Various fixes to the s2i2s project-setup workspace. Fix the openstack module requirements.

modules/complete_infra_setup/haproxy.tf

@@ -86,7 +86,7 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
     group = openstack_compute_servergroup_v2.main_haproxy_l7.id
   }
   block_device {
-    uuid                  = var.ubuntu_2204.uuid
+    uuid                  = var.ubuntu_2404.uuid
     source_type           = "image"
     volume_size           = 10
     boot_index            = 0
@@ -99,7 +99,7 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
     fixed_ip_v4 = var.main_haproxy_l7_ip.* [count.index]
   }
 
-  user_data = file("${var.ubuntu2204_data_file}")
+  user_data = file("${var.ubuntu2404_data_file}")
   # Do not replace the instance when the ssh key changes
   lifecycle {
     ignore_changes = [

modules/complete_infra_setup/internal-ca.tf

@@ -5,7 +5,7 @@ resource "openstack_compute_instance_v2" "internal_ca" {
   key_pair                = module.ssh_settings.ssh_key_name
   security_groups         = [var.default_security_group_name]
   block_device {
-    uuid                  = var.ubuntu_2204.uuid
+    uuid                  = var.ubuntu_2404.uuid
     source_type           = "image"
     volume_size           = 10
     boot_index            = 0
@@ -17,7 +17,7 @@ resource "openstack_compute_instance_v2" "internal_ca" {
     name        = var.main_private_network.name
     fixed_ip_v4 = var.basic_services_ip.ca
   }
-  user_data = file("${var.ubuntu2204_data_file}")
+  user_data = file("${var.ubuntu2404_data_file}")
   # Do not replace the instance when the ssh key changes
   lifecycle {
     ignore_changes = [

modules/complete_infra_setup/postgresql.tf

@@ -60,7 +60,7 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
   key_pair                = module.ssh_settings.ssh_key_name
   security_groups         = [var.default_security_group_name, openstack_networking_secgroup_v2.shared_postgresql_access.name]
   block_device {
-    uuid                  = var.ubuntu_2204.uuid
+    uuid                  = var.ubuntu_2404.uuid
     source_type           = "image"
     volume_size           = 10
     boot_index            = 0
@@ -76,7 +76,7 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
     fixed_ip_v4 = var.shared_postgresql_server_data.server_ip
   }
 
-  user_data = file("${var.ubuntu2204_data_file}")
+  user_data = file("${var.ubuntu2404_data_file}")
   # Do not replace the instance when the ssh key changes
   lifecycle {
     ignore_changes = [

modules/complete_infra_setup/prometheus.tf

@@ -11,7 +11,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
   key_pair                = module.ssh_settings.ssh_key_name
   security_groups         = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
   block_device {
-    uuid                  = var.ubuntu_2204.uuid
+    uuid                  = var.ubuntu_2404.uuid
     source_type           = "image"
     volume_size           = 10
     boot_index            = 0
@@ -23,7 +23,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
     name        = var.main_private_network.name
     fixed_ip_v4 = var.basic_services_ip.prometheus
   }
-  user_data = file("${var.ubuntu2204_data_file}")
+  user_data = file("${var.ubuntu2404_data_file}")
   # Do not replace the instance when the ssh key changes
   lifecycle {
     ignore_changes = [

modules/complete_infra_setup/ssh-jump-proxy.tf

@@ -6,7 +6,7 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
   key_pair                = module.ssh_settings.ssh_key_name
   security_groups         = [var.default_security_group_name, openstack_networking_secgroup_v2.access_to_the_jump_proxy.name]
   block_device {
-    uuid                  = var.ubuntu_2204.uuid
+    uuid                  = var.ubuntu_2404.uuid
     source_type           = "image"
     volume_size           = 30
     boot_index            = 0
@@ -18,7 +18,7 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
     name        = var.main_private_network.name
     fixed_ip_v4 = var.basic_services_ip.ssh_jump
   }
-  user_data = file("${var.ubuntu2204_data_file}")
+  user_data = file("${var.ubuntu2404_data_file}")
   # Do not replace the instance when the ssh key changes
   lifecycle {
     ignore_changes = [

s2i2s/project-setup/haproxy.tf

@@ -8,11 +8,15 @@ resource "openstack_compute_servergroup_v2" "main_haproxy_l7" {
   policies = ["anti-affinity"]
 }
 
