From 6ea6fa5478f68efbab6a31f8e081fb2bfd46b045 Mon Sep 17 00:00:00 2001 From: Andrea Dell'Amico Date: Tue, 11 Aug 2026 18:36:21 +0200 Subject: [PATCH] Refactor of some modules. --- .../complete_infra_setup_variables.tf | 58 +++++++++---------- modules/complete_infra_setup/octavia.tf | 26 ++++----- modules/docker_swarm/docker-swarm.tf | 10 ++-- modules/labs_common_variables/variables.tf | 4 +- .../main_network_dns_zone.tf | 40 ++++++------- .../terraform-provider.tf | 2 +- .../variables_main_network_dns.tf | 2 +- modules/ssh_keys/ssh-keys.tf | 2 +- s2i2s/variables/outputs-s2i2s.tf | 9 +++ s2i2s/variables/variables-s2i2s.tf | 39 +++++++++++-- 10 files changed, 115 insertions(+), 77 deletions(-) diff --git a/modules/complete_infra_setup/complete_infra_setup_variables.tf b/modules/complete_infra_setup/complete_infra_setup_variables.tf index bf150c6..32af842 100644 --- a/modules/complete_infra_setup/complete_infra_setup_variables.tf +++ b/modules/complete_infra_setup/complete_infra_setup_variables.tf @@ -30,11 +30,11 @@ variable "prometheus_server_data" { variable "shared_postgresql_server_data" { type = map(string) default = { - name = "shared-postgresql-server" - flavor = "m1.large" - vol_data_name = "shared-postgresql-data" - vol_data_size = "100" - vol_data_device = "/dev/vdb" + name = "shared-postgresql-server" + flavor = "m1.large" + vol_data_name = "shared-postgresql-data" + vol_data_size = "100" + vol_data_device = "/dev/vdb" network_name = "postgresql-srv-net" network_description = "Network used to communicate with the shared postgresql service" network_cidr = "192.168.0.0/22" @@ -48,15 +48,15 @@ variable "shared_postgresql_server_data" { variable "haproxy_l7_data" { type = map(string) default = { - name = "main-haproxy-l7" - haproxy_1 = "haproxy-l7-1" - haproxy_2 = "haproxy-l7-2" - flavor = "m1.medium" - vm_count = "2" - haproxy1_server_ip = "192.168.253.5" - haproxy2_server_ip = "192.168.253.6" - haproxy1_cidr = "192.168.253.5/24" - haproxy2_cidr = "192.168.253.6/24" + name = "main-haproxy-l7" + haproxy_1 = "haproxy-l7-1" + haproxy_2 = "haproxy-l7-2" + flavor = "m1.medium" + vm_count = "2" + haproxy1_server_ip = "192.168.253.5" + haproxy2_server_ip = "192.168.253.6" + haproxy1_cidr = "192.168.253.5/24" + haproxy2_cidr = "192.168.253.6/24" } } @@ -79,20 +79,20 @@ variable "main_octavia_lb_flavor" { variable "octavia_information" { type = map(string) default = { - main_lb_name = var.main_octavia_lb_name - main_lb_description = var.main_octavia_lb_description - octavia_flavor = var.main_octavia_lb_flavor - octavia_flavor_id = "394988b5-6603-4a1e-a939-8e177c6681c7" - main_lb_hostname = var.main_octavia_lb_hostname - network_name = "octavia-main-haproxy-net" - network_description = "Network that veicolates the traffic from Octavia and the main load balancer" - subnet_name = "octavia-main-haproxy-net" - subnet_description = "Network that veicolates the traffic from Octavia and the main load balancer" - subnet_cidr = "192.168.253.0/24" - gateway_ip = "192.168.253.1" - allocation_pool_start = "192.168.253.100" - allocation_pool_end = "192.168.253.254" - external_router_name = "octavia_main_lb_router" + main_lb_name = var.main_octavia_lb_name + main_lb_description = var.main_octavia_lb_description + octavia_flavor = var.main_octavia_lb_flavor + octavia_flavor_id = "394988b5-6603-4a1e-a939-8e177c6681c7" + main_lb_hostname = var.main_octavia_lb_hostname + network_name = "octavia-main-haproxy-net" + network_description = "Network that veicolates the traffic from Octavia and the main load balancer" + subnet_name = "octavia-main-haproxy-net" + subnet_description = "Network that veicolates the traffic from Octavia and the main load balancer" + subnet_cidr = "192.168.253.0/24" + gateway_ip = "192.168.253.1" + allocation_pool_start = "192.168.253.100" + allocation_pool_end = "192.168.253.254" + external_router_name = "octavia_main_lb_router" external_router_description = "Octavia Main LB router" - } + } } diff --git a/modules/complete_infra_setup/octavia.tf b/modules/complete_infra_setup/octavia.tf index 19593c8..246ea16 100644 --- a/modules/complete_infra_setup/octavia.tf +++ b/modules/complete_infra_setup/octavia.tf @@ -2,27 +2,27 @@ # Create the netework and subnet used to make Octavia and HAPROXY communicate resource "openstack_networking_network_v2" "octavia-private-network" { - name = var.octavia_information.network_name - admin_state_up = "true" - external = "false" - description = var.octavia_information.network_description - dns_domain = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone.name - mtu = module.labs_common_variables.mtu_size + name = var.octavia_information.network_name + admin_state_up = "true" + external = "false" + description = var.octavia_information.network_description + dns_domain = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone.name + mtu = module.labs_common_variables.mtu_size port_security_enabled = true - shared = false - region = module.labs_common_variables.main_region + shared = false + region = module.labs_common_variables.main_region # tenant_id = data.terraform_remote_state.privnet_dns_router.outputs.os_project_data.id } resource "openstack_networking_subnet_v2" "octavia-private-subnet" { name = var.octavia_information.subnet_name - description = var.octavia_information.subnet_description + description = var.octavia_information.subnet_description network_id = openstack_networking_network_v2.octavia-private-network.id cidr = var.octavia_information.subnet_cidr gateway_ip = var.octavia_information.gateway_ip dns_nameservers = module.labs_common_variables.resolvers_ip - ip_version = 4 - enable_dhcp = true + ip_version = 4 + enable_dhcp = true # tenant_id = data.terraform_remote_state.privnet_dns_router.outputs.os_project_data.id allocation_pool { start = var.octavia_information.allocation_pool_start @@ -32,11 +32,11 @@ resource "openstack_networking_subnet_v2" "octavia-private-subnet" { resource "openstack_networking_router_v2" "octavia-external-router" { name = var.octavia_information.external_router_name - description = var.octavia_information.external_router_description + description = var.octavia_information.external_router_description external_network_id = module.labs_common_variables.external_network.id # tenant_id = data.terraform_remote_state.privnet_dns_router.outputs.os_project_data.id enable_snat = true - vendor_options { + vendor_options { set_router_gateway_after_create = true } } diff --git a/modules/docker_swarm/docker-swarm.tf b/modules/docker_swarm/docker-swarm.tf index 37b54ab..172686b 100644 --- a/modules/docker_swarm/docker-swarm.tf +++ b/modules/docker_swarm/docker-swarm.tf @@ -236,11 +236,11 @@ resource "openstack_compute_volume_attach_v2" "swarm_nfs_data_attach_vol" { # # Swarm load balancer. L4, backed by Octavia resource "openstack_lb_loadbalancer_v2" "swarm_lb" { - vip_subnet_id = var.main_private_subnet_id - name = var.octavia_swarm_data.swarm_lb_name - description = var.octavia_swarm_data.swarm_lb_description - flavor_id = var.octavia_swarm_data.octavia_flavor_id - vip_address = var.octavia_swarm_data.swarm_octavia_main_ip + vip_subnet_id = var.main_private_subnet_id + name = var.octavia_swarm_data.swarm_lb_name + description = var.octavia_swarm_data.swarm_lb_description + flavor_id = var.octavia_swarm_data.octavia_flavor_id + vip_address = var.octavia_swarm_data.swarm_octavia_main_ip # availability_zone = var.availability_zones_names.availability_zone_no_gpu loadbalancer_provider = "amphora" } diff --git a/modules/labs_common_variables/variables.tf b/modules/labs_common_variables/variables.tf index c5e496d..3173ab0 100644 --- a/modules/labs_common_variables/variables.tf +++ b/modules/labs_common_variables/variables.tf @@ -58,8 +58,8 @@ variable "ubuntu_2404" { variable "centos_7" { type = map(string) default = { - name = "CentOS-7" - uuid = "f0187a99-64f6-462a-ab5f-ef52fe62f2ca" + name = "CentOS-7" + uuid = "f0187a99-64f6-462a-ab5f-ef52fe62f2ca" user_data_file = "../../s2i2s_openstack_vm_data_scripts/el.sh" } } diff --git a/modules/labs_private_net_and_dns_zone/main_network_dns_zone.tf b/modules/labs_private_net_and_dns_zone/main_network_dns_zone.tf index 119bec8..7548aa0 100644 --- a/modules/labs_private_net_and_dns_zone/main_network_dns_zone.tf +++ b/modules/labs_private_net_and_dns_zone/main_network_dns_zone.tf @@ -1,35 +1,35 @@ resource "openstack_dns_zone_v2" "primary_project_dns_zone" { - name = var.dns_zone.zone_name + name = var.dns_zone.zone_name email = var.dns_zone.email description = var.dns_zone.description - project_id = var.os_project_data.id + project_id = var.os_project_data.id ttl = var.dns_zone.ttl type = "PRIMARY" } resource "openstack_networking_network_v2" "main-private-network" { - name = var.main_private_network.name - admin_state_up = "true" - external = "false" - description = var.main_private_network.description - dns_domain = var.dns_zone.zone_name - mtu = module.labs_common_variables.mtu_size + name = var.main_private_network.name + admin_state_up = "true" + external = "false" + description = var.main_private_network.description + dns_domain = var.dns_zone.zone_name + mtu = module.labs_common_variables.mtu_size port_security_enabled = true - shared = false - region = module.labs_common_variables.main_region - tenant_id = var.os_project_data.id + shared = false + region = module.labs_common_variables.main_region + tenant_id = var.os_project_data.id } resource "openstack_networking_subnet_v2" "main-private-subnet" { name = var.main_private_subnet.name - description = var.main_private_subnet.description + description = var.main_private_subnet.description network_id = openstack_networking_network_v2.main-private-network.id cidr = var.main_private_subnet.cidr gateway_ip = var.main_private_subnet.gateway_ip dns_nameservers = module.labs_common_variables.resolvers_ip - ip_version = 4 - enable_dhcp = true - tenant_id = var.os_project_data.id + ip_version = 4 + enable_dhcp = true + tenant_id = var.os_project_data.id allocation_pool { start = var.main_private_subnet.allocation_start end = var.main_private_subnet.allocation_end @@ -38,11 +38,11 @@ resource "openstack_networking_subnet_v2" "main-private-subnet" { resource "openstack_networking_router_v2" "external-router" { name = var.external_router.name - description = var.external_router.description + description = var.external_router.description external_network_id = module.labs_common_variables.external_network.id - tenant_id = var.os_project_data.id - enable_snat = true - vendor_options { + tenant_id = var.os_project_data.id + enable_snat = true + vendor_options { set_router_gateway_after_create = true } } @@ -64,7 +64,7 @@ resource "openstack_networking_secgroup_v2" "default" { count = var.create_default_security_group ? 