by specifying the TF_PATH environment variable, which determines the different usages located in the example directory.

To execute this test, input the command make test TF_PATH=default, substituting default with the specific usage you wish to test.

The second variation is known as a extended test. This one performs additional checks and can be executed without specifying any parameters, using the command make test_extended.

Both are designed to be executed locally and are also integrated into the github workflow.

Each of these tests contributes to the robustness and resilience of the module. They ensure the module performs consistently and accurately under different scenarios and configurations.

Notes

Using a dedicated module, we've developed a naming convention for resources that's based on specific regular expressions for each type, ensuring correct abbreviations and offering flexibility with multiple prefixes and suffixes

Full examples detailing all usages, along with integrations with dependency modules, are located in the examples directory

Authors

Module is maintained by these awesome contributors.

License

MIT Licensed. See LICENSE for full details.

Reference

terraform-azure-vnet's People

Contributors

Stargazers

Watchers

terraform-azure-vnet's Issues

add support to disable_bgp_route_propagation on route tables

default value for disable_bgp_route_propagation is true

Need option to set value to false

length changed from 1 to 3 during apply

In the below scenario i have a public ip address linked in the ruleset

module "network" {
  source  = "cloudnationhq/vnet/azure"
  version = "~> 0.1"

  naming = local.naming

  vnet = {
    name          = module.naming.virtual_network.name
    cidr          = ["10.18.0.0/16"]
    location      = module.rg.groups.demo.location
    resourcegroup = module.rg.groups.demo.name

    subnets = {
      sn1 = {
        subnet_name = "sn-demo-testme-01"
        nsg_name    = "nsg-demo-testme-01"
        cidr        = ["10.18.1.0/24"]
        nsg = {
          name = "nsg-demo-testme-01"
          rules = [
          {
              name                       = "myhttps"
              priority                   = 100
              direction                  = "Inbound"
              access                     = "Allow"
              protocol                   = "Tcp"
              source_port_range          = "*"
              destination_port_range     = "443"
              source_address_prefix      = "10.151.1.0/24"
              destination_address_prefix = "*"
          },
          {
              name                       = "mysql"
              priority                   = 200
              direction                  = "Inbound"
              access                     = "Allow"
              protocol                   = "Tcp"
              source_port_range          = "*"
              destination_port_range     = "3306"
              source_address_prefix      = "10.0.0.0/24"
              destination_address_prefix = azurerm_public_ip.appgw.ip_address
            }
          ]
        }
      }
    }
  }
}

resource "azurerm_public_ip" "appgw" {
  name                = module.naming.public_ip.name
  resource_group_name = module.rg.groups.demo.name
  location            = module.rg.groups.demo.location
  allocation_method   = "Static"
}

During a apply i get the below error

When expanding the plan for module.network.azurerm_network_security_group.nsg["appgw"] to include new values learned so far during apply, provider "[registry.terraform.io/hashicorp/azurerm](http://registry.terraform.io/hashicorp/azurerm)" produced an invalid new value for .security_rule: length changed from 1 to 3.

Example usage nsg rules is not correct

The example does not work for nsg rules:

usage example:

   sql = {
    cidr        = var.vnet.subnets.sql.cidr
    route_table = "rt"
    nsg = {
      rules = local.rules
    }
  }

Should be to make it work:

  sql = {
    cidr        = var.vnet.subnets.sql.cidr
    route_table = "rt"
    rules       = local.rules
  }

Add tagging

I don't see an option to add tags to the different resources. Could this be added please?

fix route table creation

virtual hub connection submodule needs to be moved

This submodule needs to be moved to https://github.com/CloudNationHQ/terraform-azure-vwan

error using multiple ports or ip adresses with NSG rules

Using destination_port_ranges, source_address_prefixes or destination_address_prefixes does not work. Using the source_address_prefix, destination_port_range and destination_address_prefix does work as a work around. So you will need a rule for every port and Ip-address.

Adding nsg rules with multiple ports or ip adresses wil result in the following error:

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: Inconsistent conditional result types
│
│   on .terraform\modules\Infrastructure.network_test\locals.tf line 14, in locals:
│   14:   subnets = length(lookup(var.vnet, "subnets", {})) > 0 ? flatten([
│   15:     for subnet_key, subnet in lookup(var.vnet, "subnets", {}) : {
│   16:       subnet_key                 = subnet_key
│   17:       virtual_network_name       = azurerm_virtual_network.vnet.name
│   18:       address_prefixes           = subnet.cidr
│   19:       endpoints                  = try(subnet.endpoints, [])
│   20:       enforce_priv_link_service  = try(subnet.enforce_priv_link_service, false)
│   21:       enforce_priv_link_endpoint = try(subnet.enforce_priv_link_endpoint, false)
│   22:       rules                      = local.nsg_rules[subnet_key]
│   23:       subnet_name                = try(subnet.name, join("-", [var.naming.subnet, subnet_key]))
│   24:       nsg_name                   = try(subnet.nsg.name, join("-", [var.naming.network_security_group, subnet_key]))
│   25:       rt_name                    = try(subnet.route.name, join("-", [var.naming.route_table, subnet_key]), {})
│   26:       location                   = var.vnet.location
│   27:       routes                     = try(subnet.route.routes, {})
│   28:       route_table                = local.route_table_info[subnet_key].route_table
│   29:       shd_route_table            = local.route_table_info[subnet_key].shd_route_table
│   30:       delegations = [for d in try(subnet.delegations, {}) : {
│   31:         name    = d.name
│   32:         actions = try(d.actions, [])
│   33:       }]
│   34:     }
│   35:   ]) : []
│     ├────────────────
│     │ azurerm_virtual_network.vnet.name is "vnet-nonprod-workload1"
│     │ local.nsg_rules is object with 2 attributes
│     │ local.route_table_info is object with 2 attributes
│     │ var.naming.network_security_group is "nsg-nonprod-workload1"
│     │ var.naming.route_table is "route-nonprod-workload1"
│     │ var.naming.subnet is "snet-nonprod-workload1"
│     │ var.vnet is object with 6 attributes
│     │ var.vnet.location is "westeurope"
│
│ The true and false result expressions must have consistent types. The 'true' tuple has length 2, but the 'false' tuple has length 0.

Subnet association not working on first run

On the first run of this module the associations to the NSG and the Route table always fail. Second run after this it works fine.

Associations probably need a depends_on for the subnet to be created first.

See error below: