netascode / terraform-aci-nac-aci

Terraform Cisco ACI Nexus-as-Code Module
https://registry.terraform.io/modules/netascode/nac-aci/aci
Apache License 2.0
17 stars 14 forks source link

Enhancement: Need support for uni-directional contracts #94

Open robvand opened 4 weeks ago

robvand commented 4 weeks ago

The current contract implementation does not allow for uni directional contracts under the subject.

Currently revFltPorts is hardcoded to "yes"

Uni directional contracts are required for situations where DSR is required with a SG to return flows to a L4-7 devices, and also when configuring leaking between VRFs where consumer and provider contracts are required in both directions.

resource "aci_rest_managed" "vzSubj" {
  for_each   = { for subj in var.subjects : subj.name => subj }
  dn         = "${aci_rest_managed.vzBrCP.dn}/subj-${each.value.name}"
  class_name = "vzSubj"
  content = {
    name        = each.value.name
    nameAlias   = each.value.alias
    descr       = each.value.description
    revFltPorts = "yes"
    prio        = each.value.qos_class
    targetDscp  = each.value.target_dscp
  }
}

Unidirectional contract payload:

{
    "vzSubj": {
        "attributes": {
            "dn": "uni/tn-demo-05/brc-test/subj-test1",
            "name": "test1",
            "revFltPorts": "false",
            "rn": "subj-test1",
            "status": "created"
        },
        "children": [
            {
                "vzInTerm": {
                    "attributes": {
                        "dn": "uni/tn-demo-05/brc-test/subj-test1/intmnl",
                        "status": "created",
                        "targetDscp": "64"
                    },
                    "children": []
                }
            },
            {
                "vzOutTerm": {
                    "attributes": {
                        "dn": "uni/tn-demo-05/brc-test/subj-test1/outtmnl",
                        "status": "created",
                        "targetDscp": "64"
                    },
                    "children": []
                }
            }
        ]
    }
}
therealdoug commented 4 weeks ago

Also need support for this. Resorting to an additional native hcl for these specific use cases.