Skip to content

Commit ee3b9ef

Browse files
scafemanscafeman
committed
Added Release Version 1.1.0 of the vcd_nsxt_firewall Module to the global-vmware GitHub Organization
1 parent f960b99 commit ee3b9ef

File tree

5 files changed

+249
-1
lines changed

5 files changed

+249
-1
lines changed

‎.gitignore‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
.terraform.*
4+
5+
# .tfstate files
6+
*.tfstate
7+
*.tfstate.*
8+
secrets.tfvars
9+
secrets.auto.tfvars
10+
providers.tf
11+
12+
# Crash log files
13+
crash.log
14+
15+
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
16+
# .tfvars files are managed as part of configuration and so should be included in
17+
# version control.
18+
#
19+
# example.tfvars
20+
21+
# Ignore override files as they are usually used to override resources locally and so
22+
# are not checked in
23+
override.tf
24+
override.tf.json
25+
*_override.tf
26+
*_override.tf.json
27+
28+
# Include override files you do wish to add to version control using negated pattern
29+
#
30+
# !example_override.tf
31+
32+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
33+
# example: *tfplan*

‎README.md‎

Lines changed: 92 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,92 @@
1-
# vcd_nsxt_firewall
1+
# VCD NSX-T Edge Gateway Firewall Rules Terraform Module
2+
3+
This Terraform module deploys NSX-T Edge Gateway Firewall Rules into an existing VMware Cloud Director (VCD) environment. It enables the provisioning of new Edge Gateway Firewall Rules into [Rackspace Technology SDDC Flex](https://www.rackspace.com/cloud/private/software-defined-data-center-flex) VCD Data Center Regions.
4+
5+
## Requirements
6+
7+
| Name | Version |
8+
|------|---------|
9+
| terraform | ~> 1.2 |
10+
| vcd | ~> 3.8 |
11+
12+
## Resources
13+
14+
| Name | Type |
15+
|----------------------------------------------------------------------|--------------|
16+
| [vcd_nsxt_edgegateway](https://registry.terraform.io/providers/vmware/vcd/latest/docs/data-sources/nsxt_edgegateway) | Data Source |
17+
| [vcd_vdc_group](https://registry.terraform.io/providers/vmware/vcd/latest/docs/data-sources/vdc_group)| Data Source |
18+
| [vcd_nsxt_security_group](https://registry.terraform.io/providers/vmware/vcd/latest/docs/resources/nsxt_security_group) | Data Source |
19+
| [vcd_nsxt_firewall](https://registry.terraform.io/providers/vmware/vcd/latest/docs/resources/nsxt_firewall) | Resource |
20+
21+
## Inputs
22+
23+
| Name | Description | Type | Default | Required |
24+
|------|-------------|------|---------|----------|
25+
| vdc_org_name | The name of the Data Center Group Organization in VCD | string | - | yes |
26+
| vdc_group_name | The name of the Data Center Group in VCD | string | - | yes |
27+
| vdc_edge_name | Name of the Data Center Group Edge Gateway | string | - | yes |
28+
| app_port_profiles | Map of app port profiles with their corresponding scopes | map(string) | {} | no |
29+
| ip_set_names | List of IP set names | list(string) | [] | yes |
30+
| dynamic_security_group_names | List of dynamic security group names | list(string) | [] | no |
31+
| security_group_names | List of security group names | list(string) | [] | no |
32+
| rules | List of rules to apply | list(object({ name = string, direction = string, ip_protocol = string, action = string, enabled = optional(bool), logging = optional(bool), source_ids = optional(list(string)), destination_ids = optional(list(string)), app_port_profile_ids = optional(list(string)) })) | [] | yes |
33+
34+
## Outputs
35+
36+
| Name | Description |
37+
|------|-------------|
38+
| firewall_id | The ID of the firewall |
39+
| firewall_rule_names | The names of the firewall rules |
40+
41+
## Example Usage
42+
43+
```terraform
44+
module "vcd_nsxt_firewall" {
45+
source = "github.com/global-vmware/vcd_nsxt_firewall.git?ref=v1.1.0"
46+
47+
vdc_org_name = "<VDC-ORG-NAME>"
48+
vdc_group_name = "<VDC-GRP-NAME>"
49+
vdc_edge_name = "<VDC-EDGE-NAME>"
50+
51+
app_port_profiles = {
52+
"HTTPS" = "SYSTEM",
53+
}
54+
55+
ip_set_names = [
56+
"US1-Segment-01-Network_172.16.0.0/24_IP-Set",
57+
"US1-Segment-02-Network_172.16.1.0/24_IP-Set",
58+
"US1-Segment-03-Network_172.16.2.0/24_IP-Set",
59+
"US1-Segment-04-Network_172.16.3.0/24_IP-Set",
60+
"US1-Segment-05-Network_172.16.4.0/24_IP-Set",
61+
"Prod-App-NSXT-ALB-VIP"
62+
]
63+
64+
rules = [
65+
{
66+
name = "Allow_HTTPS-->Prod-App-NSXT-ALB-VIP"
67+
direction = "IN_OUT"
68+
ip_protocol = "IPV4"
69+
action = "ALLOW"
70+
app_port_profile_ids = ["HTTPS"]
71+
destination_ids = ["Prod-App-NSXT-ALB-VIP"]
72+
},
73+
{
74+
name = "Allow_Outbound-Internet"
75+
direction = "IN_OUT"
76+
ip_protocol = "IPV4"
77+
action = "ALLOW"
78+
source_ids = [
79+
"US1-Segment-01-Network_172.16.0.0/24_IP-Set",
80+
"US1-Segment-02-Network_172.16.1.0/24_IP-Set",
81+
"US1-Segment-03-Network_172.16.2.0/24_IP-Set",
82+
"US1-Segment-04-Network_172.16.3.0/24_IP-Set",
83+
"US1-Segment-05-Network_172.16.4.0/24_IP-Set"
84+
]
85+
}
86+
]
87+
}
88+
```
89+
90+
## Authors
91+
92+
This module is maintained by the [Global VMware Cloud Automation Services Team](https://github.com/global-vmware).

