terraform-ibm-modules/terraform-ibm-landing-zone-vpc

Creates virtual servers across subnets in a single VPC connected by a single security group. Supports floating IP addresses and multiple load balancers.

IBM Secure Landing Zone VPC module

This module creates the following IBM Cloud® Virtual Private Cloud (VPC) network components:

• VPC: Creates a VPC in a resource group and supports classic access. The VPC and components are specified in the main.tf file.
• Public gateways: Optionally create public gateways in the VPC in each of the three zones of the VPC's region.
• Subnets: Create one to three zones in the subnet.tf file.
• Network ACLs: Create network ACLs with multiple rules. By default, VPC network ACLs can have no more than 25 rules.
• VPN gateways: Create VPN gateways on your subnets by using the vpn_gateways variable. For more information about VPN gateways on VPC, see About site-to-site VPN gateways in the IBM Cloud docs.
• VPN gateway connections: Add connections to a VPN gateway.
• Hub and spoke DNS-sharing model: Optionally create a hub or spoke VPC, with associated custom resolver and DNS resolution binding, as well as a service-to-service authorization policy which supports the hub and spoke VPCs to be in separate accounts. See About DNS sharing for VPE gateways in the IBM Cloud docs for details.

Overview

• terraform-ibm-landing-zone-vpc
• Submodules
  • management-vpc
  • workload-vpc
• Examples
  • Basic Example
  • Default Example
  • Existing VPC and subnets Example
  • Hub and Spoke VPC Example
  • Hub and Spoke VPC with manual DNS resolver Example
  • Landing Zone example
  • No Prefix Example
• Contributing

terraform-ibm-landing-zone-vpc

Presets

In addition to this root module, this repository provides two submodules that call the root module with presets and defaults that are aligned with the general Framework for Financial Services management and workload VPC topologies. See the modules for details.

Usage

module vpc {
  source              = "terraform-ibm-modules/landing-zone-vpc/ibm"
  version             = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
  resource_group_id   = var.resource_group_id
  region              = var.region
  prefix              = var.prefix
  tags                = var.tags
  vpc_name            = var.vpc_name
  classic_access      = var.classic_access
  network_acls        = var.network_acls
  use_public_gateways = var.use_public_gateways
  subnets             = var.subnets
  vpn_gateways        = var.vpn_gateways
}

Resource naming

The module automatically generates names for the all provisioned VPC resources using the var.prefix input variable. You can selectively override this behavior by giving explicit names through the following input variables: name (for VPC name), dns_binding_name, dns_instance_name, dns_custom_resolver_name, routing_table_name, public_gateway_name, and vpc_flow_logs_name.

Subnets

You can create a maximum of three zones in the subnet.tf file. The zones are defined as lists in the file, and then are converted to objects before the resources are provisioned. The conversion ensures that the addition or deletion of subnets affects only the added or deleted subnets, as shown in the following example.

module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-a"]
module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-b"]
module.subnets.ibm_is_subnet.subnet["gcat-multizone-subnet-c"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-a"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-b"]
module.subnets.ibm_is_vpc_address_prefix.subnet_prefix["gcat-multizone-subnet-c"]

Required IAM access policies

You need the following permissions to run this module.

• IAM services
  • VPC Infrastructure services
    • Editor platform access
  • No service access
    • Resource Group <your resource group>
    • Viewer resource group access

To attach access management tags to resources in this module, you need the following permissions.

