f5devcentral / terraform-xc-aws-ce

Terraform to create F5XC AWS cloud CE

Overview

Terraform templates to create F5XC AWS cloud CE (manual mode deployment).

Requirements

Name	Version
terraform	>= 1.7.0
curl	>= 1.7
git	>= 8.0
jq	latest

OS Platform

Name	Status
Linux	supported
Mac OS (Sonoma)	supported
Windows	unsupported

Installation

• Git (https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
• Terraform (https://developer.hashicorp.com/terraform/install?product_intent=terraform)
• F5 XC Credentials (https://docs.cloud.f5.com/docs/how-to/user-mgmt/credentials)
  • API Certificate
• SSH public key
  • ssh-keygen -t rsa -b 4096 -C "[email protected]"
• F5 XC full tenant name
  • Obtain full tenant name in XC web console by navigating to administration page --> tenant settings
  • 

Usage

• Clone this repo with: git clone --recurse-submodules https://github.com/f5devcentral/terraform-xc-aws-ce
• Enter repository directory with: cd terraform-xc-aws-ce
• Follow usage description in topologies section
• Multiple examples in example directory are available. Change to example directory that is to be deployed with cd examples/<example_dir_name>

Input variables

Description of available input variables. Used input variables will change per topology example:

Name	Description
SLO	Site local outside interface (external interface / egress interface)
SLI	Site local inside interface (internal interface ( ingress interface)
owner	Tag aws objects with creator / owner email address
project_prefix	String added at the beginning of various AWS / F5 XC object identifier. <project_prefix>_<object>
project_suffix	String added at the end of various AWS / F5 XC object identifier. <project_prefix>_<object>_<project_suffix>
	Example prefix + suffix for F5XC site name project_prefix_cluster_name_project_suffix
f5xc_tenant	Full f5 xc tenant name e.g. playground-abcdefg
f5xc_api_url	F5 XC API URL e.g. https://playground.console.ves.volterra.io/api
f5xc_cluster_name	F5 XC cluster name e.g. "aws-ce-test"
f5xc_api_p12_file	Path to F5 XC exported API cert file
f5xc_aws_availability_zone	AWS availability zone to deploy object in
aws_region	AWS region to deploy site in e.g. "us-west-2"
aws_existing_vpc_id	Id of existing AWS VPC e.g. vpc-089de438436174ab7
aws_existing_sg_slo_ids	SLO comma separated list of security group id strings e.g. ["id-1", "id-2", "id-3"]. Leave empty to omit injection
aws_existing_sg_sli_ids	SLI comma separated list of security group id strings e.g. ["id-1", "id-2", "id-3"]. Leave empty to omit injection
aws_slo_subnet_id_nodeX	Per node slo (outside interface) existing subnet id
aws_sli_subnet_id_nodeX	Per node sli (inside interface) existing subnet id
aws_existing_key_pair_id	Inject existing ssh key pair id
aws_existing_iam_profile_name	Inject existing iam profile name

Topologies

Name	Description
Single Node Single NIC new VPC / subnet	Description
Single Node Multi NIC new VPC / subnet	Description
Single Node Single NIC Existing VPC / new subnet	Description
Single Node Multi NIC Existing VPC / new subnet	Description
Single Node Single NIC existing VPC / subnet	Description
Single Node Multi NIC existing VPC / subnet	Description
Single Node Multi NIC existing VPC / new subnet with SLO no EIP / AWS NAT GW	Description
Single Node Single NIC existing VPC / subnet and 3rd party NAT GW	Description
Single Node Multi NIC existing VPC / subnet and 3rd party NAT GW	Description
Single Node AppStack Cluster new VPC / subnet	Description
Single Node AppStack Cluster existing VPC / new subnet	Description
Three Node Cluster Single NIC new VPC / subnet	Description
Three Node Cluster Single NIC existing VPC / new subnet	Description
Three Node Cluster Single NIC existing VPC / subnet	Description
Three Node Cluster Multi NIC new VPC / subnet	Description
Three Node Cluster Multi NIC existing VPC / new subnet	Description
Three Node Single NIC existing VPC / subnet and 3rd party NAT GW	Description
Three Node Multi NIC existing VPC / subnet and 3rd party NAT GW	Description
Three Node AppStack Cluster new VPC / subnet	Description
Three Node AppStack Cluster existing VPC / new subnet	Description

Feature specific examples

Name	Description
Single Node with offline survivability mode and l3 performance enhancement mode	Description
Single Node single NIC new VPC and subnet with custom security group	Description

ClickOps

Find CE cloud-config example for ClickOps deployment at Cloud-Config

Support

For support, please open a GitHub issue. Note, the code in this repository is community supported and is not supported by F5 Networks. For a complete list of supported projects please reference SUPPORT.md.

