feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests
- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL - terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL - k8s/: namespace, deployments, services, PVC, secrets, configmap - Dockerfile.frontend: self-contained nginx+dist image - push-images.sh: multi-arch build (amd64+arm64) + push to OCIR - dns.tf: conditional OCI DNS Zone + A record (when domain available) - Both stacks 100% independent, no shared modules - .gitignore: terraform state, .terraform/, *.tfvars
This commit is contained in:
nogueiraguh
287
deploy/terraform-oke/network.tf
Normal file
287
deploy/terraform-oke/network.tf
Normal file
@@ -0,0 +1,287 @@
|
||||
# -----------------------------------------------------------------------------
|
||||
# OCI CIS Agent — OKE Deployment Stack
|
||||
# Networking: VCN, Gateways, Subnets, Route Tables, Security Lists
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
# --- VCN ---
|
||||
resource "oci_core_vcn" "main" {
|
||||
compartment_id = var.compartment_ocid
|
||||
cidr_blocks = [var.vcn_cidr]
|
||||
display_name = "cisagent-oke-vcn"
|
||||
dns_label = "cisagentoke"
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# --- Gateways ---
|
||||
resource "oci_core_internet_gateway" "main" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-igw"
|
||||
enabled = true
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
resource "oci_core_nat_gateway" "main" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-natgw"
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
data "oci_core_services" "all" {
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["All .* Services In Oracle Services Network"]
|
||||
regex = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_service_gateway" "main" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-svcgw"
|
||||
|
||||
services {
|
||||
service_id = data.oci_core_services.all.services[0].id
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# --- Route Tables ---
|
||||
resource "oci_core_route_table" "public" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-rt-public"
|
||||
|
||||
route_rules {
|
||||
network_entity_id = oci_core_internet_gateway.main.id
|
||||
destination = "0.0.0.0/0"
|
||||
destination_type = "CIDR_BLOCK"
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
resource "oci_core_route_table" "private" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-rt-private"
|
||||
|
||||
route_rules {
|
||||
network_entity_id = oci_core_nat_gateway.main.id
|
||||
destination = "0.0.0.0/0"
|
||||
destination_type = "CIDR_BLOCK"
|
||||
}
|
||||
|
||||
route_rules {
|
||||
network_entity_id = oci_core_service_gateway.main.id
|
||||
destination = data.oci_core_services.all.services[0].cidr_block
|
||||
destination_type = "SERVICE_CIDR_BLOCK"
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# --- Security Lists ---
|
||||
|
||||
# Public subnet: LB ingress on 80/443, egress all
|
||||
resource "oci_core_security_list" "public" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-sl-public"
|
||||
|
||||
ingress_security_rules {
|
||||
protocol = "6" # TCP
|
||||
source = "0.0.0.0/0"
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 80
|
||||
max = 80
|
||||
}
|
||||
}
|
||||
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = "0.0.0.0/0"
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 443
|
||||
max = 443
|
||||
}
|
||||
}
|
||||
|
||||
egress_security_rules {
|
||||
protocol = "all"
|
||||
destination = "0.0.0.0/0"
|
||||
stateless = false
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# Nodes subnet: pod-to-pod, kubelet, NodePort, SSH
|
||||
resource "oci_core_security_list" "nodes" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-sl-nodes"
|
||||
|
||||
# Pod-to-pod communication (all traffic within nodes subnet)
|
||||
ingress_security_rules {
|
||||
protocol = "all"
|
||||
source = var.nodes_subnet_cidr
|
||||
stateless = false
|
||||
}
|
||||
|
||||
# Kubelet API from API endpoint subnet
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.api_subnet_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 10250
|
||||
max = 10250
|
||||
}
|
||||
}
|
||||
|
||||
# NodePort range from public subnet (LB health checks + traffic)
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.public_subnet_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 30000
|
||||
max = 32767
|
||||
}
|
||||
}
|
||||
|
||||
# SSH from VCN (for debugging)
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.vcn_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 22
|
||||
max = 22
|
||||
}
|
||||
}
|
||||
|
||||
# ICMP Path Discovery
|
||||
ingress_security_rules {
|
||||
protocol = "1" # ICMP
|
||||
source = var.vcn_cidr
|
||||
stateless = false
|
||||
icmp_options {
|
||||
type = 3
|
||||
code = 4
|
||||
}
|
||||
}
|
||||
|
||||
egress_security_rules {
|
||||
protocol = "all"
|
||||
destination = "0.0.0.0/0"
|
||||
stateless = false
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# API endpoint subnet: Kubernetes API access
|
||||
resource "oci_core_security_list" "api_endpoint" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
display_name = "cisagent-oke-sl-api"
|
||||
|
||||
# Kubernetes API from worker nodes
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.nodes_subnet_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 6443
|
||||
max = 6443
|
||||
}
|
||||
}
|
||||
|
||||
# Kubernetes API from VCN (kubectl access via bastion / VPN)
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.vcn_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 6443
|
||||
max = 6443
|
||||
}
|
||||
}
|
||||
|
||||
# Kubernetes API from worker nodes (12250 for OKE control plane)
|
||||
ingress_security_rules {
|
||||
protocol = "6"
|
||||
source = var.nodes_subnet_cidr
|
||||
stateless = false
|
||||
tcp_options {
|
||||
min = 12250
|
||||
max = 12250
|
||||
}
|
||||
}
|
||||
|
||||
# ICMP Path Discovery
|
||||
ingress_security_rules {
|
||||
protocol = "1"
|
||||
source = var.vcn_cidr
|
||||
stateless = false
|
||||
icmp_options {
|
||||
type = 3
|
||||
code = 4
|
||||
}
|
||||
}
|
||||
|
||||
egress_security_rules {
|
||||
protocol = "all"
|
||||
destination = "0.0.0.0/0"
|
||||
stateless = false
|
||||
}
|
||||
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# --- Subnets ---
|
||||
|
||||
# Public subnet: Load Balancer
|
||||
resource "oci_core_subnet" "public" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
cidr_block = var.public_subnet_cidr
|
||||
display_name = "cisagent-oke-subnet-public"
|
||||
dns_label = "publb"
|
||||
prohibit_public_ip_on_vnic = false
|
||||
route_table_id = oci_core_route_table.public.id
|
||||
security_list_ids = [oci_core_security_list.public.id]
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# Private subnet: OKE worker nodes
|
||||
resource "oci_core_subnet" "nodes" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
cidr_block = var.nodes_subnet_cidr
|
||||
display_name = "cisagent-oke-subnet-nodes"
|
||||
dns_label = "nodes"
|
||||
prohibit_public_ip_on_vnic = true
|
||||
route_table_id = oci_core_route_table.private.id
|
||||
security_list_ids = [oci_core_security_list.nodes.id]
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
|
||||
# Private subnet: OKE API endpoint
|
||||
resource "oci_core_subnet" "api_endpoint" {
|
||||
compartment_id = var.compartment_ocid
|
||||
vcn_id = oci_core_vcn.main.id
|
||||
cidr_block = var.api_subnet_cidr
|
||||
display_name = "cisagent-oke-subnet-api"
|
||||
dns_label = "api"
|
||||
prohibit_public_ip_on_vnic = true
|
||||
route_table_id = oci_core_route_table.private.id
|
||||
security_list_ids = [oci_core_security_list.api_endpoint.id]
|
||||
freeform_tags = var.freeform_tags
|
||||
}
|
||||
Reference in New Issue
Block a user