Add bastion_tags input variable

Allow bypass auto inference of bastion tags

Author: cmd-ntrf

aws/infrastructure.tf

@@ -13,6 +13,7 @@ module "design" {
   pool           = var.pool
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
+  bastion_tags   = var.bastion_tags
 }
 
 module "configuration" {

azure/infrastructure.tf

@@ -13,6 +13,7 @@ module "design" {
   pool           = var.pool
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
+  bastion_tags   = var.bastion_tags
 }
 
 module "configuration" {

common/design/main.tf

@@ -56,7 +56,7 @@ locals {
   # and we memorize the corresponding tags so we can determine which instances can be used as a
   # first hop when transferring files or executing remote commands with Terraform.
   agent_ip = chomp(data.http.agent_ip.response_body)
-  bastion_tags = [
+  bastion_tags = distinct(concat(var.bastion_tags, [
     for rule, values in var.firewall_rules :
     values.tag
     if values.ethertype == "IPv4" &&
@@ -66,7 +66,7 @@ locals {
       tonumber(split(".", strcontains(values.cidr, "/") ? cidrhost(values.cidr, 0) : values.cidr)[i]) <= tonumber(v) &&
       tonumber(split(".", strcontains(values.cidr, "/") ? cidrhost(values.cidr, -1) : values.cidr)[i]) >= tonumber(v)
     ])
-  ]
+  ]))
 }
 
 check "disk_space_per_tag" {

common/design/variables.tf

@@ -6,3 +6,4 @@ variable "pool" {}
 variable "firewall_rules" {}
 variable "min_disk_size" {}
 variable "image" {}
+variable "bastion_tags" {}

common/variables.tf

@@ -169,3 +169,9 @@ variable "eyaml_key" {
     error_message = "Unsupported private key format"
   }
 }
+
+variable "bastion_tags" {
+  type        = list(string)
+  default     = []
+  description = "Tags identifying instances that can be used by Terraform as the first hop to transfer files to the Puppet server."
+}

docs/README.md

@@ -960,6 +960,16 @@ install complementary modules with [r10k](https://github.com/puppetlabs/r10k).
 **Post build modification effect**: trigger scp of Puppetfile at next `terraform apply`.
 Each instance's Puppet agent will be reloaded following the installation of the new modules.
 
+### 4.22 bastion_tags (optional)
+
+**default_value** = `[]`
+
+Defines a list of tags identifying instances that can be used by Terraform as the first hop
+to transfer files to the Puppet server. By default, this list is infered from the list of
+[firewall rules](#416-firewall_rules-optional) and the public ip address of the agent calling
+`terraform apply`. Providing an explicit list of tags allow to bypass the firewall rule inference,
+which can be useful when the agent is in the same network as the cluster.
+
 ## 5. Cloud Specific Configuration
 
 ### 5.1 Amazon Web Services

gcp/infrastructure.tf

@@ -13,6 +13,7 @@ module "design" {
   pool           = var.pool
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
+  bastion_tags   = var.bastion_tags
 }
 
 module "configuration" {

incus/infrastructure.tf

@@ -8,6 +8,7 @@ module "design" {
   pool           = var.pool
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
+  bastion_tags   = var.bastion_tags
 }
 
 module "configuration" {

openstack/infrastructure.tf

@@ -8,6 +8,7 @@ module "design" {
   pool           = var.pool
   volumes        = var.volumes
   firewall_rules = var.firewall_rules
+  bastion_tags   = var.bastion_tags
 }
 
 module "configuration" {