Community Code of Conduct

Please refer to the F5 DevCentral Community Code of Conduct.

License

Apache License 2.0

Copyright

Copyright 2014-2020 F5 Networks Inc.

F5 Networks Contributor License Agreement

Before you start contributing to any project sponsored by F5 Networks, Inc. (F5) on GitHub, you will need to sign a Contributor License Agreement (CLA).

If you are signing as an individual, we recommend that you talk to your employer (if applicable) before signing the CLA since some employment agreements may have restrictions on your contributions to other projects. Otherwise, by submitting a CLA you represent that you are legally entitled to grant the licenses recited therein.

If your employer has rights to intellectual property that you create, such as your contributions, you represent that you have received permission to make contributions on behalf of that employer, that your employer has waived such rights for your contributions, or that your employer has executed a separate CLA with F5.

If you are signing on behalf of a company, you represent that you are legally entitled to grant the license recited therein. You represent further that each employee of the entity that submits contributions is authorized to submit such contributions on behalf of the entity pursuant to the CLA.

terraform-xc-aws-ce's Issues

recursive module is not getting cloned

The "modules" submodule is not correctly referenced.

git clone throws error:
fatal: remote error: upload-pack: not our ref e3b7750ee07b6f7ab7afe18d9f0df84a03756618
fatal: Fetched in submodule path 'modules', but it did not contain e3b7750ee07b6f7ab7afe18d9f0df84a03756618. Direct fetching of that commit failed.

Getting multiple 400 errors when using manual mode to deploy CE's in aws

Getting multiple 400 errors when using manual mode to deploy CE's in aws. Using https://github.com/f5devcentral/terraform-xc-aws-ce/tree/main and trying to deploy the three_node_cluster_multi_nic_new_vpc_new_subnet option:

Error outputs:
Error: error creating SecuremeshSite: Creating object: Unsuccessful POST at URL https://visa.console.ves.volterra.io/api/public/namespaces/system/securemesh_sites, status code 400, body
│
│
│
│
│
│
│
│
│ <title> We're sorry...
│ </title>
│
│
│
│ <style>
│ :root {
│ --spinner: url('data:image/svg+xml;base64,PHN2ZyBjbGFzcz0ic3BpbiIgd2lkdGg9IjE4IiBoZWlnaHQ9IjE4IiB2aWV3Qm94PSIwIDAgMTggMTgiIGZpbGw9IiNmZmYiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CiAgPHBhdGggaWQ9InNlZ21lbnQiIGQ9Ik0xNS43NSA5QTYuNzUgNi43NSAwIDExOSAyLjI1YS43NS43NSAwIDAwMC0xLjVBOC4yNSA4LjI1IDAgMTAxNy4yNSA5YS43NS43NSAwIDAwLTEuNSAweiI+PC9wYXRoPgo8L3N2Zz4=');
│ }
│ </style>
│ <script type="text/javascript">
│ function injectTracker(src, async, crossorigin) {
│ // tora browser should not have any trackers injected
│ if (!navigator.userAgent.endsWith('TORA-RUNNER')) {
│ var scriptElem = document.createElement('script');
│ scriptElem.type= 'text/javascript';
│ scriptElem.src = src;
│ if (async) {
│ scriptElem.async = true;
│ }
│ if (crossorigin) {
│ scriptElem.setAttribute('crossorigin', '');
│ }
│ document.head.appendChild(scriptElem);
│ }
│ }
│ </script>
│ <script type="text/javascript">
│ var vesStellarBaseUrl = 'console.ves.volterra.io';
│ </script>
│ <script src="/auth/resources/ks7v1/login/volterra/dist/main.js?v7.0.9" type="text/javascript"></script>
│
│
│
│

│
│
│

│

│

│

│

│
│

│ error
│

│

│

Invalid parameter: redirect_uri

│
│ <a id="backToApplication"
│ href="#"
│ class="btn btn-primary btn-block btn-lg">
│ Try again
│
│

