Hanyoyin Terraform Client VPN da CIDR fiye da subnets

Kwamfutar hannu tana haɗawa da Client VPN endpoint, kuma terraform apply har yanzu yana kasawa a kan albarkar hanya. Tsarin yawanci yana da CIDR na manufa fiye da subnets masu alaƙa, kuma ɓangaren hanya yana zaɓar manufa da index. Wannan yana ɗauka cewa jerin biyu suna layi ɗaya. Ba haka suke ba, kuma gazawar tana bayyana a lokacin amfani maimakon a lokacin bita.

Faɗi abin da ke kasawa

Albarkatu uku ne suka shiga kuma kowanne yana amsa tambaya daban. Haɗin kai yana sanya network interface na endpoint a cikin subnet. Hanya tana faɗin wane prefix na manufa ake kaiwa subnet manufa. Dokar izini tana faɗin wane masu amfani za su iya isa wane prefix. Hanyar da ke nuni ga subnet da ba a taɓa haɗa ba tana kasawa ko da duka abubuwan biyu suna nan, domin manufar dole ta kasance ta wannan endpoint.

Da farko jera haɗe-haɗen: aws ec2 describe-client-vpn-target-networks --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0.

Ka tuna da hanyar gida ta VPC

Haɗin farko yana ƙara hanyar gida ga dukan VPC, don haka kowane subnet a cikin wannan VPC yana iya isa ba tare da albarkar hanya ba. Akwai ƙarin hanyoyi don VPC masu peer, haɗe-haɗen Transit Gateway, da prefixes na on-premises waɗanda VPC ba ya mallaka. Shi ya sa endpoint mai haɗe-haɗe uku zai iya ɗaukar shigarwar manufa bakwai bisa doka.

Ka ƙidaya manufofin da suke wajen VPC kafin ka ƙara hanyoyi. Idan wannan adadin ya fi ƙasa da jerin CIDR, jerin yana bayyana subnets waɗanda ba sa buƙatar hanya ko kaɗan.

Maye gurbin index da taswira

Naɗe index cikin modulo operator yana shiru da kuskure kuma yana riƙe kuskuren ƙirira. Manufar da ba za a iya isa ta hanyar zaɓaɓɓiyar manufa ba har yanzu ba ta ɗaukar wani zirga-zirga, komai tsaftar da aka yi amfani da shirin. A maimakon haka, ajiye alaƙar, kuma bari Terraform ya duba ta kafin a ƙirƙiri wani abu. Ɓangaren da ke ƙasa misali ne kuma yana amfani da hujjojin hanyar endpoint na mai bayarwa.

variable "client_vpn_destinations" {
  description = "Destination CIDR mapped to an associated subnet key"
  type        = map(string)
}

resource "aws_ec2_client_vpn_route" "this" {
  for_each               = var.client_vpn_destinations
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.this.id
  destination_cidr_block = each.key
  target_vpc_subnet_id   = aws_subnet.private[each.value].id

  lifecycle {
    precondition {
      condition     = contains(keys(aws_subnet.private), each.value)
      error_message = "Route target must be a subnet key in the associated map."
    }
  }
}

Yayin da taswirar ke gefen jerin haɗe-haɗe, ƙara manufa yana tilasta yanke shawara kan wace subnet za ta ɗauke ta. Wannan ita ce tattaunawar da index ya ɓoye.

Wata gazawa tana haifar da ƙimomi marasa ma'ana maimakon kuskuren index. Ba da ginin ƙananan mataki a inda ake tsammanin interface mafi girma yana barin filayen da API ke karantawa ba su cika ba, kuma CIDR da aka samu ba shi da amfani. Terraform yana nuna irin wannan siffa idan kirtani ya zo inda ake tsammanin abu. Duba tsarin mai bayarwa don nau'in hujja.

Tabbatar da shi daga abokin ciniki

Gudanar da terraform validate da shiri a kan ainihin yanayi kafin amfani. Bayan haka, kwatanta jerin cibiyoyin sadarwa na endpoint da taswirar maimakon dogaro da apply mai nasara.

Jarrabawar karɓa ita ce abokin ciniki da ke haɗe wanda ke isa kowane prefix da aka yi niyya.

Dokar izini ita ce inda yawancin tsare-tsare ke tsayawa da wuri. An iyakance ta ga CIDR manufa da rukuni, kuma hanya ba tare da izini mai dacewa ba tana haifar da abokin ciniki da ke haɗe wanda ba zai iya isa prefix ɗin ba. Duba duka abubuwan biyu don kowane prefix, domin apply da ya ƙirƙiri hanyar kuma ya manta da dokar yana kama da cikakke. Gwada da mai amfani ɗaya cikin rukuni da ɗaya a waje.

Idan prefix ɗaya ya kasa, kwatanta shigarwar hanyar sa da dokar izini. Rashin izini da rashin hanya suna kama da juna a cikin log ɗin abokin ciniki kuma ana gyara su a cikin albarkatu daban-daban.