feat: add dualstack support

Makes the necessary changes to the VPC, subnets, security groups and gateways to add IPv6 Dualstack support.

Signed-off-by: Ismayil Mirzali <[email protected]>

Author: Volatus

terraform/aws/templates/base.tf

@@ -53,6 +53,11 @@ variable "short_env_id" {
   type = string
 }
 
+variable "dualstack" {
+  type = bool
+  default = false
+}
+
 variable "vpc_cidr" {
   type    = string
   default = "10.0.0.0/16"
@@ -95,6 +100,7 @@ resource "aws_security_group_rule" "nat_to_internet_rule" {
   to_port     = 0
   protocol    = "-1"
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "nat_icmp_rule" {
@@ -105,6 +111,7 @@ resource "aws_security_group_rule" "nat_icmp_rule" {
   from_port   = -1
   to_port     = -1
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "nat_tcp_rule" {
@@ -189,6 +196,7 @@ resource "aws_security_group_rule" "internal_security_group_rule_icmp" {
   from_port         = -1
   to_port           = -1
   cidr_blocks       = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "internal_security_group_rule_allow_internet" {
@@ -198,6 +206,7 @@ resource "aws_security_group_rule" "internal_security_group_rule_allow_internet"
   from_port         = 0
   to_port           = 0
   cidr_blocks       = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "internal_security_group_rule_ssh" {
@@ -293,6 +302,7 @@ resource "aws_security_group_rule" "bosh_security_group_rule_allow_internet" {
   from_port         = 0
   to_port           = 0
   cidr_blocks       = ["0.0.0.0/0"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group" "jumpbox" {
@@ -316,6 +326,7 @@ resource "aws_security_group_rule" "jumpbox_ssh" {
   from_port         = 22
   to_port           = 22
   cidr_blocks       = ["${var.bosh_inbound_cidr}"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "jumpbox_rdp" {
@@ -325,6 +336,7 @@ resource "aws_security_group_rule" "jumpbox_rdp" {
   from_port         = 3389
   to_port           = 3389
   cidr_blocks       = ["${var.bosh_inbound_cidr}"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "jumpbox_agent" {
@@ -334,6 +346,7 @@ resource "aws_security_group_rule" "jumpbox_agent" {
   from_port         = 6868
   to_port           = 6868
   cidr_blocks       = ["${var.bosh_inbound_cidr}"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "jumpbox_director" {
@@ -343,6 +356,7 @@ resource "aws_security_group_rule" "jumpbox_director" {
   from_port         = 25555
   to_port           = 25555
   cidr_blocks       = ["${var.bosh_inbound_cidr}"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "jumpbox_egress" {
@@ -352,6 +366,7 @@ resource "aws_security_group_rule" "jumpbox_egress" {
   from_port         = 0
   to_port           = 0
   cidr_blocks       = ["0.0.0.0/0"]
+  ipv6_cidr_blocks  = var.dualstack ? ["::/0"] : null
 }
 
 resource "aws_security_group_rule" "bosh_internal_security_rule_tcp" {
@@ -375,6 +390,10 @@ resource "aws_security_group_rule" "bosh_internal_security_rule_udp" {
 resource "aws_subnet" "bosh_subnet" {
   vpc_id     = "${local.vpc_id}"
   cidr_block = "${cidrsubnet(var.vpc_cidr, 8, 0)}"
+  ipv6_cidr_block = var.dualstack ? "${cidrsubnet(aws_vpc.vpc[0].ipv6_cidr_block, 8, 0)}" : null
+
+  assign_ipv6_address_on_creation = var.dualstack
+  enable_dns64 = var.dualstack
 
   tags = {
     Name = "${var.env_id}-bosh-subnet"
@@ -391,6 +410,13 @@ resource "aws_route" "bosh_route_table" {
   route_table_id         = "${aws_route_table.bosh_route_table.id}"
 }
 
