A-Team-Security-Infra-Agent-Engineer/deploy/terraform-oke/network.tf

# -----------------------------------------------------------------------------
# OCI CIS Agent — OKE Deployment Stack
# Networking: VCN, Gateways, Subnets, Route Tables, Security Lists
# -----------------------------------------------------------------------------

# --- VCN ---
resource "oci_core_vcn" "main" {
  compartment_id = var.compartment_ocid
  cidr_blocks    = [var.vcn_cidr]
  display_name   = "cisagent-oke-vcn"
  dns_label      = "cisagentoke"
  freeform_tags  = var.freeform_tags
}

# --- Gateways ---
resource "oci_core_internet_gateway" "main" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-igw"
  enabled        = true
  freeform_tags  = var.freeform_tags
}

resource "oci_core_nat_gateway" "main" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-natgw"
  freeform_tags  = var.freeform_tags
}

data "oci_core_services" "all" {
  filter {
    name   = "name"
    values = ["All .* Services In Oracle Services Network"]
    regex  = true
  }
}

resource "oci_core_service_gateway" "main" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-svcgw"

  services {
    service_id = data.oci_core_services.all.services[0].id
  }

  freeform_tags = var.freeform_tags
}

# --- Route Tables ---
resource "oci_core_route_table" "public" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-rt-public"

  route_rules {
    network_entity_id = oci_core_internet_gateway.main.id
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
  }

  freeform_tags = var.freeform_tags
}

resource "oci_core_route_table" "private" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-rt-private"

  route_rules {
    network_entity_id = oci_core_nat_gateway.main.id
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
  }

  route_rules {
    network_entity_id = oci_core_service_gateway.main.id
    destination       = data.oci_core_services.all.services[0].cidr_block
    destination_type  = "SERVICE_CIDR_BLOCK"
  }

  freeform_tags = var.freeform_tags
}

# --- Security Lists ---

# Public subnet: LB ingress on 80/443, egress all
resource "oci_core_security_list" "public" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-sl-public"

  ingress_security_rules {
    protocol  = "6" # TCP
    source    = "0.0.0.0/0"
    stateless = false
    tcp_options {
      min = 80
      max = 80
    }
  }

  ingress_security_rules {
    protocol  = "6"
    source    = "0.0.0.0/0"
    stateless = false
    tcp_options {
      min = 443
      max = 443
    }
  }

  egress_security_rules {
    protocol    = "all"
    destination = "0.0.0.0/0"
    stateless   = false
  }

  freeform_tags = var.freeform_tags
}

# Nodes subnet: pod-to-pod, kubelet, NodePort, SSH
resource "oci_core_security_list" "nodes" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-sl-nodes"

  # Pod-to-pod communication (all traffic within nodes subnet)
  ingress_security_rules {
    protocol  = "all"
    source    = var.nodes_subnet_cidr
    stateless = false
  }

  # Kubelet API from API endpoint subnet
  ingress_security_rules {
    protocol  = "6"
    source    = var.api_subnet_cidr
    stateless = false
    tcp_options {
      min = 10250
      max = 10250
    }
  }

  # NodePort range from public subnet (LB health checks + traffic)
  ingress_security_rules {
    protocol  = "6"
    source    = var.public_subnet_cidr
    stateless = false
    tcp_options {
      min = 30000
      max = 32767
    }
  }

  # SSH from VCN (for debugging)
  ingress_security_rules {
    protocol  = "6"
    source    = var.vcn_cidr
    stateless = false
    tcp_options {
      min = 22
      max = 22
    }
  }

  # ICMP Path Discovery
  ingress_security_rules {
    protocol  = "1" # ICMP
    source    = var.vcn_cidr
    stateless = false
    icmp_options {
      type = 3
      code = 4
    }
  }

  egress_security_rules {
    protocol    = "all"
    destination = "0.0.0.0/0"
    stateless   = false
  }

  freeform_tags = var.freeform_tags
}

# API endpoint subnet: Kubernetes API access
resource "oci_core_security_list" "api_endpoint" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.main.id
  display_name   = "cisagent-oke-sl-api"

  # Kubernetes API from worker nodes
  ingress_security_rules {
    protocol  = "6"
    source    = var.nodes_subnet_cidr
    stateless = false
    tcp_options {
      min = 6443
      max = 6443
    }
  }

  # Kubernetes API from VCN (kubectl access via bastion / VPN)
  ingress_security_rules {
    protocol  = "6"
    source    = var.vcn_cidr
    stateless = false
    tcp_options {
      min = 6443
      max = 6443
    }
  }

  # Kubernetes API from worker nodes (12250 for OKE control plane)
  ingress_security_rules {
    protocol  = "6"
    source    = var.nodes_subnet_cidr
    stateless = false
    tcp_options {
      min = 12250
      max = 12250
    }
  }

  # ICMP Path Discovery
  ingress_security_rules {
    protocol  = "1"
    source    = var.vcn_cidr
    stateless = false
    icmp_options {
      type = 3
      code = 4
    }
  }

  egress_security_rules {
    protocol    = "all"
    destination = "0.0.0.0/0"
    stateless   = false
  }

  freeform_tags = var.freeform_tags
}

# --- Subnets ---

# Public subnet: Load Balancer
resource "oci_core_subnet" "public" {
  compartment_id             = var.compartment_ocid
  vcn_id                     = oci_core_vcn.main.id
  cidr_block                 = var.public_subnet_cidr
  display_name               = "cisagent-oke-subnet-public"
  dns_label                  = "publb"
  prohibit_public_ip_on_vnic = false
  route_table_id             = oci_core_route_table.public.id
  security_list_ids          = [oci_core_security_list.public.id]
  freeform_tags              = var.freeform_tags
}

# Private subnet: OKE worker nodes
resource "oci_core_subnet" "nodes" {
  compartment_id             = var.compartment_ocid
  vcn_id                     = oci_core_vcn.main.id
  cidr_block                 = var.nodes_subnet_cidr
  display_name               = "cisagent-oke-subnet-nodes"
  dns_label                  = "nodes"
  prohibit_public_ip_on_vnic = true
  route_table_id             = oci_core_route_table.private.id
  security_list_ids          = [oci_core_security_list.nodes.id]
  freeform_tags              = var.freeform_tags
}

# Private subnet: OKE API endpoint
resource "oci_core_subnet" "api_endpoint" {
  compartment_id             = var.compartment_ocid
  vcn_id                     = oci_core_vcn.main.id
  cidr_block                 = var.api_subnet_cidr
  display_name               = "cisagent-oke-subnet-api"
  dns_label                  = "api"
  prohibit_public_ip_on_vnic = true
  route_table_id             = oci_core_route_table.private.id
  security_list_ids          = [oci_core_security_list.api_endpoint.id]
  freeform_tags              = var.freeform_tags
}