121 lines
4.3 KiB
HCL
121 lines
4.3 KiB
HCL
#
|
|
# HAPROXY L7 behind the main Octavia load balancer
|
|
#
|
|
|
|
# Server group for anti-affinity (VMs on different hosts)
|
|
resource "openstack_compute_servergroup_v2" "main_haproxy_l7" {
|
|
name = "main_haproxy_l7"
|
|
policies = ["anti-affinity"]
|
|
}
|
|
|
|
# Security group for traffic from Octavia LB to HAProxy
|
|
resource "openstack_networking_secgroup_v2" "main_lb_to_haproxy_l7" {
|
|
name = "traffic_from_main_lb_to_haproxy_l7"
|
|
delete_default_rules = "true"
|
|
description = "Traffic coming from the main L4 lb directed to the haproxy l7 servers"
|
|
}
|
|
|
|
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_1_peer" {
|
|
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
description = "Peer traffic from haproxy l7 1 to l7 2"
|
|
direction = "ingress"
|
|
ethertype = "IPv4"
|
|
protocol = "tcp"
|
|
port_range_min = 10000
|
|
port_range_max = 10000
|
|
remote_ip_prefix = local.basic_services_ip.haproxy_l7_1_cidr
|
|
}
|
|
|
|
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
|
|
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
description = "Peer traffic from haproxy l7 2 to l7 1"
|
|
direction = "ingress"
|
|
ethertype = "IPv4"
|
|
protocol = "tcp"
|
|
port_range_min = 10000
|
|
port_range_max = 10000
|
|
remote_ip_prefix = local.basic_services_ip.haproxy_l7_2_cidr
|
|
}
|
|
|
|
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_80" {
|
|
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
description = "Traffic from the octavia lb instance to HAPROXY l7 port 80"
|
|
direction = "ingress"
|
|
ethertype = "IPv4"
|
|
protocol = "tcp"
|
|
port_range_min = 80
|
|
port_range_max = 80
|
|
remote_ip_prefix = local.main_private_subnet.cidr
|
|
}
|
|
|
|
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_443" {
|
|
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
description = "Traffic from the octavia lb instance to HAPROXY l7 port 443"
|
|
direction = "ingress"
|
|
ethertype = "IPv4"
|
|
protocol = "tcp"
|
|
port_range_min = 443
|
|
port_range_max = 443
|
|
remote_ip_prefix = local.main_private_subnet.cidr
|
|
}
|
|
|
|
resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880" {
|
|
security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
description = "Traffic from the octavia lb instance to HAPROXY l7 port 8880"
|
|
direction = "ingress"
|
|
ethertype = "IPv4"
|
|
protocol = "tcp"
|
|
port_range_min = 8880
|
|
port_range_max = 8880
|
|
remote_ip_prefix = local.main_private_subnet.cidr
|
|
}
|
|
|
|
# Ports in the main private network for HAProxy instances
|
|
resource "openstack_networking_port_v2" "main_haproxy_l7_port" {
|
|
count = local.haproxy_l7_data.vm_count
|
|
name = format("%s-%02d-port", local.haproxy_l7_data.name, count.index + 1)
|
|
admin_state_up = true
|
|
network_id = local.main_private_network_id
|
|
security_group_ids = [
|
|
openstack_networking_secgroup_v2.default.id,
|
|
openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
|
|
]
|
|
fixed_ip {
|
|
subnet_id = local.main_private_subnet_id
|
|
ip_address = local.main_haproxy_l7_ip[count.index]
|
|
}
|
|
}
|
|
|
|
# HAProxy L7 instances
|
|
resource "openstack_compute_instance_v2" "main_haproxy_l7" {
|
|
count = local.haproxy_l7_data.vm_count
|
|
name = format("%s-%02d", local.haproxy_l7_data.name, count.index + 1)
|
|
availability_zone_hints = local.availability_zones_names.availability_zone_no_gpu
|
|
flavor_name = local.haproxy_l7_data.flavor
|
|
key_pair = module.ssh_settings.ssh_key_name
|
|
scheduler_hints {
|
|
group = openstack_compute_servergroup_v2.main_haproxy_l7.id
|
|
}
|
|
|
|
block_device {
|
|
uuid = local.ubuntu_2404.uuid
|
|
source_type = "image"
|
|
volume_size = 10
|
|
boot_index = 0
|
|
destination_type = "volume"
|
|
delete_on_termination = false
|
|
}
|
|
|
|
network {
|
|
port = openstack_networking_port_v2.main_haproxy_l7_port[count.index].id
|
|
}
|
|
|
|
user_data = file("${local.ubuntu2404_data_file}")
|
|
# Do not replace the instance when the ssh key changes
|
|
lifecycle {
|
|
ignore_changes = [
|
|
key_pair, user_data, network
|
|
]
|
|
}
|
|
}
|