-# Security group for traffic from Octavia LB to HAProxy
+# Security group for traffic from the Octavia LB to HAProxy.
+# The main LB uses the OVN provider, not amphora: OVN does not SNAT the traffic to
+# the amphora VIP, so the HAProxy L7 servers see the original client source IP.
+# Only the health monitor probes and the hairpinned traffic come from the private
+# subnet. Therefore the public listeners (80, 443) must accept any source.
 resource "openstack_networking_secgroup_v2" "main_lb_to_haproxy_l7" {
   name                 = "traffic_from_main_lb_to_haproxy_l7"
   delete_default_rules = "true"
-  description          = "Traffic coming from the main L4 lb directed to the haproxy l7 servers"
+  description          = "Traffic coming from the main L4 lb (OVN provider, client IP is preserved) directed to the haproxy l7 servers"
 }
 
 resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_1_peer" {
@@ -39,29 +43,34 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
 
 resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_80" {
   security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
-  description       = "Traffic from the octavia lb instance to HAPROXY l7 port 80"
+  description       = "HTTP traffic to HAPROXY l7 port 80, through the OVN based main lb. The source is the client IP"
   direction         = "ingress"
   ethertype         = "IPv4"
   protocol          = "tcp"
   port_range_min    = 80
   port_range_max    = 80
-  remote_ip_prefix  = local.main_private_subnet.cidr
+  remote_ip_prefix  = "0.0.0.0/0"
 }
 
 resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_443" {
   security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
-  description       = "Traffic from the octavia lb instance to HAPROXY l7 port 443"
+  description       = "HTTPS traffic to HAPROXY l7 port 443, through the OVN based main lb. The source is the client IP"
   direction         = "ingress"
   ethertype         = "IPv4"
   protocol          = "tcp"
   port_range_min    = 443
   port_range_max    = 443
-  remote_ip_prefix  = local.main_private_subnet.cidr
+  remote_ip_prefix  = "0.0.0.0/0"
 }
 
-resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880" {
+# HAPROXY stats, port 8880.
+# The OVN provider does not support allowed_cidrs on the listener, so this security
+# group is the only place where the stats can be restricted. Since OVN preserves the
+# client source IP, we can filter on the real client addresses instead of opening the
+# port to everybody. The private subnet is still needed for the health monitor probes.
+resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880_healthcheck" {
   security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
-  description       = "Traffic from the octavia lb instance to HAPROXY l7 port 8880"
+  description       = "Health monitor probes to the HAPROXY l7 stats port 8880"
   direction         = "ingress"
   ethertype         = "IPv4"
   protocol          = "tcp"
@@ -70,6 +79,28 @@ resource "openstack_networking_secgroup_rule_v2" "octavia_to_haproxy_l7_8880" {
   remote_ip_prefix  = local.main_private_subnet.cidr
 }
 
+resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_8880_stats_sources" {
+  for_each = {
+    d4s_vpn_1        = local.ssh_sources.d4s_vpn_1_cidr
+    d4s_vpn_2        = local.ssh_sources.d4s_vpn_2_cidr
+    s2i2s_vpn_1      = local.ssh_sources.s2i2s_vpn_1_cidr
+    s2i2s_vpn_2      = local.ssh_sources.s2i2s_vpn_2_cidr
+    infrascience_net = local.ssh_sources.infrascience_net_cidr
+    # Prometheus scrapes the HAPROXY stats: it reaches them over the private network,
+    # and through the load balancer public IP via its own floating IP
+    prometheus_private = local.basic_services_ip.prometheus_cidr
+    prometheus_public  = "${openstack_networking_floatingip_v2.prometheus_server_ip.address}/32"
+  }
+  security_group_id = openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.id
+  description       = "HAPROXY l7 stats port 8880 from ${each.key}"
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = 8880
+  port_range_max    = 8880
+  remote_ip_prefix  = each.value
+}
+
 # Ports in the main private network for HAProxy instances
 resource "openstack_networking_port_v2" "main_haproxy_l7_port" {
   count          = local.haproxy_l7_data.vm_count

s2i2s/project-setup/outputs.tf

@@ -154,6 +154,10 @@ output "ubuntu_2204" {
   value = local.ubuntu_2204
 }
 
+output "ubuntu_2404" {
+  value = local.ubuntu_2404
+}
+
 output "availability_zones_names" {
   value = local.availability_zones_names
 }
@@ -162,6 +166,10 @@ output "ubuntu2204_data_file" {
   value = local.ubuntu2204_data_file
 }
 
+output "ubuntu2404_data_file" {
+  value = local.ubuntu2404_data_file
+}
+
 output "mtu_size" {
   value = local.mtu_size
 }

s2i2s/project-setup/provider.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     openstack = {
       source  = "terraform-provider-openstack/openstack"
-      version = "~> 1.53.0"
+      version = ">= 2.0.0"
     }
   }
 }