Skip to content

Commit 9315b09

Browse files
skommalaskommala
authored
Topic sk main 1 (#189)
- Updating image versions with autoscaling functions issues addressed - Remove requirement from network validation script for private load balancer to open to 0.0.0.0/0 CIDR.
1 parent c27ab4b commit 9315b09

File tree

11 files changed

+39
-30
lines changed

11 files changed

+39
-30
lines changed

‎terraform/images/mp_image_ee_byol.tfvars‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
tf_script_version = "23.1.3-230323195128"
55
use_marketplace_image = true
66
listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaawd5ti5ldjzdppppi675onvo3mvjcwt64jjey7rib3beau2ngkl2q"
7-
listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
8-
instance_image_id = "ocid1.image.oc1..aaaaaaaadgqvwsbfcm6bjaowtogdym4kv5gffi6rwv3d5po2o4vk2smwwcxa"
7+
listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
8+
instance_image_id = "ocid1.image.oc1..aaaaaaaaxtluh6hcu57iwdkq6eyycporj4fxttwrnevipybbl53h6xd2ysjq"
99

1010
ucm_listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaa653zc2e4fsem5hhwinmfgnv3xp4dmbq6c6gvf45okxf6xz3smhiq"
11-
ucm_listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
12-
ucm_instance_image_id = "ocid1.image.oc1..aaaaaaaagmy46blg6wrvwvozvnui25jxaus5jt6fquv2efkktcf2p6vnveiq"
11+
ucm_listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
12+
ucm_instance_image_id = "ocid1.image.oc1..aaaaaaaal7yykedaeoibixspndnemfynqzfmj5umooepdw6xnftdkyc3qu6q"

‎terraform/images/mp_image_ee_ucm.tfvars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@
44
tf_script_version = "23.1.3-230323195128"
55
use_marketplace_image = true
66
listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaa653zc2e4fsem5hhwinmfgnv3xp4dmbq6c6gvf45okxf6xz3smhiq"
7-
listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
8-
instance_image_id = "ocid1.image.oc1..aaaaaaaagmy46blg6wrvwvozvnui25jxaus5jt6fquv2efkktcf2p6vnveiq"
7+
listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
8+
instance_image_id = "ocid1.image.oc1..aaaaaaaal7yykedaeoibixspndnemfynqzfmj5umooepdw6xnftdkyc3qu6q"

‎terraform/images/mp_image_se_byol.tfvars‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Copyright (c) 2023, Oracle and/or its affiliates.
22
# Licensed under the Universal Permissive License v1.0 as shown at https://oss.oracle.com/licenses/upl.
33

4-
tf_script_version = "23.1.1-230118062825"
4+
tf_script_version = "23.1.3-230323195128"
55
use_marketplace_image = true
66
listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaaalcwal6mfwjbezzqyj3waoxrvigml4n3lcn3hfday3ozetjqn25a"
7-
listing_resource_version = "23.1.1-ol7.9-22.08.29-230118-1"
8-
instance_image_id = "ocid1.image.oc1..aaaaaaaa3wt3nt5w44bjllp3hjg37rxbtt34qijzzuv2v6youp3my2eadtha"
7+
listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
8+
instance_image_id = "ocid1.image.oc1..aaaaaaaahligehnfnp2xftozjwuhgfkpkadq6pushc2sb7nealnxzqo2zx7a"

‎terraform/images/mp_image_suite_byol.tfvars‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
tf_script_version = "23.1.3-230323195128"
55
use_marketplace_image = true
66
listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaajl5w3d76x5vdc4n7oqjpsxh4jtwivclvvp6gj4em3kufju6sftga"
7-
listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
8-
instance_image_id = "ocid1.image.oc1..aaaaaaaar3qjebqyaqpqwqzeg2mtf2gt4oosly23qaeb4k76fzhprnphnuxa"
7+
listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
8+
instance_image_id = "ocid1.image.oc1..aaaaaaaabmhlyilqghz5otg6w7nso3k3bhxwvy33nvfnlshkflxwa566jsua"
99

1010
ucm_listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaaq2vkow7zwkxg6ky4zxsnckdlfgtgmg7i4kkyev3y6zyo72mpkgza"
11-
ucm_listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
12-
ucm_instance_image_id = "ocid1.image.oc1..aaaaaaaaxrntnjc2btd7o3rig3wpqkyskair2iospvquto2ofjt2tmuuujya"
11+
ucm_listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
12+
ucm_instance_image_id = "ocid1.image.oc1..aaaaaaaata2m6fw5ox4xz3c4w7ujsobiaqyhtfcz67jlut33kgbxpk2mhejq"

‎terraform/images/mp_image_suite_ucm.tfvars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@
44
tf_script_version = "23.1.3-230323195128"
55
use_marketplace_image = true
66
listing_id = "ocid1.appcataloglisting.oc1..aaaaaaaaq2vkow7zwkxg6ky4zxsnckdlfgtgmg7i4kkyev3y6zyo72mpkgza"
7-
listing_resource_version = "23.1.3-ol7.9-22.08.29-230323-1"
8-
instance_image_id = "ocid1.image.oc1..aaaaaaaaxrntnjc2btd7o3rig3wpqkyskair2iospvquto2ofjt2tmuuujya"
7+
listing_resource_version = "23.1.3-ol7.9-22.08.29-230403-1"
8+
instance_image_id = "ocid1.image.oc1..aaaaaaaata2m6fw5ox4xz3c4w7ujsobiaqyhtfcz67jlut33kgbxpk2mhejq"

