From 1240733f9a36196d31b0f8ccc5b77af48d6a84e8 Mon Sep 17 00:00:00 2001 From: KoomeKiriinya Date: Wed, 21 Feb 2024 21:02:03 +0300 Subject: [PATCH] refactor vpn for p2s --- modules/azure/s2svpn/README.md | 41 -------- modules/azure/vpn/README.md | 107 +++++++++++++++++++++ modules/azure/{s2svpn => vpn}/main.tf | 10 +- modules/azure/{s2svpn => vpn}/outputs.tf | 0 modules/azure/{s2svpn => vpn}/variables.tf | 7 +- 5 files changed, 122 insertions(+), 43 deletions(-) delete mode 100644 modules/azure/s2svpn/README.md create mode 100644 modules/azure/vpn/README.md rename modules/azure/{s2svpn => vpn}/main.tf (92%) rename modules/azure/{s2svpn => vpn}/outputs.tf (100%) rename modules/azure/{s2svpn => vpn}/variables.tf (90%) diff --git a/modules/azure/s2svpn/README.md b/modules/azure/s2svpn/README.md deleted file mode 100644 index fe20ebd..0000000 --- a/modules/azure/s2svpn/README.md +++ /dev/null @@ -1,41 +0,0 @@ -# terraform module for azure site to site vpn - -example using static routes - -```shell -module "s2svpn-legacy" { - source = "git::https://github.com/cloudkite-io/terraform-modules.git//modules/azure/s2svpn?ref=v0.1.4" - name = "vpn" - resource_group_name = "sample-resource-group" - location = "eastus" - subnet_id = "/subscriptions/{Subscription ID}/resourceGroups/MyResourceGroup.providers/Microsoft.Network/virtualNetworks/MyNet/subnets/MySubnet" - sku = "VpnGw1" - enable_bgp = false - active_active = false - local_networks = - local_networks = [ - { - name = "onpremise" - #on-premise gateway address - gateway_address = "8.8.8.8" - address_space = [ - "10.0.0.0/8" - ] - #pre-shared key must be similar to on-premise key - shared_key = "TESTING" - - ipsec_policy = { - dh_group = "DHGroup14" - ike_encryption = "AES256" - ike_integrity = "SHA256" - ipsec_encryption = "AES256" - ipsec_integrity = "SHA256" - pfs_group = "PFS2048" - sa_datasize = "1024" - sa_lifetime = "3600" - } - }, - ] - -} -``` diff --git a/modules/azure/vpn/README.md b/modules/azure/vpn/README.md new file mode 100644 index 0000000..c4371a3 --- /dev/null +++ b/modules/azure/vpn/README.md @@ -0,0 +1,107 @@ +# terraform module for azure s2s and p2s vpn + +example using static routes for s2svpn + +```shell +module "s2svpn" { + source = "git::https://github.com/cloudkite-io/terraform-modules.git//modules/azure/s2svpn?ref=v0.1.4" + name = "vpn" + resource_group_name = "sample-resource-group" + location = "eastus" + subnet_id = "/subscriptions/{Subscription ID}/resourceGroups/MyResourceGroup.providers/Microsoft.Network/virtualNetworks/MyNet/subnets/MySubnet" + sku = "VpnGw1" + enable_bgp = false + active_active = false + local_networks = + local_networks = [ + { + name = "onpremise" + #on-premise gateway address + gateway_address = "8.8.8.8" + address_space = [ + "10.0.0.0/8" + ] + #pre-shared key must be similar to on-premise key + shared_key = "TESTING" + + ipsec_policy = { + dh_group = "DHGroup14" + ike_encryption = "AES256" + ike_integrity = "SHA256" + ipsec_encryption = "AES256" + ipsec_integrity = "SHA256" + pfs_group = "PFS2048" + sa_datasize = "1024" + sa_lifetime = "3600" + } + }, + ] + +} +``` +example using static routes for p2svpn +``` +module "p2svpn" { + source = "git::https://github.com/cloudkite-io/terraform-modules.git//modules/azure/vpn?ref=0.1.7" + name = "${var.environment}-vpn" + resource_group_name = var.azure.resource_group_name + sku = var.vpn.sku + location = var.azure.location + subnet_id = module.networking.vnet_subnets["GatewaySubnet"].id + client_configuration = { + protocols = var.vpn.p2s.protocols + auth_types = var.vpn.p2s.auth_types + address_space = var.vpn.p2s.address_space + certificate = data.azurerm_key_vault_secret.secrets["P2S-VPN-DEVICES-ROOT-CERTIFICATE"].value + } +} + + +``` +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.13 | +| [azurerm](#requirement\_azurerm) | >=3.40.0 | + +## Providers + +| Name | Version | +|------|---------| +| [azurerm](#provider\_azurerm) | >=3.40.