-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
103 lines (89 loc) · 3.62 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
##############################################################################
# VPE Locals
##############################################################################
locals {
# List of Gateways to create
gateway_list = concat([
# Create object for each service
for service in var.cloud_services :
{
name = "${var.vpc_name}-${service}"
service = service
crn = null
}
],
[
for service in var.cloud_service_by_crn :
{
name = "${var.vpc_name}-${service.name}"
service = null
crn = service.crn
}
]
)
# List of IPs to create
endpoint_ip_list = flatten([
# Create object for each subnet
for subnet in var.subnet_zone_list :
[
for service in var.cloud_services :
{
ip_name = "${subnet.name}-${service}-gateway-${replace(subnet.zone, "/${var.region}-/", "")}-ip"
subnet_id = subnet.id
gateway_name = "${var.vpc_name}-${service}"
}
]
])
# Map of Services to endpoints
service_to_endpoint_map = {
kms = "crn:v1:bluemix:public:kms:${var.region}:::endpoint:${var.service_endpoints}.${var.region}.kms.cloud.ibm.com"
hs-crypt = "crn:v1:bluemix:public:hs-crypto:${var.region}:::endpoint:api.${var.service_endpoints}.${var.region}.hs-crypto.cloud.ibm.com"
cloud-object-storage = "crn:v1:bluemix:public:cloud-object-storage:global:::endpoint:s3.direct.${var.region}.cloud-object-storage.appdomain.cloud"
container-registry = "crn:v1:bluemix:public:container-registry:${var.region}:::endpoint:vpe.${var.region}.container-registry.cloud.ibm.com"
}
}
##############################################################################
##############################################################################
# Create Reserved IPs
##############################################################################
resource "ibm_is_subnet_reserved_ip" "ip" {
for_each = {
# Create a map based on endpoint IP name
for gateway_ip in local.endpoint_ip_list :
(gateway_ip.ip_name) => gateway_ip
}
subnet = each.value.subnet_id
}
##############################################################################
##############################################################################
# Create Endpoint Gateways
##############################################################################
resource "ibm_is_virtual_endpoint_gateway" "vpe" {
for_each = {
# Create map based on gateway name if enabled
for gateway in local.gateway_list :
(gateway.name) => gateway
}
name = "${var.prefix}-${each.key}-endpoint-gateway"
vpc = var.vpc_id
resource_group = var.resource_group_id
security_groups = var.security_group_ids
target {
crn = each.value.service == null ? each.value.crn : local.service_to_endpoint_map[each.value.service]
resource_type = "provider_cloud_service"
}
}
##############################################################################
##############################################################################
# Attach Endpoint Gateways to Reserved IPs
##############################################################################
resource "ibm_is_virtual_endpoint_gateway_ip" "endpoint_gateway_ip" {
for_each = {
# Create a map based on endpoint IP
for gateway_ip in local.endpoint_ip_list :
(gateway_ip.ip_name) => gateway_ip
}
gateway = ibm_is_virtual_endpoint_gateway.vpe[each.value.gateway_name].id
reserved_ip = ibm_is_subnet_reserved_ip.ip[each.key].reserved_ip
}
##############################################################################