‎main.tf‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
terraform {
2+
required_version = "~> 1.2"
3+
4+
required_providers {
5+
vcd = {
6+
source = "vmware/vcd"
7+
version = "~> 3.8"
8+
}
9+
}
10+
}
11+
12+
# Create the Datacenter Group data source
13+
data "vcd_vdc_group" "dcgroup" {
14+
name = var.vdc_group_name
15+
}
16+
17+
# Create the NSX-T Edge Gateway data source
18+
data "vcd_nsxt_edgegateway" "edge_gateway" {
19+
org = var.vdc_org_name
20+
owner_id = data.vcd_vdc_group.dcgroup.id
21+
name = var.vdc_edge_name
22+
}
23+
24+
# Create the NSX-T Data Center Edge Gateway Firewall data source
25+
data "vcd_nsxt_firewall" "edge_fw" {
26+
edge_gateway_id = data.vcd_nsxt_edgegateway.edge_gateway.id
27+
}
28+
29+
data "vcd_nsxt_app_port_profile" "app_port_profiles" {
30+
for_each = var.app_port_profiles
31+
name = each.key
32+
scope = each.value
33+
}
34+
35+
data "vcd_nsxt_ip_set" "ip_sets" {
36+
for_each = toset(var.ip_set_names)
37+
edge_gateway_id = data.vcd_nsxt_edgegateway.edge_gateway.id
38+
name = each.value
39+
}
40+
41+
data "vcd_nsxt_dynamic_security_group" "dynamic_security_groups" {
42+
for_each = toset(var.dynamic_security_group_names)
43+
vdc_group_id = data.vcd_vdc_group.dcgroup.id
44+
name = each.value
45+
}
46+
47+
data "vcd_nsxt_security_group" "security_groups" {
48+
for_each = toset(var.security_group_names)
49+
edge_gateway_id = data.vcd_nsxt_edgegateway.edge_gateway.id
50+
name = each.value
51+
}
52+
53+
resource "vcd_nsxt_firewall" "edge_firewall" {
54+
edge_gateway_id = data.vcd_nsxt_edgegateway.edge_gateway.id
55+
56+
dynamic "rule" {
57+
for_each = var.rules
58+
content {
59+
name = rule.value["name"]
60+
direction = rule.value["direction"]
61+
ip_protocol = rule.value["ip_protocol"]
62+
action = rule.value["action"]
63+
enabled = lookup(rule.value, "enabled", true)
64+
logging = lookup(rule.value, "logging", false)
65+
source_ids = try(length(rule.value["source_ids"]), 0) > 0 ? [for id in rule.value["source_ids"]: try(data.vcd_nsxt_security_group.security_groups[id].id, try(data.vcd_nsxt_dynamic_security_group.dynamic_security_groups[id].id, data.vcd_nsxt_ip_set.ip_sets[id].id)) if id != null && id != ""] : null
66+
destination_ids = try(length(rule.value["destination_ids"]), 0) > 0 ? [for id in rule.value["destination_ids"]: try(data.vcd_nsxt_security_group.security_groups[id].id, try(data.vcd_nsxt_dynamic_security_group.dynamic_security_groups[id].id, data.vcd_nsxt_ip_set.ip_sets[id].id)) if id != null && id != ""] : null
67+
app_port_profile_ids = try(length(rule.value["app_port_profile_ids"]), 0) > 0 ? [for name in rule.value["app_port_profile_ids"]: data.vcd_nsxt_app_port_profile.app_port_profiles[name].id if name != null && name != ""] : null
68+
}
69+
}
70+
}
71+
72+
73+

‎outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "firewall_id" {
2+
description = "The ID of the firewall"
3+
value = vcd_nsxt_firewall.edge_firewall.id
4+
}
5+
6+
output "firewall_rule_names" {
7+
description = "The names of the firewall rules"
8+
value = [for r in vcd_nsxt_firewall.edge_firewall.rule: r.name]
9+
}

‎variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
variable "vdc_org_name" {}
2+
3+
variable "vdc_group_name" {}
4+
5+
variable "vdc_edge_name" {}
6+
7+
variable "app_port_profiles" {
8+
description = "Map of app port profiles with their corresponding scopes"
9+
type = map(string)
10+
default = {}
11+
}
12+
13+
variable "ip_set_names" {
14+
type = list(string)
15+
default = []
16+
}
17+
18+
variable "dynamic_security_group_names" {
19+
type = list(string)
20+
default = []
21+
}
22+
23+
variable "security_group_names" {
24+
type = list(string)
25+
default = []
26+
}
27+
28+
variable "rules" {
29+
description = "List of rules to apply"
30+
type = list(object({
31+
name = string
32+
direction = string
33+
ip_protocol = string
34+
action = string
35+
enabled = optional(bool)
36+
logging = optional(bool)
37+
source_ids = optional(list(string))
38+
destination_ids = optional(list(string))
39+
app_port_profile_ids = optional(list(string))
40+
}))
41+
default = []
42+
}

0 commit comments

Comments
 (0)