• IAM Services
  • Tagging service
    • Administrator platform access

Requirements

Name	Version
terraform	>= 1.3.0
ibm	>= 1.59.0, < 2.0.0
time	>= 0.9.1, < 1.0.0

Modules

Name	Source	Version
dynamic_values	./dynamic_values	n/a
unit_tests	./dynamic_values	n/a

Resources

Name	Type
ibm_dns_custom_resolver.custom_resolver_hub	resource
ibm_iam_authorization_policy.policy	resource
ibm_iam_authorization_policy.vpc_dns_resolution_auth_policy	resource
ibm_is_flow_log.flow_logs	resource
ibm_is_network_acl.network_acl	resource
ibm_is_public_gateway.gateway	resource
ibm_is_security_group_rule.default_vpc_rule	resource
ibm_is_subnet.subnet	resource
ibm_is_subnet_public_gateway_attachment.exist_subnet_gw	resource
ibm_is_vpc.vpc	resource
ibm_is_vpc_address_prefix.address_prefixes	resource
ibm_is_vpc_address_prefix.subnet_prefix	resource
ibm_is_vpc_dns_resolution_binding.vpc_dns_resolution_binding_crn	resource
ibm_is_vpc_dns_resolution_binding.vpc_dns_resolution_binding_id	resource
ibm_is_vpc_routing_table.route_table	resource
ibm_is_vpc_routing_table_route.routing_table_routes	resource
ibm_resource_instance.dns_instance_hub	resource
time_sleep.wait_for_authorization_policy	resource
time_sleep.wait_for_vpc_creation_data	resource
ibm_iam_account_settings.iam_account_settings	data source
ibm_is_subnet.subnet	data source
ibm_is_vpc.vpc	data source
ibm_is_vpc_address_prefixes.get_address_prefixes	data source

