feat: add sg custom ingress rule support

README.md

@@ -500,6 +500,7 @@ proxy_url = VALUE
 | <a name="input_script_post_cluster_creation"></a> [script\_post\_cluster\_creation](#input\_script\_post\_cluster\_creation) | Script to run after cluster creation | `string` | `""` | no |
 | <a name="input_script_pre_start_io"></a> [script\_pre\_start\_io](#input\_script\_pre\_start\_io) | Script to run before starting IO | `string` | `""` | no |
 | <a name="input_set_dedicated_fe_container"></a> [set\_dedicated\_fe\_container](#input\_set\_dedicated\_fe\_container) | Create cluster with FE containers | `bool` | `false` | no |
+| <a name="input_sg_custom_ingress_rules"></a> [sg\_custom\_ingress\_rules](#input\_sg\_custom\_ingress\_rules) | Custom inbound rules to be added to the security group. | <pre>list(object({<br>    from_port  = string<br>    to_port    = string<br>    protocol   = string<br>    cidr_block = string<br>  }))</pre> | `[]` | no |
 | <a name="input_sg_id"></a> [sg\_id](#input\_sg\_id) | The security group id. | `string` | `""` | no |
 | <a name="input_smb_cluster_name"></a> [smb\_cluster\_name](#input\_smb\_cluster\_name) | The name of the SMB setup. | `string` | `"Weka-SMB"` | no |
 | <a name="input_smb_create_private_dns_resolver"></a> [smb\_create\_private\_dns\_resolver](#input\_smb\_create\_private\_dns\_resolver) | Create dns resolver for smb with outbound rule | `bool` | `false` | no |

modules/network/README.md

@@ -83,6 +83,7 @@ No modules.
 | [azurerm_nat_gateway.nat_gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/nat_gateway) | resource |
 | [azurerm_nat_gateway_public_ip_prefix_association.nat_ip_association](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/nat_gateway_public_ip_prefix_association) | resource |
 | [azurerm_network_security_group.sg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |
+| [azurerm_network_security_rule.sg_custom](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |
 | [azurerm_network_security_rule.sg_public_ssh](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |
 | [azurerm_network_security_rule.sg_weka_ui](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |
 | [azurerm_private_dns_zone.dns](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_dns_zone) | resource |
@@ -110,6 +111,7 @@ No modules.
 | <a name="input_private_dns_zone_name"></a> [private\_dns\_zone\_name](#input\_private\_dns\_zone\_name) | The private DNS zone name. | `string` | `""` | no |
 | <a name="input_private_dns_zone_use"></a> [private\_dns\_zone\_use](#input\_private\_dns\_zone\_use) | Determines whether to use private DNS zone. Required for LB dns name. | `bool` | `true` | no |
 | <a name="input_rg_name"></a> [rg\_name](#input\_rg\_name) | A predefined resource group in the Azure subscription. | `string` | n/a | yes |
+| <a name="input_sg_custom_ingress_rules"></a> [sg\_custom\_ingress\_rules](#input\_sg\_custom\_ingress\_rules) | Custom inbound rules to be added to the security group. | <pre>list(object({<br>    from_port  = string<br>    to_port    = string<br>    protocol   = string<br>    cidr_block = string<br>  }))</pre> | `[]` | no |
 | <a name="input_sg_id"></a> [sg\_id](#input\_sg\_id) | The security group id. | `string` | `""` | no |
 | <a name="input_subnet_name"></a> [subnet\_name](#input\_subnet\_name) | Subnet name, if exist. | `string` | `""` | no |
 | <a name="input_subnet_prefix"></a> [subnet\_prefix](#input\_subnet\_prefix) | Address prefixes to use for the subnet. | `string` | `"10.0.2.0/24"` | no |

modules/network/main.tf

@@ -88,7 +88,7 @@ resource "azurerm_subnet_nat_gateway_association" "subnet_nat_gateway_associatio
   depends_on     = [azurerm_subnet.subnet, azurerm_nat_gateway.nat_gateway, data.azurerm_subnet.subnet_data]
 }
 
-# ====================== sg ssh ========================== #
+# ====================== ssh sg ========================== #
 resource "azurerm_network_security_rule" "sg_public_ssh" {
   count                       = var.sg_id == "" ? length(var.allow_ssh_cidrs) : 0
   name                        = "${var.prefix}-ssh-sg-${count.index}"
@@ -104,7 +104,7 @@ resource "azurerm_network_security_rule" "sg_public_ssh" {
   network_security_group_name = azurerm_network_security_group.sg[0].name
 }
 
