deevnet_tenant (Resource) #

A tenant: its index and numbering, its DNS zone and key, its state-store credential, and its own API token. Everything but the name is issued by the API.

Example Usage #

resource "deevnet_tenant" "this" {
  name = "tdemo"
}

output "subnet" {
  value = deevnet_tenant.this.subnet
}

# What the API issued this tenant. This state is the authoritative copy.
output "state_credentials" {
  value = {
    endpoint   = deevnet_tenant.this.state_endpoint
    bucket     = deevnet_tenant.this.state_bucket
    key_prefix = deevnet_tenant.this.state_key_prefix
    access_key = deevnet_tenant.this.state_access_key
    secret_key = deevnet_tenant.this.state_secret_key
  }
  sensitive = true
}

Schema #

Required #

• name (String) 1-8 lowercase alphanumerics, starting with a letter: the SDN zone id, a DNS label and a state-store user.

Read-Only #

• api_token (String, Sensitive) The tenant’s own API token, for every later call it makes.
• controller_id (String) EVPN controller the tenant’s zone attaches to.
• dashboard_org_id (Number) The tenant’s own Grafana organization. The grafana provider ignores its provider-level org_id under basic auth, so set this as org_id on each grafana_folder and grafana_dashboard.
• dashboard_password (String, Sensitive) The Grafana login’s password. Issued by the API, which keeps it sealed, so a reconcile can hand it back. The organization’s three log data sources have fixed UIDs - deevnet-logs-workloads, deevnet-logs-platform, deevnet-logs-devices - the same on every site and on the take-home Pi.
• dashboard_url (String) The tenant’s Grafana, empty at a site with none (ADR-0024). Feed it to the grafana provider as GRAFANA_URL.
• dashboard_username (String) The tenant’s Grafana login: an Editor in its own organization and a member of no other.
• dns_reverse_zone (String) The tenant’s reverse DNS zone.
• dns_update_server (String) Where RFC 2136 updates go, if the tenant publishes names itself.
• dns_zone (String) The tenant’s forward DNS zone.
• gateway (String) The anycast gateway address workloads use on the overlay subnet.
• index (Number) The tenant index every identifier derives from (ADR-0002).
• log_account_id (Number) The tenant’s partition family: project 0 is what its workloads ship, 1 what the substrate publishes about it, 2 its devices’ logs from MQTT.
• log_endpoint (String) The log store this tenant ships to, empty at a site with none (ADR-0027).
• log_ingest_token (String, Sensitive) Writes this tenant’s own log partition. Issued by the API, which keeps it sealed - unlike the API token, so a reconcile can hand it back.
• log_read_token (String, Sensitive) Reads this tenant’s three log partitions, and no other tenant’s.
• log_select_header (String) The header a reader sends to choose a partition, for example X-Deevnet-Partition: 2-1. Without it a read returns project 0. It selects only among this tenant’s partitions: the proxy sets the store’s own headers itself.
• node (String) Hypervisor the tenant’s workloads land on.
• present (Boolean) Whether the API still holds this tenant. False after the API’s registry is lost, which makes the next apply restore it from this state rather than create a new one.
• secrets_stored (Boolean) Whether the API can still read the secrets it holds for this tenant. False after its Transit key is rebuilt or rotated past them, which makes the next apply send this state’s copies again - they are the authoritative ones.
• state_access_key (String) State store access key.
• state_bucket (String) The state store bucket this tenant writes to.
• state_endpoint (String) S3 endpoint of the state store (ADR-0007).
• state_key_prefix (String) The prefix this tenant may write.
• state_secret_key (String, Sensitive) State store secret key. This state is its authoritative copy (ADR-0015 §4).
• status (String) provisioning or ready.
• subnet (String) The tenant’s overlay subnet, in CIDR form.
• tsig_algorithm (String) Algorithm of the TSIG key.
• tsig_key_name (String) Name of the TSIG key that may update the tenant’s zones.
• tsig_secret (String, Sensitive) TSIG secret. This state is its authoritative copy (ADR-0015 §4).
• vnet_vni_base (Number) First VXLAN id of the tenant’s VNets, derived from the index.
• vrf_vni (Number) VXLAN id of the tenant’s VRF, derived from the index.