│

│

│

│
│
│

│ © 2022 F5, Inc. All Rights Reserved.
│
│
│ Policies
│
│
│
│ Trademarks
│
│
│
│ F5 CA Privacy Summary
│
│
│
│ Do Not Sell My Personal Information
│
│

│

│
│
│
│
│
│ with module.f5xc_aws_cloud_ce_three_node_multi_nic_new_vpc_new_subnet.module.secure_mesh_site[0].volterra_securemesh_site.secure_mesh_site,
│ on ../../modules/f5xc/secure-mesh-site/main.tf line 1, in resource "volterra_securemesh_site" "secure_mesh_site":
│ 1: resource "volterra_securemesh_site" "secure_mesh_site" {
│
╵
╷
│ Error: error creating Token: Creating object: Unsuccessful POST at URL https://visa.console.ves.volterra.io/api/public/namespaces/system/tokens, status code 400, body
│
│
│
│
│
│
│
│
│ <title> We're sorry...
│ </title>
│
│
│
│ <style>
│ :root {
│ --spinner: url('data:image/svg+xml;base64,PHN2ZyBjbGFzcz0ic3BpbiIgd2lkdGg9IjE4IiBoZWlnaHQ9IjE4IiB2aWV3Qm94PSIwIDAgMTggMTgiIGZpbGw9IiNmZmYiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CiAgPHBhdGggaWQ9InNlZ21lbnQiIGQ9Ik0xNS43NSA5QTYuNzUgNi43NSAwIDExOSAyLjI1YS43NS43NSAwIDAwMC0xLjVBOC4yNSA4LjI1IDAgMTAxNy4yNSA5YS43NS43NSAwIDAwLTEuNSAweiI+PC9wYXRoPgo8L3N2Zz4=');
│ }
│ </style>
│ <script type="text/javascript">
│ function injectTracker(src, async, crossorigin) {
│ // tora browser should not have any trackers injected
│ if (!navigator.userAgent.endsWith('TORA-RUNNER')) {
│ var scriptElem = document.createElement('script');
│ scriptElem.type= 'text/javascript';
│ scriptElem.src = src;
│ if (async) {
│ scriptElem.async = true;
│ }
│ if (crossorigin) {
│ scriptElem.setAttribute('crossorigin', '');
│ }
│ document.head.appendChild(scriptElem);
│ }
│ }
│ </script>
│ <script type="text/javascript">
│ var vesStellarBaseUrl = 'console.ves.volterra.io';
│ </script>
│ <script src="/auth/resources/ks7v1/login/volterra/dist/main.js?v7.0.9" type="text/javascript"></script>
│
│
│
│

│
│
│

│

│

│

│

│
│

│ error
│

│

│

Invalid parameter: redirect_uri

│
│ <a id="backToApplication"
│ href="#"
│ class="btn btn-primary btn-block btn-lg">
│ Try again
│
│

│

│

│

│
│
│

│ © 2022 F5, Inc. All Rights Reserved.
│
│
│ Policies
│
│
│
│ Trademarks
│
│
│
│ F5 CA Privacy Summary
│
│
│
│ Do Not Sell My Personal Information
│
│

│

│
│
│
│
│
│ with module.f5xc_aws_cloud_ce_three_node_multi_nic_new_vpc_new_subnet.volterra_token.site,
│ on ../../modules/f5xc/ce/aws/main.tf line 1, in resource "volterra_token" "site":
│ 1: resource "volterra_token" "site" {

The AWS security group rules array/list in the examples section are empty.

The AWS security group rules in the examples are empty. Can there be example how the provider will add this security groups ?

"var.aws_existing_sg_sli_ids is empty list of string" when attempting to deploy single_node_multi_nic_new_vpc_new_subnet

I'm attempting to run the TF plan for single_node_multi_nic_new_vpc_new_subnet and I'm receiving the following error:

╷
│ Error: Invalid operand
│ 
│   on ../../modules/f5xc/ce/aws/main.tf line 56, in module "network_node":
│   56:   aws_sg_sli_ids                     = local.is_multi_nic ? length(var.aws_existing_sg_sli_ids > 0) ? var.aws_existing_sg_sli_ids : module.network_common.common["sg_sli_ids"] : []
│     ├────────────────
│     │ var.aws_existing_sg_sli_ids is empty list of string
│ 
│ Unsuitable value for left operand: number required.
╵