Inputs

Name	Description	Type	Default	Required
access_tags	A list of access tags to apply to the VPC resources created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial.	list(string)	[]	no
address_prefixes	OPTIONAL - IP range that will be defined for the VPC for a certain location. Use only with manual address prefixes	object({ zone-1 = optional(list(string)) zone-2 = optional(list(string)) zone-3 = optional(list(string)) })	{ "zone-1": null, "zone-2": null, "zone-3": null }	no
classic_access	OPTIONAL - Classic Access to the VPC	bool	false	no
clean_default_sg_acl	Remove all rules from the default VPC security group and VPC ACL (less permissive)	bool	false	no
create_authorization_policy_vpc_to_cos	Create authorisation policy for VPC to access COS. Set as false if authorization policy exists already	bool	false	no
create_subnets	Indicates whether user wants to use existing subnets or create new. Set it to true to create new subnets.	bool	true	no
create_vpc	Indicates whether user wants to use an existing vpc or create a new one. Set it to true to create a new vpc	bool	true	no
default_network_acl_name	OPTIONAL - Name of the Default ACL. If null, a name will be automatically generated	string	null	no
default_routing_table_name	OPTIONAL - Name of the Default Routing Table. If null, a name will be automatically generated	string	null	no
default_security_group_name	OPTIONAL - Name of the Default Security Group. If null, a name will be automatically generated	string	null	no
dns_binding_name	The name to give the provisioned VPC DNS resolution binding. If not set, the module generates a name based on the prefix and name variables.	string	null	no
dns_custom_resolver_name	The name to give the provisioned DNS custom resolver instance. If not set, the module generates a name based on the prefix and name variables.	string	null	no
dns_instance_name	The name to give the provisioned DNS instance. If not set, the module generates a name based on the prefix and name variables.	string	null	no
dns_location	The target location or environment for the DNS instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable_hub is true and skip_custom_resolver_hub_creation is false (defaults).	string	"global"	no
dns_plan	The plan for the DNS resource instance created to host the custom resolver in a hub-spoke DNS resolution topology. Only used if enable_hub is true and skip_custom_resolver_hub_creation is false (defaults).	string	"standard-dns"	no
enable_hub	Indicates whether this VPC is enabled as a DNS name resolution hub.	bool	false	no
enable_hub_vpc_crn	Indicates whether Hub VPC CRN is passed.	bool	false	no
enable_hub_vpc_id	Indicates whether Hub VPC ID is passed.	bool	false	no
enable_vpc_flow_logs	Flag to enable vpc flow logs. If true, flow log collector will be created	bool	false	no
existing_cos_instance_guid	GUID of the COS instance to create Flow log collector	string	null	no
existing_dns_instance_id	Id of an existing dns instance in which the custom resolver is created. Only relevant if enable_hub is set to true.	string	null	no
existing_storage_bucket_name	Name of the COS bucket to collect VPC flow logs	string	null	no
existing_subnets	The detail of the existing subnets and required mappings to other resources. Required if 'create_subnets' is false.	list(object({ id = string public_gateway = optional(bool, false) }))	[]	no
existing_vpc_id	The ID of the existing vpc. Required if 'create_vpc' is false.	string	null	no
hub_account_id	ID of the hub account for DNS resolution, required if 'skip_spoke_auth_policy' is false.	string	null	no
hub_vpc_crn	Indicates the crn of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub_vpc_id.	string	null	no
hub_vpc_id	Indicates the id of the hub VPC for DNS resolution. See https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-model. Mutually exclusive with hub_vpc_crn.	string	null	no
is_flow_log_collector_active	Indicates whether the collector is active. If false, this collector is created in inactive mode.	bool	true	no
manual_servers	The DNS server addresses to use for the VPC, replacing any existing servers. All the entries must either have a unique zone_affinity, or not have a zone_affinity.	list(object({ address = string zone_affinity = optional(string) }))	[]	no
name	Used for the naming of the VPC (if create_vpc is set to true), as well as in the naming for any resources created inside the VPC (unless using one of the optional variables for explicit control over naming).	string	n/a	yes
network_acls	The list of ACLs to create. Provide at least one rule for each ACL.	list( object({ name = string add_ibm_cloud_internal_rules = optional(bool) add_vpc_connectivity_rules = optional(bool) prepend_ibm_rules = optional(bool) rules = list( object({ name = string action = string destination = string direction = string source = string tcp = optional( object({ port_max = optional(number) port_min = optional(number) source_port_max = optional(number) source_port_min = optional(number) }) ) udp = optional( object({ port_max = optional(number) port_min = optional(number) source_port_max = optional(number) source_port_min = optional(number) }) ) icmp = optional( object({ type = optional(number) code = optional(number) }) ) }) ) }) )	[ { "add_ibm_cloud_internal_rules": true, "add_vpc_connectivity_rules": true, "name": "vpc-acl", "prepend_ibm_rules": true, "rules": [] } ]	no
network_cidrs	List of Network CIDRs for the VPC. This is used to manage network ACL rules for cluster provisioning.	list(string)	[ "10.0.0.0/8" ]	no
prefix	The value that you would like to prefix to the name of the resources provisioned by this module. Explicitly set to null if you do not wish to use a prefix. This value is ignored if using one of the optional variables for explicit control over naming.	string	null	no
public_gateway_name	The name to give the provisioned VPC public gateways. If not set, the module generates a name based on the prefix and name variables.	string	null	no
region	The region to which to deploy the VPC	string	n/a	yes
resolver_type	Resolver type. Can be system or manual. For delegated resolver type, see the update_delegated_resolver variable instead.	string	null	no
resource_group_id	The resource group ID where the VPC to be created	string	n/a	yes
routes	OPTIONAL - Allows you to specify the next hop for packets based on their destination address	list( object({ name = string route_direct_link_ingress = optional(bool) route_transit_gateway_ingress = optional(bool) route_vpc_zone_ingress = optional(bool) routes = optional( list( object({ action = optional(string) zone = number destination = string next_hop = string }) )) }) )	[]	no
routing_table_name	The name to give the provisioned routing tables. If not set, the module generates a name based on the prefix and name variables.	string	null	no
security_group_rules	A list of security group rules to be added to the default vpc security group (default empty)	list( object({ name = string direction = string remote = string tcp = optional( object({ port_max = optional(number) port_min = optional(number) }) ) udp = optional( object({ port_max = optional(number) port_min = optional(number) }) ) icmp = optional( object({ type = optional(number) code = optional(number) }) ) }) )	[]	no
skip_custom_resolver_hub_creation	Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable_hub is set to true.	bool	false	no
skip_spoke_auth_policy	Set to true to skip the creation of an authorization policy between the DNS resolution spoke and hub, only enable this if a policy already exists between these two VPCs. See https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-dns-sharing-s2s-auth&interface=ui for more details.	bool	false	no
subnets	List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created	object({ zone-1 = list(object({ name = string cidr = string public_gateway = optional(bool) acl_name = string no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true })) zone-2 = optional(list(object({ name = string cidr = string public_gateway = optional(bool) acl_name = string no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) zone-3 = optional(list(object({ name = string cidr = string public_gateway = optional(bool) acl_name = string no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true }))) })	{ "zone-1": [ { "acl_name": "vpc-acl", "cidr": "10.10.10.0/24", "name": "subnet-a", "no_addr_prefix": false, "public_gateway": true } ], "zone-2": [ { "acl_name": "vpc-acl", "cidr": "10.20.10.0/24", "name": "subnet-b", "no_addr_prefix": false, "public_gateway": true } ], "zone-3": [ { "acl_name": "vpc-acl", "cidr": "10.30.10.0/24", "name": "subnet-c", "no_addr_prefix": false, "public_gateway": false } ] }	no
tags	List of Tags for the resource created	list(string)	null	no
update_delegated_resolver	If set to true, and if the vpc is configured to be a spoke for DNS resolution (enable_hub_vpc_crn or enable_hub_vpc_id set), then the spoke VPC resolver will be updated to a delegated resolver.	bool	false	no
use_existing_dns_instance	Whether to use an existing dns instance. If true, existing_dns_instance_id must be set.	bool	false	no
use_public_gateways	Create a public gateway in any of the three zones with true.	object({ zone-1 = optional(bool) zone-2 = optional(bool) zone-3 = optional(bool) })	{ "zone-1": true, "zone-2": false, "zone-3": false }	no
vpc_flow_logs_name	The name to give the provisioned VPC flow logs. If not set, the module generates a name based on the prefix and name variables.	string	null	no

