IBM Cloud Global

 View Only

Guide to use terraform for creating IBM Cloud resources (Classic and VPC)

By Lavisha Bhatia posted Thu August 29, 2024 12:10 AM

  

Imagine being able to sculpt your cloud infrastructure with the precision of a master builder, all from a single blueprint. With Terraform, this vision becomes reality. In this guide, we’ll explore how to use Terraform code on IBM Cloud, guiding you through the art of crafting both Classic and VPC environments. 

Whether you're an architect of digital landscapes or a curious newcomer, this guide will equip you with the tools to create and control your cloud world with ease.

Ready to terraform your future? Let’s get started!

Reference : https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started

Note: Use Visual Studio Code for best results!

We will take few scenarios in this blog. 

  1. Create a VPC, a VSI and a Security Group created for VSI
  2. A VSI along with public IP and one IBM Cloud load balancer
  3. VPN tunnel connection between two VPCs
  4. TGW connection between 2 VPCs
  5. Application load balancer created for a VPC
  6. Network Load balancer created for a VPC


Step 1 : 

Go to terminal and run below commands:

$mkdir terraform && cd terraform
$export PATH=$PATH:$HOME/terraform
$terraform
$mkdir myproject && cd myproject

Step 2:

Create “versions.tf” file as mentioned below:

terraform {
  required_version = ">=1.0.0, <2.0"
  required_providers {
    ibm = {
      source = "IBM-Cloud/ibm"
    }
  }
}

Step 3:

Create or retrieve an IBM Cloud API key

Step 4: 

Create “terraform.tfvars” file as mentioned below:

ibmcloud_api_key = <ibmcloud api key>


Step 5: 

Create “provider.tf” file as mentioned below:



variable "ibmcloud_api_key" {}
variable "region" {}

provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
  region           = var.region
}

Note: To check the sample templates for VPC infrastructure go to below link:

https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-provider-template#vpc-templates

Note: To check vpc.tf file which we will need, go to below document, step 4:

https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-sample_vpc_config


The above steps are same for every scenario. The next step will actually determine your configuration. 

Example 1: 

  • Create a VPC along with a VSI.
  • VSI will have FIP assigned to it.
  • SG created for VSI

Step 1-5 will be same as mentioned above. 

Step 6 is as follows: 

Create "vpc.tf" file as below:

// Creating ssh-key. Provide the public key here and use private key to login into the VSI.
resource "ibm_is_ssh_key" "ssh-key" {
  name       = "testterranewkey"
  public_key = "xxxxx"
  type       = "rsa"
}


// Allow all incoming network traffic on port 22 for VPC

resource "ibm_is_security_group_rule" "ingress_ssh_all" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 22
    port_max = 22
  }
}

// Getting image for VSI
data "ibm_is_image" "centos" {
  name = "ibm-centos-7-9-minimal-amd64-10"
}


//
#Code for VPC
//

resource "ibm_is_vpc" "vpc" {
  name = "vpctest1"
}

// Creating address-prefix
resource "ibm_is_vpc_address_prefix" "vpc_prefix" {
  name = "test-address-prefix"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "192.168.10.0/24"
}

// Creating Subnet resource

resource "ibm_is_subnet" "subnet1" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix
  ]
  ipv4_cidr_block = "192.168.10.0/24"
  name            = "subnettest1"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "br-sao-1"
}

// Defining Security Group Rules 

resource "ibm_is_security_group" "sg1" {
  name = "sgtestgroup1"
  vpc  = ibm_is_vpc.vpc.id
}

resource "ibm_is_security_group_rule" "sgrule1" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule2" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  udp {
    port_min = 500
    port_max = 500
  }
}

resource "ibm_is_security_group_rule" "sgrule3" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  udp {
    port_min = 4500
    port_max = 4500
  }
}

resource "ibm_is_security_group_rule" "sgrule4" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule5" {
  group     = ibm_is_security_group.sg1.id
  direction = "outbound"
  remote    = "0.0.0.0/0"

}

// Creating VSI

resource "ibm_is_instance" "vsi1" {
  name    = "vsitest1"
  vpc     = ibm_is_vpc.vpc.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet1.id
    security_groups = [ibm_is_security_group.sg1.id]
  }
}

// Assigning Floating-IP

resource "ibm_is_floating_ip" "fip1" {
  name   = "fiptest1"
  target = ibm_is_instance.vsi1.primary_network_interface[0].id
}

// Getting ssh command to login VSI

output "sshcommand" {
  value = "ssh root@${ibm_is_floating_ip.fip1.address}"

Step 7: 

After saving the vpc.tf file, run below commands on the terminal:

$terraform init
This command initializes a working directory containing Terraform configuration files. This is the first command that should be run after writing a new Terraform configuration or cloning an existing one from version control. It is safe to run this command multiple times.

