Skip to content

Commit f3fe628

Browse files
nirajdp76nirajdp76
committed
feat: E2E PoC Readiness
1 parent 059b04a commit f3fe628

12 files changed

+643
-163
lines changed

‎README.md

+29-16
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,23 @@
1-
# Virtual Server for Virtual Private Cloud using Custom Image
1+
# F5-BIGIP Virtual Server for Virtual Private Cloud using Custom Image
22

3-
With this template, you can use IBM Cloud Schematics to create F5-BIGIP virtual server using custom image from you IBM Cloud account. Schematics uses [Terraform](https://www.terraform.io/) as the infrastructure-as-code engine. With this template, you can create and manage infrastructure as a single unit as follows. For more information about how to use this template, see the [IBM Cloud Schematics documentation](https://cloud.ibm.com/docs/schematics).
3+
With this template, you can use IBM Cloud Schematics to create F5-BIGIP virtual server using custom image from your IBM Cloud account. Schematics uses [Terraform](https://www.terraform.io/) as the infrastructure-as-code engine. With this template, you can create and manage infrastructure as a single unit as follows. For more information about how to use this template, see the [IBM Cloud Schematics documentation](https://cloud.ibm.com/docs/schematics).
44

55
**Included**:
6-
* 1 [virtual private cloud](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-started) instance, in specified zone.
7-
* 1 [VPC virtual servers using bring your own custom F5-BigIP image](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-getting-started) instances per zone.
6+
* 1. (1) Public-Gateway for given VPC
7+
* 2. (1) Subnet that will be used by F5-BIGIP VSI and attach the public-gateway
8+
* 3. (1) Security-Group with rules to allow access to F5-BIGIP admin portal
9+
* 4. (1) Custom Image using provided F5-BIGIP qcow2
10+
* 5. (1) F5-BIGIP VSI and attach security-group rules
11+
* 6. (1) FIP and attach to primary network interface of F5-BIGIP VSI
12+
* 7. (2) Backend VSI with nginx and customized welcome page (Demo purpose only)
813

914
**Not included**:
1015
* This is a poc work.
11-
* [Bring your F5 Custom Image](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-images#custom-images)
16+
17+
**Must have IBM IS Terraform Provider fixes**:
18+
* Provide `data source for ibm_login_target` that would provide some key information from provider session (example: account-id)
19+
* Provide `resource for ibm_is_image` - IS Image create, update, delete
20+
* Catalog offering Deployment variable must provide way to mark some variable sensitive (example: vendor svc account apikey)
1221

1322
## Costs
1423

@@ -24,12 +33,7 @@ Before you can apply the template in IBM Cloud, complete the following steps.
2433
1. Make sure that you have the following permissions in IBM Cloud Identity and Access Management:
2534
* **Manager** service access role for IBM Cloud Schematics
2635
* **Operator** platform role for VPC Infrastructure
27-
2. Download the [`ibmcloud` command line interface (CLI) tool](https://cloud.ibm.com/docs/cli/reference/ibmcloud?topic=cloud-cli-install-ibmcloud-cli).
28-
3. Install the `ibmcloud terraform` and `ibmcloud is` CLI plug-ins for Schematics and VPC infrastructure. **Tip**: To update your current plug-ins, run `ibmcloud plugin update`.
29-
* `ibmcloud plugin install schematics`
30-
* `ibmcloud plugin install vpc-infrastructure`
31-
4. [Create or use an existing SSH key for VPC virtual servers](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-ssh-keys).
32-
5. [Bring your F5 Custom Image](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-images#custom-images)
36+
2. Ensure given VPC and SSHKey already exists in your account.
3337

