IBM VPC Gen 2 Terraform

Overview

This repository provides a set of Terraform configurations to automate the provisioning of an IBM Cloud VPC (Virtual Private Cloud) Gen 2 environment. It creates:

• A VPC (or uses an existing one)
• Subnets across multiple zones
• Public gateways
• Security groups and rules
• Virtual Server Instances (VSIs) for Ansible, OpenVPN, and RHEL
• Floating IPs and block storage

The included scripts (in the scripts/ directory) help automate post-provisioning tasks such as disk partitioning, mounting, and system hardening.

---

Custom Variables

Below is a quick reference for the variables in custom.tfvars (all are required unless otherwise noted):

• ibmcloud_api_key: IBM Cloud API key with VPC permissions
• vpc_name: Name for your VPC
• vsi_name: Name for the Ansible VSI
• vsi_openvpn_name: Name for the OpenVPN VSI
• rhel_image: RHEL image name or ID
• workstation_public_ip: Your workstation’s public IP in CIDR format
• create_vpc: Set to true to create a new VPC, or false to use an existing one
• existing_vpc_id: Existing VPC ID (if not creating a new one)
• ssh_private_key: SSH private key for accessing the VSIs (in base64 format)
• ssh_public_key: SSH public key (plain text)
• resource_group: IBM Cloud Resource Group (default: "Default")

---

Usage (Local Terraform CLI)

1. Create a new variable file called custom.tfvars.
2. Update the variables in custom.tfvars to match your environment.
3. Run:
   • terraform init
   • terraform plan --var-file=custom.tfvars
   • terraform apply --var-file=custom.tfvars
4. Wait for the resources to be provisioned in your IBM Cloud account.

---

Using with IBM Cloud Schematics

IBM Cloud Schematics allows you to run Terraform automation directly from the IBM Cloud web console, without needing a local Terraform installation. To use this repository with Schematics:

1. Clone or Fork this Repository

   • Make your own copy if you want to customize.

2. Create a Schematics Workspace

   • In the IBM Cloud console, go to Schematics > Workspaces and click Create workspace.
   • Set the source to this repository (GitHub URL).

3. Customize Variables

   • In the workspace, go to the Variables tab.
   • Enter the required variables (see above). You can copy the contents of your custom.tfvars or enter them in the UI.
   • Important:
     • ibmcloud_api_key must be set (use a secure method, e.g., as a sensitive variable).
     • Set create_vpc to true to create a new VPC, or false and provide existing_vpc_id to use an existing VPC.
     • Update rhel_image to match the RHEL image available in your region/account.
     • Set workstation_public_ip to your current public IP in CIDR format (e.g., 203.0.113.5/32).
     • Provide your SSH keys as required.

4. Run the Automation

   • Click Plan to preview changes.
   • Click Apply to provision resources.

5. Post-Provisioning

   • Use the floating IPs and SSH keys to access the provisioned VSIs.
   • The scripts in the scripts/ directory (e.g., ansible_mount.sh, ansible_authselect.sh, rhel9-cis-level2-fix.sh) can be run on the VSIs for additional configuration, such as mounting disks or applying security hardening.

---

Customization Notes

• Regions/Zones:
  • The default region is set to jp-tok (Tokyo). Update the provider.tf and subnet/zone variables if you need a different region.
• Images:
  • Ensure the rhel_image variable matches an image available in your IBM Cloud account/region.
• Resource Group:
  • Update the resource_group variable if you want to use a non-default resource group.
• SSH Keys:
  • You must provide your own SSH key pair for secure access to the VSIs.
• Scripts:
  • Review and modify the scripts in scripts/ as needed for your environment or compliance requirements.

---

What this Repository Does

This repository automates the creation of a secure, multi-zone IBM Cloud VPC environment with:

• VPC and subnets in three zones
• Public gateways for internet access
• Security groups with rules for SSH and other access
• Multiple VSIs (Ansible, OpenVPN, RHEL) with floating IPs
• Optional block storage and volume attachments
• Post-provisioning scripts for system configuration and hardening

You can use this as a starting point for more complex IBM Cloud VPC deployments, or as a template for your own infrastructure automation.