Outputs

Name	Description
cidr_blocks	List of CIDR blocks present in VPC stack
custom_resolver_hub	The custom resolver created for the hub vpc. Only set if enable_hub is set and skip_custom_resolver_hub_creation is false.
dns_custom_resolver_id	The ID of the DNS Custom Resolver.
dns_endpoint_gateways_by_crn	The list of VPEs that are made available for DNS resolution in the created VPC. Only set if enable_hub is false and enable_hub_vpc_id are true.
dns_endpoint_gateways_by_id	The list of VPEs that are made available for DNS resolution in the created VPC. Only set if enable_hub is false and enable_hub_vpc_id are true.
dns_instance_id	The ID of the DNS instance.
network_acls	List of shortnames and IDs of network ACLs
public_gateways	Map of public gateways by zone
subnet_detail_list	A list of subnets containing names, CIDR blocks, and zones.
subnet_detail_map	A map of subnets containing IDs, CIDR blocks, and zones
subnet_ids	The IDs of the subnets
subnet_zone_list	A list containing subnet IDs and subnet zones
vpc_crn	CRN of VPC created
vpc_data	Data of the VPC used in this module, created or existing.
vpc_flow_logs	Details of VPC flow logs collector
vpc_id	ID of VPC created
vpc_name	Name of VPC created

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.

terraform-ibm-landing-zone-vpc's Issues

VPC generated ip prefix unexpected in default example

Extra address prefix generated by vpc stack in default example.