3438
## Configuring your deployment values
3539

@@ -41,21 +45,30 @@ Fill in the following values, based on the steps that you completed before you b
4145
|Variable Name|Description|
4246
|-------------|-----------|
4347
|`ssh_public_key`|Enter the [public SSH key](https://cloud.ibm.com/docs/vpc-on-classic-vsi?topic=vpc-on-classic-vsi-ssh-keys) that you use to access your VPC virtual servers. Use the public key from the `~/.ssh/id_rsa.pub` file generated by the latest version of ssh-keygen tool, with the recommended key-size 2048.|
44-
|`f5_image`|The ID of the F5 custom image provisioned in your IBM Cloud account. To list available images, run `ibmcloud is images`. The default image is for an `f5-bigip` image in a demo account.|
4548

4649
### Optional values
4750
Before you apply your template, you can customize the following default variable values.
4851

4952
|Variable Name|Description|Default Value|
5053
|-------------|-----------|-------------|
54+
|`ibmcloud_api_key`|[Temp hack] to workaround IBM IS Provider (Image Create) gap. The APIKey of the IBM Cloud account where resources will be provisioned.|`None`|
55+
|`ibmcloud_vnf_svc_api_key`|The APIKey of the IBM Cloud NFV service account that is hosting the F5-BIGIP qcow2 image file.|`None`|
5156
|`generation`|The VPC Generation to target. Valid values are 2 or 1..|`2`|
5257
|`region`|The VPC Region that you want your VPC to be provisioned. To list available zones, run `ibmcloud is regions`.|`us-south`|
5358
|`zone`|The VPC Zone that you want your VPC virtual servers to be provisioned. To list available zones, run `ibmcloud is zones`.|`us-south-1`|
54-
|`vpc_name`|The name of your VPC to be provisioned.|`f5-bigip-1nic-demo-vpc`|
55-
|`ssh_key_name`|The name of your public SSH key.|`f5-ssh-pub-ke`|
56-
|`f5_vsi_name`|The name of your F5 Virtual Server to be provisioned.|`f5-bigip-1nic-demo-appliance`|
57-
|`profile`|Enter the profile of compute CPU and memory resources that you want your VPC virtual servers to have. To list available profiles, run `ibmcloud is instance-profiles`.|`bx2-2x8`|
59+
|`resource_group`|The resource group to use. If unspecified, the account's default resource group is used. To list available resource groups, run `ibmcloud resource groups`.|`Default`|
60+
|`vpc_name`|The name of your VPC in which F5-BIGIP VSI is to be provisioned.|`None`|
61+
|`ssh_key_name`|The name of your public SSH key to be used for F5-BIGIP VSI.|`None`|
62+
|`f5_image_name`|The name of the F5 custom image to be provisioned in your IBM Cloud account.|`f5-bigip-15-0-1-0-0-11`|
63+
|`f5_vsi_name`|The name of your F5 Virtual Server to be provisioned.|`f5-1arm-vsi`|
64+
|`f5_profile`|Enter the profile of compute CPU and memory resources that you want your F5-BIGIP virtual servers to have. To list available profiles, run `ibmcloud is instance-profiles`.|`bx2-2x8`|
5865
|`f5_license`|Optional: The BYOL license key that you want your F5 virtual server in a VPC to be used by registration flow during cloud-init.|`None`|
66+
|`vnf_f5bigip_cos_instance_id`|Hidden: The COS instance-id hosting the F5-BIGIP qcow2 image.|`NA`|
67+
|`vnf_f5bigip_cos_image_url`|The COS image object url for F5-BIGIP qcow2 image.|`NA`|
5968

6069
## Outputs
6170
After you apply the template your VPC resources are successfully provisioned in IBM Cloud, you can review information such as the virtual server IP addresses and VPC identifiers in the Schematics log files, in the `Terraform SHOW` section.
71+
72+
|Variable Name|Description|Default Value|
73+
|-------------|-----------|-------------|
74+
|f5_admin_portal|Web url to interact with F5-BIGIP admin portal.|`None`|

