├── sample-application ├── versions.tf ├── guestbook.yml └── main.tf ├── .github ├── dependabot.yml └── workflows │ └── ci.yml ├── aks ├── vnet.tf ├── main.tf ├── variables.tf ├── outputs.tf └── cluster.tf ├── cn-series ├── outputs.tf ├── variables.tf └── main.tf ├── .gitignore ├── SUPPORT.md ├── gke ├── main.tf ├── outputs.tf ├── variables.tf └── cluster.tf ├── eks ├── main.tf ├── outputs.tf ├── kubernetes.tf ├── variables.tf ├── locals.tf ├── nodegroup.tf └── cluster.tf ├── README.md └── LICENSE /sample-application/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_providers { 3 | panos = { 4 | source = "paloaltonetworks/panos" 5 | } 6 | } 7 | required_version = ">= 0.13" 8 | } 9 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | version: 2 2 | updates: 3 | - package-ecosystem: "github-actions" 4 | directory: "/" 5 | schedule: 6 | interval: "weekly" 7 | 8 | - package-ecosystem: "terraform" 9 | directory: "/" 10 | schedule: 11 | interval: "weekly" 12 | -------------------------------------------------------------------------------- /aks/vnet.tf: -------------------------------------------------------------------------------- 1 | resource "azurerm_virtual_network" "aks_vnet" { 2 | name = "${random_pet.prefix.id}-network" 3 | address_space = ["10.1.0.0/16"] 4 | location = azurerm_resource_group.rg.location 5 | resource_group_name = azurerm_resource_group.rg.name 6 | } 7 | 8 | resource "azurerm_subnet" "aks_subnet" { 9 | name = "${random_pet.prefix.id}-subnet" 10 | resource_group_name = azurerm_resource_group.rg.name 11 | virtual_network_name = azurerm_virtual_network.aks_vnet.name 12 | address_prefixes = ["10.1.0.0/24"] 13 | } 14 | -------------------------------------------------------------------------------- /cn-series/outputs.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Local .terraform directories 2 | **/.terraform/* 3 | 4 | # .tfstate files 5 | *.tfstate 6 | *.tfstate.* 7 | 8 | # Crash log files 9 | crash.log 10 | 11 | # Ignore any .tfvars files that are generated automatically for each Terraform run. Most 12 | # .tfvars files are managed as part of configuration and so should be included in 13 | # version control. 14 | # 15 | *.tfvars 16 | 17 | # Ignore override files as they are usually used to override resources locally and so 18 | # are not checked in 19 | override.tf 20 | override.tf.json 21 | *_override.tf 22 | *_override.tf.json 23 | 24 | # Include override files you do wish to add to version control using negated pattern 25 | # 26 | # !example_override.tf 27 | 28 | # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan 29 | # example: *tfplan* 30 | 31 | # Ignore YAML files generated by Terraform 32 | *.yaml -------------------------------------------------------------------------------- /.github/workflows/ci.yml: -------------------------------------------------------------------------------- 1 | 2 | --- 3 | name: CI/CD 4 | on: 5 | push: 6 | pull_request: 7 | 8 | # Run at midnight GMT on Fridays. 9 | schedule: 10 | - cron: '0 0 * * 5' 11 | 12 | jobs: 13 | validate: 14 | name: Validate 15 | runs-on: ubuntu-latest 16 | 17 | steps: 18 | - name: Check out source 19 | uses: actions/checkout@v2 20 | 21 | - name: Set up Terraform 22 | uses: hashicorp/setup-terraform@v1.3.2 23 | 24 | - name: terraform validate 25 | run: | 26 | cd ${GITHUB_WORKSPACE} 27 | for dir in $(find . -type d -not \( -name ".?*" \) -maxdepth 1 -mindepth 1); 28 | do 29 | echo "Validating directory ${dir}..." 30 | cd ${GITHUB_WORKSPACE}/${dir} 31 | terraform init -backend=false 32 | terraform validate 33 | done 34 | 35 | - name: terraform fmt 36 | run: | 37 | terraform fmt -check -recursive 38 | -------------------------------------------------------------------------------- /SUPPORT.md: -------------------------------------------------------------------------------- 1 | Community Supported 2 | 3 | The software and templates in the repo are released under an as-is, best effort, 4 | support policy. This software should be seen as community supported and Palo 5 | Alto Networks will contribute our expertise as and when possible. We do not 6 | provide technical support or help in using or troubleshooting the components of 7 | the project through our normal support options such as Palo Alto Networks 8 | support teams, or ASC (Authorized Support Centers) partners and backline support 9 | options. The underlying product used (the VM-Series firewall) by the scripts or 10 | templates are still supported, but the support is only for the product 11 | functionality and not for help in deploying or using the template or script 12 | itself. Unless explicitly tagged, all projects or work posted in our GitHub 13 | repository (at https://github.com/PaloAltoNetworks) or sites other than our 14 | official Downloads page on https://support.paloaltonetworks.com are provided 15 | under the best effort policy. 16 | -------------------------------------------------------------------------------- /gke/main.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | terraform { 19 | required_version = ">= 0.13" 20 | 21 | required_providers { 22 | google = { 23 | source = "hashicorp/google" 24 | version = "~> 3.47.0" 25 | } 26 | } 27 | } 28 | 29 | provider "google" { 30 | project = var.project 31 | region = var.region 32 | } 33 | 34 | -------------------------------------------------------------------------------- /aks/main.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | terraform { 18 | required_version = ">= 0.13" 19 | } 20 | 21 | provider "azurerm" { 22 | version = "~> 2.0" 23 | features {} 24 | } 25 | 26 | resource "azurerm_resource_group" "rg" { 27 | name = "${random_pet.prefix.id}-rg" 28 | location = var.location 29 | } 30 | 31 | resource "random_pet" "prefix" {} 32 | 33 | -------------------------------------------------------------------------------- /eks/main.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | terraform { 19 | required_version = ">= 0.13" 20 | } 21 | 22 | provider "aws" { 23 | version = ">= 2.28.1" 24 | region = var.region 25 | } 26 | 27 | provider "random" { 28 | version = "~> 2.1" 29 | } 30 | 31 | provider "null" { 32 | version = "~> 2.1" 33 | } 34 | 35 | provider "template" { 36 | version = "~> 2.1" 37 | } 38 | -------------------------------------------------------------------------------- /aks/variables.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | variable "location" { 19 | default = "East US" 20 | type = string 21 | description = "The Azure location" 22 | } 23 | 24 | variable "k8s_version" { 25 | default = "1.19.9" 26 | type = string 27 | description = "The version of Kubernetes" 28 | } 29 | 30 | variable "ssh_key" { 31 | type = string 32 | description = "The SSH public key" 33 | } 34 | -------------------------------------------------------------------------------- /eks/outputs.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | output "eks_cluster_name" { 18 | value = aws_eks_cluster.ControlPlane.name 19 | } 20 | 21 | output "eks_cluster_endpoint" { 22 | value = split("//", aws_eks_cluster.ControlPlane.endpoint)[1] 23 | } 24 | 25 | # output "eks_cluster_certificat_authority" { 26 | # value = aws_eks_cluster.ControlPlane.certificate_authority 27 | # } 28 | 29 | # output "config_map_aws_auth" { 30 | # value = local.config_map_aws_auth 31 | # } 32 | 33 | # output "kubeconfig" { 34 | # value = local.kubeconfig 35 | # } 36 | -------------------------------------------------------------------------------- /eks/kubernetes.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | resource "local_file" "kubeconfig" { 19 | content = local.kubeconfig 20 | filename = "${path.module}/${random_pet.prefix.id}-kubeconfig.yaml" 21 | } 22 | 23 | resource "local_file" "auth_configmap" { 24 | content = local.config_map_aws_auth 25 | filename = "${path.module}/${random_pet.prefix.id}-auth-configmap.yaml" 26 | } 27 | 28 | resource "null_resource" "apply_configmap" { 29 | provisioner "local-exec" { 30 | command = "kubectl apply -f ${local_file.auth_configmap.filename} --kubeconfig ${local_file.kubeconfig.filename}" 31 | } 32 | } 33 | 34 | -------------------------------------------------------------------------------- /aks/outputs.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | output "az_resource_group" { 18 | value = azurerm_resource_group.rg.name 19 | } 20 | 21 | output "az_cluster_name" { 22 | value = azurerm_kubernetes_cluster.default.name 23 | } 24 | 25 | output "az_cluster_endpoint" { 26 | value = azurerm_kubernetes_cluster.default.fqdn 27 | } 28 | 29 | output "run_this_command_to_configure_kubectl" { 30 | value = "az aks get-credentials --name ${azurerm_kubernetes_cluster.default.name} --resource-group ${azurerm_resource_group.rg.name}" 31 | } 32 | 33 | # output "az_cluster_kubeconfig" { 34 | # value = azurerm_kubernetes_cluster.default.kube_config_raw 35 | # } 36 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # cn-series-deploy 2 | A set of Terraform plans for deploying a Kubernetes cluster protected by a Palo Alto Networks CN-Series Next-Generation Firewall. Kubernetes environments supported include GKE, EKS, and AKS. 3 | 4 | ### Documentation 5 | All documentation for the Terraform plans contained in this repository are located in the project wiki located [here](https://github.com/PaloAltoNetworks/cn-series-deploy/wiki). 6 | 7 | ## Support 8 | 9 | This template/solution is released under an as-is, best effort, support 10 | policy. These scripts should be seen as community supported and Palo 11 | Alto Networks will contribute our expertise as and when possible. We do 12 | not provide technical support or help in using or troubleshooting the 13 | components of the project through our normal support options such as 14 | Palo Alto Networks support teams, or ASC (Authorized Support Centers) 15 | partners and backline support options. The underlying product used (the 16 | VM-Series firewall) by the scripts or templates are still supported, but 17 | the support is only for the product functionality and not for help in 18 | deploying or using the template or script itself. 19 | 20 | Unless explicitly tagged, all projects or work posted in our GitHub 21 | repository (at ) or sites other 22 | than our official Downloads page on 23 | are provided under the best effort policy. 24 | -------------------------------------------------------------------------------- /gke/outputs.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | output "cluster_master_ip" { 18 | value = google_container_cluster.cluster.endpoint 19 | description = "The IP endpoint of the GKE cluster master" 20 | } 21 | 22 | output "cluster_name" { 23 | value = google_container_cluster.cluster.name 24 | description = "The name of the GKE cluster" 25 | } 26 | 27 | output "cluster_location" { 28 | value = google_container_cluster.cluster.location 29 | description = "The zone in which the GKE cluster resides" 30 | } 31 | 32 | output "cluster_project" { 33 | value = google_container_cluster.cluster.project 34 | } 35 | 36 | output "kubectl_config_command" { 37 | value = "gcloud container clusters get-credentials ${google_container_cluster.cluster.name} --region ${google_container_cluster.cluster.location} --project ${google_container_cluster.cluster.project}" 38 | } -------------------------------------------------------------------------------- /eks/variables.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | # variable "project" { 19 | # type = string 20 | # default = "cnseries-testing" 21 | # description = "An identifier for the deployment" 22 | # } 23 | 24 | variable "ssh_key_name" { 25 | type = string 26 | description = "The SSH key pair name in EC2" 27 | } 28 | 29 | variable "region" { 30 | type = string 31 | default = "us-west-2" 32 | description = "The AWS region" 33 | } 34 | 35 | # variable "panorama_auth_key" { 36 | # type = string 37 | # description = "The VM auth key generated on Panorama" 38 | # } 39 | 40 | variable "k8s_version" { 41 | type = string 42 | default = "1.19" 43 | description = "Kubernetes version" 44 | } 45 | 46 | variable "instance_type" { 47 | type = string 48 | default = "m5.2xlarge" 49 | description = "The EC2 instance type" 50 | } 51 | -------------------------------------------------------------------------------- /gke/variables.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | variable "project" { 18 | type = string 19 | description = "The GCP project ID" 20 | } 21 | 22 | variable "region" { 23 | type = string 24 | description = "The GCP region" 25 | } 26 | 27 | # Not supported for GKE >= 1.19 28 | # variable "gke_username" { 29 | # type = string 30 | # description = "The cluster master username" 31 | # } 32 | 33 | # Not supported for GKE >= 1.19 34 | # variable "gke_password" { 35 | # type = string 36 | # description = "The cluster master password" 37 | 38 | # validation { 39 | # condition = length(var.gke_password) >= 16 40 | # error_message = "The cluster master passsword must be 16 characters or more." 41 | # } 42 | # } 43 | 44 | variable "k8s_version" { 45 | default = "1.20" # latest supported version of GKE as of 2021-09-28 46 | type = string 47 | description = "The version of Kubernetes" 48 | } 49 | -------------------------------------------------------------------------------- /aks/cluster.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | resource "azurerm_kubernetes_cluster" "default" { 19 | name = "${random_pet.prefix.id}-k8s" 20 | location = azurerm_resource_group.rg.location 21 | resource_group_name = azurerm_resource_group.rg.name 22 | kubernetes_version = var.k8s_version 23 | dns_prefix = "${random_pet.prefix.id}-k8s" 24 | 25 | default_node_pool { 26 | name = "default" 27 | node_count = 2 28 | vm_size = "Standard_D8s_v3" 29 | vnet_subnet_id = azurerm_subnet.aks_subnet.id 30 | availability_zones = ["1", "2"] 31 | } 32 | 33 | linux_profile { 34 | admin_username = "ubuntu" 35 | ssh_key { 36 | key_data = var.ssh_key 37 | } 38 | } 39 | 40 | identity { 41 | type = "SystemAssigned" 42 | } 43 | 44 | network_profile { 45 | network_plugin = "azure" 46 | load_balancer_sku = "standard" 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /eks/locals.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | locals { 19 | config_map_aws_auth = <= 1.19 65 | # username = var.gke_username 66 | # password = var.gke_password 67 | 68 | client_certificate_config { 69 | issue_client_certificate = false 70 | } 71 | } 72 | 73 | addons_config { 74 | network_policy_config { 75 | disabled = false 76 | } 77 | } 78 | 79 | # Needs container.googleapis.com API enabled on Project 80 | depends_on = [google_project_service.container] 81 | } 82 | 83 | // Unmanaged node pool definition 84 | resource "google_container_node_pool" "primary_preemptible_nodes" { 85 | name = "${var.project}-nodepool" 86 | location = var.region 87 | cluster = google_container_cluster.cluster.name 88 | 89 | node_count = 1 90 | 91 | node_config { 92 | preemptible = true 93 | machine_type = "n1-standard-8" 94 | 95 | metadata = { 96 | disable-legacy-endpoints = "true" 97 | } 98 | 99 | oauth_scopes = [ 100 | "https://www.googleapis.com/auth/logging.write", 101 | "https://www.googleapis.com/auth/monitoring", 102 | ] 103 | } 104 | } 105 | 106 | 107 | -------------------------------------------------------------------------------- /cn-series/variables.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | // Kubernetes 18 | variable "k8s_environment" { 19 | description = "The Kubernetes environment (gke|eks|aks|openshift|native)" 20 | type = string 21 | } 22 | 23 | // Panorama 24 | variable "panorama_ip" { 25 | description = "The primary Panorama IP address" 26 | type = string 27 | } 28 | 29 | variable "panorama_ip2" { 30 | default = "" 31 | description = "The secondary Panorama IP address" 32 | type = string 33 | } 34 | 35 | variable "panorama_auth_key" { 36 | description = "The Panorama auth key for VM-series registration" 37 | type = string 38 | } 39 | 40 | variable "panorama_device_group" { 41 | description = "The Panorama device group" 42 | type = string 43 | } 44 | 45 | variable "panorama_template_stack" { 46 | description = "The Panorama template stack" 47 | type = string 48 | } 49 | 50 | variable "panorama_collector_group" { 51 | description = "The Panorama log collector group" 52 | type = string 53 | } 54 | 55 | // CNI container 56 | variable "k8s_cni_image" { 57 | default = "docker.io/paloaltonetworks/pan_cni" 58 | description = "The CNI container image" 59 | type = string 60 | } 61 | 62 | variable "k8s_cni_version" { 63 | default = "latest" 64 | description = "The CNI container image version tag" 65 | type = string 66 | } 67 | 68 | // MP container 69 | variable "k8s_mp_init_image" { 70 | default = "docker.io/paloaltonetworks/pan_cn_mgmt_init" 71 | description = "The MP init container image" 72 | type = string 73 | } 74 | 75 | variable "k8s_mp_init_version" { 76 | default = "latest" 77 | description = "The MP init container image version tag" 78 | type = string 79 | } 80 | 81 | variable "k8s_mp_image" { 82 | default = "docker.io/paloaltonetworks/panos_cn_mgmt" 83 | description = "The MP container image" 84 | type = string 85 | } 86 | 87 | variable "k8s_mp_image_version" { 88 | default = "latest" 89 | description = "The MP container image version tag" 90 | type = string 91 | } 92 | 93 | variable "k8s_mp_cpu" { 94 | default = "2" 95 | description = "The MP container CPU limit" 96 | type = string 97 | } 98 | 99 | // DP container 100 | variable "k8s_dp_image" { 101 | default = "docker.io/paloaltonetworks/panos_cn_ngfw" 102 | description = "The DP container image" 103 | type = string 104 | } 105 | 106 | variable "k8s_dp_image_version" { 107 | default = "latest" 108 | description = "The DP container image version tag" 109 | type = string 110 | } 111 | 112 | variable "k8s_dp_cpu" { 113 | default = "1" 114 | description = "The DP container CPU limit" 115 | type = string 116 | } 117 | 118 | -------------------------------------------------------------------------------- /cn-series/main.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | terraform { 18 | required_version = ">= 0.13" 19 | } 20 | 21 | provider "helm" { 22 | kubernetes { 23 | config_path = "~/.kube/config" 24 | } 25 | } 26 | 27 | resource "helm_release" "cn-series" { 28 | name = "cn-series-deploy" 29 | repository = "https://paloaltonetworks.github.io/cn-series-helm/" 30 | chart = "cn-series" 31 | version = "0.1.5" 32 | timeout = 600 33 | wait = false 34 | 35 | // Kubernetes values 36 | set { 37 | name = "cluster.deployTo" 38 | value = var.k8s_environment 39 | type = "string" 40 | } 41 | 42 | // Panorma values 43 | set { 44 | name = "panorama.ip" 45 | value = var.panorama_ip 46 | type = "string" 47 | } 48 | 49 | set { 50 | name = "panorama.ip2" 51 | value = var.panorama_ip2 52 | type = "string" 53 | } 54 | 55 | set { 56 | name = "panorama.authKey" 57 | value = var.panorama_auth_key 58 | type = "string" 59 | } 60 | 61 | set { 62 | name = "panorama.deviceGroup" 63 | value = var.panorama_device_group 64 | type = "string" 65 | } 66 | 67 | set { 68 | name = "panorama.template" 69 | value = var.panorama_template_stack 70 | type = "string" 71 | } 72 | 73 | set { 74 | name = "panorama.cgName" 75 | value = var.panorama_collector_group 76 | type = "string" 77 | } 78 | 79 | // CNI values 80 | set { 81 | name = "cni.image" 82 | value = var.k8s_cni_image 83 | type = "string" 84 | } 85 | 86 | set { 87 | name = "cni.version" 88 | value = var.k8s_cni_version 89 | type = "string" 90 | } 91 | 92 | // MP values 93 | set { 94 | name = "mp.initImage" 95 | value = var.k8s_mp_init_image 96 | type = "string" 97 | } 98 | 99 | set { 100 | name = "mp.initVersion" 101 | value = var.k8s_mp_init_version 102 | type = "string" 103 | } 104 | 105 | set { 106 | name = "mp.image" 107 | value = var.k8s_mp_image 108 | type = "string" 109 | } 110 | 111 | set { 112 | name = "mp.version" 113 | value = var.k8s_mp_image_version 114 | type = "string" 115 | } 116 | 117 | set { 118 | name = "mp.cpuLimit" 119 | value = var.k8s_mp_cpu 120 | } 121 | 122 | // DP values 123 | set { 124 | name = "dp.image" 125 | value = var.k8s_dp_image 126 | type = "string" 127 | } 128 | 129 | set { 130 | name = "dp.version" 131 | value = var.k8s_dp_image_version 132 | type = "string" 133 | } 134 | 135 | set { 136 | name = "dp.cpuLimit" 137 | value = var.k8s_dp_cpu 138 | type = "string" 139 | } 140 | 141 | 142 | // Firewall values 143 | set { 144 | name = "firewall.failoverMode" 145 | value = "failopen" 146 | type = "string" 147 | } 148 | 149 | set { 150 | name = "firewall.operationMode" 151 | value = "daemonset" 152 | type = "string" 153 | } 154 | 155 | set { 156 | name = "firewall.serviceName" 157 | value = "pan-mgmt-svc" 158 | type = "string" 159 | } 160 | 161 | // Service account values 162 | set { 163 | name = "serviceAccount.create" 164 | value = "true" 165 | type = "string" 166 | } 167 | } 168 | -------------------------------------------------------------------------------- /sample-application/guestbook.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: sample-app 5 | annotations: { 6 | paloaltonetworks.com/firewall: pan-fw 7 | } 8 | --- 9 | apiVersion: apps/v1 10 | kind: Deployment 11 | metadata: 12 | name: redis-master 13 | labels: 14 | app: redis 15 | namespace: sample-app 16 | spec: 17 | selector: 18 | matchLabels: 19 | app: redis 20 | role: master 21 | tier: backend 22 | replicas: 1 23 | template: 24 | metadata: 25 | labels: 26 | app: redis 27 | role: master 28 | tier: backend 29 | spec: 30 | containers: 31 | - name: master 32 | image: k8s.gcr.io/redis:e2e # or just image: redis 33 | resources: 34 | requests: 35 | cpu: 100m 36 | memory: 100Mi 37 | ports: 38 | - containerPort: 6379 39 | --- 40 | apiVersion: v1 41 | kind: Service 42 | metadata: 43 | name: redis-master 44 | labels: 45 | app: redis 46 | role: master 47 | tier: backend 48 | namespace: sample-app 49 | spec: 50 | ports: 51 | - port: 6379 52 | targetPort: 6379 53 | selector: 54 | app: redis 55 | role: master 56 | tier: backend 57 | --- 58 | apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2 59 | kind: Deployment 60 | metadata: 61 | name: redis-slave 62 | labels: 63 | app: redis 64 | namespace: sample-app 65 | spec: 66 | selector: 67 | matchLabels: 68 | app: redis 69 | role: slave 70 | tier: backend 71 | replicas: 2 72 | template: 73 | metadata: 74 | labels: 75 | app: redis 76 | role: slave 77 | tier: backend 78 | spec: 79 | containers: 80 | - name: slave 81 | image: gcr.io/google_samples/gb-redisslave:v3 