‎terraform/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ module "network-validation" {
2121
existing_lb_nsg_id = var.add_existing_nsg && var.add_load_balancer ? var.existing_lb_nsg_id : ""
2222
existing_mount_target_nsg_id = var.add_existing_nsg && var.add_fss ? var.existing_mount_target_nsg_id : ""
2323
existing_bastion_nsg_id = var.add_existing_nsg && var.is_bastion_instance_required ? var.existing_bastion_nsg_id : ""
24+
lb_source_cidr = var.add_load_balancer ? (var.is_lb_private ? "" : "0.0.0.0/0") : ""
2425
}
2526

2627
module "system-tags" {

‎terraform/modules/network-validator/locals.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
validation_script_bastion_ip_param = var.bastion_ip != "" ? format("--bastionip %s", var.bastion_ip) : ""
88
validation_script_lb_subnet_1_param = var.lb_subnet_1_id != "" ? format("--lbsubnet1 %s", var.lb_subnet_1_id) : ""
99
validation_script_lb_subnet_2_param = var.lb_subnet_2_id != "" ? format("--lbsubnet2 %s", var.lb_subnet_2_id) : ""
10+
validation_script_lb_source_cidr_param = var.lb_source_cidr != "" ? format("--lbsourcecidr %s", var.lb_source_cidr) : ""
1011
validation_script_wls_lb_port = var.wls_ms_extern_port != "" ? format("--externalport %s", var.wls_ms_extern_port) : ""
1112
validation_script_mount_target_subnet_param = var.mount_target_subnet_id != "" ? format("--fsssubnet %s", var.mount_target_subnet_id) : ""
1213
validation_script_atp_db_id_param = var.atp_db_id != "" ? format("--atpdbid %s", var.atp_db_id) : ""

‎terraform/modules/network-validator/scripts/network_validation.sh‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ LB_NSG_OCID=""
3737
FSS_NSG_OCID=""
3838
LPG_OCID=""
3939
ALL_IPS="0.0.0.0/0"
40+
LB_SOURCE_CIDR=""
4041
NETWORK_VALIDATION_MSG="Fix the network validation script errors and re-run the script in the cloud shell"
4142

