icy-dress-83371
10/03/2023, 8:47 PMterraform-aws-modules/vpc/aws
module, which allows me to easily add a secondary CIDR block as well as dictate the CIDR blocks for the subnets within it.
I am trying to create a networking custom resource here in Pulumi for future re-usability. Below is the code I have so far, but I can’t seem to figure out how I can accomplish the same thing. I am adding the secondary CIDR block, but that happens after the awsx.vpc
resource and therefor I am not able to have my isolated subnet utilize my secondary CIDR block.
from dataclasses import dataclass
import pulumi
import pulumi_aws as aws
import pulumi_awsx as awsx
@dataclass
class VpcArgs:
vpc_cidr_block: str
vpc_cidr_block_secondary: str
instance_tenancy: str
enable_dns_hostnames: bool
enable_dns_support: bool
owner: str
class Vpc(pulumi.ComponentResource):
def __init__(self, name: str, args: VpcArgs, opts: pulumi.ResourceOptions = None) -> None:
super().__init__("awsCustomNetworking:index:Vpc", name, None, opts)
self.name = name
self.args = args
self.vpc = awsx.ec2.Vpc(
f"{name}-vpc",
awsx.ec2.VpcArgs(
cidr_block=args.vpc_cidr_block,
subnet_specs=[
awsx.ec2.SubnetSpecArgs(
type=awsx.ec2.SubnetType.PUBLIC,
cidr_mask=28,
),
awsx.ec2.SubnetSpecArgs(
type=awsx.ec2.SubnetType.PRIVATE,
cidr_mask=28,
),
awsx.ec2.SubnetSpecArgs(
type=awsx.ec2.SubnetType.ISOLATED,
cidr_mask=28,
),
],
nat_gateways=awsx.ec2.NatGatewayConfigurationArgs(
strategy=awsx.ec2.NatGatewayStrategy.ONE_PER_AZ
),
tags={
"Name": f"{name}-vpc",
"Owner": f"{args.owner}",
}
),
opts=pulumi.ResourceOptions(
*(opts or {}),
parent=self,
),
)
self.secondary_cidr = aws.ec2.VpcIpv4CidrBlockAssociation(f"{name}-secondary-cidr",
vpc_id=self.vpc.vpc_id,
cidr_block=args.vpc_cidr_block_secondary,
opts=pulumi.ResourceOptions(
*(opts or {}),
parent=self,
depends_on=[self.vpc],
),
)
self.eip = aws.ec2.Eip(
f"{name}-eip",
tags={
"Name": f"{name}-eip",
"Owner": f"{args.owner}",
},
opts=pulumi.ResourceOptions(
parent=self,
depends_on=[self.vpc],
),
)
self.nat_gateway = aws.ec2.NatGateway(
f"{name}-nat-gateway",
aws.ec2.NatGatewayArgs(
subnet_id=self.vpc.public_subnet_ids[0],
allocation_id=self.eip.allocation_id,
tags={
"Name": f"{name}-nat-gateway",
"Owner": f"{args.owner}",
}
),
pulumi.ResourceOptions(
parent=self,
depends_on=[self.vpc],
)
)
self.register_outputs({})
icy-dress-83371
10/04/2023, 1:35 PMpulumi_aws
components and build each piece myself. Creating the VPC, then adding the additional cidr block, followed by the subnets, then everything else like nat gateway and internet gateway.billowy-army-68599
icy-dress-83371
10/04/2023, 2:48 PMlocals {
cluster_name = "${var.name}-${var.environment}"
region = var.aws_region
sliced_azs = slice(data.aws_availability_zones.available_azs.zone_ids, 0, var.number_of_azs)
subnet_group_count = 3
tags = {
Environment = var.environment
}
}
data "aws_availability_zones" "available_azs" {
state = "available"
exclude_names = [ "us-east-1e" ] #us-east-1e was not supporting EKS deployment
}