(the 10.240. addresses in the picture below)

At first glance, I think this is because use_manual_address_prefixes is not set to true in the default example https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/examples/default/main.tf#L44

https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/variables.tf#L49

We probably want to make it less error prone as well - eg: is there really a need to have the use_manual_address_prefixes variable when this value could be deduced from address_prefixes.zone* != null

cleanup: network_connections option in variable is not used

Description

This variable https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/5351ab46cc0e98af43b4b2bece0f8bf30fa870d5/variables.tf#LL103C7-L103C36 is in the map but not used anywhere in the code. Suggest to remove it.

Finer granuarity on network ACLs + some cleanup

Description

• Narrow down the network connectivity rules

  • Currently the network rule uses the network cidr block 10.0.0.0/8 as source and destination
  • Instead:
    • On inbound: use the VPC address prefixes as source (and network cidr 10.0.0.0/8 as destination). There is one ACL rule per VPC address prefix.
    • On outbound: use network cidr 10.0.0.0/8 as source, and VPC address prefixes as destination. There is one ACL rule per VPC address prefix.

• Rename the rules (as those are not specifically cluster related) https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf#L6 . Prefix the name with [IBM Flow]. eg:
  [IBM Flow] dns servers
  [IBM Flow] license servers
  ...

• Add a way for consumer to add their own rules before and after IBM rule

eg: split current variable https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/variables.tf#L98 "network_acls" to "prepend_network_acls" and "append_network_acls" (or a better name :) )

Update 20 March:

• The following requirement has been postponed following additional research. Approach is to focus on accelerating VPE support which removes the need to maintain list of IPs (except the few DNS ones).
• Reduce the list of default ACLs here: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf#L6
  • Remove references to 161.26.0.0./16 and 166.8.0.0/14.
  • Only add 161.26.0.10/31 and 161.26.112.28/32 (for now - I suspect a few more IPs will need to be added by region depending on VPE availability - see corresponding approach on classic with calico https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies/private-network-isolation)

New or affected modules

terraform-ibm-landing-zone-vpc

---

By submitting this issue, you agree to follow our Code of Conduct

Terraform error creating outputs with v5.0.0

I'm trying to run terraform plan on this module after upgrading to v5.0.0 and I get an error which I didn't get before.
I have the following vars:

address_prefixes = {
    zone-1 = ["10.243.0.0/23", "10.243.5.0/24"]
    zone-2 = ["10.243.64.0/23", "10.243.69.0/24"]
    zone-3 = ["10.243.128.0/23", "10.243.133.0/24"]
  }

and my subnets is an object with 6 subnets (2 for each zone).

When I run terraform plan I get the error reported below, which was probably introduced in #427

ibm_is_subnet.subnet contains 6 items but var.address_prefixes is an object with some lists in it, so it only contains 3 items

Affected modules

• terraform-ibm-landing-zone-vpc

Terraform CLI and Terraform provider versions

Terraform v1.4.0
on linux_amd64

• provider registry.terraform.io/hashicorp/kubernetes v2.18.1
• provider registry.terraform.io/ibm-cloud/ibm v1.51.0

Terraform output

Debug output

Expected behavior

I should be able to run terraform plan on the module.

Actual behavior

I get the following error:

│ 
│   on .terraform/modules/vpc/outputs.tf line 83, in output "subnet_detail_map":
│   83:   value       = zipmap([for prefix, _ in var.address_prefixes : prefix], [for subnet in ibm_is_subnet.subnet : [{ id = subnet.id, zone = subnet.zone, cidr_block = subnet.ipv4_cidr_block }]])
│     ├────────────────
│     │ while calling zipmap(keys, values)
│     │ ibm_is_subnet.subnet is object with 6 attributes
│     │ var.address_prefixes is object with 3 attributes
│ 
│ Call to function "zipmap" failed: number of keys (3) does not match number of values (6).`

### Steps to reproduce (including links and screen captures)

<!-- List the steps required to reproduce the issue. -->

1. Run `terraform apply`

### Anything else

<!-- Include anything that will give us more context about the issue. -->

---

By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/terraform-ibm-modules/documentation/blob/main/CODE_OF_CONDUCT.md)

