109 lines
2.9 KiB
Terraform
109 lines
2.9 KiB
Terraform
# Copyright IBM Corp. 2020, 2026
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
locals {
|
|
stack = {
|
|
"4" = "ipv4",
|
|
"dual" = "dualstack",
|
|
"6" = "dualstack-without-public-ipv4",
|
|
}
|
|
}
|
|
|
|
resource "aws_alb" "boundary_alb" {
|
|
name = "boundary-alb-${random_string.cluster_id.result}"
|
|
depends_on = [aws_instance.controller]
|
|
security_groups = [aws_security_group.boundary_alb_sg.id]
|
|
subnets = data.aws_subnets.infra.ids
|
|
|
|
ip_address_type = lookup(local.stack, var.ip_version, local.stack["4"])
|
|
|
|
tags = merge(local.common_tags,
|
|
{
|
|
Name = "boundary-alb-${random_string.cluster_id.result}"
|
|
}
|
|
)
|
|
}
|
|
|
|
resource "tls_private_key" "private_key" {
|
|
depends_on = [aws_alb.boundary_alb]
|
|
count = var.protocol == "https" ? 1 : 0
|
|
|
|
algorithm = "RSA"
|
|
rsa_bits = 2048
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "certificate" {
|
|
depends_on = [aws_alb.boundary_alb]
|
|
count = var.protocol == "https" ? 1 : 0
|
|
|
|
private_key_pem = tls_private_key.private_key[0].private_key_pem
|
|
|
|
subject {
|
|
common_name = aws_alb.boundary_alb.dns_name
|
|
}
|
|
|
|
dns_names = [aws_alb.boundary_alb.dns_name]
|
|
|
|
validity_period_hours = 8760
|
|
|
|
allowed_uses = [
|
|
"key_encipherment",
|
|
"digital_signature",
|
|
"server_auth",
|
|
]
|
|
}
|
|
|
|
resource "aws_acm_certificate" "cert" {
|
|
depends_on = [aws_alb.boundary_alb]
|
|
count = var.protocol == "https" ? 1 : 0
|
|
|
|
private_key = tls_private_key.private_key[0].private_key_pem
|
|
certificate_body = tls_self_signed_cert.certificate[0].cert_pem
|
|
}
|
|
|
|
resource "aws_alb_target_group" "boundary_tg" {
|
|
depends_on = [aws_acm_certificate.cert]
|
|
name = "boundary-tg-${random_string.cluster_id.result}"
|
|
protocol = "HTTP"
|
|
port = var.listener_api_port
|
|
vpc_id = var.vpc_id
|
|
ip_address_type = var.ip_version == "6" ? "ipv6" : "ipv4"
|
|
|
|
health_check {
|
|
path = var.healthcheck_path
|
|
port = var.listener_ops_port
|
|
interval = 5
|
|
timeout = 2
|
|
healthy_threshold = 2
|
|
}
|
|
|
|
tags = merge(local.common_tags,
|
|
{
|
|
Name = "boundary-tg-${random_string.cluster_id.result}"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource "aws_lb_target_group_attachment" "boundary" {
|
|
for_each = toset([for idx in range(var.controller_count) : tostring(idx)])
|
|
|
|
target_group_arn = aws_alb_target_group.boundary_tg.arn
|
|
target_id = aws_instance.controller[each.value].id
|
|
port = var.listener_api_port
|
|
}
|
|
|
|
resource "aws_alb_listener" "boundary" {
|
|
load_balancer_arn = aws_alb.boundary_alb.arn
|
|
port = var.alb_listener_api_port
|
|
protocol = var.protocol == "https" ? "HTTPS" : "HTTP"
|
|
|
|
# These MUST be null if protocol is HTTP
|
|
ssl_policy = var.protocol == "https" ? "ELBSecurityPolicy-2016-08" : null
|
|
certificate_arn = var.protocol == "https" ? aws_acm_certificate.cert[0].arn : null
|
|
|
|
default_action {
|
|
target_group_arn = aws_alb_target_group.boundary_tg.arn
|
|
type = "forward"
|
|
}
|
|
}
|