migrate
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,84 @@
|
||||
locals {
|
||||
policy_source_group_names = [
|
||||
for name in split(",", "<< source_group_names >>") : trimspace(name)
|
||||
if trimspace(name) != ""
|
||||
]
|
||||
policy_destination_group_names = [
|
||||
for name in split(",", "<< destination_group_names >>") : trimspace(name)
|
||||
if trimspace(name) != ""
|
||||
]
|
||||
<%- if source_posture_check_names %>
|
||||
policy_source_posture_check_names = [
|
||||
for name in split(",", "<< source_posture_check_names >>") : trimspace(name)
|
||||
if trimspace(name) != ""
|
||||
]
|
||||
<%- endif %>
|
||||
<%- if authorized_group_entries %>
|
||||
policy_authorized_group_entries = [
|
||||
for entry in split(";", "<< authorized_group_entries >>") : trimspace(entry)
|
||||
if trimspace(entry) != ""
|
||||
]
|
||||
policy_authorized_group_map = {
|
||||
for entry in local.policy_authorized_group_entries :
|
||||
trimspace(split("|", entry)[0]) => [
|
||||
for username in split(",", split("|", entry)[1]) : trimspace(username)
|
||||
if trimspace(username) != ""
|
||||
]
|
||||
}
|
||||
<%- endif %>
|
||||
policy_group_names = distinct(concat(
|
||||
local.policy_source_group_names,
|
||||
local.policy_destination_group_names,
|
||||
<%- if authorized_group_entries %>
|
||||
keys(local.policy_authorized_group_map),
|
||||
<%- endif %>
|
||||
[]
|
||||
))
|
||||
}
|
||||
|
||||
data "netbird_group" "policy_groups" {
|
||||
for_each = toset(local.policy_group_names)
|
||||
name = each.value
|
||||
}
|
||||
|
||||
<%- if source_posture_check_names %>
|
||||
data "netbird_posture_check" "source_posture_checks" {
|
||||
for_each = toset(local.policy_source_posture_check_names)
|
||||
name = each.value
|
||||
}
|
||||
|
||||
<%- endif %>
|
||||
resource "netbird_policy" "policy" {
|
||||
name = "<< policy_name >>"
|
||||
<%- if policy_description %>
|
||||
description = "<< policy_description >>"
|
||||
<%- endif %>
|
||||
enabled = << policy_enabled | lower >>
|
||||
<%- if source_posture_check_names %>
|
||||
source_posture_checks = [for name in local.policy_source_posture_check_names : data.netbird_posture_check.source_posture_checks[name].id]
|
||||
<%- endif %>
|
||||
|
||||
rule {
|
||||
name = "<< rule_name >>"
|
||||
action = "<< rule_action >>"
|
||||
bidirectional = << rule_bidirectional | lower >>
|
||||
enabled = << rule_enabled | lower >>
|
||||
protocol = "<< rule_protocol >>"
|
||||
sources = [for name in local.policy_source_group_names : data.netbird_group.policy_groups[name].id]
|
||||
destinations = [for name in local.policy_destination_group_names : data.netbird_group.policy_groups[name].id]
|
||||
<%- if rule_description %>
|
||||
description = "<< rule_description >>"
|
||||
<%- endif %>
|
||||
<%- if ports %>
|
||||
ports = [<< ports >>]
|
||||
<%- endif %>
|
||||
<%- if rule_protocol == "netbird-ssh" %>
|
||||
<%- if authorized_group_entries %>
|
||||
authorized_groups = {
|
||||
for group_name, users in local.policy_authorized_group_map :
|
||||
data.netbird_group.policy_groups[group_name].id => users
|
||||
}
|
||||
<%- endif %>
|
||||
<%- endif %>
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
{
|
||||
"slug": "netbird-policy",
|
||||
"kind": "terraform",
|
||||
"metadata": {
|
||||
"name": "NetBird Policy",
|
||||
"description": "Creates a NetBird access policy with a single rule and optional posture checks.",
|
||||
"tags": [
|
||||
"netbird",
|
||||
"terraform"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "selfhst",
|
||||
"id": "netbird"
|
||||
},
|
||||
"draft": false,
|
||||
"version": {
|
||||
"name": "0.0.12",
|
||||
"source_dep_name": "manual/netbird-policy"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "General",
|
||||
"name": "general",
|
||||
"items": [
|
||||
{
|
||||
"name": "policy_name",
|
||||
"type": "str",
|
||||
"title": "Policy Name",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "Allow Internal HTTPS"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy_description",