Delegated Resolver test destroy fails to destroy

Affected modules

• terraform-ibm-landing-zone-vpc

Terraform CLI and Terraform provider versions

Terraform v1.5.7
on darwin_amd64

• provider registry.terraform.io/hashicorp/time v0.11.1
• provider registry.terraform.io/ibm-cloud/ibm v1.64.2

Terraform output

output.txt

Debug output

Expected behavior

test should destroy the spoke vpc and its DNS resolution bindings before attempting to delete the hub vpc or its custom resolver

Actual behavior

Error is encountered due to the destroy being apparently run out of order (see attached output.txt)

Steps to reproduce (including links and screen captures)

1. Run go test -run TestRunHubAndSpokeDelegatedExample -count=1 -v -timeout 300m from tests directory

Anything else

---

By submitting this issue, you agree to follow our Code of Conduct

Enable creating network acls for disjoint ip address spaces

Context:

• network_cidr currently takes one string

  terraform-ibm-landing-zone-vpc/variables.tf

  Line 37 in 44fe07c

  variable "network_cidr" {

• this value is used to compute a set of network acl for ibm flows, and cross subnet flows. see https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf

Enhancement:

• case where the address space is disjoint (eg: multiple vpcs and on-prem direct link connected to same transit gateway) - it is not possible to have one single cidr covering all address space

Proposed solution:

• network_cidr to be renamed network_cidrs accepting a list of string (cidrs)
• iterate through each cidr in the logic at https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf#L6 https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf#L50 and https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/network_acls.tf#L63

On adding existing_vpc_id under vpcs map of landing-zone module, got vpc_data output issue

• Did terraform init which downloaded the landing-zone code
• Then locally updated landing-zone-vpc module version to 7.13.1
• Now tried adding existing_vpc_id under vpcs map of landing-zone module like below:

vpcs = var.vpc == null ? [
   {
     prefix                       = local.name
     existing_vpc_id              = "r010-b9904587-1eec-43bc-83ce-140abb22534d"
     resource_group               = var.resource_group == null ? "workload-rg" : var.resource_group
     clean_default_security_group = true
     clean_default_acl            = true
     flow_logs_bucket_name        = var.enable_vpc_flow_logs ? "vpc-flow-logs-bucket" : null
     network_acls = [
       {
         name              = "hpc-acl"
         add_cluster_rules = false
         rules             = local.network_acl_rules
       }
     ],
     subnets             = local.subnets
     use_public_gateways = local.use_public_gateways
     address_prefixes    = local.address_prefixes
   }
 ] : []

• This gave error:

│ Error: Unsupported attribute
│ 
│   on .terraform/modules/hpc.landing_zone.landing_zone/outputs.tf line 210, in output "vpc_resource_list":
│  210:       name              = vpc.vpc_data.name
│     ├────────────────
│     │ vpc.vpc_data is tuple with 1 element
│ 
│ This value does not have any attributes.
╵
╷
│ Error: Unsupported attribute
│ 
│   on .terraform/modules/hpc.landing_zone.landing_zone/outputs.tf line 211, in output "vpc_resource_list":
│  211:       resource_group_id = vpc.vpc_data.resource_group
│     ├────────────────
│     │ vpc.vpc_data is tuple with 1 element
│ 
│ This value does not have any attributes.
╵
╷
│ Error: Unsupported attribute
│ 
│   on .terraform/modules/hpc.landing_zone.landing_zone/outputs.tf line 214, in output "vpc_resource_list":
│  214:         cluster.id if cluster.vpc_id == vpc.vpc_data.id
│     ├────────────────
│     │ vpc.vpc_data is tuple with 1 element
│ 
│ This value does not have any attributes. 

Create a basic VPC example

Description

It may be good to have a very basic example. The current examples creates relatively complex topology.

Something like: VPC with 1 subnet that is publically exposed (public gw, default VPC network acl).

