internal_network.tf

locals {
  network_prefix_name = var.prefix
  az_number           = try(coalesce(var.cluster_network_internal_vpc_availability_zones_number, 2), 2)
  public_subnets = {
    tags = {
      "Purpose"                = "Kubernetes Internet facing traffic address pool"
      "kubernetes.io/role/elb" = 1
    }
  }
  private_subnets = {
    tags = {
      "Purpose"                = "Kubernetes internal traffic address pool"
      "karpenter.sh/discovery" = try(var.cluster_autoscaler_subnet_selector, var.prefix)
    }
  }
  intranet_subnets = {
    tags = {
      "Purpose"                         = "Kubernetes intranet traffic address pool"
      "kubernetes.io/role/internal-elb" = 1
    }
  }
  data_subnets = {
    tags = {
      "Purpose" = "Kubernetes intranet traffic address pool for stateful services"
    }
  }
  nat_gateway_type = {
    single_nat_gateway = {
      enable_nat_gateway     = true
      single_nat_gateway     = true
      one_nat_gateway_per_az = false
    },
    one_nat_gateway_per_subnet = {
      enable_nat_gateway     = true
      single_nat_gateway     = false
      one_nat_gateway_per_az = false
    },
    one_nat_gateway_per_az = {
      enable_nat_gateway     = true
      single_nat_gateway     = false
      one_nat_gateway_per_az = true
    }
  }
}

module "internal_network" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.20.0"

  create_vpc            = var.cluster_network_type == "internal"
  name                  = local.network_prefix_name
  cidr                  = try(coalesce(var.cluster_network_internal_vpc_cidr, "10.0.0.0/16"), "10.0.0.0/16")
  secondary_cidr_blocks = try(coalesce(var.cluster_network_internal_vpc_secondary_cidr_blocks, []), [])
  instance_tenancy      = try(coalesce(var.cluster_network_internal_vpc_instance_tenancy, "default"), "default")

  azs = slice(data.aws_availability_zones.available.names, 0, local.az_number)

  enable_dns_hostnames                 = try(coalesce(var.cluster_network_internal_vpc_enable_dns_hostnames, true), true)
  enable_dns_support                   = try(coalesce(var.cluster_network_internal_vpc_enable_dns_support, true), true)
  enable_network_address_usage_metrics = try(coalesce(var.cluster_network_internal_vpc_enable_network_address_usage_metrics, false), false)
  use_ipam_pool                        = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.enabled, false), false)
  ipv4_ipam_pool_id                    = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv4_pool_id, null), null)
  ipv4_netmask_length                  = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv4_netmask_length, null), null)
  enable_ipv6                          = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.enable_ipv6, false), false)
  ipv6_cidr                            = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv6_cidr, null), null)
  ipv6_ipam_pool_id                    = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv6_pool_id, null), null)
  ipv6_netmask_length                  = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv6_netmask_length, null), null)
  ipv6_cidr_block_network_border_group = try(coalesce(var.cluster_network_internal_vpc_ipam_pool_options.ipv6_cidr_block_network_border_group, null), null)
  enable_dhcp_options                  = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.enabled, false), false)
  dhcp_options_domain_name             = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.domain_name, ""), "")
  dhcp_options_domain_name_servers     = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.domain_name_servers, ["AmazonProvidedDNS"]), ["AmazonProvidedDNS"])
  dhcp_options_ntp_servers             = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.ntp_servers, []), [])
  dhcp_options_netbios_name_servers    = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.netbios_name_servers, []), [])
  dhcp_options_netbios_node_type       = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.netbios_node_type, ""), "")
  dhcp_options_tags                    = try(coalesce(var.cluster_network_internal_vpc_dhcp_options.tags, {}), {})
  vpc_tags                             = try(coalesce(var.cluster_network_internal_vpc_tags, {}), {})

