VMware Cloud Director Terraform Provider

The vcd_external_network resource allows you to create and delete external networks in VMware Cloud Director. This resource requires system administrator privileges and is supported in provider version v2.2+.

Note: This resource is deprecated in favor of vcd_external_network_v2. Use the v2 resource for new implementations.

Key capabilities:

• Define multiple ip_scope blocks to support different IP ranges.
• Define multiple vsphere_network blocks to back the network with different vSphere objects.
• Control whether network resources (like IP/MAC of a router) are retained across deployments using retain_net_info_across_deployments (defaults to false).

provider "vcd" {
  user     = var.admin_user
  password = var.admin_password
  org      = "System"
  url      = "https://Vcd/api"
}

resource "vcd_external_network" "net" {
  name        = "my-ext-net"
  description = "Reference for vCD external network"

  ip_scope {
    gateway    = "192.168.30.49"
    netmask    = "255.255.255.240"
    dns1       = "192.168.0.164"
    dns2       = "192.168.0.196"
    dns_suffix = "mybiz.biz"

    static_ip_pool {
      start_address = "192.168.30.51"
      end_address   = "192.168.30.62"
    }
  }

  vsphere_network {
    name    = "myNetwork"
    type    = "DV_PORTGROUP"
    vcenter = "vcenter-name"
  }

  retain_net_info_across_deployments = false
}

The vcd_vapp_firewall_rules resource allows you to create, modify, and delete firewall settings and rules within a VMware Cloud Director vApp network. These rules can be applied to vApp networks connected to Org networks or vApp org networks that are fenced.

Warning: Using this resource overrides any existing firewall rules on the target vApp network. To avoid unintended rule deletion, it is recommended to have only one vcd_vapp_firewall_rules resource per vApp and vApp network.

resource "vcd_vapp_firewall_rules" "vapp-fw" {
  vapp_id        = vcd_vapp.web.id
  network_id     = vcd_vapp_network.vapp-net.id
  default_action = "drop"

  rule {
    name             = "drop-ftp-out"
    policy           = "drop"
    protocol         = "tcp"
    destination_port = "21"
    destination_ip   = "any"
    source_port      = "any"
    source_ip        = "10.10.0.0/24"
  }

  rule {
    name             = "allow-outbound"
    policy           = "allow"
    protocol         = "any"
    destination_port = "any"
    destination_ip   = "any"
    source_port      = "any"
    source_ip        = "10.10.0.0/24"
  }
}

The vcd_nsxt_alb_virtual_service resource manages ALB Virtual services for a specific NSX-T Edge Gateway. A virtual service advertises an IP address and ports to the external world and directs incoming client traffic to members in an ALB Pool.

Requirements:

• Provider version: v3.5+
• VCD version: 10.2+ with NSX-T and ALB enabled.

Key Concepts:

• Virtual IP: The service listens on a specific IP (virtual_ip_address or ipv6_virtual_ip_address).
• Application Profile: Defines the traffic type via application_profile_type (e.g., HTTP, HTTPS, L4, L4_TLS).
• Service Ports: You must define one or more service_port blocks to specify ports, ranges, and traffic types (e.g., TCP_PROXY).

resource "vcd_nsxt_alb_virtual_service" "test" {
  org = "my-org"
  name = "new-virtual-service"
  edge_gateway_id = data.vcd_nsxt_edgegateway.existing.id
  pool_id = vcd_nsxt_alb_pool.test.id
  service_engine_group_id = vcd_nsxt_alb_edgegateway_service_engine_group.assignment.service_engine_group_id
  virtual_ip_address = tolist(data.vcd_nsxt_edgegateway.existing.subnet)[0].primary_ip
  application_profile_type = "HTTP"
  service_port {
    start_port = 80
    type = "TCP_PROXY"
  }
}

The vcd_nsxt_edgegateway_l2_vpn_tunnel resource manages NSX-T Edge Gateway L2 VPN Tunnel sessions. This resource is supported in provider v3.11+ and VCD 10.4+ with NSX-T.