‎backends.tf

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
##############################################################################
2+
# This file creates two compute instances that will be used by PoC to setup
3+
# F5-BIGIP loadbalancer. Each of the backend server will be enabled with nginx
4+
# and a customize welcome page via cloud-init.
5+
# - Two Virtual Server using ubuntu-18-04-amd64
6+
##############################################################################
7+
8+
data "template_file" "welcom_page" {
9+
template = "${file("${path.module}/templates/index.nginx-debian.html.tpl")}"
10+
vars = {
11+
server_marker = "One"
12+
}
13+
}
14+
15+
##############################################################################
16+
# Read Public Image using the image name and visibility
17+
##############################################################################
18+
data "ibm_is_image" "ubuntu_18_image" {
19+
name = "ibm-ubuntu-18-04-64"
20+
visibility = "public"
21+
}
22+
23+
resource "ibm_is_instance" "backend_vsi" {
24+
count = 2
25+
name = "backend-vsi-0${count.index}"
26+
image = "${data.ibm_is_image.ubuntu_18_image.id}"
27+
profile = "cx2-2x4"
28+
29+
primary_network_interface = {
30+
subnet = "${ibm_is_subnet.f5_subnet1.id}"
31+
}
32+
33+
vpc = "${data.ibm_is_vpc.f5_vpc.id}"
34+
zone = "${data.ibm_is_zone.zone.name}"
35+
keys = ["${data.ibm_is_ssh_key.f5_ssh_pub_key.id}"]
36+
user_data = <<EOF
37+
#!/bin/bash -v
38+
apt-get update -y
39+
apt-get install -y nginx > /tmp/nginx.log
40+
echo "${base64encode(data.template_file.welcom_page.rendered)}" | base64 -d | sed 's/SERVER_MARKER/${count.index}/g' > /var/www/html/index.nginx-debian.html
41+
service nginx start
42+
EOF
43+
44+
//User can configure timeouts
45+
timeouts {
46+
create = "10m"
47+
delete = "10m"
48+
}
49+
}

‎compute.tf

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
##############################################################################
2+
# This file creates the compute instances for the solution.
3+
# - Virtual Server using F5-BIGIP custom image
4+
# - Two virtual servers initialized with nginx to demo Load Balancing using F5-BIGIP
5+
##############################################################################
6+
7+
##############################################################################
8+
# Read/validate sshkey
9+
##############################################################################
10+
data "ibm_is_ssh_key" "f5_ssh_pub_key" {
11+
name = "${var.ssh_key_name}"
12+
}
13+
14+
##############################################################################
15+
# Read/validate vsi profile
16+
##############################################################################
17+
data "ibm_is_instance_profile" "f5_profile" {
18+
name = "${var.f5_profile}"
19+
}
20+
21+
##############################################################################
22+
# Create F5-BIGIP virtual server.
23+
##############################################################################
24+
resource "ibm_is_instance" "f5_vsi" {
25+
name = "${var.f5_vsi_name}"
26+
image = "${data.ibm_is_image.f5_custom_image.id}"
27+
profile = "${data.ibm_is_instance_profile.f5_profile.name}"
28+
29+
primary_network_interface = {
30+
subnet = "${ibm_is_subnet.f5_subnet1.id}"
31+
}
32+
33+
vpc = "${data.ibm_is_vpc.f5_vpc.id}"
34+
zone = "${data.ibm_is_zone.zone.name}"
35+
keys = ["${data.ibm_is_ssh_key.f5_ssh_pub_key.id}"]
36+
# user_data = "$(replace(file("f5-userdata.sh"), "F5-LICENSE-REPLACEMENT", var.f5_license)"
37+
38+
//User can configure timeouts
39+
timeouts {
40+
create = "10m"
41+
delete = "10m"
42+
}
43+
44+
# Hack to handle some race condition; will remove it once have root caused the issues.
45+
provisioner "local-exec" {
46+
command = "sleep 30"
47+
}
48+
}