  public_subnets                                               = try(slice(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_addresses, []), 0, local.az_number), [])
  public_subnet_assign_ipv6_address_on_creation                = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_assign_ipv6_address_on_creation, false), false)
  public_subnet_enable_dns64                                   = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_enable_dns64, true), true)
  public_subnet_enable_resource_name_dns_aaaa_record_on_launch = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_enable_resource_name_dns_aaaa_record_on_launch, true), true)
  public_subnet_enable_resource_name_dns_a_record_on_launch    = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_enable_resource_name_dns_a_record_on_launch, false), false)
  public_subnet_ipv6_prefixes                                  = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_ipv6_prefixes, []), [])
  public_subnet_ipv6_native                                    = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_ipv6_native, false), false)
  map_public_ip_on_launch                                      = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_map_public_ip_on_launch, false), false)
  public_subnet_private_dns_hostname_type_on_launch            = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_private_dns_hostname_type_on_launch, null), null)
  public_subnet_tags                                           = try(merge(local.public_subnets.tags, var.cluster_network_internal_public_ingress_subnets_subnets_tags.tags), local.public_subnets.tags)
  public_route_table_tags                                      = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_tags.route_table_tags, {}), {})
  public_subnet_tags_per_az                                    = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_tags.subnet_tags_per_az, {}), {})
  public_dedicated_network_acl                                 = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_acls.enabled, false), false)
  public_inbound_acl_rules = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_acls.inbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])
  public_outbound_acl_rules = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_acls.outbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])
  public_acl_tags = try(coalesce(var.cluster_network_internal_public_ingress_subnets_subnets_tags.acl_tags, {}), {})

  private_subnets                                               = try(slice(coalesce(var.cluster_network_internal_vpc_node_subnets_addresses, []), 0, local.az_number), [])
  private_subnet_assign_ipv6_address_on_creation                = try(coalesce(var.cluster_network_internal_vpc_node_subnets_assign_ipv6_address_on_creation, false), false)
  private_subnet_enable_dns64                                   = try(coalesce(var.cluster_network_internal_vpc_node_subnets_enable_dns64, true), true)
  private_subnet_enable_resource_name_dns_aaaa_record_on_launch = try(coalesce(var.cluster_network_internal_vpc_node_subnets_enable_resource_name_dns_aaaa_record_on_launch, true), true)
  private_subnet_enable_resource_name_dns_a_record_on_launch    = try(coalesce(var.cluster_network_internal_vpc_node_subnets_enable_resource_name_dns_a_record_on_launch, false), false)
  private_subnet_ipv6_prefixes                                  = try(coalesce(var.cluster_network_internal_vpc_node_subnets_ipv6_prefixes, []), [])
  private_subnet_ipv6_native                                    = try(coalesce(var.cluster_network_internal_vpc_node_subnets_ipv6_native, false), false)
  private_subnet_private_dns_hostname_type_on_launch            = try(coalesce(var.cluster_network_internal_vpc_node_subnets_private_dns_hostname_type_on_launch, null), null)
  private_subnet_tags                                           = try(merge(local.private_subnets.tags, var.cluster_network_internal_vpc_node_subnets_tags.tags), local.private_subnets.tags)
  private_subnet_tags_per_az                                    = try(coalesce(var.cluster_network_internal_vpc_node_subnets_tags.subnet_tags_per_az, {}), {})
  private_route_table_tags                                      = try(coalesce(var.cluster_network_internal_vpc_node_subnets_tags.route_table_tags, {}), {})
  private_dedicated_network_acl                                 = try(coalesce(var.cluster_network_internal_vpc_node_subnets_acls.enabled, false), false)
  private_inbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_node_subnets_acls.inbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])
  private_outbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_node_subnets_acls.outbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])

  private_acl_tags = try(coalesce(var.cluster_network_internal_vpc_node_subnets_tags.acl_tags, {}), {})

