Fix the default security group everywhere.

modules/labs_private_net_and_dns_zone/main_network_dns_zone.tf

@@ -55,8 +55,13 @@ resource "openstack_networking_router_interface_v2" "private-network-routing" {
 }
 
 #
-# This is the security group that should be added to every instance
+# This is the security group that should be added to every instance.
+# Projects that define their own "default_for_all" elsewhere set
+# create_default_security_group = false, otherwise the project ends up with two
+# security groups sharing the same name, which is ambiguous for every instance
+# that selects its security groups by name.
 resource "openstack_networking_secgroup_v2" "default" {
+  count                = var.create_default_security_group ? 1 : 0
   name                 = module.labs_common_variables.default_security_group_name
   delete_default_rules = "true"
   tenant_id = var.os_project_data.id
@@ -64,14 +69,16 @@ resource "openstack_networking_secgroup_v2" "default" {
 }
 
 resource "openstack_networking_secgroup_rule_v2" "egress-ipv4" {
-  security_group_id = openstack_networking_secgroup_v2.default.id
+  count             = var.create_default_security_group ? 1 : 0
+  security_group_id = openstack_networking_secgroup_v2.default[0].id
   description       = "Allow all the egress traffic"
   direction         = "egress"
   ethertype         = "IPv4"
 }
 
 resource "openstack_networking_secgroup_rule_v2" "ingress-icmp" {
-  security_group_id = openstack_networking_secgroup_v2.default.id
+  count             = var.create_default_security_group ? 1 : 0
+  security_group_id = openstack_networking_secgroup_v2.default[0].id
   description       = "Allow ICMP from remote"
   direction         = "ingress"
   ethertype         = "IPv4"
@@ -80,8 +87,8 @@ resource "openstack_networking_secgroup_rule_v2" "ingress-icmp" {
 }
 # Configure the default security group
 resource "openstack_networking_secgroup_rule_v2" "default_firewall_rules" {
-  for_each          = var.default_firewall_rules_map
-  security_group_id = openstack_networking_secgroup_v2.default.id
+  for_each          = var.create_default_security_group ? var.default_firewall_rules_map : {}
+  security_group_id = openstack_networking_secgroup_v2.default[0].id
   description       = each.value.description
   direction         = "ingress"
   ethertype         = "IPv4"

modules/labs_private_net_and_dns_zone/variables_main_network_dns.tf

@@ -45,6 +45,13 @@ variable "external_router" {
   }
 }
 
+# Set this to false in projects that define their own "default_for_all" security group
+# elsewhere, to avoid ending up with two security groups sharing the same name.
+variable "create_default_security_group" {
+  type    = bool
+  default = true
+}
+
 variable "default_firewall_rules_map" {
   type = map(object({
     description = string

s2i2s/main_net_dns_router/main.tf

@@ -24,6 +24,12 @@ module "project_variables" {
 # Main module
 module "main_private_net_and_dns_zone" {
   source = "../../modules/labs_private_net_and_dns_zone"
+
+  # The "default_for_all" security group of this project is defined in ../project-setup,
+  # which is the authoritative one. Letting the module create its own would leave the
+  # project with two security groups sharing that name.
+  create_default_security_group = false
+
   dns_zone = {
     zone_name   = "s2i2s.cloud.isti.cnr.it."
     email       = "postmaster@isti.cnr.it"

s2i2s/project-setup/security-groups.tf

@@ -95,28 +95,6 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
   remote_ip_prefix  = local.ssh_sources.d4s_vpn_2_cidr
 }
 
-resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
-  security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
-  description       = "SSH traffic from shell.d4science.org"
-  direction         = "ingress"
-  ethertype         = "IPv4"
-  protocol          = "tcp"
-  port_range_min    = 22
-  port_range_max    = 22
-  remote_ip_prefix  = local.ssh_sources.shell_d4s_cidr
-}
-
-resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
-  security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
-  description       = "SSH traffic from the InfraScience network"
-  direction         = "ingress"
-  ethertype         = "IPv4"
-  protocol          = "tcp"
-  port_range_min    = 22
-  port_range_max    = 22
-  remote_ip_prefix  = local.ssh_sources.infrascience_net_cidr
-}
-
 # Debug via tunnel from the jump proxy node
 resource "openstack_networking_secgroup_v2" "debugging" {
   name                 = "debugging_from_jump_node"