$terraform fmt 
This command should always be run on your configuration files, so formatting standards and language style conventions are applied across your configuration in a uniform manner.

$terraform validate
Validates the configuration files in a directory.

$terraform plan
The terraform plan command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure.

$terraform apply
The terraform apply command performs a plan just like terraform plan does, but then actually carries out the planned changes to each resource using the relevant infrastructure provider's API.

$terraform show
The terraform show command is used to provide human-readable output from a state or plan file. This can be used to inspect a plan to ensure that the planned operations are expected, or to inspect the current state as Terraform sees it.

$terraform plan -destroy
The terraform plan command is a crucial part of the Terraform workflow. It is used to generate an execution plan that outlines the changes that will be applied to the infrastructure when the terraform apply command is executed.

$terraform destroy
The terraform destroy command is a convenient way to destroy all remote objects managed by a particular Terraform configuration.

Note: To delete any specific resource from vpc.tf file , there are two ways:

  • Comment the resource block you wish to delete and run “terraform apply” command.
  • elete the resource block you wish to delete and run “terraform apply” command.

Example 2: 

  • A VSI along with public and private address
  • Cloud LB provisioned with the new VSI created above attached to it

Create "vpc.tf" file as below:

resource "ibm_compute_ssh_key" "test_ssh_key" {
    label = "testterranewkey"
    notes = "test_key_terra_classic"
    public_key = "xxxxx"
}

resource "ibm_compute_vm_instance" "compute_test1" {
  hostname                   = "testvsi1"
  domain                     = "SoftLayer-Internal-Network-Operations.cloud"
  os_reference_code          = "CENTOS_7_64"
  datacenter                 = "sjc04"
  network_speed              = 100
  hourly_billing             = true
  private_network_only       = false
  cores                      = 1
  memory                     = 1024
  public_vlan_id             = 3023244
  private_vlan_id            = 3023246
}


resource "ibm_lbaas" "lbaas" {
  name        = "terraformLB"
  description = "testLB_terraform"
  subnets = [2095401]

  protocols {
    frontend_protocol     = "TCP"
    frontend_port         = 22
    backend_protocol      = "TCP"
    backend_port          = 22
    load_balancing_method = "round_robin"
  }
}

resource "ibm_lbaas_health_monitor" "lbaas_hm" {
  protocol    = ibm_lbaas.lbaas.health_monitors[0].protocol
  port        = ibm_lbaas.lbaas.health_monitors[0].port
  timeout     = 3
  interval    = 5
  max_retries = 6
  url_path    = "/"
  lbaas_id    = ibm_lbaas.lbaas.id
  monitor_id  = ibm_lbaas.lbaas.health_monitors[0].monitor_id
}

resource "ibm_lbaas_server_instance_attachment" "lbaas_member" {
  count = 1
  private_ip_address = element(
    ibm_compute_vm_instance.compute_test1.*.ipv4_address_private,
    count.index,
  )
  lbaas_id   = ibm_lbaas.lbaas.id
  depends_on = [ibm_lbaas.lbaas]
}

resource "ibm_subnet" "testsubnet" {
     type = "Portable"
     private = true
     ip_version = 4
    capacity = 8
    vlan_id = xyz
}

Use a built-in function cidrhost with index 1.

output "first_ip_address" {
   value = cidrhost(ibm_subnet.testsubnet.subnet_cidr,1)
}

Example 3: 

  • Create 2 VPCs along with 2 VSIs.
  • VSIs will have FIPs assigned to them.
  • Both VPC will have address-prefixes and subnets added.
  • We will create a successful working VPN tunnel between the VPCs. 