4243
debug=false
@@ -240,6 +241,9 @@ function check_tcp_port_open_in_seclist_or_nsg() {
240241
else
241242
source_in_cidr_range=1
242243
fi
244+
elif [[ $source = "" ]]
245+
then
246+
source_in_cidr_range=0
243247
else
244248
source_in_cidr_range=$(in_cidr_range $ingress_source $source ; echo $?)
245249
fi
@@ -519,9 +523,10 @@ This script is used to validate existing subnets, and optionally network securit
519523
-g, --lpg OCID of the Local Peering Gateway (LPG) in the DB VCN
520524
-b, --bastionsubnet Bastion Subnet OCID
521525
-i, --bastionip Bastion Host IP. Provide this if using existing bastion
526+
-j, --lbsourcecidr Load Balance Source CIDR
522527
-u, --lbsubnet1 Load Balancer Subnet 1 OCID
523528
-v, --lbsubnet2 Load Balancer Subnet 2 OCID which is required only for AD subnet
524-
-l, --externalport WebLogic Managed Server External Port
529+
-l, --externalport WebLogic Managed Server External Port
525530
-f, --fsssubnet File Storage Service (FSS) Mount Target Subnet OCID
526531
-a, --adminsrvnsg OCID of the Network Security Group (NSG) for the administration server (Required if using NSGs instead of security lists)
527532
-m, --managedsrvnsg OCID of the Network Security Group (NSG) for the managed servers (Required if using NSGs instead of security lists)
@@ -587,6 +592,7 @@ while [[ $1 = -?* ]]; do
587592
-g|--lpg) shift; LPG_OCID=${1} ;;
588593
-b|--bastionsubnet) shift; BASTION_SUBNET_OCID=${1} ;;
589594
-i|--bastionip) shift; BASTION_HOST_IP=${1} ;;
595+
-j|--lbsourcecidr) shift; LB_SOURCE_CIDR=${1} ;;
590596
-u|--lbsubnet1) shift; LB_SUBNET_1_OCID=${1} ;;
591597
-v|--lbsubnet2) shift; LB_SUBNET_2_OCID=${1} ;;
592598
-l|--externalport) shift; WLS_LB_PORT=${1} ;;
@@ -963,20 +969,18 @@ if [[ -n ${LB_SUBNET_1_OCID} ]]
963969
then
964970
if [[ -z ${LB_NSG_OCID} ]]
965971
then
966-
res=$(validate_subnet_port_access "${LB_SUBNET_1_OCID}" ${LB_PORT} "${ALL_IPS}")
972+
res=$(validate_subnet_port_access "${LB_SUBNET_1_OCID}" ${LB_PORT} "${LB_SOURCE_CIDR}")
967973
if [[ $res -ne 0 ]]
968974
then
969-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in LB Subnet CIDR [${LB_SUBNET_1_OCID}]. ${NETWORK_VALIDATION_MSG}"
970-
validation_return_code=2
975+
echo "WARNING : Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in LB Subnet CIDR [${LB_SUBNET_1_OCID}]. ${NETWORK_VALIDATION_MSG}"
971976
fi
972977
else
973978
if [[ -n ${ADMIN_SRV_NSG_OCID} && -n ${MANAGED_SRV_NSG_OCID} ]]
974979
then
975-
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "$ALL_IPS" "nsg")
980+
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "${LB_SOURCE_CIDR}" "nsg")
976981
if [[ $res -ne 0 ]]
977982
then
978-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
979-
validation_return_code=2
983+
echo "WARNING : Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
980984
fi
981985
fi
982986
fi
@@ -1014,20 +1018,18 @@ if [[ -n ${LB_SUBNET_2_OCID} ]]
10141018
then
10151019
if [[ -z ${LB_NSG_OCID} ]]
10161020
then
1017-
res=$(validate_subnet_port_access "${LB_SUBNET_2_OCID}" ${LB_PORT} "${ALL_IPS}")
1021+
res=$(validate_subnet_port_access "${LB_SUBNET_2_OCID}" ${LB_PORT} "${LB_SOURCE_CIDR}")
10181022
if [[ $res -ne 0 ]]
10191023
then
1020-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in LB Subnet CIDR [${LB_SUBNET_2_OCID}]. ${NETWORK_VALIDATION_MSG}"
1021-
validation_return_code=2
1024+
echo "WARNING: Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in LB Subnet CIDR [${LB_SUBNET_2_OCID}]. ${NETWORK_VALIDATION_MSG}"
10221025
fi
10231026
else
10241027
if [[ -n ${ADMIN_SRV_NSG_OCID} && -n ${MANAGED_SRV_NSG_OCID} ]]
10251028
then
1026-
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "$ALL_IPS" "nsg")
1029+
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "${LB_SOURCE_CIDR}" "nsg")
10271030
if [[ $res -ne 0 ]]
10281031
then
1029-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
1030-
validation_return_code=2
1032+
echo "WARNING: Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
10311033
fi
10321034
fi
10331035
fi

‎terraform/modules/network-validator/validator.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
resource "null_resource" "validate_network" {
55
provisioner "local-exec" {
6-
command = "chmod +x ./scripts/network_validation.sh && ./scripts/network_validation.sh ${local.validation_script_wls_subnet_param} ${local.validation_script_bastion_subnet_param} ${local.validation_script_bastion_ip_param} ${local.validation_script_lb_subnet_1_param} ${local.validation_script_lb_subnet_2_param} ${local.validation_script_wls_lb_port} ${local.validation_script_mount_target_subnet_param} ${local.validation_script_atp_db_id_param} ${local.validation_script_oci_db_dbsystem_id_param} ${local.validation_script_oci_db_port_param} ${local.validation_script_http_port_param} ${local.validation_script_https_port_param} ${local.validation_script_existing_admin_server_nsg_id_param} ${local.validation_script_existing_managed_server_nsg_id_param} ${local.validation_script_existing_lb_nsg_id_param} ${local.validation_script_existing_mount_target_nsg_id_param} ${local.validation_script_existing_bastion_nsg_id_param}"
6+
command = "chmod +x ./scripts/network_validation.sh && ./scripts/network_validation.sh ${local.validation_script_wls_subnet_param} ${local.validation_script_bastion_subnet_param} ${local.validation_script_bastion_ip_param} ${local.validation_script_lb_subnet_1_param} ${local.validation_script_lb_subnet_2_param} ${local.validation_script_wls_lb_port} ${local.validation_script_lb_source_cidr_param} ${local.validation_script_mount_target_subnet_param} ${local.validation_script_atp_db_id_param} ${local.validation_script_oci_db_dbsystem_id_param} ${local.validation_script_oci_db_port_param} ${local.validation_script_http_port_param} ${local.validation_script_https_port_param} ${local.validation_script_existing_admin_server_nsg_id_param} ${local.validation_script_existing_managed_server_nsg_id_param} ${local.validation_script_existing_lb_nsg_id_param} ${local.validation_script_existing_mount_target_nsg_id_param} ${local.validation_script_existing_bastion_nsg_id_param}"
77
interpreter = ["/bin/bash", "-c"]
88
working_dir = path.module
99
}

‎terraform/modules/network-validator/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,8 @@ variable "existing_bastion_nsg_id" {
8585
type = string
8686
description = "The OCID of the pre-created NSG that should be attached to the bastion instance"
8787
}
88+
89+
variable "lb_source_cidr" {
90+
type = string
91+
description = "Set to empty value if loadbalancer is set to private"
92+
}

0 commit comments

Comments
 (0)