-# ====================== sg  ========================== #
+# ====================== ui sg ========================== #
 resource "azurerm_network_security_rule" "sg_weka_ui" {
   count                       = var.sg_id == "" ? length(var.allow_weka_api_cidrs) : 0
   name                        = "${var.prefix}-ui-sg-${count.index}"
@@ -120,6 +120,22 @@ resource "azurerm_network_security_rule" "sg_weka_ui" {
   network_security_group_name = azurerm_network_security_group.sg[0].name
 }
 
+# ====================== custom sg ========================== #
+resource "azurerm_network_security_rule" "sg_custom" {
+  count                       = var.sg_id == "" ? length(var.sg_custom_ingress_rules) : 0
+  name                        = "${var.prefix}-custom-sg-${count.index}"
+  resource_group_name         = data.azurerm_resource_group.rg.name
+  priority                    = 300 + (count.index + 1)
+  direction                   = "Inbound"
+  access                      = "Allow"
+  protocol                    = var.sg_custom_ingress_rules[count.index].protocol
+  source_port_range           = var.sg_custom_ingress_rules[count.index].from_port
+  destination_port_range      = var.sg_custom_ingress_rules[count.index].to_port
+  source_address_prefix       = var.sg_custom_ingress_rules[count.index].cidr_block
+  destination_address_prefix  = "*"
+  network_security_group_name = azurerm_network_security_group.sg[0].name
+}
+
 resource "azurerm_network_security_group" "sg" {
   count               = var.sg_id == "" ? 1 : 0
   name                = "${var.prefix}-sg"

modules/network/variables.tf

@@ -51,6 +51,17 @@ variable "allow_weka_api_cidrs" {
   default     = []
 }
 
+variable "sg_custom_ingress_rules" {
+  type = list(object({
+    from_port  = string
+    to_port    = string
+    protocol   = string
+    cidr_block = string
+  }))
+  default     = []
+  description = "Custom inbound rules to be added to the security group."
+}
+
 variable "vnet_rg_name" {
   type        = string
   default     = ""

prerequisites.tf

@@ -3,21 +3,22 @@ data "azurerm_resource_group" "rg" {
 }
 
 module "network" {
-  source                = "./modules/network"
-  prefix                = var.prefix
-  vnet_name             = var.vnet_name
-  subnet_name           = var.subnet_name
-  rg_name               = var.rg_name
-  vnet_rg_name          = var.vnet_rg_name
-  private_dns_rg_name   = var.private_dns_rg_name
-  address_space         = var.address_space
-  subnet_prefix         = var.subnet_prefix
-  allow_ssh_cidrs       = var.allow_ssh_cidrs
-  allow_weka_api_cidrs  = var.allow_weka_api_cidrs
-  private_dns_zone_name = var.private_dns_zone_name
-  private_dns_zone_use  = var.private_dns_zone_use
-  sg_id                 = var.sg_id
-  create_nat_gateway    = var.create_nat_gateway
+  source                  = "./modules/network"
+  prefix                  = var.prefix
+  vnet_name               = var.vnet_name
+  subnet_name             = var.subnet_name
+  rg_name                 = var.rg_name
+  vnet_rg_name            = var.vnet_rg_name
+  private_dns_rg_name     = var.private_dns_rg_name
+  address_space           = var.address_space
+  subnet_prefix           = var.subnet_prefix
+  allow_ssh_cidrs         = var.allow_ssh_cidrs
+  allow_weka_api_cidrs    = var.allow_weka_api_cidrs
+  sg_custom_ingress_rules = var.sg_custom_ingress_rules
+  private_dns_zone_name   = var.private_dns_zone_name
+  private_dns_zone_use    = var.private_dns_zone_use
+  sg_id                   = var.sg_id
+  create_nat_gateway      = var.create_nat_gateway
 }
 
 module "iam" {

variables.tf

@@ -43,6 +43,17 @@ variable "allow_weka_api_cidrs" {
   default     = []
 }
 
+variable "sg_custom_ingress_rules" {
+  type = list(object({
+    from_port  = string
+    to_port    = string
+    protocol   = string
+    cidr_block = string
+  }))
+  default     = []
+  description = "Custom inbound rules to be added to the security group."
+}
+
 variable "address_space" {
   type        = string
   description = "The range of IP addresses the virtual network uses."