Create "vpc.tf" file as below:

//Create ssh-key
resource "ibm_is_ssh_key" "ssh-key" {
  name       = "testterranewkey"
  public_key = "xxxx"
  type       = "rsa"
}


//allow all incoming network traffic on port 22 for 1st VPC

resource "ibm_is_security_group_rule" "ingress_ssh_all" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 22
    port_max = 22
  }
}

//allow all incoming network traffic on port 22 for 2nd VPC

resource "ibm_is_security_group_rule" "ingress_ssh_all2" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 22
    port_max = 22
  }
}

// Getting VSI image
data "ibm_is_image" "centos" {
  name = "ibm-centos-7-9-minimal-amd64-10"
}


//
#Code for First VPC
//

resource "ibm_is_vpc" "vpc" {
  name = "vpctest1"
}

// Creating address-prefix
resource "ibm_is_vpc_address_prefix" "vpc_prefix" {
  name = "test-address-prefix"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "192.168.10.0/24"
}

// Creating subnet
resource "ibm_is_subnet" "subnet1" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix
  ]
  ipv4_cidr_block = "192.168.10.0/24"
  name            = "subnettest1"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "br-sao-1"
}

//Creating Security Group
resource "ibm_is_security_group" "sg1" {
  name = "sgtestgroup1"
  vpc  = ibm_is_vpc.vpc.id
}

// Creating Security group rules
resource "ibm_is_security_group_rule" "sgrule1" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule2" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  udp {
    port_min = 500
    port_max = 500
  }
}

resource "ibm_is_security_group_rule" "sgrule3" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
udp {
    port_min = 4500
    port_max = 4500
  }
}

resource "ibm_is_security_group_rule" "sgrule4" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule5" {
  group     = ibm_is_security_group.sg1.id
  direction = "outbound"
  remote    = "0.0.0.0/0"
  
}

// Creating VSI1
resource "ibm_is_instance" "vsi1" {
  name    = "vsitest1"
  vpc     = ibm_is_vpc.vpc.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet1.id
    security_groups = [ibm_is_security_group.sg1.id]
  }
}

// Creating FIP1
resource "ibm_is_floating_ip" "fip1" {
  name   = "fiptest1"
  target = ibm_is_instance.vsi1.primary_network_interface[0].id
}

// Creating VPN gateway
resource "ibm_is_vpn_gateway" "is_vpn_gateway" {
  name   = "my-vpn-gateway"
  subnet = ibm_is_subnet.subnet1.id
  mode   = "route"
}

// Creating VPN gateway connection 
resource "ibm_is_vpn_gateway_connection" "conn1" {
  name           = "vpn-gateway-connection1"
  vpn_gateway    = ibm_is_vpn_gateway.is_vpn_gateway.id
  peer_address   = ibm_is_vpn_gateway.is_vpn_gateway2.public_ip_address
  preshared_key  = "xxxx"
  admin_state_up = true
  local_cidrs    = [ibm_is_subnet.subnet1.ipv4_cidr_block]
  peer_cidrs     = [ibm_is_subnet.subnet2.ipv4_cidr_block]
}

output "sshcommand" {
  value = "ssh root@${ibm_is_floating_ip.fip1.address}"
}


//
#Code for Second VPC
//
resource "ibm_is_vpc" "vpc2" {
  name = "vpctest2"
}

// Creating address-prefix
resource "ibm_is_vpc_address_prefix" "vpc_prefix2" {
  name = "test-address-prefix2"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc2.id
  cidr = "192.168.30.0/24"
}

// Creating subnet
resource "ibm_is_subnet" "subnet2" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix2
  ]
  ipv4_cidr_block = "192.168.30.0/24"
  name            = "subnettest-2"
  vpc             = ibm_is_vpc.vpc2.id
  zone            = "br-sao-1"
}

// Creating Security Group
resource "ibm_is_security_group" "sg2" {
  name = "sgtestgroup2"
  vpc  = ibm_is_vpc.vpc2.id
}

// Creating Security Group rules
resource "ibm_is_security_group_rule" "sgrule6" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule7" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  udp {
    port_min = 500
    port_max = 500
  }
}

resource "ibm_is_security_group_rule" "sgrule8" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
udp {
    port_min = 4500
    port_max = 4500
  }
}

resource "ibm_is_security_group_rule" "sgrule9" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule10" {
  group     = ibm_is_security_group.sg2.id
  direction = "outbound"
  remote    = "0.0.0.0/0"
  
}

// Creating VSI2
resource "ibm_is_instance" "vsi2" {
  name    = "vsitest2"
  vpc     = ibm_is_vpc.vpc2.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet2.id
    security_groups = [ibm_is_security_group.sg2.id]
  }
}

// Creating FIP2 
resource "ibm_is_floating_ip" "fip2" {
  name   = "fiptest2"
  target = ibm_is_instance.vsi2.primary_network_interface[0].id
}

