loudstack_loadbalancer_rule.k8s_lb_talos_api: Creation complete after 8s [id=c25b350b-d190-473e-abab-ca55a909361e]
2025-07-04T11:25:23.975+0530 [DEBUG] State storage *statemgr.Filesystem declined to persist a state snapshot
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to cloudstack_firewall.default_lbfw01, provider "provider[\"registry.terraform.io/cloudstack/cloudstack\"]" produced an unexpected new value: Root object was present, but now absent.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to cloudstack_egress_firewall.default_egress_fw_01, provider "provider[\"registry.terraform.io/cloudstack/cloudstack\"]" produced an unexpected new value: Root object was present, but now absent.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
2025-07-04T11:25:23.984+0530 [INFO]  provider: plugin process exited: plugin=.terraform/providers/registry.terraform.io/cloudstack/cloudstack/0.5.0/darwin_arm64/terraform-provider-cloudstack_v0.5.0 id=66538
2025-07-04T11:25:23.984+0530 [DEBUG] provider: plugin exited

provider "cloudstack" {
  api_url    = var.cloudstack_api_url
  api_key    = var.cloudstack_api_key
  secret_key = var.cloudstack_secret_key

}


# Guest network used for K8s
resource "cloudstack_network" "k8s_nw_01" {
  name                = "terraform-net"
  cidr                = "10.0.0.0/16"
  network_offering    = "DefaultIsolatedNetworkOfferingWithSourceNatService"
  zone                = "10ee8574-1763-4b2f-8f4c-ec3cd1ae9bfd"
  project             = "a1d57a6a-19c4-40ae-962a-51cf6ea0edbe"
}

# Egress firewall and rules for outside communication
resource "cloudstack_egress_firewall" "default_egress_fw_01" {
  network_id          = cloudstack_network.k8s_nw_01.id
  depends_on          = [ cloudstack_network.k8s_nw_01,cloudstack_ipaddress.k8s_ips01 ]

  rule {
    cidr_list         = ["10.0.0.0/16"]
    protocol          = "tcp"
    ports             = ["53", "80", "443"]
  }

  rule {
    cidr_list         = ["10.0.0.0/16"]
    protocol          = "udp"
    ports             = ["53", "123"]
  }

  # TODO: Find out where to limit this rule to the destination ip of the Cloudstack API
  rule {
    cidr_list         = ["10.0.0.0/16"]
    ports             = ["8443"]
    protocol          = "tcp"
  }
}

# SNAT ip address
resource "cloudstack_ipaddress" "k8s_ips01" {
  network_id          = cloudstack_network.k8s_nw_01.id
  project             = "a1d57a6a-19c4-40ae-962a-51cf6ea0edbe"
}

# Load balancer for K8s API
resource "cloudstack_loadbalancer_rule" "k8s_lb_k8s_api" {
  depends_on = [ cloudstack_instance.controller,cloudstack_ipaddress.k8s_ips01]
  project             = "a1d57a6a-19c4-40ae-962a-51cf6ea0edbe" 
  algorithm           = "roundrobin"
  ip_address_id       = cloudstack_ipaddress.k8s_ips01.id
  member_ids          = [ cloudstack_instance.controller.id ]
  name                = "lb-k8s-api"
  private_port        = 6443
  public_port         = 6443
}

# Loadbalancer for Talos API
resource "cloudstack_loadbalancer_rule" "k8s_lb_talos_api" {
  depends_on = [ cloudstack_instance.controller,cloudstack_ipaddress.k8s_ips01 ]
  project             = "a1d57a6a-19c4-40ae-962a-51cf6ea0edbe"
  algorithm           = "roundrobin"
  ip_address_id       = cloudstack_ipaddress.k8s_ips01.id
  member_ids          = [cloudstack_instance.controller.id]
  name                = "lb-talos-api"
  private_port        = 50000
  public_port         = 50000
}

# Firewall for accessing the SNAT ip address
# TODO: set a valid range
resource "cloudstack_firewall" "default_lbfw01" {
  ip_address_id       = cloudstack_ipaddress.k8s_ips01.id
  depends_on = [ cloudstack_network.k8s_nw_01,cloudstack_ipaddress.k8s_ips01 ]

  rule {
    cidr_list         = ["0.0.0.0/0"]
    protocol          = "tcp"
    ports             = ["6443", "50000"]
  }
}



resource "cloudstack_instance" "controller" {
  depends_on = [ cloudstack_network.k8s_nw_01 ]
  name             = "server-1"
  service_offering = "Small Instance"
  network_id       = cloudstack_network.k8s_nw_01.id
  template         = "f8f06c80-57e4-11f0-8563-1e005f0001e1"
  zone             = "10ee8574-1763-4b2f-8f4c-ec3cd1ae9bfd"
  project          = "a1d57a6a-19c4-40ae-962a-51cf6ea0edbe"
}