1 : 0 name = module.labs_common_variables.default_security_group_name delete_default_rules = "true" - tenant_id = var.os_project_data.id + tenant_id = var.os_project_data.id description = "Default security group with rules that allow ssh access from the ISTI networks, http, https" } diff --git a/modules/labs_private_net_and_dns_zone/terraform-provider.tf b/modules/labs_private_net_and_dns_zone/terraform-provider.tf index 6067ede..615b6f7 100644 --- a/modules/labs_private_net_and_dns_zone/terraform-provider.tf +++ b/modules/labs_private_net_and_dns_zone/terraform-provider.tf @@ -1,6 +1,6 @@ # Define required providers terraform { -required_version = ">= 0.14.0" + required_version = ">= 0.14.0" required_providers { openstack = { source = "terraform-provider-openstack/openstack" diff --git a/modules/labs_private_net_and_dns_zone/variables_main_network_dns.tf b/modules/labs_private_net_and_dns_zone/variables_main_network_dns.tf index 43f0789..513c996 100644 --- a/modules/labs_private_net_and_dns_zone/variables_main_network_dns.tf +++ b/modules/labs_private_net_and_dns_zone/variables_main_network_dns.tf @@ -2,7 +2,7 @@ variable "os_project_data" { type = map(string) default = { name = "" - id = "" + id = "" } } diff --git a/modules/ssh_keys/ssh-keys.tf b/modules/ssh_keys/ssh-keys.tf index e815e25..d49af19 100644 --- a/modules/ssh_keys/ssh-keys.tf +++ b/modules/ssh_keys/ssh-keys.tf @@ -1,6 +1,6 @@ # Define required providers terraform { -required_version = ">= 0.14.0" + required_version = ">= 0.14.0" required_providers { openstack = { source = "terraform-provider-openstack/openstack" diff --git a/s2i2s/variables/outputs-s2i2s.tf b/s2i2s/variables/outputs-s2i2s.tf index 776356e..dc1b2a9 100644 --- a/s2i2s/variables/outputs-s2i2s.tf +++ b/s2i2s/variables/outputs-s2i2s.tf @@ -37,3 +37,12 @@ output "haproxy_l7_data" { output "prometheus_server_data" { value = var.prometheus_server_data } + +# Derived from the address plan, so that the addresses are declared once +output "keycloak_ip" { + value = [var.basic_services_ip.keycloak_1, var.basic_services_ip.keycloak_2] +} + +output "git_ssh_data" { + value = var.git_ssh_data +} diff --git a/s2i2s/variables/variables-s2i2s.tf b/s2i2s/variables/variables-s2i2s.tf index ff4fb79..6e97193 100644 --- a/s2i2s/variables/variables-s2i2s.tf +++ b/s2i2s/variables/variables-s2i2s.tf @@ -17,11 +17,11 @@ variable "networks_list" { variable "shared_postgresql_server_data" { type = map(string) default = { - name = "shared-postgresql-server" - flavor = "m1.large" - vol_data_name = "shared-postgresql-data" - vol_data_size = "100" - vol_data_device = "/dev/vdb" + name = "shared-postgresql-server" + flavor = "m1.large" + vol_data_name = "shared-postgresql-data" + vol_data_size = "100" + vol_data_device = "/dev/vdb" network_name = "postgresql-srv-net" network_description = "Network used to communicate with the shared postgresql service" network_cidr = "192.168.0.0/22" @@ -32,6 +32,24 @@ variable "shared_postgresql_server_data" { } } +# Git over SSH, published by the load balancers instead of a floating IP on the +# forgejo VM: +# +# client -> Octavia TCP 22 -> HAPROXY L7 tcp 2222 -> forgejo 2222 +# +# The public port stays 22, so the clone URLs need no port. The HAPROXY L7 hosts +# cannot listen on 22 either, sshd is there +variable "git_ssh_data" { + type = object({ + public_port = number + haproxy_bind_port = number + }) + default = { + public_port = 22 + haproxy_bind_port = 2222 + } +} + variable "basic_services_ip" { type = map(string) default = { @@ -47,6 +65,17 @@ variable "basic_services_ip" { haproxy_l7_2_cidr = "10.10.0.12/32" octavia_main = "10.10.0.20" octavia_main_cidr = "10.10.0.20/32" + # Services deployed by their own workspaces. The sizing of each one is a + # default of its module, under ../../modules; the addresses live here so + # that the whole plan is visible in one place + postgresql = "10.10.0.162" + postgresql_cidr = "10.10.0.162/32" + keycloak_1 = "10.10.0.163" + keycloak_1_cidr = "10.10.0.163/32" + keycloak_2 = "10.10.0.164" + keycloak_2_cidr = "10.10.0.164/32" + forgejo = "10.10.0.165" + forgejo_cidr = "10.10.0.165/32" } }