// Creating VPN Gateway 2
resource "ibm_is_vpn_gateway" "is_vpn_gateway2" {
  name   = "my-vpn-gateway2"
  subnet = ibm_is_subnet.subnet2.id
  mode   = "route"
}

// Creating VPN gateway Connection 2
resource "ibm_is_vpn_gateway_connection" "conn2" {
  name           = "vpn-gateway-connection2"
  vpn_gateway    = ibm_is_vpn_gateway.is_vpn_gateway2.id
  peer_address   = ibm_is_vpn_gateway.is_vpn_gateway.public_ip_address
  preshared_key  = "xxxx"
  admin_state_up = true
  local_cidrs    = [ibm_is_subnet.subnet2.ipv4_cidr_block]
  peer_cidrs     = [ibm_is_subnet.subnet1.ipv4_cidr_block]
}

output "sshcommand2" {
  value = "ssh root@${ibm_is_floating_ip.fip2.address}"
}

Example 4: 

  • Create 2 VPCs along with 2 VSIs.
  • VSIs will have FIPs assigned to them.
  • Both VPC will have address-prefixes and subnets added.
  • Create TGW for both VPCs
  • We will create a successful working TGW connection between the VPCs. 

Create "vpc.tf" file as below:

// Use this resource block if you wish to create new API-Key
 resource "ibm_iam_api_key" "iam_api_key" {
   name    = "test-api-2"
  apikey = "xxx"
 }

// To create new SSH-Key
resource "ibm_is_ssh_key" "ssh-key" {
  name       = "testterranewkey2"
  public_key = "xxxxx"
  type       = "rsa"
}


// Use below data block if you want to use existing ssh Key (Edit the name field as per your need)
 data "ibm_is_ssh_key" "ssh" {
   name = "abcd"
 }

// Use below data block if you want to use existing API Key  (Edit the apikey_id field as per your need)
data "ibm_iam_api_key" "iam_api_key" {
    apikey_id = "xxxx"
}

// Creating transit gateway
resource "ibm_tg_gateway" "new_tg_gw"{
name="transit-gateway-test-terra"
location="br-sao"
global=true
}

// Creating transit gateway connection for VPC 1
resource "ibm_tg_connection" "test_ibm_tg_connection" {
  gateway      = ibm_tg_gateway.new_tg_gw.id
  network_type = "vpc"
  name         = "myconnection"
    network_id   = ibm_is_vpc.vpc.resource_crn
  }

// Creating transit gateway connection for VPC 2
resource "ibm_tg_connection" "test_ibm_tg_connection2" {
  gateway      = ibm_tg_gateway.new_tg_gw.id
  network_type = "vpc"
  name         = "myconnection2"
    network_id   = ibm_is_vpc.vpc2.resource_crn
  }


// Allow all incoming network traffic on port 22 for 1st VPC

resource "ibm_is_security_group_rule" "ingress_ssh_all" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "0.0.0.0/0"
  tcp {
    port_min = 22
    port_max = 22
  }
}

// Allow all incoming network traffic on port 22 for 2nd VPC
resource "ibm_is_security_group_rule" "ingress_ssh_all2" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 22
    port_max = 22
  }
}

// Getting image for VSI
data "ibm_is_image" "centos" {
  name = "ibm-centos-7-9-minimal-amd64-10"
}


//
#Code for First VPC
//

resource "ibm_is_vpc" "vpc" {
  name = "vpctest1"
}

resource "ibm_is_vpc_address_prefix" "vpc_prefix" {
  name = "test-address-prefix"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "192.168.10.0/24"
}

// Creating Subnet1
resource "ibm_is_subnet" "subnet1" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix
  ]
  ipv4_cidr_block = "192.168.10.0/24"
  name            = "subnettest1"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "br-sao-1"
}

// Creating SG1
resource "ibm_is_security_group" "sg1" {
  name = "sgtestgroup1"
  vpc  = ibm_is_vpc.vpc.id
}

// Creating SG rules
resource "ibm_is_security_group_rule" "sgrule1" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule2" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  udp {
    port_min = 500
    port_max = 500
  }
}

resource "ibm_is_security_group_rule" "sgrule3" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  udp {
    port_min = 4500
    port_max = 4500
  }
}

resource "ibm_is_security_group_rule" "sgrule4" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule5" {
  group     = ibm_is_security_group.sg1.id
  direction = "outbound"
  remote    = "0.0.0.0/0"

}

// Creating VSI1
resource "ibm_is_instance" "vsi1" {
  name    = "vsitest-terra"
  vpc     = ibm_is_vpc.vpc.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet1.id
    security_groups = [ibm_is_security_group.sg1.id]
  }
}
// Creating Floating IP1
resource "ibm_is_floating_ip" "fip1" {
  name   = "fiptest1-terra"
  target = ibm_is_instance.vsi1.primary_network_interface[0].id
}


output "sshcommand" {
  value = "ssh root@${ibm_is_floating_ip.fip1.address}"
}


//
#Code for Second VPC
//
resource "ibm_is_vpc" "vpc2" {
  name = "vpctest2"
}

resource "ibm_is_vpc_address_prefix" "vpc_prefix2" {
  name = "test-address-prefix2"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc2.id
  cidr = "192.168.30.0/24"
}

// Creating Subnet2
resource "ibm_is_subnet" "subnet2" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix2
  ]
  ipv4_cidr_block = "192.168.30.0/24"
  name            = "subnettest-2"
  vpc             = ibm_is_vpc.vpc2.id
  zone            = "br-sao-1"
}

#Creating SG2
resource "ibm_is_security_group" "sg2" {
  name = "sgtestgroup2"
  vpc  = ibm_is_vpc.vpc2.id
}

// Creating SG2 Rules
resource "ibm_is_security_group_rule" "sgrule6" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule7" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  udp {
    port_min = 500
    port_max = 500
  }
}

resource "ibm_is_security_group_rule" "sgrule8" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  udp {
    port_min = 4500
    port_max = 4500
  }
}

resource "ibm_is_security_group_rule" "sgrule9" {
  group     = ibm_is_security_group.sg2.id
  direction = "inbound"
  remote    = "192.168.10.0/24"
  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule10" {
  group     = ibm_is_security_group.sg2.id
  direction = "outbound"
  remote    = "0.0.0.0/0"

}

// Creating VSI2
resource "ibm_is_instance" "vsi2" {
  name    = "vsitest2-terra"
  vpc     = ibm_is_vpc.vpc2.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet2.id
    security_groups = [ibm_is_security_group.sg2.id]
  }
}

// Creating FIP2
resource "ibm_is_floating_ip" "fip2" {
  name   = "fiptest2-terra"
  target = ibm_is_instance.vsi2.primary_network_interface[0].id
}


output "sshcommand2" {
  value = "ssh root@${ibm_is_floating_ip.fip2.address}"
}

Example 5: 

  • Create a VPC along with a VSI.
  • VSI will have FIP assigned to it.
  • SG created for VSI
  • ALB created for VPC

"vpc.tf" file will be as below:

// Use this resource block if you wish to create new API-Key
 resource "ibm_iam_api_key" "iam_api_key" {
   name    = "test-api-2-terra-lavisha"
   apikey = "xxxxx"
 }


// Use below data block if you want to use existing API Key  (Edit the apikey_id field as per your need)
data "ibm_iam_api_key" "iam_api_key" {
  apikey_id = "xxxxx"
}

// Use this resource block if you wish to create new SSH-Key

resource "ibm_is_ssh_key" "ssh-key" {
  name       = "testterranewkey2"
  public_key = "xxxxl"
  type       = "rsa"
}

// Use below data block if you want to use existing ssh Key (Edit the name field as per your need)
# data "ibm_is_ssh_key" "ssh" {
#   name = "testterranewkey2"
# }

//Allow all incoming network traffic on port 22 for VPC

resource "ibm_is_security_group_rule" "ingress_ssh_all" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 22
    port_max = 22
  }
}

// Creating ALB
resource "ibm_is_lb" "albtest" {
  name    = "alb-test-terra"
  subnets = [ibm_is_subnet.subnet1.id, ibm_is_subnet.subnet2.id]
}

// Getting VSI image
data "ibm_is_image" "centos" {
  name = "ibm-centos-7-9-minimal-amd64-10"
}

//
#Code for VPC
//


resource "ibm_is_vpc" "vpc" {
  name = "vpctestlavisha1"
}

resource "ibm_is_vpc_address_prefix" "vpc_prefix" {
  name = "test-address-prefix"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "192.168.10.0/24"
}

resource "ibm_is_vpc_address_prefix" "vpc_prefix2" {
  name = "test-address-prefix2"
  zone = "br-sao-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "192.168.30.0/24"
}

