-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
✨ feat(securitygroups.ports.tf): added ports file for additional sg
- Loading branch information
Showing
3 changed files
with
173 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,166 @@ | ||
| # See | ||
| # https://stackoverflow.com/questions/71902887/transport-error-while-dialing-dial-tcp-xx-xx-xx-xx15012-i-o-timeout-with-aws-e | ||
| # Ports needed to correctly install Istio for the error message: transport: Error while dialing dial tcp xx.xx.xx.xx15012: i/o timeout | ||
| # other ports here as needed | ||
| locals { | ||
| sg_additional_ports = [ | ||
| { | ||
| component = "istio" | ||
| description = "Envoy admin port / outbound" | ||
| from_port = 15000 | ||
| to_port = 15001 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Debug port" | ||
| from_port = 15004 | ||
| to_port = 15004 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Envoy inbound" | ||
| from_port = 15006 | ||
| to_port = 15006 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "HBONE mTLS tunnel port / secure networks XDS and CA services (Plaintext)" | ||
| from_port = 15008 | ||
| to_port = 15010 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "XDS and CA services (TLS and mTLS)" | ||
| from_port = 15012 | ||
| to_port = 15012 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Control plane monitoring" | ||
| from_port = 15014 | ||
| to_port = 15014 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Webhook container port, forwarded from 443" | ||
| from_port = 15017 | ||
| to_port = 15017 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Merged Prometheus telemetry from Istio agent, Envoy, and application, Health checks" | ||
| from_port = 15020 | ||
| to_port = 15021 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "DNS port" | ||
| from_port = 15053 | ||
| to_port = 15053 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Envoy Prometheus telemetry" | ||
| from_port = 15090 | ||
| to_port = 15090 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "aws-load-balancer-controller" | ||
| from_port = 9443 | ||
| to_port = 9443 | ||
| }, | ||
| { | ||
| component = "cert-manager" | ||
| description = "cert-manager-webhook" | ||
| from_port = 10250 | ||
| to_port = 10250 | ||
| } | ||
| ] | ||
|
|
||
| sg_additional_ports_2 = [ | ||
| { | ||
| component = "istio" | ||
| description = "XDS and CA services (TLS and mTLS)" | ||
| from_port = 15012 | ||
| to_port = 15012 | ||
| }, | ||
| { | ||
| component = "istio" | ||
| description = "Webhook container port, forwarded from 443" | ||
| from_port = 15017 | ||
| to_port = 15017 | ||
| } | ||
| ] | ||
|
|
||
| sg_additional_ingress_rules = { | ||
| for ikey, ivalue in local.sg_additional_ports : | ||
| "${ikey}_ingress" => { | ||
| description = ivalue.description | ||
| protocol = "tcp" | ||
| from_port = ivalue.from_port | ||
| to_port = ivalue.to_port | ||
| type = "ingress" | ||
| self = true | ||
| } | ||
| } | ||
|
|
||
| sg_additional_egress_rules = { | ||
| for ekey, evalue in local.sg_additional_ports : | ||
| "${ekey}_egress" => { | ||
| description = evalue.description | ||
| protocol = "tcp" | ||
| from_port = evalue.from_port | ||
| to_port = evalue.to_port | ||
| type = "egress" | ||
| self = true | ||
| } | ||
| } | ||
|
|
||
| sg_additional_ingress_rules_2 = { | ||
| for ikey, ivalue in local.sg_additional_ports_2 : | ||
| "${ikey}_ingress" => { | ||
| description = ivalue.description | ||
| protocol = "tcp" | ||
| from_port = ivalue.from_port | ||
| to_port = ivalue.to_port | ||
| type = "ingress" | ||
| self = true | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource "aws_vpc_security_group_ingress_rule" "additional" { | ||
| for_each = { for k, v in local.sg_additional_ingress_rules : v.from_port => v } | ||
| security_group_id = aws_security_group.additional_eks_cluster_sg.id | ||
|
|
||
| description = each.value.description | ||
| from_port = each.value.from_port | ||
| to_port = each.value.to_port | ||
| ip_protocol = each.value.protocol | ||
| referenced_security_group_id = each.value.self ? aws_security_group.additional_eks_cluster_sg.id : null | ||
| # referenced_security_group_id = aws_security_group.all_worker_mgmt.id | ||
| } | ||
|
|
||
| resource "aws_vpc_security_group_egress_rule" "additional" { | ||
| for_each = { for k, v in local.sg_additional_egress_rules : v.from_port => v } | ||
| security_group_id = aws_security_group.additional_eks_cluster_sg.id | ||
|
|
||
| description = each.value.description | ||
| from_port = each.value.from_port | ||
| to_port = each.value.to_port | ||
| ip_protocol = each.value.protocol | ||
| referenced_security_group_id = each.value.self ? aws_security_group.additional_eks_cluster_sg.id : null | ||
| # referenced_security_group_id = aws_security_group.all_worker_mgmt.id | ||
| } | ||
|
|
||
| resource "aws_vpc_security_group_ingress_rule" "additional_ingress_rules_2" { | ||
| for_each = { for k, v in local.sg_additional_ingress_rules_2 : v.from_port => v } | ||
| security_group_id = aws_security_group.extra_cluster_sg.id | ||
|
|
||
| description = each.value.description | ||
| from_port = each.value.from_port | ||
| to_port = each.value.to_port | ||
| ip_protocol = each.value.protocol | ||
| referenced_security_group_id = aws_security_group.additional_eks_cluster_sg.id | ||
| } |