kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for context to net-lb-int net-vpc-firewall and net-vpc module (#3419)

Browse Source 
* net-lb-int

* net-vpc-firewall

* net-vpc

* net-vpc
This commit is contained in:
Ludovico Magnocavallo
2025-10-16 07:54:14 +02:00
committed by GitHub
parent ecdc248f3f
commit 7c920d7d35
25 changed files with 1044 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
modules/net-vpc-firewall/default-rules.tf
View File

@@ -25,23 +25,27 @@ locals {
}
resource "google_compute_firewall" "allow-admins" {
count = length(local.default_rules.admin_ranges) > 0 ? 1 : 0
name = "${var.network}-ingress-admins"
description = "Access from the admin subnet to all subnets."
network = var.network
project = var.project_id
source_ranges = local.default_rules.admin_ranges
count = length(local.default_rules.admin_ranges) > 0 ? 1 : 0
project = local.project_id
network = local.network
name = "${local.network_name}-ingress-admins"
description = "Access from the admin subnet to all subnets."
source_ranges = [
for r in local.default_rules.admin_ranges : lookup(local.ctx.cidr_ranges, r, r)
]
allow { protocol = "all" }
}
resource "google_compute_firewall" "allow-tag-http" {
count = length(local.default_rules.http_ranges) > 0 ? 1 : 0
name = "${var.network}-ingress-tag-http"
description = "Allow http to machines with matching tags."
network = var.network
project = var.project_id
source_ranges = local.default_rules.http_ranges
target_tags = local.default_rules.http_tags
count = length(local.default_rules.http_ranges) > 0 ? 1 : 0
project = local.project_id
network = local.network
name = "${local.network_name}-ingress-tag-http"
description = "Allow http to machines with matching tags."
source_ranges = [
for r in local.default_rules.http_ranges : lookup(local.ctx.cidr_ranges, r, r)
]
target_tags = local.default_rules.http_tags
allow {
protocol = "tcp"
ports = ["80"]
@@ -49,13 +53,15 @@ resource "google_compute_firewall" "allow-tag-http" {
}
resource "google_compute_firewall" "allow-tag-https" {
count = length(local.default_rules.https_ranges) > 0 ? 1 : 0
name = "${var.network}-ingress-tag-https"
description = "Allow http to machines with matching tags."
network = var.network
project = var.project_id
source_ranges = local.default_rules.https_ranges
target_tags = local.default_rules.https_tags
count = length(local.default_rules.https_ranges) > 0 ? 1 : 0
project = local.project_id
network = local.network
name = "${local.network_name}-ingress-tag-https"
description = "Allow http to machines with matching tags."
source_ranges = [
for r in local.default_rules.https_ranges : lookup(local.ctx.cidr_ranges, r, r)
]
target_tags = local.default_rules.https_tags
allow {
protocol = "tcp"
ports = ["443"]
@@ -63,13 +69,15 @@ resource "google_compute_firewall" "allow-tag-https" {
}
resource "google_compute_firewall" "allow-tag-ssh" {
count = length(local.default_rules.ssh_ranges) > 0 ? 1 : 0
name = "${var.network}-ingress-tag-ssh"
description = "Allow SSH to machines with matching tags."
network = var.network
project = var.project_id
source_ranges = local.default_rules.ssh_ranges
target_tags = local.default_rules.ssh_tags
count = length(local.default_rules.ssh_ranges) > 0 ? 1 : 0
project = local.project_id
network = local.network
name = "${local.network_name}-ingress-tag-ssh"
description = "Allow SSH to machines with matching tags."
source_ranges = [
for r in local.default_rules.ssh_ranges : lookup(local.ctx.cidr_ranges, r, r)
]
target_tags = local.default_rules.ssh_tags
allow {
protocol = "tcp"
ports = ["22"]