Terraform Client VPN imizila ene-CIDR eningi kune-subnet

I-laptop ixhuma ku-Client VPN endpoint, futhi i-terraform apply isahluleka kusisetshenziswa somzila. Ukucushwa kuvame ukuba nama-CIDR amaningi endawo okuyiwa kuyo kunama-subnet ahlotshanisiwe, futhi ibhloko yomzila ikhetha umgomo ngenkomba. Lokho kucabanga ukuthi amaqoqo amabili ayafana. Awafani, futhi ukuhluleka kuvela ngesikhathi sokusetshenziswa hhayi ngesikhathi sokubuyekezwa.

Shono into ehlulekayo

Izinsiza ezintathu ziyabandakanyeka futhi ngayinye iphendula umbuzo ohlukile. Ukuhlotshanisa kubeka i-network interface ye-endpoint ku-subnet. Umzila usho ukuthi iyiphi i-prefix yendawo ehlosiwe elethwa ku-subnet ehlosiwe. Umthetho wokugunyazwa usho ukuthi abaphi abasebenzisi abangafinyelela kuyiphi i-prefix. Umzila okhomba ku-subnet engakaze ihlotshaniswe uyahluleka ngisho zombili izinto zikhona, ngoba umgomo kufanele ube ngeyale endpoint.

Qala ngokubala ukuhlotshanisa: aws ec2 describe-client-vpn-target-networks --client-vpn-endpoint-id cvpn-endpoint-0123456789abcdef0.

Khumbula umzila wasekhaya we-VPC

Ukuhlotshanisa kokuqala kwengeza umzila wasekhaya kuyo yonke i-VPC, ngakho zonke izixhumi ze-subnet kuleyo VPC ziyafinyeleleka ngaphandle kwesetshenziswa somzila. Imizila eyengeziwe ikhona yama-VPC abambisene, ukuxhumana kwe-Transit Gateway kanye nama-prefix e-on-premises okungeyona eye-VPC. Yingakho i-endpoint enokuhlotshanisa okuthathu ingathwala ngokusemthethweni izinto eziyisikhombisa zendawo ehlosiwe.

Bala izindawo ezingaphandle kwe-VPC ngaphambi kokwengeza imizila. Uma leso sibalo siphansi kuhlu lwe-CIDR, uhlu luchaza izixhumi ze-subnet ezingadingi mzila nhlobo.

Faka imephu esikhundleni senkomba

Ukusonga inkomba ku-opharetha ye-modulo kuthulisa iphutha futhi kugcina iphutha lokumodela. Indawo ehlosiwe engafinyeleleki ngomgomo okhethiwe ayithwali thrafikhi noma ngabe uhlelo lusetshenziswa ngokuhlanzekile kangakanani. Esikhundleni salokho gcina ubudlelwane, bese uvumela i-Terraform ukuba ibuhlole ngaphambi kokudala noma yini. Ibhloko engezansi iyisibonelo futhi isebenzisa izimpikiswano zomzila we-endpoint zomhlinzeki.

variable "client_vpn_destinations" {
  description = "Destination CIDR mapped to an associated subnet key"
  type        = map(string)
}

resource "aws_ec2_client_vpn_route" "this" {
  for_each               = var.client_vpn_destinations
  client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.this.id
  destination_cidr_block = each.key
  target_vpc_subnet_id   = aws_subnet.private[each.value].id

  lifecycle {
    precondition {
      condition     = contains(keys(aws_subnet.private), each.value)
      error_message = "Route target must be a subnet key in the associated map."
    }
  }
}

Uma imephu iseceleni kohlu lokuhlotshanisa, ukwengeza indawo ehlosiwe kuphoqa isinqumo sokuthi iyiphi i-subnet eyithwalayo. Yilokho kuxoxa inkomba eyayikufihlile.

Okunye ukuhluleka kuveza amanani angenasizathu esikhundleni sephutha lenkomba. Ukudlulisa isakhiwo sezinga eliphansi lapho kulindeleke khona i-interface yezinga eliphezulu kushiya izinkambu ezifundwa yi-API zingagcwalisiwe, futhi i-CIDR evelayo ayisebenziseki. I-Terraform ibonisa isimo esifanayo lapho intambo ifika lapho kulindeleke khona into. Hlola isikimu somhlinzeki ngohlobo lwempikiswano.

Kufakazele kusuka kuklayenti

Ngaphambi kokusebenzisa, gijimisa i-terraform validate kanye nohlelo olumelene nesimo sangempela. Ngemva kwalokho, qhathanisa uhlu lwamanethiwekhi okuhlosiwe e-endpoint nemephu esikhundleni sokwethemba i-apply ephumelele.

Ukuhlolwa kokwamukela i-klayenti exhunyiwe efinyelela yonke i-prefix ehlosiwe.

Umthetho wokugunyazwa yindawo lapho izilungiselelo eziningi ziyekela khona kusenesikhathi. Ukhawulelwe ku-CIDR yendawo ehlosiwe kanye neqembu, futhi umzila ongenalo ugunyazwo olufanayo uveza iklayenti exhunyiwe engakwazi ukufinyelela i-prefix. Hlola zombili izinto kuyo yonke i-prefix, ngoba i-apply eyakha umzila ikhohlwa umthetho ibonakala iphelele. Hlola nomsebenzisi oyedwa ngaphakathi kweqembu kanye nomunye ngaphandle kwalo.

Uma i-prefix eyodwa ihluleka, qhathanisa ingeno yayo yomzila nomthetho wokugunyazwa. Ukugunyazwa okungekho nomzila ongekho kubonakala kufana kusithome sika-klayenti futhi kulungiswa ezinsizeni ezihlukene.