|
||||
"type": "str",
|
||||
"title": "Description",
|
||||
"required": false,
|
||||
"description": "Optional description for the policy.",
|
||||
"config": {
|
||||
"placeholder": "Allow app traffic from users to services",
|
||||
"textarea": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "policy_enabled",
|
||||
"type": "bool",
|
||||
"title": "Enabled",
|
||||
"required": false,
|
||||
"default": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Rule",
|
||||
"name": "rule",
|
||||
"items": [
|
||||
{
|
||||
"name": "rule_name",
|
||||
"type": "str",
|
||||
"title": "Rule Name",
|
||||
"required": true,
|
||||
"config": {
|
||||
"placeholder": "HTTPS"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "rule_description",
|
||||
"type": "str",
|
||||
"title": "Rule Description",
|
||||
"required": false,
|
||||
"description": "Optional description for the rule.",
|
||||
"config": {
|
||||
"placeholder": "Allow HTTPS from users to the app group",
|
||||
"textarea": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "rule_action",
|
||||
"type": "enum",
|
||||
"title": "Action",
|
||||
"required": false,
|
||||
"default": "accept",
|
||||
"description": "Policy action to take.",
|
||||
"config": {
|
||||
"options": [
|
||||
"accept",
|
||||
"drop"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "rule_protocol",
|
||||
"type": "enum",
|
||||
"title": "Protocol",
|
||||
"required": false,
|
||||
"default": "tcp",
|
||||
"description": "Protocol enforced by the policy rule.",
|
||||
"config": {
|
||||
"options": [
|
||||
"tcp",
|
||||
"udp",
|
||||
"icmp",
|
||||
"all",
|
||||
"netbird-ssh"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "rule_bidirectional",
|
||||
"type": "bool",
|
||||
"title": "Bidirectional",
|
||||
"required": false,
|
||||
"default": true,
|
||||
"description": "Allow traffic in both directions between the selected groups."
|
||||
},
|
||||
{
|
||||
"name": "rule_enabled",
|
||||
"type": "bool",
|
||||
"title": "Rule Enabled",
|
||||
"required": false,
|
||||
"default": true
|
||||
},
|
||||
{
|
||||
"name": "source_group_names",
|
||||
"type": "str",
|
||||
"title": "Source Group Names",
|
||||
"required": true,
|
||||
"description": "Comma-separated existing NetBird source group names.",
|
||||
"config": {
|
||||
"placeholder": "Users,Developers",
|
||||
"textarea": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "destination_group_names",
|
||||
"type": "str",
|
||||
"title": "Destination Group Names",
|
||||
"required": true,
|
||||
"description": "Comma-separated existing NetBird destination group names.",
|
||||
"config": {
|
||||
"placeholder": "Services,Internal Apps",
|
||||
"textarea": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "ports",
|
||||
"type": "str",
|
||||
"title": "Ports",
|
||||
"required": false,
|
||||
"description": "Raw HCL list entries for ports, for example `\"443\", \"8443\"`.",
|
||||
"config": {
|
||||
"placeholder": "\"443\"",
|
||||
"textarea": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "authorized_group_entries",
|
||||
"type": "str",
|
||||
"title": "Authorized Group Entries",
|
||||
"required": false,
|
||||
"description": "Semicolon-separated `group_name|user1,user2` entries for NetBird SSH local-user authorization.",
|
||||
"needs": [
|
||||
"rule_protocol=netbird-ssh"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "Admins|ubuntu;SRE|root,ec2-user",
|
||||
"textarea": true
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Posture Checks",
|
||||
"name": "posture-checks",
|
||||
"items": [
|
||||
{
|
||||
"name": "source_posture_check_names",
|
||||
"type": "str",
|
||||
"title": "Posture Check Names",
|
||||
"required": false,
|
||||
"description": "Comma-separated existing NetBird posture check names.",
|
||||
"config": {
|
||||
"placeholder": "Managed Devices,Minimum Version",
|
||||
"textarea": true
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user