feat: Support alicloud international

modules/alicloud/private-link/README.md

@@ -0,0 +1,124 @@
+# StreamNative Cloud - Managed AliCloud Private Link
+
+This Terraform module configures your AliCloud network to access private StreamNative BYOC pulsar service.
+
+# QuickStart
+
+## Create PrivateLink with default settings
+
+```hcl
+provider "alicloud" {
+  region = "<region>"
+}
+
+module "alicloud_private_link" {
+  source = "github.com/streamnative/terraform-managed-cloud//modules/alicloud/private-link?ref=main"
+
+  privatelink_service_id = "<privatelink_service_id>"
+  domain_name = "<pulsar_domain_suffix>"
+  endpoint_name = "streamnative-pulsar-endpoint"
+
+  vpc_id = "<vpc_id>"
+  vswitches = [
+    {
+        id = "<vswitch_id>"
+        zone = "<zone_id>"
+    },
+    {
+        id = "<vswitch_id2>"
+        zone = "<zone_id2>"
+    }
+  ]
+}
+```
+
+## Create PrivateLink with customized Security Group
+
+```hcl
+provider "alicloud" {
+  region = "region"
+}
+
+module "alicloud_private_link" {
+  source = "github.com/streamnative/terraform-managed-cloud//modules/alicloud/private-link?ref=main"
+
+  privatelink_service_id = "<privatelink_service_id>"
+  domain_name = "<pulsar_domain_suffix>"
+  endpoint_name = "streamnative-pulsar-endpoint"
+
+  vpc_id = "<vpc_id>"
+  vswitches = [
+    {
+        id = "<vswitch_id>"
+        zone = "<zone_id>"
+    },
+    {
+        id = "<vswitch_id2>"
+        zone = "<zone_id2>"
+    }
+  ]
+  security_group_ids = ["<security_group_id>"]
+}
+```
+
+Make sure you have the following inbound rules in your security group:
+
+- Allow TCP port 443 from the VPC CIDR
+- Allow TCP port 6651 from the VPC CIDR
+- Allow TCP port 9093 from the VPC CIDR
+- Allow TCP port 5671 from the VPC CIDR
+- Allow TCP port 8883 from the VPC CIDR
+
+## Run terraform
+
+After [authenticating to your AliCloud international account](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs#authentication) execute the following sequence of commands from the directory containing the `main.tf` configuration file:
+
+1. Run `terraform init`
+2. Run `terraform plan`
+3. Run `terraform apply`
+
+# Terraform Docs
+
+## Requirements
+
+| Name                                                                  | Version |
+| --------------------------------------------------------------------- | ------- |
+| <a name="requirement_alicloud"></a> [alicloud](#requirement_alicloud) | 1.248.0 |
+
+## Providers
+
+| Name                                                            | Version |
+| --------------------------------------------------------------- | ------- |
+| <a name="provider_alicloud"></a> [alicloud](#provider_alicloud) | 1.248.0 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name                                                                                                                                                           | Type     |
+| -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
+| [alicloud_privatelink_vpc_endpoint.this](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/privatelink_vpc_endpoint)           | resource |
+| [alicloud_privatelink_vpc_endpoint_zone.this](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/privatelink_vpc_endpoint_zone) | resource |
+| [alicloud_pvtz_zone.this](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/pvtz_zone)                                         | resource |
+| [alicloud_pvtz_zone_attachment.this](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/pvtz_zone_attachment)                   | resource |
+| [alicloud_pvtz_zone_record.this](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/pvtz_zone_record)                           | resource |
+| [alicloud_security_group.new](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/security_group)                                | resource |
+| [alicloud_security_group_rule.new](https://registry.terraform.io/providers/hashicorp/alicloud/1.248.0/docs/resources/security_group_rule)                      | resource |
+
+## Inputs
+
+| Name                                                                                                                  | Description                                                                                                       | Type                                                                        | Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Required |
+| --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------: |
+| <a name="input_domain_name"></a> [domain_name](#input_domain_name)                                                    | The domain suffix of the Pulsar endpoint, it should be obtained from StreamNative Cloud.                          | `string`                                                                    | n/a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |   yes    |
+| <a name="input_endpoint_name"></a> [endpoint_name](#input_endpoint_name)                                              | The name of the VPC endpoint will be created, used to identify from other endpoints.                              | `string`                                                                    | `"streamnative-pulsar-endpoint"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |    no    |
+| <a name="input_privatelink_service_id"></a> [privatelink_service_id](#input_privatelink_service_id)                   | The ID of the PrivateLink service, it should be obtained from StreamNative Cloud.                                 | `string`                                                                    | n/a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |   yes    |
+| <a name="input_security_group_ids"></a> [security_group_ids](#input_security_group_ids)                               | The list of security group IDs to associate with the endpoint, will create a new security group if this is empty. | `list(string)`                                                              | `[]`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |    no    |
+| <a name="input_security_group_inbound_rules"></a> [security_group_inbound_rules](#input_security_group_inbound_rules) | List of inbound rules for the security group, allowing traffic to the endpoint.                                   | <pre>list(object({<br> port = string<br> description = string<br> }))</pre> | <pre>[<br> {<br> "description": "Allow HTTPS traffic to the endpoint",<br> "port": "443/443"<br> },<br> {<br> "description": "Allow Pulsar traffic to the endpoint",<br> "port": "6651/6651"<br> },<br> {<br> "description": "Allow Kafka traffic to the endpoint",<br> "port": "9093/9093"<br> },<br> {<br> "description": "Allow AMQP traffic to the endpoint",<br> "port": "5671/5671"<br> },<br> {<br> "description": "Allow MQTT traffic to the endpoint",<br> "port": "8883/8883"<br> }<br>]</pre> |    no    |
+| <a name="input_vpc_id"></a> [vpc_id](#input_vpc_id)                                                                   | The ID of the VPC to create the endpoint in.                                                                      | `string`                                                                    | n/a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |   yes    |
+| <a name="input_vswitches"></a> [vswitches](#input_vswitches)                                                          | The list of VSwitches to associate with the endpoint.                                                             | <pre>list(object({<br> id = string<br> zone = string<br> }))</pre>          | n/a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |   yes    |
+
+## Outputs
+
+No outputs.

modules/alicloud/private-link/main.tf

@@ -0,0 +1,60 @@
+resource "alicloud_security_group" "new" {
+  count = length(var.security_group_ids) != 0 ? 0 : 1
+
+  security_group_name = "${var.endpoint_name}-sg"
+  vpc_id              = var.vpc_id
+  description         = "Security group for PrivateLink VPC Endpoint ${var.endpoint_name}"
+}
+
+resource "alicloud_security_group_rule" "new" {
+  count = length(var.security_group_ids) != 0 ? 0 : length(var.security_group_inbound_rules)
+
+  security_group_id = alicloud_security_group.new[0].id
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  cidr_ip           = "0.0.0.0/0"
+  port_range        = var.security_group_inbound_rules[count.index].port
+  policy            = "accept"
+  description       = var.security_group_inbound_rules[count.index].description
+}
+
+
+locals {
+  security_group_ids = length(var.security_group_ids) != 0 ? var.security_group_ids : [alicloud_security_group.new[0].id]
+}
+
+
+resource "alicloud_privatelink_vpc_endpoint" "this" {
+  service_id         = var.privatelink_service_id
+  security_group_ids = local.security_group_ids
+  vpc_id             = var.vpc_id
+  vpc_endpoint_name  = var.endpoint_name
+}
+
+resource "alicloud_privatelink_vpc_endpoint_zone" "this" {
+  count = length(var.vswitches)
+
+  endpoint_id = alicloud_privatelink_vpc_endpoint.this.id
+  vswitch_id  = var.vswitches[count.index].id
+  zone_id     = var.vswitches[count.index].zone
+}
+
+resource "alicloud_pvtz_zone" "this" {
+  zone_name = var.domain_name
+  remark    = "PrivateLink-${var.endpoint_name}"
+}
+
+resource "alicloud_pvtz_zone_attachment" "this" {
+  zone_id = alicloud_pvtz_zone.this.id
+  vpc_ids = [var.vpc_id]
+}
+
+resource "alicloud_pvtz_zone_record" "this" {
+  count = length(var.vswitches)
+
+  zone_id = alicloud_pvtz_zone.this.id
+  rr      = "*"
+  type    = "A"
+  value   = alicloud_privatelink_vpc_endpoint_zone.this[count.index].eni_ip
+  ttl     = 600
+}

modules/alicloud/private-link/variables.tf

@@ -0,0 +1,73 @@
+terraform {
+  required_providers {
+    alicloud = {
+      source  = "hashicorp/alicloud"
+      version = "1.248.0"
+    }
+  }
+}
+
+variable "privatelink_service_id" {
+  description = "The ID of the PrivateLink service, it should be obtained from StreamNative Cloud."
+  type        = string
+}
+
+variable "domain_name" {
+  description = "The domain suffix of the Pulsar endpoint, it should be obtained from StreamNative Cloud."
+  type        = string
+}
+
+variable "endpoint_name" {
+  description = "The name of the VPC endpoint will be created, used to identify from other endpoints."
+  type        = string
+  default     = "streamnative-pulsar-endpoint"
+}
+
+variable "vpc_id" {
+  description = "The ID of the VPC to create the endpoint in."
+  type        = string
+}
+
+variable "vswitches" {
+  description = "The list of VSwitches to associate with the endpoint."
+  type = list(object({
+    id   = string
+    zone = string
+  }))
+}
+
+variable "security_group_ids" {
+  description = "The list of security group IDs to associate with the endpoint, will create a new security group if this is empty."
+  type        = list(string)
+  default     = []
+}
+
+variable "security_group_inbound_rules" {
+  description = "List of inbound rules for the security group, allowing traffic to the endpoint."
+  type = list(object({
+    port        = string
+    description = string
+  }))
+  default = [
+    {
+      port        = "443/443",
+      description = "Allow HTTPS traffic to the endpoint"
+    },
+    {
+      port        = "6651/6651",
+      description = "Allow Pulsar traffic to the endpoint"
+    },
+    {
+      port        = "9093/9093",
+      description = "Allow Kafka traffic to the endpoint"
+    },
+    {
+      port        = "5671/5671",
+      description = "Allow AMQP traffic to the endpoint"
+    },
+    {
+      port        = "8883/8883",
+      description = "Allow MQTT traffic to the endpoint"
+    }
+  ]
+}