Note:

Attach a Reserved IP to an Oracle Cloud Infrastructure Compute Instance using Terraform and cloud-init Script

Introduction

In the world of infrastructure as code (IaC), automating the provisioning and configuration of compute instances is essential for efficient and scalable cloud deployments. When it comes to attaching Reserved IP addresses to Oracle Cloud Infrastructure (OCI) Compute Instances, Terraform and cloud-init provide a powerful combination.

In OCI Compute Terraform module, there is no option to Attach a Reserved IP to a Compute Instance while the instance gets created. We can only attach Reserved IP after creation of the Instance. In this blog post, we will explore how to leverage Terraform and cloud-init script to attach a reserved IP to an OCI Compute instance seamlessly.

Objective

Attach a reserved IP to a OCI Compute instance seamlessly using Terraform and cloud-init script.

What is a Reserved IP?

A Reserved IP address is a static IP assigned to a compute instance within a virtual network. It ensures consistent connectivity for applications that require a fixed IP and simplifies network administration. Reserved IPs are commonly used in scenarios such as load balancing, firewall rules, and secure network communication.

Prerequisites

First, you need access to an OCI environment. If you don’t have one, you can easily create your Always Free instance, which comes with lots of free capacity and US$300 in trial credits.

When you have an environment, ensure that your user has been assigned to a group with permissions to manage the instance-family resources and storage-family. A security best practice has you create a user, instead of using a Console user that already has permissions assigned to it. If you need help, check out the docs to create a group and grant proper permissions to users.

  1. OCI Account
  2. Terraform Access. See this link for more details.
  3. Public Subnet, where the instance will be launched. This has to be attached to an Internet Gateway.
  4. Private Subnet, where the secondary VNIC gets created and assigns the Reserved IP. This has to be attached to a Service Gateway.
  5. Dynamic Group wherein the Resources in the group require the permissions to manage Network Family.
  6. Policies must be configured for Instance Principal Authentication.

Task 1: Set Up a Terraform Script

Here, we will add a cloud-init script as metadata to an OCI Terraform Create Compute Instance module. Also, we will pass Reserved IP OCID and Private Subnet OCID to the Compute VM as freeform tags.

resource "oci_core_public_ip" "pubip" {
  # In case of Multiple Instances has to be created, Provide the count in the vars file.
  # This block creates a Reserved Public IP from Oracle IP Pool
  count = var.instance_count
  compartment_id = var.compartment_id
  display_name   = var.res_ip_display_name
  lifetime       = "RESERVED"
  private_ip_id  = ""
}

resource "oci_core_instance" "pubiptest" {
  count = var.instance_count
  compartment_id      = var.compartment_id
  availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
  display_name        = var.display_name
  shape               = var.shape

  # We will pass Reserved Public IP OCID and Private Subnet OCID as a freeform tags to the instance
  freeform_tags = {
    "publicIP" = resource.oci_core_public_ip.pubip[count.index].id
    "SubnetId" = var.private_subnet_id
    }

  create_vnic_details {
    display_name     = var.vnic_display_name
    assign_public_ip = true
    subnet_id        = var.public_subnet_id
  }

  source_details {
    source_type = var.source_type
    source_id   = var.source_id
  }

  metadata = {
    ssh_authorized_keys = var.pub_key
    user_data = "${base64encode(file("./cloud-init.sh"))}"
  }
}

The above script will create a Reserved IP (considering the count variable value) and will spin up a Compute Instance with Ephemeral IP, which gets attached to the Primary VNIC.

In the Compute Metadata, we will pass the cloud-init script, which will assign the Reserved IP by replacing the existing Ephemeral IP.

Task 2: Understand the cloud-init Script

Task 2.1: Install OCI CLI and other required tools

Use the following command to install OCI CLI and jq (Parsing JSON).

`sudo yum install -y python36-oci-cli jq`

Task 2.2: Retrieve Instance Metadata

Task 2.3: Attach Secondary VNIC

Attach the Secondary VNIC to the Compute VM which will use the Private Subnet by running the following command.

oci compute instance attach-vnic --instance-id $instanceid --subnet-id $subnetid --auth instance_principal --wait

Task 2.4: Configure Routes

Task 2.5: Make Secondary VNIC route as Default route

Task 2.6: Delete Ephemeral Public IP

Task 2.7: Attach Reserved IP

We have the Public IP OCID from freeform tags and we have deleted the Ephermeral IP, so we can attach the Reserved IP to the Primary VNIC. Below command attaches Reserved IP to the Primary VNIC of the instance.

assign=$(oci network public-ip update --force --auth instance_principal --public-ip-id $publicIp --private-ip-id $privateIpId --wait-for-state ASSIGNED)

Task 2.8: Detach Secondary VNIC

Next Steps

This is a sample implementation and make the corresponding changes before using this as a cloud-init script. This has been tested with Oracle Linux 8.

If you choose any other Linux Flavor, the oci-cli installation procedure will change. For more details, see Installing the CLI.

Acknowledgments

Author - Rithesh Subramanian (OCI Cloud Architect)

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.