‎image.tf

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
##############################################################################
2+
# This file creates custom image using F5-BIGIP qcow2 image hosted in vnfsvc COS
3+
# - Creates IAM Authorization Policy in vnfsvc account
4+
# - Creates Custom Image in User account
5+
#
6+
# Note: There are following gaps in ibm is provider and thus using Terraform tricks
7+
# to overcome the gaps for the PoC sake.
8+
# Gap1: IBM IS Provider missing resource implementation for is_image (Create, update, delete)
9+
# Gap2: IBM IS provider missing data source to read logged user provider session info
10+
# example: account-id
11+
##############################################################################
12+
13+
# =============================================================================
14+
# Hack: parse out the user account from the vpc resource crn
15+
# Fix: Get data_source_ibm_iam_target added that would provide information
16+
# about user from provider session
17+
# =============================================================================
18+
locals {
19+
user_acct_id = "${substr(element(split("a/", data.ibm_is_vpc.f5_vpc.resource_crn), 1),0,32)}"
20+
}
21+
22+
##############################################################################
23+
# Create IAM Authorization Policy for user to able to create custom image
24+
# pointing to COS object url hosted in vnfsvc account.
25+
##############################################################################
26+
resource "ibm_iam_authorization_policy" "authorize_image" {
27+
depends_on = ["data.ibm_is_vpc.f5_vpc"]
28+
provider = "ibm.vfnsvc"
29+
source_service_account = "${local.user_acct_id}"
30+
source_service_name = "is"
31+
source_resource_type = "image"
32+
target_service_name = "cloud-object-storage"
33+
target_resource_type = "bucket"
34+
roles = ["Reader"]
35+
target_resource_instance_id = "${var.vnf_f5bigip_cos_instance_id}"
36+
}
37+
38+
##############################################################################
39+
# Read Custom Image using the image name and visibility
40+
##############################################################################
41+
data "ibm_is_image" "f5_custom_image" {
42+
depends_on = ["data.external.create_image_hack"]
43+
name = "${var.f5_image_name}"
44+
visibility = "private"
45+
}
46+
47+
##############################################################################
48+
# Create Custom Image
49+
# Hack: Given ibm provider is missing ibm_is_image resource we using
50+
# external data provider tricks and provisining the resource using bash script.
51+
##############################################################################
52+
data "external" "create_image_hack" {
53+
depends_on = ["ibm_iam_authorization_policy.authorize_image"]
54+
program = ["bash", "${path.module}/scripts/create-image-hack.sh"]
55+
56+
query = {
57+
ibmcloud_endpoint = "${var.ibmcloud_endpoint}"
58+
ibmcloud_api_key = "${var.ibmcloud_api_key}"
59+
generation = "${var.generation}"
60+
region = "${data.ibm_is_region.region.name}"
61+
resource_group_id = "${data.ibm_resource_group.rg.id}"
62+
f5_image_name = "${var.f5_image_name}"
63+
vnf_f5bigip_cos_image_url = "${var.vnf_f5bigip_cos_image_url}"
64+
}
65+
}
66+
67+
# resource "null_resource" "null_custom_image" {
68+
# # provisioner "local-exec" {
69+
# # command = "${path.module}/scripts/create-image-hack.sh"
70+
# # environment = {
71+
# # ibmcloud_api_key = "${var.ibmcloud_api_key}"
72+
# # generation = "${var.generation}"
73+
# # region = "${var.region}"
74+
# # resource_group_id = "${data.ibm_resource_group.rg.id}"
75+
# # f5_image_name = "${var.f5_image_name}"
76+
# # vnf_f5bigip_cos_image_url = "${var.vnf_f5bigip_cos_image_url}"
77+
# # }
78+
# # }
79+
# # provisioner "local-exec" {
80+
# # when = "destroy"
81+
# # command = <<EOT
82+
# # ibmcloud plugin install vpc-infrastructure -f
83+
# # ibmcloud login --apikey ${var.ibmcloud_api_key} -r "${var.region}" -g "${var.resource_group}"
84+
# # ibmcloud is target --gen ${var.generation}
85+
# # ibmcloud is image-delete "${data.external.create_image_hack.result.id}" -f
86+
# # EOT
87+
# # }
88+
# }

0 commit comments

Comments
 (0)