+resource "aws_route" "bosh_route_table_ipv6" {
+  count = var.dualstack ? 1 : 0
+  route_table_id         = "${aws_route_table.bosh_route_table.id}"
+  destination_ipv6_cidr_block = "::/0"
+  egress_only_gateway_id      = aws_egress_only_internet_gateway.egress_ipv6[0].id
+}
+
 resource "aws_route_table_association" "route_bosh_subnets" {
   subnet_id      = "${aws_subnet.bosh_subnet.id}"
   route_table_id = "${aws_route_table.bosh_route_table.id}"
@@ -401,6 +427,10 @@ resource "aws_subnet" "internal_subnets" {
   vpc_id            = "${local.vpc_id}"
   cidr_block        = "${cidrsubnet(var.vpc_cidr, 4, count.index+1)}"
   availability_zone = "${element(var.availability_zones, count.index)}"
+  ipv6_cidr_block   = var.dualstack ? "${cidrsubnet(aws_vpc.vpc[0].ipv6_cidr_block, 8, count.index + 1)}" : null
+
+  assign_ipv6_address_on_creation = var.dualstack
+  enable_dns64 = var.dualstack
 
   tags = {
     Name = "${var.env_id}-internal-subnet${count.index}"
@@ -420,6 +450,13 @@ resource "aws_route_table" "nated_route_table" {
   }
 }
 
+resource "aws_route" "internal_subnets_route_table_ipv6" {
+  count = var.dualstack ? 1 : 0
+  route_table_id         = "${aws_route_table.nated_route_table.id}"
+  destination_ipv6_cidr_block = "::/0"
+  egress_only_gateway_id      = aws_egress_only_internet_gateway.egress_ipv6[0].id
+}
+
 resource "aws_route_table_association" "route_internal_subnets" {
   count          = "${length(var.availability_zones)}"
   subnet_id      = "${element(aws_subnet.internal_subnets.*.id, count.index)}"
@@ -428,6 +465,19 @@ resource "aws_route_table_association" "route_internal_subnets" {
 
 resource "aws_internet_gateway" "ig" {
   vpc_id = "${local.vpc_id}"
+
+  tags = {
+    Name = "${var.env_id}"
+  }
+}
+
+resource "aws_egress_only_internet_gateway" "egress_ipv6" {
+  count = var.dualstack ? 1 : 0
+  vpc_id = "${local.vpc_id}"
+
+  tags = {
+    Name = "${var.env_id}"
+  }
 }
 
 locals {

terraform/aws/templates/cf_lb.tf

@@ -10,6 +10,7 @@ resource "aws_security_group" "cf_ssh_lb_security_group" {
 
   ingress {
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
     protocol    = "tcp"
     from_port   = 2222
     to_port     = 2222
@@ -20,6 +21,7 @@ resource "aws_security_group" "cf_ssh_lb_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {
@@ -52,6 +54,7 @@ resource "aws_security_group" "cf_ssh_lb_internal_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {
@@ -111,20 +114,23 @@ resource "aws_security_group" "cf_router_lb_security_group" {
 
   ingress {
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
     protocol    = "tcp"
     from_port   = 80
     to_port     = 80
   }
 
   ingress {
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
     protocol    = "tcp"
     from_port   = 443
     to_port     = 443
   }
 
   ingress {
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
     protocol    = "tcp"
     from_port   = 4443
     to_port     = 4443
@@ -135,6 +141,7 @@ resource "aws_security_group" "cf_router_lb_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {
@@ -167,6 +174,7 @@ resource "aws_security_group" "cf_router_lb_internal_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {
@@ -257,6 +265,7 @@ resource "aws_security_group" "cf_tcp_lb_security_group" {
 
   ingress {
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
     protocol    = "tcp"
     from_port   = 1024
     to_port     = 1123
@@ -267,6 +276,7 @@ resource "aws_security_group" "cf_tcp_lb_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {
@@ -306,6 +316,7 @@ resource "aws_security_group" "cf_tcp_lb_internal_security_group" {
     to_port     = 0
     protocol    = "-1"
     cidr_blocks = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
   }
 