Address prefixes auto generated when specifying only subnets

Run examples/basic. Notice that the address prefixes 10.240.64.0/18 that do not belong to the subnets.

By submitting this issue, you agree to follow our Code of Conduct

Support passing null for prefix

When setting prefix to null, the following error is thrown:

│ Error: Invalid template interpolation value
│ 
│   on .terraform/modules/vpc/dynamic_values.tf line 7, in module "dynamic_values":
│    7:   prefix               = "${var.prefix}-${var.name}"
│     ├────────────────
│     │ var.prefix is null
│ 
│ The expression result is null. Cannot include a null value in a string template.
╵
╷
│ Error: Invalid template interpolation value
│ 
│   on .terraform/modules/vpc/main.tf line 94, in resource "ibm_is_public_gateway" "gateway":
│   94:   name           = "${var.prefix}-${var.name}-public-gateway-${each.key}"
│     ├────────────────
│     │ var.prefix is null
│ 
│ The expression result is null. Cannot include a null value in a string template.

It seems the code for the vpc name already supports prefix being null:

name                        = var.prefix != null ? "${var.prefix}-${var.name}-vpc" : "${var.name}-vpc"

However, the code for routing tables, flow logs, and public gateways are not. They should be updated to support a null prefix. Also ensure we update the prefix variable name to mention it supports passing null if you do not want to pass use a prefix
Make sure we test this end to end.

Add logic to create flow logs in terraform-ibm-landing-zone-vpc module

Description

The flow log creation logic conceptually belong to this VPC module.
The logic is currently located in the landing-zone module (at https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/main.tf#L39)

The objective of this ticket is to:

1. Move the flow log logic to this VPC module
2. Update the references in the landing-zone module

New or affected modules

• terraform-ibm-landing-zone-vpc
• terraform-ibm-landing-zone

---

By submitting this issue, you agree to follow our Code of Conduct

Addition of dns attributes to the vpc resource

Description

VPC introduced new feature on vpc resource - dns attribute. Request from BNPP is to add this attribute to the module at following location

New or affected modules

https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/main.tf#L24

---

By submitting this issue, you agree to follow our Code of Conduct

Create submodules with defaults aligned with landing-zone workload and management VPCs

Description

Context:

• The patterns at https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone currently pass parameters to this vpc module to create 2 types of VPCs: workload and management VPCs. This example https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main/examples/no-compute-example creates the 2 type of VPCs
• Some consumers want to use the VPC module directly to gain extra flexibility
• The VPC module contains generic defaults currently (eg: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/variables.tf#L256)

What:

• The objective of this ticket is to create 2 submodules (1 for workload and 1 for management VPC) that call the parent module with the right input variables / defaults to create a workload and management vpcs aligned with what is being passed by the https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone currently.

New or affected modules

• terraform-ibm-landing-zone-vpc

---

By submitting this issue, you agree to follow our Code of Conduct

Incorrect names generated if prefix is null

Some checks for null are missing through the code.

Lite plan no longer exists in COS

See https://cloud.ibm.com/status/announcement?query=Cloud+Object+Storage+Lite+Plan+will+be+replaced+by+Free+Tier

terraform-ibm-landing-zone-vpc/examples/default/variables.tf

Line 46 in ad3a7dc

condition = contains(["standard", "lite"], var.cos_plan)

Need a support for existing VPC functionality

Description

Customers usually have an existing VPC and expect the solution (VSIs) to be deployed in the same.
Requirements:

1. Existing VPC: If the customer provides a VPC name, we should not create VPC and address prefix (default=null); and use the VPC to deploy the resources (subnet, VSI, SG etc)
2. Existing Subnet: If customer provide a subnet name, we should skip Subnet creation (default=null) and use the subnet to deploy the resources (VSI, SG, Gateway etc)
3. Existing Gateway: If customer provide a VPC where gateway already exists for a particular zone then use it and skip creating gateway