  database_subnets                                               = try(slice(coalesce(var.cluster_network_internal_vpc_data_subnets_addresses, []), 0, local.az_number), [])
  database_subnet_assign_ipv6_address_on_creation                = try(coalesce(var.cluster_network_internal_vpc_data_subnets_assign_ipv6_address_on_creation, false), false)
  database_subnet_enable_dns64                                   = try(coalesce(var.cluster_network_internal_vpc_data_subnets_enable_dns64, true), true)
  database_subnet_enable_resource_name_dns_aaaa_record_on_launch = try(coalesce(var.cluster_network_internal_vpc_data_subnets_enable_resource_name_dns_aaaa_record_on_launch, false), true)
  database_subnet_enable_resource_name_dns_a_record_on_launch    = try(coalesce(var.cluster_network_internal_vpc_data_subnets_enable_resource_name_dns_a_record_on_launch, false), false)
  database_subnet_ipv6_prefixes                                  = try(coalesce(var.cluster_network_internal_vpc_data_subnets_ipv6_prefixes, []), [])
  database_subnet_ipv6_native                                    = try(coalesce(var.cluster_network_internal_vpc_data_subnets_ipv6_native, false), false)
  database_subnet_private_dns_hostname_type_on_launch            = try(coalesce(var.cluster_network_internal_vpc_data_subnets_dns_hostname_type_on_launch, null), null)
  database_subnet_tags                                           = try(merge(local.data_subnets.tags, var.cluster_network_internal_vpc_data_subnets_tags.tags), local.data_subnets.tags)
  database_dedicated_network_acl                                 = try(coalesce(var.cluster_network_internal_vpc_data_subnets_acls.enabled, false), false)
  database_inbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_data_subnets_acls.inbound_rules,
    [{
      rule_number = 100
      rule_action = "allow"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_block  = "0.0.0.0/0"
  }]), [])
  database_outbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_data_subnets_acls.outbound_rules,
    [{
      rule_number = 100
      rule_action = "allow"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_block  = "0.0.0.0/0"
  }]), [])
  database_acl_tags = try(coalesce(var.cluster_network_internal_vpc_data_subnets_tags.acls_tags, {}), {})

  intra_subnets                                               = try(slice(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_addresses, []), 0, local.az_number), [])
  intra_subnet_assign_ipv6_address_on_creation                = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_assign_ipv6_address_on_creation, false), false)
  intra_subnet_enable_dns64                                   = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_enable_dns64, true), true)
  intra_subnet_enable_resource_name_dns_aaaa_record_on_launch = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_enable_resource_name_dns_aaaa_record_on_launch, true), true)
  intra_subnet_enable_resource_name_dns_a_record_on_launch    = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_enable_resource_name_dns_a_record_on_launch, false), false)
  intra_subnet_ipv6_prefixes                                  = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_ipv6_prefixes, []), [])
  intra_subnet_ipv6_native                                    = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_ipv6_native, false), false)
  intra_subnet_private_dns_hostname_type_on_launch            = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_dns_hostname_type_on_launch, null), null)
  intra_subnet_tags                                           = try(merge(local.intranet_subnets.tags, var.cluster_network_internal_vpc_private_ingress_subnets_tags.tags), local.intranet_subnets.tags)
  intra_route_table_tags                                      = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_tags.route_table_tags, {}), {})
  intra_dedicated_network_acl                                 = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_acls.enabled, false), false)
  intra_inbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_acls.inbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])

  intra_outbound_acl_rules = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_acls.outbound_rules, [{
    rule_number = 100
    rule_action = "allow"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_block  = "0.0.0.0/0"
  }]), [])

  intra_acl_tags = try(coalesce(var.cluster_network_internal_vpc_private_ingress_subnets_tags.acl_tags, {}), {})

  enable_nat_gateway     = local.nat_gateway_type[try(coalesce(var.cluster_network_internal_vpc_nat_gateway_type, "one_nat_gateway_per_az"), "one_nat_gateway_per_az")].enable_nat_gateway
  single_nat_gateway     = local.nat_gateway_type[try(coalesce(var.cluster_network_internal_vpc_nat_gateway_type, "one_nat_gateway_per_az"), "one_nat_gateway_per_az")].single_nat_gateway
  one_nat_gateway_per_az = local.nat_gateway_type[try(coalesce(var.cluster_network_internal_vpc_nat_gateway_type, "one_nat_gateway_per_az"), "one_nat_gateway_per_az")].one_nat_gateway_per_az

  tags = local.tags
}

module "internal_network_vpc_endpoints" {
  source  = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
  version = "5.19.0"

  create             = try(var.cluster_network_type == "internal" && var.cluster_network_internal_vpc_endpoints.enabled, false)
  endpoints          = try(var.cluster_network_internal_vpc_endpoints.services, {})
  security_group_ids = try(coalesce(var.cluster_network_internal_vpc_endpoints.security_group_ids, []), [])
  vpc_id             = try(module.internal_network.vpc_id, null)
  subnet_ids         = try(module.internal_network.private_subnets, [])
  timeouts           = try(var.cluster_network_internal_vpc_endpoints.timeout_options, {})
  tags               = try(merge(var.cluster_network_internal_vpc_endpoints.tags, var.cluster_network_internal_vpc_tags), var.cluster_network_internal_vpc_tags, {})
}