resource and data for VPC - quotas for projects

[msyretis]

Is your feature request related to a problem? Please describe.

Hello, I was going down the project + VPC path to isolate and create a level of self service for the devops team, however halfway through - made it all the way from zero to project - when I noticed there are no resources for vpc, any plan to add them?
Also, there is no way to build quotas either for the projects, is that in the roadmap?

Describe the solution you'd like

It would be great if we could build using terraform all things to do with projects and vpcs

Describe alternatives you've considered

I don't think I have a workaround at this moment, at least by using only terraform.

Additional context

Great work so far. kudos.

[salv-orlando]

Hello! VPC resources are supported by their own provider, which can work together with the "regular" NSX Terraform provider

Hashicorp registry: https://registry.terraform.io/providers/vmware/for-vmware-nsxt-virtual-private-cloud/latest/docs
Github: https://github.com/vmware/terraform-provider-nsxt-virtual-private-cloud

[msyretis]

Thanks for your response @salv-orlando , I will have a look at that provider. What about quotas for projects? Anything in the roadmap for that?

[salv-orlando]

Hello @msyretis I will let @ksamoray comment on the feasibility of supporting quotas for projects, it should not be too challenging

[ksamoray]

Supporting project quotas requires implementations of a resource for constraint API, e.g:

PUT https://NSXMANAGER/policy/api/v1/infra/constraints/test

With the payload

{ "constraint_expressions": [ { "resource_type": "EntityInstanceCountConstraintExpression", "operator": "<=", "count": 1, "target_resource_type": "Infra.Tier1" } ], "display_name": "test_t1_quota", "targets": [ { "path_prefix": "/orgs/default/projects/test/" } ], "constraint_expression": null, "target": null, "id": "test" }

To create a 1 T1 quota for test project.

[msyretis]

Hello both, thanks for your responses.
I played around with the provider for vpc, however I must admit, I have not found a way to create a VPC through it. I understand that the multi-tenancy is handled by the nsxt provider, through the nsxt_policy_project, I assume IP blocks are through nsxt_policy_ip_block, but I cannot find how do add the external project ip block, and how to create a VPC.

any pointers you can offer?

thanks
Mel

[adarobin]

vpc_id is a provider level attribute on the NSX VPC provider https://github.com/vmware/terraform-provider-nsxt-virtual-private-cloud/blob/f433100ce0e4e7d345a939a3604f34f54790c1e1/website/docs/index.html.markdown?plain=1#L151. This means each VPC you want to work with requires its own instance of the provider to be declared. You'd have to completely rearchitect how that provider works in order for it to be able to create VPCs.

If you are a user consuming a few VPCs this makes sense, but if you want to administer a bunch of customers or provision VPCs for customers this does not work.

[adarobin]

This is my hacky workaround using the Mastercard/restapi provider to initially create the VPC. I left out the variable and provider declarations for brevity.

locals {
  vpc_path = "/policy/api/v1/orgs/${var.org_id}/projects/${var.project_id}/vpcs"
  vpc_body = {
    display_name = var.display_name
    id           = var.vpc_id
    short_id     = var.short_id
    site_infos = [{
      edge_cluster_paths = var.edge_cluster_paths
    }]
    load_balancer_vpc_endpoint = {
      enabled = var.load_balancer_vpc_endpoint_enabled
    }
    default_gateway_path = var.default_gateway_path
    service_gateway = {
      disable = var.service_gateway_disable
      qos_config = {
        ingress_qos_profile_path = var.ingress_qos_profile_path
        egress_qos_profile_path  = var.egress_qos_profile_path
      }
      auto_snat = var.service_gateway_auto_snat
    }
    ip_address_type      = var.ip_address_type
    private_ipv4_blocks  = var.private_ipv4_blocks
    external_ipv4_blocks = var.external_ipv4_blocks
    ipv6_profile_paths   = var.ipv6_profile_paths
    dhcp_config = {
      enable_dhcp = var.enable_dhcp,
      dns_client_config = {
        dns_server_ips = var.dns_server_ips
      }
    }
  }
}

resource "restapi_object" "vpc" {
  create_method = "PATCH"
  create_path   = "${local.vpc_path}/{id}"
  path          = local.vpc_path
  id_attribute  = "id"
  object_id     = var.vpc_id
  data          = jsonencode(local.vpc_body)
}

[annakhm]

Hi @msyretis , @adarobin VPC support is coming in the next release. Quotas however are scoped for the one after that.