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [azurerm_local_network_gateway.local](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/local_network_gateway) | resource | +| [azurerm_public_ip.gw](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) | resource | +| [azurerm_public_ip.gw_aa](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) | resource | +| [azurerm_virtual_network_gateway.gw](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_gateway) | resource | +| [azurerm_virtual_network_gateway_connection.local](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_gateway_connection) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [active\_active](#input\_active\_active) | If true, an active-active Virtual Network Gateway will be created. An active-active gateway requires a HighPerformance or an UltraPerformance sku. If false, an active-standby gateway will be created. Defaults to false. | `bool` | `false` | no | +| [client\_configuration](#input\_client\_configuration) | If set it will activate point-to-site configuration. | 
object({
    address_space  = string
    protocols      = list(string)
    certificate    = string
    vpn_auth_types = list(string)
    revoked_certificates = map(object({
      name = string
      thumbprint = string
    }))
  })
| `null` | no | +| [enable\_bgp](#input\_enable\_bgp) | If true, BGP (Border Gateway Protocol) will be enabled for this Virtual Network Gateway. Defaults to false. | `bool` | `false` | no | +| [local\_networks](#input\_local\_networks) | List of local virtual network connections to connect to gateway. | 
list(
    object({
      name            = string
      gateway_address = string
      address_space   = list(string)
      shared_key      = string
      ipsec_policy    = any
    })
  )
| `[]` | no | +| [location](#input\_location) | The Azure Region in which to create resource. | `string` | n/a | yes | +| [name](#input\_name) | Name of virtual gateway. | `string` | n/a | yes | +| [resource\_group\_name](#input\_resource\_group\_name) | Name of resource group to deploy resources in. | `string` | n/a | yes | +| [sku](#input\_sku) | Configuration of the size and capacity of the virtual network gateway. | `string` | n/a | yes | +| [subnet\_id](#input\_subnet\_id) | Id of subnet where gateway should be deployed, have to be named GatewaySubnet. | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [fqdns](#output\_fqdns) | List of the fqdn for gateway. Will return 2 for active\_active mode and 1 otherwise | +| [gateway\_id](#output\_gateway\_id) | The ID of the virtual network gateway. | diff --git a/modules/azure/s2svpn/main.tf b/modules/azure/vpn/main.tf similarity index 92% rename from modules/azure/s2svpn/main.tf rename to modules/azure/vpn/main.tf index 7460d83..c7a4aa0 100644 --- a/modules/azure/s2svpn/main.tf +++ b/modules/azure/vpn/main.tf @@ -65,7 +65,7 @@ resource "azurerm_virtual_network_gateway" "gw" { for_each = var.client_configuration != null ? [var.client_configuration] : [] iterator = vpn content { - address_space = [vpn.value.address_space] + address_space = vpn.value.address_space root_certificate { name = "VPN-Certificate" @@ -74,6 +74,14 @@ resource "azurerm_virtual_network_gateway" "gw" { } vpn_client_protocols = vpn.value.protocols + vpn_auth_types = vpn.value.auth_types + dynamic "revoked_certificate" { + for_each = vpn.value.revoked_certificates + content { + name = revoked_certificate.key + thumbprint = revoked_certificate.thumbprint + } + } } } diff --git a/modules/azure/s2svpn/outputs.tf b/modules/azure/vpn/outputs.tf similarity index 100% rename from modules/azure/s2svpn/outputs.tf rename to modules/azure/vpn/outputs.tf diff --git a/modules/azure/s2svpn/variables.tf b/modules/azure/vpn/variables.tf similarity index 90% rename from modules/azure/s2svpn/variables.tf rename to modules/azure/vpn/variables.tf index 73f0570..0ccb5ed 100644 --- a/modules/azure/s2svpn/variables.tf +++ b/modules/azure/vpn/variables.tf @@ -38,9 +38,14 @@ variable "sku" { variable "client_configuration" { description = "If set it will activate point-to-site configuration." type = object({ - address_space = string + address_space = list(string) protocols = list(string) certificate = string + auth_types = list(string) + revoked_certificates = optional(map(object({ + name = string + thumbprint = string + })),{}) }) default = null }