Key Concepts

• Session Modes: An Edge Gateway can function in either SERVER or CLIENT mode, but not both. You must create separate resources for the server-side and client-side sessions.
• Endpoint IPs: The local_endpoint_ip must be sub-allocated on the Edge Gateway where the tunnel is being configured.
• Peer Code Dependency: For CLIENT mode sessions, the peer_code argument is required. This value is computed by the SERVER mode session. Because the peer_code is updated when the server session changes, you may need to run terraform apply twice to ensure the client session correctly synchronizes with the server's configuration.
• Stretched Networks: You can associate one or more stretched networks with the tunnel. In CLIENT mode, you must explicitly define a tunnel_id for every stretched network.

# Example of a SERVER session
resource "vcd_nsxt_edgegateway_l2_vpn_tunnel" "server-session" {
  org             = "datacloud"
  edge_gateway_id = data.vcd_nsxt_edgegateway.server-testing.id
  name            = "server-session"
  session_mode    = "SERVER"
  local_endpoint_ip  = "10.10.50.2"
  remote_endpoint_ip = "1.2.2.3"
  pre_shared_key     = "secret_passphrase"

  stretched_network {
    network_id = data.vcd_network_routed_v2.test_network_server.id
  }
}

# Example of a CLIENT session connecting to the server
resource "vcd_nsxt_edgegateway_l2_vpn_tunnel" "client-session" {
  org             = "datacloud"
  edge_gateway_id = data.vcd_nsxt_edgegateway.client-testing.id
  name            = "client-session"
  session_mode     = "CLIENT"
  local_endpoint_ip  = "101.22.30.3"
  remote_endpoint_ip = "1.2.2.3"

  stretched_network {
    network_id = data.vcd_network_routed_v2.test_network_client.id
    tunnel_id  = 1
  }

  # Reference the computed peer_code from the server session
  peer_code = vcd_nsxt_edgegateway_l2_vpn_tunnel.server-session.peer_code
}

The vcd_vm_internal_disk resource allows you to create, update, and delete internal disks on existing Virtual Machines in VMware Cloud Director.

Important Constraints:

• VDC Fast Provisioning: Managing disks in a VM is only possible when VDC fast provisioning is disabled.
• New VM Disk Configuration: To adjust disk parameters during the initial creation of a new VM, use the override_template_disk argument within the vapp_vm resource instead of this resource.
• Disk Order: Bus and unit numbers do not guarantee the order in which the operating system detects disks. To ensure a specific disk presentation order, use Terraform depends_on clauses between disk resources.
• Provider Version: Supported in provider v2.7+.
• NVMe Support: nvme bus type requires provider v3.4.0+ and VCD 10.2.1+ or later.

resource "vcd_vm_internal_disk" "disk1" {
  vapp_name       = "my-vapp"
  vm_name         = "my-vm1"
  bus_type        = "sata"
  size_in_mb      = "13333"
  bus_number      = 0
  unit_number     = 1
  storage_profile = "Development"
  allow_vm_reboot = true
  depends_on      = [vcd_vapp_vm.web1]
}

The vcd_nsxt_alb_settings resource allows you to activate or deactivate Application Load Balancer (ALB) settings for a specific NSX-T Edge Gateway.

Requirements:

• Provider version: v3.5+
• VCD version: 10.2+ with NSX-T and ALB enabled.
• Permissions: Only a System Administrator can create this resource.

Key Behaviors:

• Activation/Deactivation: Use the is_active argument to enable or disable ALB.
• Deletion: Deleting this resource will automatically set the ALB status to false (disabled) on the Edge Gateway.
• Network Stacks:
  • If both service_network_specification and ipv6_service_network_specification are unset, a default IPv4 network (192.168.255.125/25) is used.
  • If both are set, the service engine group uses a dual IPv4 and IPv6 stack.
  • If only ipv6_service_network_specification is set, only IPv6 is used.

resource "vcd_nsxt_alb_settings" "example" {
  org             = "my-org"
  edge_gateway_id = data.vcd_nsxt_edgegateway.existing.id
  is_active       = true
}