k3s-oci/security.tf at main · mbologna/k3s-oci · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# Security list for the public subnet (LBs + bastion)
resource "oci_core_security_list" "public" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.k3s.id
  display_name   = "${var.cluster_name}-public-sl"
  freeform_tags  = local.common_tags

  egress_security_rules {
    destination = "0.0.0.0/0"
    protocol    = "all"
    description = "Allow all egress"
  }

  # ICMP from operator IP for diagnostics
  ingress_security_rules {
    protocol    = "1"
    source      = var.my_public_ip_cidr
    description = "ICMP from operator"
  }

  # SSH to bastion only from operator IP
  ingress_security_rules {
    protocol    = "6"
    source      = var.my_public_ip_cidr
    description = "SSH from operator"
    tcp_options {
      min = 22
      max = 22
    }
  }

  # HTTP inbound for the NLB listener
  ingress_security_rules {
    protocol    = "6"
    source      = "0.0.0.0/0"
    description = "HTTP inbound"
    tcp_options {
      min = var.http_lb_port
      max = var.http_lb_port
    }
  }

  # HTTPS inbound for the NLB listener
  ingress_security_rules {
    protocol    = "6"
    source      = "0.0.0.0/0"
    description = "HTTPS inbound"
    tcp_options {
      min = var.https_lb_port
      max = var.https_lb_port
    }
  }
}

# Security list for the private subnet (k3s nodes)
resource "oci_core_security_list" "private" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.k3s.id
  display_name   = "${var.cluster_name}-private-sl"
  freeform_tags  = local.common_tags

  egress_security_rules {
    destination = "0.0.0.0/0"
    protocol    = "all"
    description = "Allow all egress (via NAT gateway)"
  }

  # ICMP within the VCN
  ingress_security_rules {
    protocol    = "1"
    source      = var.oci_core_vcn_cidr
    description = "ICMP within VCN"
  }

  # All TCP/UDP within the VCN (k3s, etcd, flannel, Longhorn)
  ingress_security_rules {
    protocol    = "all"
    source      = var.oci_core_vcn_cidr
    description = "All traffic within VCN (k3s cluster communication)"
  }
}