Skip to content

Prevent FIPs being released from project on terraform destroy #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 23, 2024

Conversation

sjpb
Copy link
Collaborator

@sjpb sjpb commented Feb 8, 2024

Prevent users outside the openstack project "stealing" the cluster's FIPs when the cluster infra is destroyed.

This is done by removing the openstack_networking_floatingip_v2 resources and instead directly defining the addresses of FIPs to be attached to fixed IPs. This means FIPs must be manually associated to the OpenStack project, but also means they are not released from the project on terraform destroy.

Note experimenting showed the following will be required on applying these changes:

  • Run terraform apply; terraform will destroy the openstack_networking_floatingip_v2. The FIP will be released from the project and the fixed to floating IP associations will be lost - but terraform will not error on this.
  • Add the FIPs back into the project manually.
  • Run terraform apply again. The FIPs will be reassociated with the fixed IPs.

@sjpb sjpb marked this pull request as ready for review February 16, 2024 15:09
@sjpb sjpb changed the base branch from prod2312-state to prod2312-merger February 23, 2024 15:26
@sjpb sjpb merged commit ade347c into prod2312-merger Feb 23, 2024
@sjpb sjpb mentioned this pull request Feb 23, 2024
5 tasks
@sjpb sjpb deleted the prod2312-fips branch July 19, 2024 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant