From d6e5b184fdcf3e3436679795e2be4e09b2276862 Mon Sep 17 00:00:00 2001 From: Matthias Hauber Date: Fri, 12 Jun 2026 11:49:00 +0200 Subject: [PATCH] fix: update stackit version and correct firewall next hop IP description --- src/README.md | 3 ++- src/modules/connectivity/4-internal-network.tf | 2 +- src/modules/connectivity/README.md | 2 +- src/modules/connectivity/outputs.tf | 2 +- src/modules/management/README.md | 2 ++ 5 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/README.md b/src/README.md index a12acd8..52627e6 100644 --- a/src/README.md +++ b/src/README.md @@ -4,7 +4,7 @@ | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.10 | -| [stackit](#requirement\_stackit) | 0.96.0 | +| [stackit](#requirement\_stackit) | 0.98.0 | | [time](#requirement\_time) | 0.14.0 | | [vault](#requirement\_vault) | 5.9.0 | @@ -35,6 +35,7 @@ No resources. | [company\_name](#input\_company\_name) | Name of the company. | `string` | n/a | yes | | [connectivity](#input\_connectivity) | Connectivity configuration including DNS zones, network area, and firewall. Set firewall/network\_area to null to skip deployment. | 
object({
    dns_zones = optional(map(object({
      dns_name      = string
      name          = optional(string, null)
      contact_email = optional(string, null)
      type          = optional(string, "primary")
      acl           = optional(string, null)
      description   = optional(string, null)
      default_ttl   = optional(number, 3600)
    })), {})
    network_area = optional(object({
      ranges                = list(string)
      transfer_network      = string
      min_prefix_length     = optional(number, 24)
      max_prefix_length     = optional(number, 28)
      default_prefix_length = optional(number, 28)
    }), null)
    firewall = optional(object({
      zone                     = string
      flavor                   = string
      name                     = string
      volume_performance_class = optional(string, "storage_premium_perf4")
      volume_size              = optional(number, 16)
      lan_network_range        = string
      wan_network_range        = string
      lan_ip                   = optional(string, null)
      wan_ip                   = optional(string, null)
    }), null)
  })
| `null` | no | | [devops](#input\_devops) | DevOps module configuration. Set to null to skip deployment. | 
object({
    git_flavor             = optional(string, null)
    allowed_network_ranges = optional(list(string), ["0.0.0.0/0"])
  })
| `null` | no | +| [federated\_identity\_providers](#input\_federated\_identity\_providers) | List of federated identity providers to configure for the management service account. | 
list(object({
    name   = string
    issuer = string
    assertions = list(object({
      item     = string
      operator = string
      value    = string
    }))
  }))
| `[]` | no | | [labels](#input\_labels) | Additional labels to apply to all resources. | `map(string)` | `{}` | no | | [landing\_zones](#input\_landing\_zones) | Map of landing zones to create. Set corporate = true for network area connectivity, false for public. | 
map(object({
    project_name = string
    project_code = string
    owner_email  = string
    # Set to true for corporate landing zones (connected to network area), false for public
    corporate = optional(bool, true)
    env       = optional(string, "dev")
    role_assignments = optional(list(object({
      role    = string
      subject = string
    })), [])
    network_prefix_length = optional(number, null)
    custom_roles = optional(list(object({
      name        = string
      description = string
      permissions = list(string)
    })), [])
  }))
| `{}` | no | | [observability](#input\_observability) | Observability instance configuration for the management module. Set to null to skip observability deployment. | 
object({
    plan_name                              = optional(string, "Observability-Starter-EU01")
    acl                                    = optional(list(string), [])
    logs_retention_days                    = optional(number, 30)
    traces_retention_days                  = optional(number, 30)
    metrics_retention_days                 = optional(number, 90)
    metrics_retention_days_5m_downsampling = optional(number, 90)
    metrics_retention_days_1h_downsampling = optional(number, 90)
  })
| `null` | no | diff --git a/src/modules/connectivity/4-internal-network.tf b/src/modules/connectivity/4-internal-network.tf index 18718a7..cceebd6 100644 --- a/src/modules/connectivity/4-internal-network.tf +++ b/src/modules/connectivity/4-internal-network.tf @@ -6,7 +6,7 @@ resource "stackit_network" "lan" { count = var.firewall != null ? 1 : 0 project_id = stackit_resourcemanager_project.this.project_id - name = "lan_network" + name = "lan" ipv4_prefix = var.firewall.lan_network_range routed = true } diff --git a/src/modules/connectivity/README.md b/src/modules/connectivity/README.md index f7fa98b..0b8bcc6 100644 --- a/src/modules/connectivity/README.md +++ b/src/modules/connectivity/README.md @@ -62,7 +62,7 @@ No modules. |------|-------------| | [dns\_zone\_dns\_names](#output\_dns\_zone\_dns\_names) | Map of DNS zone keys to their DNS names | | [dns\_zone\_ids](#output\_dns\_zone\_ids) | Map of DNS zone keys to their zone IDs | -| [firewall\_next\_hop\_ip](#output\_firewall\_next\_hop\_ip) | The IP address to be used as next hop for the default route in the landing zones (firewall WAN IP). | +| [firewall\_next\_hop\_ip](#output\_firewall\_next\_hop\_ip) | The IP address to be used as next hop for the default route in the landing zones (firewall LAN IP). | | [firewall\_public\_ip](#output\_firewall\_public\_ip) | The public IP address of the firewall WAN interface. | | [network\_area\_id](#output\_network\_area\_id) | The ID of the created network area. | | [project\_container\_id](#output\_project\_container\_id) | The container ID of the created STACKIT project. | diff --git a/src/modules/connectivity/outputs.tf b/src/modules/connectivity/outputs.tf index 025db01..2d1c1ad 100644 --- a/src/modules/connectivity/outputs.tf +++ b/src/modules/connectivity/outputs.tf @@ -9,7 +9,7 @@ output "dns_zone_ids" { } output "firewall_next_hop_ip" { - description = "The IP address to be used as next hop for the default route in the landing zones (firewall WAN IP)." + description = "The IP address to be used as next hop for the default route in the landing zones (firewall LAN IP)." value = var.firewall != null ? stackit_network_interface.lan[0].ipv4 : null } diff --git a/src/modules/management/README.md b/src/modules/management/README.md index f26de67..b5c9b49 100644 --- a/src/modules/management/README.md +++ b/src/modules/management/README.md @@ -36,6 +36,7 @@ No modules. | [stackit_secretsmanager_instance.this](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/secretsmanager_instance) | resource | | [stackit_secretsmanager_user.default](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/secretsmanager_user) | resource | | [stackit_service_account.automation](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/service_account) | resource | +| [stackit_service_account_federated_identity_provider.this](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/service_account_federated_identity_provider) | resource | | [stackit_service_account_key.automation](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/service_account_key) | resource | | [time_rotating.key_rotate](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/rotating) | resource | | [vault_kv_secret_v2.object_storage_credentials](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/kv_secret_v2) | resource | @@ -46,6 +47,7 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [federated\_identity\_providers](#input\_federated\_identity\_providers) | List of federated identity providers to configure for the management service account. | 
list(object({
    name   = string
    issuer = string
    assertions = list(object({
      item     = string
      operator = string
      value    = string
    }))
  }))
| `[]` | no | | [labels](#input\_labels) | Additional labels to apply to all folders. | `map(string)` | `{}` | no | | [naming\_pattern](#input\_naming\_pattern) | Naming prefix for all resources in this module, e.g. "myco-pltfm-hub-prod". | `string` | n/a | yes | | [observability](#input\_observability) | Observability instance configuration. Set to null to skip observability deployment. | 
object({
    plan_name                              = optional(string, "Observability-Starter-EU01")
    acl                                    = optional(list(string), [])
    logs_retention_days                    = optional(number, 30)
    traces_retention_days                  = optional(number, 30)
    metrics_retention_days                 = optional(number, 90)
    metrics_retention_days_5m_downsampling = optional(number, 90)
    metrics_retention_days_1h_downsampling = optional(number, 90)
  })
| `null` | no |