82 | resources: 83 | requests: 84 | cpu: 100m 85 | memory: 100Mi 86 | env: 87 | - name: GET_HOSTS_FROM 88 | value: dns 89 | # Using `GET_HOSTS_FROM=dns` requires your cluster to 90 | # provide a dns service. As of Kubernetes 1.3, DNS is a built-in 91 | # service launched automatically. However, if the cluster you are using 92 | # does not have a built-in DNS service, you can instead 93 | # access an environment variable to find the master 94 | # service's host. To do so, comment out the 'value: dns' line above, and 95 | # uncomment the line below: 96 | # value: env 97 | ports: 98 | - containerPort: 6379 99 | --- 100 | apiVersion: v1 101 | kind: Service 102 | metadata: 103 | name: redis-slave 104 | labels: 105 | app: redis 106 | role: slave 107 | tier: backend 108 | namespace: sample-app 109 | spec: 110 | ports: 111 | - port: 6379 112 | selector: 113 | app: redis 114 | role: slave 115 | tier: backend 116 | --- 117 | apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2 118 | kind: Deployment 119 | metadata: 120 | name: frontend 121 | labels: 122 | app: guestbook 123 | namespace: sample-app 124 | spec: 125 | selector: 126 | matchLabels: 127 | app: guestbook 128 | tier: frontend 129 | replicas: 3 130 | template: 131 | metadata: 132 | labels: 133 | app: guestbook 134 | tier: frontend 135 | spec: 136 | containers: 137 | - name: php-redis 138 | image: gcr.io/google-samples/gb-frontend:v4 139 | resources: 140 | requests: 141 | cpu: 100m 142 | memory: 100Mi 143 | env: 144 | - name: GET_HOSTS_FROM 145 | value: dns 146 | # Using `GET_HOSTS_FROM=dns` requires your cluster to 147 | # provide a dns service. As of Kubernetes 1.3, DNS is a built-in 148 | # service launched automatically. However, if the cluster you are using 149 | # does not have a built-in DNS service, you can instead 150 | # access an environment variable to find the master 151 | # service's host. To do so, comment out the 'value: dns' line above, and 152 | # uncomment the line below: 153 | # value: env 154 | ports: 155 | - containerPort: 80 156 | --- 157 | apiVersion: v1 158 | kind: Service 159 | metadata: 160 | name: frontend 161 | labels: 162 | app: guestbook 163 | tier: frontend 164 | namespace: sample-app 165 | annotations: 166 | service.beta.kubernetes.io/aws-load-balancer-type: nlb 167 | spec: 168 | # comment or delete the following line if you want to use a LoadBalancer 169 | #type: NodePort 170 | # if your cluster supports it, uncomment the following to automatically create 171 | # an external load-balanced IP for the frontend service. 172 | type: LoadBalancer 173 | ports: 174 | - port: 80 175 | selector: 176 | app: guestbook 177 | tier: frontend 178 | -------------------------------------------------------------------------------- /eks/nodegroup.tf: -------------------------------------------------------------------------------- 1 | ############################################################################################ 2 | # Copyright 2020 Palo Alto Networks. 3 | # 4 | # Licensed under the Apache License, Version 2.0 (the "License"); 5 | # you may not use this file except in compliance with the License. 6 | # You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software 11 | # distributed under the License is distributed on an "AS IS" BASIS, 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | # See the License for the specific language governing permissions and 14 | # limitations under the License. 15 | ############################################################################################ 16 | 17 | 18 | // Nodegroup IAM roles and policies 19 | resource "aws_iam_role" "NodeInstanceRole" { 20 | name = "${random_pet.prefix.id}-NodeInstanceRole" 21 | 22 | assume_role_policy = <