terraform-opentelekomcloud

terraform-opentelekomcloud

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator that renders Terraform JSON for Open Telekom Cloud:

• network: a VPC, its subnets with CIDRs derived in Python, and optionally a NAT gateway with an EIP and one SNAT rule per egress subnet
• bucket: a private OBS bucket with versioning, KMS server-side encryption (own key, given key or OBS default key) and a lifecycle rule

The output pins opentelekomcloud/opentelekomcloud 1.37.10 and needs Terraform >= 1.5.0.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/terraform-opentelekomcloud@sha256:<digest>
        output_path: lib/terraform-opentelekomcloud
    compile:
      - input_type: kadet
        input_paths:
          - lib/terraform-opentelekomcloud
        output_path: terraform/
        output_type: json

output_type: json is required: without it Kapitan writes YAML, which Terraform ignores.

The provider authenticates at plan time from its usual environment, for example OS_USERNAME, OS_PASSWORD and OS_DOMAIN_NAME, or OS_ACCESS_KEY and OS_SECRET_KEY. Credentials never go into the inventory or the output.

Example

parameters:
  generators:
    terraform-opentelekomcloud:
      tenant_name: eu-de_myproject
      region: eu-de
      network:
        platform:
          cidr: 10.20.0.0/16
          tags:
            env: prod
          subnets:
            kubernetes: {}              # 10.20.2.0/24
            database:
              cidr: 10.20.200.0/24
            jumphost:                   # 10.20.1.0/24, no internet egress
              egress: false
          nat:
            spec: "1"
            bandwidth_mbit: 200
            subnet: kubernetes
      bucket:
        tf-state:
          bucket: myproject-tf-state
          tags:
            env: prod

Inventory Contract

All keys live under parameters.generators.terraform-opentelekomcloud.

Inventory keys become Terraform resource names after lower-casing and replacing every character outside [a-z0-9_] with _ (a leading digit gets a _ prefix). Two keys that map to the same name fail the compile.

Network

A derived subnet is block index of size /<vpc prefix + newbits> inside the VPC, so 10.0.0.0/16 with the defaults gives 10.0.0.0/24, 10.0.1.0/24 and so on. The gateway is the first host of the subnet. The compile fails when a subnet lies outside the VPC, is longer than /28, overlaps another subnet or does not fit (index too large).

The DNS defaults are the OTC-internal resolvers (secondary DNS release note). The first entry becomes primary_dns, the second secondary_dns, and dns_list is set only for more than two entries. Keep the primary OTC-internal: managed services such as CCE need it.

nat.spec selects the NAT gateway size by its maximum SNAT connections:

The EIP is a 5_bgp address with a dedicated (PER) bandwidth. SNAT rules select subnets by network_id, not by CIDR.

Bucket

The bucket is always private and encrypted with SSE-KMS. Once versioning has been enabled, a bucket can only suspend it, never return to unversioned. The KMS key alias is <bucket>-obs with . replaced by -, because KMS aliases allow only letters, digits and :/_-. With create_key: false and no key_id, OBS uses its default master key.

Created keys live in the base project, because OBS accepts only base-project KMS keys for encryption (see the server_side_encryption note in the opentelekomcloud_obs_bucket docs). When tenant_name is a sub-project such as eu-de_myproject and a bucket creates a key, providers.tf.json gets a second provider block with alias base and tenant_name set to the part before the first _ (eu-de), and every KMS key uses provider = opentelekomcloud.base. The credentials must have KMS rights in that base project. A tenant_name without _ is already the base project and gets no alias.

The lifecycle rule default covers the whole bucket. Its 90 and 7 days are this generator’s choice, not vendor defaults.

Output

Terraform outputs, with <name> the sanitized key:

Resource reference (provider 1.37.10):

• opentelekomcloud_vpc_v1
• opentelekomcloud_vpc_subnet_v1
• opentelekomcloud_nat_gateway_v2
• opentelekomcloud_vpc_eip_v1
• opentelekomcloud_nat_snat_rule_v2
• opentelekomcloud_kms_key_v1
• opentelekomcloud_obs_bucket

The network defaults (OTC DNS pair, gateway on the first host, NAT spec "0", 100 Mbit/s PER bandwidth on a 5_bgp EIP, SNAT by network ID) mirror the community modules iits-consulting/terraform-opentelekomcloud-vpc and iits-consulting/terraform-opentelekomcloud-snat (MPL-2.0).

Resource arguments follow the provider documentation (MPL-2.0); the examples here are written for this generator.