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
name = "${var.name}-${var.environment}-vpc"
cidr = var.primary_vpc_cidr
secondary_cidr_blocks = [var.secondary_vpc_cidr]
azs = local.sliced_azs
enable_nat_gateway = true
single_nat_gateway = true
enable_dns_hostnames = true
private_subnets = [
for netnumber in range(0, length(local.sliced_azs)):
cidrsubnet(var.primary_vpc_cidr, ceil(log(length(local.sliced_azs) * local.subnet_group_count, 2)), netnumber)
]
public_subnets = [
for netnumber in range(length(local.sliced_azs), length(local.sliced_azs) * 2):
cidrsubnet(var.primary_vpc_cidr, ceil(log(length(local.sliced_azs) * local.subnet_group_count, 2)), netnumber)
]
intra_subnets = [
for netnumber in range(length(local.sliced_azs) * 2, length(local.sliced_azs)):
cidrsubnet(var.secondary_vpc_cidr, ceil(log(length(local.sliced_azs) * local.subnet_group_count, 2)), netnumber)
]
tags = {
"<http://kubernetes.io/cluster/${local.cluster_name}|kubernetes.io/cluster/${local.cluster_name}>" = "shared"
}
public_subnet_tags = {
"<http://kubernetes.io/cluster/${local.cluster_name}-primary|kubernetes.io/cluster/${local.cluster_name}-primary>" = "shared"
"<http://kubernetes.io/role/elb|kubernetes.io/role/elb>" = "1"
}
private_subnet_tags = {
"<http://kubernetes.io/cluster/${local.cluster_name}-primary|kubernetes.io/cluster/${local.cluster_name}-primary>" = "shared"
"<http://kubernetes.io/role/internal-elb|kubernetes.io/role/internal-elb>" = "1"
}
}
icy-dress-83371
10/04/2023, 2:55 PMbillowy-army-68599
awsx.ec2.Vpc
as a native input. However, you should be able to do this, because it’s just a resource https://github.com/terraform-aws-modules/terraform-aws-vpc/blob/master/main.tf#L53billowy-army-68599
icy-dress-83371
10/04/2023, 3:04 PMaws.ec2.VpcIpv4CidrBlockAssociation
requires a vpc_id. But in order for the VPC to be built (at least using awsx.ec2.Vpc
) I need to provide subnet specs. I also don’t see how I would set the actual cidr for each subnet, when it only seems to allow a cidr_mask.billowy-army-68599
icy-dress-83371
10/04/2023, 3:11 PMbillowy-army-68599
billowy-army-68599
"""An AWS Python Pulumi program"""
import pulumi
import pulumi_aws as aws
import pulumi_awsx as awsx
vpc = awsx.ec2.Vpc(
"vpc",
cidr_block="10.0.0.0/16",
subnet_specs=[
awsx.ec2.SubnetSpecArgs(
cidr_mask=22,
type="public",
),
awsx.ec2.SubnetSpecArgs(
cidr_mask=22,
type="private",
),
],
)
secondary_block = aws.ec2.VpcIpv4CidrBlockAssociation(
"secondaryBlock", vpc_id=vpc.vpc_id, cidr_block="10.0.20.0/22"
)
intra = aws.ec2.Subnet(
"intra",
vpc_id=vpc.vpc_id,
cidr_block=secondary_block.cidr_block,
)
intra_rt = aws.ec2.RouteTable(
"intra",
vpc_id=vpc.vpc_id,
)
intra_rt_associ = aws.ec2.RouteTableAssociation(
"intra",
route_table_id=intra_rt.id,
subnet_id=intra.id,
)
icy-dress-83371
10/04/2023, 3:26 PMbillowy-army-68599
icy-dress-83371
10/04/2023, 3:32 PMbillowy-army-68599
icy-dress-83371
10/04/2023, 3:34 PMicy-dress-83371
10/04/2023, 3:34 PMbillowy-army-68599
icy-dress-83371
10/04/2023, 3:41 PMbillowy-army-68599