使用Terraform為彈性網卡綁定EIP-Elastic Compute Service-阿里雲

Elastic IP Address（Elastic IP Address）是可以獨立購買和持有的公網IP地址資源，當EIP和雲資源綁定後，雲資源可以通過EIP與公網通訊。例如在單個ECS執行個體上託管多個應用時，可以通過為每個應用程式指派獨立的輔助彈性網卡並綁定獨立的Elastic IP Address（EIP），實現每個應用對外呈現一個獨立的公網IP地址。本文將為您介紹如何為輔助彈性網卡綁定Elastic IP Address。

說明

本教程所含範例程式碼支援一鍵運行，您可以直接運行代碼。一鍵運行

所涉及資源

alicloud_eip_address：建立EIP。
alicloud_eip_association：將EIP綁定至雲資源，例如將EIP綁定至ECS執行個體或者彈性網卡。
alicloud_vpc：建立Virtual Private Cloud。
alicloud_vswitch：建立虛擬交換器。
alicloud_security_group：建立安全性群組。
alicloud_security_group_rule：為安全性群組添加存取控制規則。
alicloud_ecs_network_interface：建立彈性網卡。

編寫設定檔

建立terraform.tf檔案，輸入以下內容並儲存。

provider "alicloud" {
  region = var.region
}

# 資源將要建立的地區
variable "region" {
  default     = "cn-beijing"
  description = "The region where the resources will be created."
}

# 輸入已有的VPC ID，當為已有ECS執行個體綁定彈性網卡時，該值必填，且值為ECS執行個體所對應的VPC。
variable "vpc_id" {
  default     = ""
  description = "When binding an ENI to an existing ECS instance, this value is required and must be the VPC associated with the ECS instance."
}

# 指定VPC的CIDR塊，當填入vpc_id時，該值可不填。
variable "vpc_cidr_block" {
  default     = "192.168.0.0/16"
  description = "Specify the CIDR block of the VPC. If the vpc_id is provided, this value can be left blank."
}

# 輸入可用性區域，當為已有ECS執行個體綁定彈性網卡時，該值必填，且值為ECS執行個體所在可用性區域。
variable "zone_id" {
  default     = ""
  description = "When binding an ENI to an existing ECS instance, this value is required and must be the zone where the ECS instance is located."
}

# 指定VSwitch的CIDR塊，CIDR塊需在VPC CIDR塊的範圍內
variable "vswitch_cidr_block" {
  default     = "192.168.0.0/24"
  description = "Specify the CIDR block of the VSwitch. The CIDR block must be within the range of the VPC CIDR block."
}

# 訪問彈性網卡的源地址
variable "source_ip" {
  description = "The IP address you used to access the ENI."
  type        = string
  default     = "0.0.0.0/0"
}

# 指定彈性網卡的私網IP地址
variable "private_ip" {
  description = "The primary private IP address of the ENI. The specified IP address must be available within the CIDR block of the VSwitch. If this parameter is not specified, an available IP address is assigned from the VSwitch CIDR block at random."
  type        = string
  default     = ""
}

locals {
  new_zone_id = var.zone_id == ""
  create_vpc  = var.vpc_id == ""
}

resource "alicloud_eip" "eip" {
  address_name = "test_eip"
}

resource "alicloud_vpc" "vpc" {
  count      = local.create_vpc ? 1 : 0
  vpc_name   = "test_vpc"
  cidr_block = var.vpc_cidr_block
}

data "alicloud_zones" "default" {
  count                       = local.new_zone_id ? 1 : 0
  available_resource_creation = "VSwitch"
}

resource "alicloud_vswitch" "vswitch" {
  vswitch_name = "test_vswitch"
  cidr_block   = var.vswitch_cidr_block
  zone_id      = local.new_zone_id ? data.alicloud_zones.default[0].zones.0.id : var.zone_id
  vpc_id       = local.create_vpc ? alicloud_vpc.vpc[0].id : var.vpc_id
}

resource "alicloud_security_group" "group" {
  security_group_name = "test_sg"
  vpc_id              = local.create_vpc ? alicloud_vpc.vpc[0].id : var.vpc_id
}

# 添加允許TCP 80連接埠入方向流量的規則
resource "alicloud_security_group_rule" "allow_80_tcp" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "80/80"
  priority          = 1
  security_group_id = alicloud_security_group.group.id
  cidr_ip           = var.source_ip
}

resource "alicloud_network_interface" "default" {
  network_interface_name             = "test_eni"
  vswitch_id                         = alicloud_vswitch.vswitch.id
  security_group_ids                 = [alicloud_security_group.group.id]
  primary_ip_address                 = var.private_ip
  secondary_private_ip_address_count = 1
}

resource "alicloud_eip_association" "default" {
  allocation_id = alicloud_eip.eip.id
  instance_type = "NetworkInterface"
  instance_id   = alicloud_network_interface.default.id
}

建立資源

以下命令需要在terraform.tf檔案所在目錄執行。

運行terraform init進行初始化，當返回如下資訊時，表示初始化完成。

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

運行terraform apply並根據提示輸入yes建立資源，當返回如下資訊時，表示資源建立完成。
```
Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_vpc.vpc: Creating...
alicloud_eip.eip: Creating...

...

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.
```
說明
當您建立彈性網卡是為了綁定到已有ECS執行個體時，可以執行terraform apply傳相應的參數，例如terraform apply -var source_ip=XX.XX.XX.XX -var vpc_id=vpc-2vc4ctyuxpq6nXXXXXXXXX -var zone_id=cn-beijing-a -var vswitch_cidr_block=XX.XX.XX.XX/XX。
運行terraform show查看已建立的資源，包括VPC、Elastic IP Address、彈性網卡等。
說明
您也可以在控制台查看所建立的資源。

清理資源

當您不再需要上述通過Terraform建立或管理的資源時，請運行terraform destroy命令以釋放資源。

terraform destroy

通過Terraform為彈性網卡綁定EIP

所涉及資源

編寫設定檔

建立資源

清理資源

相關文檔