New or affected modules

---

By submitting this issue, you agree to follow our Code of Conduct

Add subnet output designed to work OOTB with the ocp-base module

Description

See terraform-ibm-modules/terraform-ibm-base-ocp-vpc#15 (comment)

I think we should add an output designed to be consumed by the ocp module in the vpc module to ease integration between the 2 modules.
New or affected modules

terraform-ibm-base-ocp-vpc module

By submitting this issue, you agree to follow our Code of Conduct

Conflicting address prefix and subnets for multi-regional deployments

Affected modules

https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/

Terraform CLI and Terraform provider versions

• Terraform version: v1.3.8
• Provider version: 1.49.0

Expected behavior

Non-conflicting CIDRs between regions. Please use VPC defaults. Ideally use the VPC defaults without creating new address prefixes. The work-around is creating a local map with address prefixes for each region and defining the subnets manually.

This causes a few issues:

• Impossible to use transit gateway with defaults
• Default address prefixes are not used and not cleaned up
• Kludge code to workaround (for each usage):

  address_prefixes            = {
    zone-1  = ["10.40.10.0/24"]
    zone-2  = ["10.50.10.0/24"]
    zone-3  = ["10.60.10.0/24"]
  }
  subnets                     = {
    zone-1  = [{
      acl_name  = "vpc-acl"
      name      = "zone-1"
      cidr      = "10.40.10.0/24"
    }]
    zone-2  = [{
      acl_name  = "vpc-acl"
      name      = "zone-2"
      cidr      = "10.50.10.0/24"
    }]
    zone-3  = [{
      acl_name  = "vpc-acl"
      name      = "zone-3"
      cidr      = "10.60.10.0/24"
    }]
  }

See: https://github.ibm.com/mathewss/SLZ-Demo/blob/main/main.tf

Actual behavior

Address prefixes conflict between regions, which could cause long term issues for slz adopters as they scale.

Steps to reproduce (including links and screen captures)

Create an SLZ with defaults in 2 or more regions.

Anything else

Unintuitive use of vpc-acl for the network_acl index. Without looking at the code, its very difficult to know the name that should be specified for acl_name when specifying the subnets object.

Give full control on naming of objects created by this module

Description

vpc, subnets, etc
This will requires extra fields in the inputs to take the full name.

The existing behavior using prefix to auto-generate name should remain, this is an opt-in new capability.

cleanup: remove unexercised logic under dynamic_values

Description

There is significant amount of legacy logic under the dynamic_values folder. However, only a small subset of those are used at the moment - see https://github.com/search?q=repo%3Aterraform-ibm-modules%2Fterraform-ibm-landing-zone-vpc+module.dynamic_values&type=code

This ticket is about removing the unused logic for now to avoid any confusion.

Update delegated resolver support and examples

Description

The terraform provider limitations mentioned in the README at https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/tree/main/examples/hub-spoke-delegated-resolver are being resolved from version 1.61 of the provider (currently in preview at 1.61.0-beta0 ) . This ticket covers the effort to update the module and example to use the re-designed feature in the provider.

ibm_is_vpc_dns_resolution_binding between VPCs now requires auth policy

The latest test of example hub-spoke-delegated-resolver is failing to set up the DNS resolver in the spoke VPC with the following error:

Error: CreateVPCDnsResolutionBindingWithContext failed the provided token is not authorized to connect the specified dns-resolution-binding (ID:r006-96473c8b-81a7-4738-b588-e91601e70bb4) in this account

In the IBM Cloud Web UI for VPC, when setting up a DNS resolver manually, the following text is displayed:

Important: The DNS hub VPC administrator must create a service-to-service authentication policy that grants this DNS-shared VPC DNSBindingConnector permission on the DNS hub VPC.

This might be a new requirement, as this example (and test case) have been running successfully up until March 19 2024, and only the most recent test run of the example (March 26) is reporting this error with no other changes to the module in that time.