   tags = {

terraform/aws/templates/concourse_lb.tf

@@ -18,6 +18,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_80" {
   from_port   = 80
   to_port     = 80
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }
@@ -28,6 +29,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_2222" {
   from_port   = 2222
   to_port     = 2222
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }
@@ -38,6 +40,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_443" {
   from_port   = 443
   to_port     = 443
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }
@@ -48,6 +51,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_egress" {
   from_port   = 0
   to_port     = 0
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }
@@ -141,6 +145,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_8844" {
   from_port   = 8844
   to_port     = 8844
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }
@@ -151,6 +156,7 @@ resource "aws_security_group_rule" "concourse_lb_internal_8443" {
   from_port   = 8443
   to_port     = 8443
   cidr_blocks = ["0.0.0.0/0"]
+  ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
 
   security_group_id = "${aws_security_group.concourse_lb_internal_security_group.id}"
 }

terraform/aws/templates/iso_segments.tf

@@ -24,10 +24,13 @@ locals {
 }
 
 resource "aws_subnet" "iso_subnets" {
-  count             = "${local.iso_az_count}"
-  vpc_id            = "${local.vpc_id}"
-  cidr_block        = "${cidrsubnet(var.vpc_cidr, 4, count.index + length(var.availability_zones) + 1)}"
-  availability_zone = "${element(var.availability_zones, count.index)}"
+  count                           = "${local.iso_az_count}"
+  vpc_id                          = "${local.vpc_id}"
+  cidr_block                      = "${cidrsubnet(var.vpc_cidr, 4, count.index + length(var.availability_zones) + 1)}"
+  ipv6_cidr_block                 = var.dualstack ? "${cidrsubnet(aws_vpc.vpc[0].ipv6_cidr_block, 8, count.index + 2 + length(var.availability_zones))}" : null
+  availability_zone               = "${element(var.availability_zones, count.index)}"
+  assign_ipv6_address_on_creation = true
+  enable_dns64                    = true
 
   tags = {
     Name = "${var.env_id}-iso-subnet${count.index}"

terraform/aws/templates/lb_subnet.tf

@@ -2,7 +2,10 @@ resource "aws_subnet" "lb_subnets" {
   count             = "${length(var.availability_zones)}"
   vpc_id            = "${local.vpc_id}"
   cidr_block        = "${cidrsubnet(var.vpc_cidr, 8, count.index+2)}"
+  ipv6_cidr_block   = var.dualstack ? "${cidrsubnet(aws_vpc.vpc[0].ipv6_cidr_block, 8, count.index + 1 + length(var.availability_zones))}" : null
   availability_zone = "${element(var.availability_zones, count.index)}"
+  assign_ipv6_address_on_creation = var.dualstack
+  enable_dns64 = var.dualstack
 
   tags = {
     Name = "${var.env_id}-lb-subnet${count.index}"
@@ -23,6 +26,13 @@ resource "aws_route" "lb_route_table" {
   route_table_id         = "${aws_route_table.lb_route_table.id}"
 }
 
+resource "aws_route" "lb_route_table_ipv6" {
+  count = var.dualstack ? 1 : 0
+  route_table_id         = "${aws_route_table.lb_route_table.id}"
+  destination_ipv6_cidr_block = "::/0"
+  egress_only_gateway_id = aws_egress_only_internet_gateway.egress_ipv6[0].id
+}
+
 resource "aws_route_table_association" "route_lb_subnets" {
   count          = "${length(var.availability_zones)}"
   subnet_id      = "${element(aws_subnet.lb_subnets.*.id, count.index)}"

terraform/aws/templates/vpc.tf

@@ -14,6 +14,7 @@ resource "aws_vpc" "vpc" {
   cidr_block           = "${var.vpc_cidr}"
   instance_tenancy     = "default"
   enable_dns_hostnames = true
+  assign_generated_ipv6_cidr_block = var.dualstack
 
   tags = {
     Name = "${var.env_id}-vpc"