// Creating Subnet resource

resource "ibm_is_subnet" "subnet1" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix
  ]
  ipv4_cidr_block = "192.168.10.0/24"
  name            = "subnettest1"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "br-sao-1"
}

resource "ibm_is_subnet" "subnet2" {
  depends_on = [
    ibm_is_vpc_address_prefix.vpc_prefix2
  ]
  ipv4_cidr_block = "192.168.30.0/24"
  name            = "subnettest2"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "br-sao-1"
}

// Defining Security Group Rules 

resource "ibm_is_security_group" "sg1" {
  name = "sgtestgroup1"
  vpc  = ibm_is_vpc.vpc.id
}

resource "ibm_is_security_group_rule" "sgrule1" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  icmp {
  }
}

resource "ibm_is_security_group_rule" "sgrule4" {
  group     = ibm_is_security_group.sg1.id
  direction = "inbound"
  remote    = "192.168.30.0/24"
  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "sgrule5" {
  group     = ibm_is_security_group.sg1.id
  direction = "outbound"
  remote    = "0.0.0.0/0"

}

// Creating VSI

resource "ibm_is_instance" "vsi1" {
  name    = "vsitest1"
  vpc     = ibm_is_vpc.vpc.id
  zone    = "br-sao-1"
  keys    = [ibm_is_ssh_key.ssh-key.id]
  image   = data.ibm_is_image.centos.id
  profile = "cx2-2x4"

  primary_network_interface {
    subnet          = ibm_is_subnet.subnet1.id
    security_groups = [ibm_is_security_group.sg1.id]
  }
}

// Assigning Floating-IP

resource "ibm_is_floating_ip" "fip1" {
  name   = "fiptest1"
  target = ibm_is_instance.vsi1.primary_network_interface[0].id
}

// Getting ssh command to login VSI

output "sshcommand" {
  value = "ssh root@${ibm_is_floating_ip.fip1.address}"
}

Example 6: 

  • Create a VPC along with a VSI.
  • VSI will have FIP assigned to it.
  • SG created for VSI
  • NLB created for VPC

"vpc.tf" file will be as below:

// Create a VPC
resource "ibm_is_vpc" "vpc" {
  name = "my-vpc"
}

// Create a Subnet
resource "ibm_is_subnet" "subnet" {
  name            = "my-subnet"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "us-south-1"
  ipv4_cidr_block = "10.10.10.0/24"
}

// Create a Security Group
resource "ibm_is_security_group" "security_group" {
  name = "my-security-group"
  vpc  = ibm_is_vpc.vpc.id
}

// Allow all inbound traffic for security group
resource "ibm_is_security_group_rule" "allow_inbound" {
  direction         = "inbound"
  remote            = "0.0.0.0/0"
  ip_version        = "ipv4"
  action            = "allow"
  protocol          = "all"
  security_group_id = ibm_is_security_group.security_group.id
}

// Allow all outbound traffic for security group
resource "ibm_is_security_group_rule" "allow_outbound" {
  direction         = "outbound"
  remote            = "0.0.0.0/0"
  ip_version        = "ipv4"
  action            = "allow"
  protocol          = "all"
  security_group_id = ibm_is_security_group.security_group.id
}

// Create a VSI
resource "ibm_is_instance" "vsi" {
  name              = "my-vsi"
  vpc               = ibm_is_vpc.vpc.id
  profile           = "bx2-2x8"
  zone              = "us-south-1"
  image             = "ibm-ubuntu-20-04-1-minimal-amd64-3"
  primary_network_interface {
    subnet          = ibm_is_subnet.subnet.id
    security_groups = [ibm_is_security_group.security_group.id]
  }
  keys = ["<your-ssh-key-name>"]
}

// Assign a Floating IP to the VSI
resource "ibm_is_floating_ip" "fip" {
  name     = "my-fip"
  zone     = "us-south-1"
  target   = ibm_is_instance.vsi.primary_network_interface[0].id
}

// Create a Network Load Balancer
resource "ibm_is_lb" "nlb" {
  name = "my-nlb"
  subnets = [ibm_is_subnet.subnet.id]
  type = "network"
  listener {
    protocol = "tcp"
    port = 80
  }
  pool {
    protocol = "tcp"
    algorithm = "round_robin"
    member {
      target = ibm_is_instance.vsi.primary_network_interface[0].id
      port = 80
    }
  }
}

Happy coding! If you’re hungry for more examples or have any questions, drop a comment below—I’d love to hear from you.

Thanks for stopping by, and happy Terraforming!

0 comments
6 views

Permalink