ISTI-provisioning
/
openstack-infrastructure-terraform
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Various fixes to the s2i2s project-setup workspace. Fix the openstack module requirements.

This commit is contained in:
Andrea Dell'Amico 2026-08-05 18:23:57 +02:00
parent ba86dfcbb9
commit 2d47dab116
Signed by: adellam
GPG Key ID: 147ABE6CEB9E20FF
9 changed files with 59 additions and 4326 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/complete_infra_setup/haproxy.tf
View File

@ -86,7 +86,7 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
group = openstack_compute_servergroup_v2.main_haproxy_l7.id
}
block_device {
uuid = var.ubuntu_2204.uuid
uuid = var.ubuntu_2404.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -99,7 +99,7 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
fixed_ip_v4 = var.main_haproxy_l7_ip.* [count.index]
}
user_data = file("${var.ubuntu2204_data_file}")
user_data = file("${var.ubuntu2404_data_file}")
# Do not replace the instance when the ssh key changes
lifecycle {
ignore_changes = [

4
modules/complete_infra_setup/internal-ca.tf
View File

@ -5,7 +5,7 @@ resource "openstack_compute_instance_v2" "internal_ca" {
key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name]
block_device {
uuid = var.ubuntu_2204.uuid
uuid = var.ubuntu_2404.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -17,7 +17,7 @@ resource "openstack_compute_instance_v2" "internal_ca" {
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.ca
}
user_data = file("${var.ubuntu2204_data_file}")
user_data = file("${var.ubuntu2404_data_file}")
# Do not replace the instance when the ssh key changes
lifecycle {
ignore_changes = [

4
modules/complete_infra_setup/postgresql.tf
View File

@ -60,7 +60,7 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.shared_postgresql_access.name]
block_device {
uuid = var.ubuntu_2204.uuid
uuid = var.ubuntu_2404.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -76,7 +76,7 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
fixed_ip_v4 = var.shared_postgresql_server_data.server_ip
}
user_data = file("${var.ubuntu2204_data_file}")
user_data = file("${var.ubuntu2404_data_file}")
# Do not replace the instance when the ssh key changes
lifecycle {
ignore_changes = [

4
modules/complete_infra_setup/prometheus.tf
View File

@ -11,7 +11,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
block_device {
uuid = var.ubuntu_2204.uuid
uuid = var.ubuntu_2404.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -23,7 +23,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.prometheus
}
user_data = file("${var.ubuntu2204_data_file}")
user_data = file("${var.ubuntu2404_data_file}")
# Do not replace the instance when the ssh key changes
lifecycle {
ignore_changes = [

4
modules/complete_infra_setup/ssh-jump-proxy.tf
View File

@ -6,7 +6,7 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.access_to_the_jump_proxy.name]
block_device {
uuid = var.ubuntu_2204.uuid
uuid = var.ubuntu_2404.uuid
source_type = "image"
volume_size = 30
boot_index = 0
@ -18,7 +18,7 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.ssh_jump
}
user_data = file("${var.ubuntu2204_data_file}")
user_data = file("${var.ubuntu2404_data_file}")
# Do not replace the instance when the ssh key changes
lifecycle {
ignore_changes = [

47
s2i2s/project-setup/haproxy.tf
View File

@ -8,11 +8,15 @@ resource "openstack_compute_servergroup_v2" "main_haproxy_l7" {
policies = ["anti-affinity"]
}
# Security group for traffic from Octavia LB to HAProxy
# Security group for traffic from the Octavia LB to HAProxy.
# The main LB uses the OVN provider, not amphora: OVN does not SNAT the traffic to
# the amphora VIP, so the HAProxy L7 servers see the original client source IP.
# Only the health monitor probes and the hairpinned traffic come from the private
# subnet. Therefore the public listeners (80, 443) must accept any source.
resource "openstack_networking_secgroup_v2" "main_lb_to_haproxy_l7" {
name = "traffic_from_main_lb_to_haproxy_l7"
delete_default_rules = "true"
description = "Traffic coming from the main L4 lb directed to the haproxy l7 servers"
description = "Traffic coming from the main L4 lb (OVN provider, client IP is preserved) directed to the haproxy l7 servers"
}
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_1_peer" {
@ -39,29 +43,34 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_80" {
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
description = "Traffic from the octavia lb instance to HAPROXY l7 port 80"
description = "HTTP traffic to HAPROXY l7 port 80, through the OVN based main lb. The source is the client IP"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = local.main_private_subnet.cidr
remote_ip_prefix = "0.0.0.0/0"
}
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_443" {
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
description = "Traffic from the octavia lb instance to HAPROXY l7 port 443"
description = "HTTPS traffic to HAPROXY l7 port 443, through the OVN based main lb. The source is the client IP"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = local.main_private_subnet.cidr
remote_ip_prefix = "0.0.0.0/0"
}
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880" {
# HAPROXY stats, port 8880.
# The OVN provider does not support allowed_cidrs on the listener, so this security
# group is the only place where the stats can be restricted. Since OVN preserves the
# client source IP, we can filter on the real client addresses instead of opening the
# port to everybody. The private subnet is still needed for the health monitor probes.
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880_healthcheck" {
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
description = "Traffic from the octavia lb instance to HAPROXY l7 port 8880"
description = "Health monitor probes to the HAPROXY l7 stats port 8880"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
@ -70,6 +79,28 @@ resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880" {
remote_ip_prefix = local.main_private_subnet.cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_8880_stats_sources" {
for_each = {
d4s_vpn_1 = local.ssh_sources.d4s_vpn_1_cidr
d4s_vpn_2 = local.ssh_sources.d4s_vpn_2_cidr
s2i2s_vpn_1 = local.ssh_sources.s2i2s_vpn_1_cidr
s2i2s_vpn_2 = local.ssh_sources.s2i2s_vpn_2_cidr
infrascience_net = local.ssh_sources.infrascience_net_cidr
# Prometheus scrapes the HAPROXY stats: it reaches them over the private network,
# and through the load balancer public IP via its own floating IP
prometheus_private = local.basic_services_ip.prometheus_cidr
prometheus_public = "${openstack_networking_floatingip_v2.prometheus_server_ip.address}/32"
}
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
description = "HAPROXY l7 stats port 8880 from ${each.key}"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8880
port_range_max = 8880
remote_ip_prefix = each.value
}
# Ports in the main private network for HAProxy instances
resource "openstack_networking_port_v2" "main_haproxy_l7_port" {
count = local.haproxy_l7_data.vm_count

8
s2i2s/project-setup/outputs.tf
View File

@ -154,6 +154,10 @@ output "ubuntu_2204" {
value = local.ubuntu_2204
}
output "ubuntu_2404" {
value = local.ubuntu_2404
}
output "availability_zones_names" {
value = local.availability_zones_names
}
@ -162,6 +166,10 @@ output "ubuntu2204_data_file" {
value = local.ubuntu2204_data_file
}
output "ubuntu2404_data_file" {
value = local.ubuntu2404_data_file
}
output "mtu_size" {
value = local.mtu_size
}

2
s2i2s/project-setup/provider.tf
View File

@ -4,7 +4,7 @@ terraform {
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "~> 1.53.0"
version = ">= 2.0.0"
}
}
}

4308
s2i2s/project-setup/terraform.tfstate
View File

File diff suppressed because one or more lines are too long