cloudInit.yaml

heat_template_version: queens
## cli deploy
#$ openstack stack create <--parameter FGT_count=2> -t cloudInit.yml <stack_name>
# cli scale-up
#$ openstack stack update --wait --existing --parameter FGT_count=3 --parameter WS_count=2 <stack_name>

description: >
  Openstack demo infrastucture for Fortinet SecDays.
  The template deploys 4 fortigates (FGT), 2 FGT are used in HA
  2 others FGT are deployed with a resource group between the
  two first one in parallele to provided security in a High Availability


################## PARAMETERS ##################
parameters:
  mgmt_net:
    type: string
    description: My private network
    default: "mgmt"
  public_net:
    type: string
    description: External network for floating ips
    default: "public"
  inet:
    type: string
    description: External network for floating ips
    default: "inet"
  web_server_img_name:
    type: string
    description: Web Server image name in openstack
    default: "web_server"
  web_server_flavor:
    type: string
    description: Web Server flavor name in openstack
    default: "ds512M"
  fortigate_img_name:
    type: string
    description: Fortigate image name in openstack
    default: "fortigateVM_604"
  fortigate_flavor:
    type: string
    description: Fortigate flavor name in openstack
    default: "m1.fgt"
  FGT_count:
    type: number
    description: Number of FGT deployed
    default: 2
  WS_count:
    type: number
    description: Number of Web Server deployed
    default: 2
  WAN_CIDR:
    type: string
    default: "10.10.1"
  LAN_CIDR:
    type: string
    default: "10.20.1"
  Web_Server_CIDR:
    type: string
    description: CIDR for Web servers subnet
    default: "10.100.1"
  HA_CIDR:
    type: string
    description: CIDR for HA subnet
    default: "1.1.1"

################## RESOURCES ##################
resources:

# SUBNETs
  WAN:
    type: OS::Neutron::Net
    properties:
      name: "WAN"
      port_security_enabled: false

  WAN_subnet:
    type: OS::Neutron::Subnet
    properties:
      name: "WAN_subnet"
      network_id: { get_resource: WAN }
      cidr: { list_join: [".", [{ get_param: WAN_CIDR }, "0/24"]] }
      gateway_ip: { list_join: [".", [{ get_param: WAN_CIDR}, "254"]] }
      allocation_pools:
        - start: { list_join: [".", [{ get_param: WAN_CIDR}, "3"]] }
          end: { list_join: [".", [{ get_param: WAN_CIDR}, "250"]] }

  LAN:
    type: OS::Neutron::Net
    properties:
      name: "LAN"
      port_security_enabled: false

  LAN_subnet:
    type: OS::Neutron::Subnet
    properties:
      name: "LAN_subnet"
      network_id: { get_resource: LAN }
      cidr: { list_join: [".", [{ get_param: LAN_CIDR }, "0/24"]] }
      gateway_ip: null
      allocation_pools:
        - start: { list_join: [".", [{ get_param: LAN_CIDR}, "3"]] }
          end: { list_join: [".", [{ get_param: LAN_CIDR}, "250"]] }

  net01:
    type: OS::Neutron::Net
    properties:
      name: "NET_01"
      port_security_enabled: false

  net01_subnet:
    type: OS::Neutron::Subnet
    properties:
      name: "NET01_subnet"
      network_id: { get_resource: net01 }
      cidr: { list_join: [".", [{ get_param: Web_Server_CIDR }, "0/24"]] }
      gateway_ip: { list_join: [".", [{ get_param: Web_Server_CIDR}, "254"]] }
      allocation_pools:
        - start: { list_join: [".", [{ get_param: Web_Server_CIDR}, "3"]] }
          end: { list_join: [".", [{ get_param: Web_Server_CIDR}, "250"]] }

  net_ha:
    type: OS::Neutron::Net
    properties:
      name: "net_ha"
      port_security_enabled: false

  ha_subnet:
    type: OS::Neutron::Subnet
    properties:
      name: "HA_subnet"
      network_id: { get_resource: net_ha }
      cidr: { list_join: [".", [{ get_param: HA_CIDR }, "0/24"]] }
      gateway_ip: null
      enable_dhcp: false

# INSTANCES

# FGT WAN HA mode
  FGT_WAN:
    type: instance.yaml
    properties:
      image: { get_param: fortigate_img_name }
      flavor: { get_param: fortigate_flavor }
      net_id_list:
        # list of network to connect to
        - { get_resource: WAN }
        - { get_param: inet }
      hostname: "FGT_WAN"
      config: { get_file: ./config/FGT/fgt.conf } # conf to push on instance. !!!!! relative path !!!!!

# FGT LAN HA mode
  FGT_LAN:
    type: instance.yaml
    properties:
      image: { get_param: fortigate_img_name }
      flavor: { get_param: fortigate_flavor }
      net_id_list:
        - { get_resource: LAN }
        - { get_resource: net01 }
      hostname: "FGT_LAN"
      config: { get_file: ./config/FGT/fgt.conf }

# FGT ResourceGroup
# %index% -> loop index number
  FGTs:
    type: OS::Heat::ResourceGroup
    properties:
      count: { get_param: FGT_count } # specified with --parameter FGT_count=
      resource_def:
        type: instance.yaml
        properties:
          image: { get_param: fortigate_img_name }
          flavor: { get_param: fortigate_flavor }
          net_id_list:
            - { get_resource: WAN }
            - { get_resource: LAN }
            - { get_resource: net_ha }
          hostname: "FGT_%index%"
          config: { get_file: ./config/FGT/fgt.conf }

# UBUNTU ResourceGroup
  Web_Servers:
    type: OS::Heat::ResourceGroup
    properties:
      count: { get_param: WS_count }
      resource_def:
        type: instance.yaml
        properties:
          image: { get_param: web_server_img_name }
          flavor: { get_param: web_server_flavor }
          net_id_list: [{ get_resource: net01 }]
          hostname: "Web_server_%index%"
          config: { get_file: ./config/web_server/debian.conf }

################## OUTPUTS ##################
outputs:
  mgmtIP_FGT_WAN:
    value: { get_attr: [FGT_WAN, addresses, mgmt, 0, addr] }
  mgmtIP_FGT_LAN:
    value: { get_attr: [FGT_LAN, addresses, mgmt, 0, addr] }
  portWAN:
    value: { get_attr: [FGT_WAN, addresses, inet, 0, port] }
  FGTs:
    value: 
      repeat:
        template:
          [<%hostname%>, <%IP%>]
        for_each:
          <%IP%>: { get_attr: [FGTs, addresses, mgmt, 0, addr]}
          <%hostname%>: { get_attr: [FGTs, Hostname] }
        permutations: false
  IP_WebServers:
    value:
      repeat:
        template:
          [<%hostname%>, <%IP%>]
        for_each:
          <%IP%>: { get_attr: [Web_Servers, addresses, { get_attr: [net01, name] }, 0, addr]}
          <%hostname%>: { get_attr: [Web_Servers, Hostname] }
        permutations: false
  WAN_CIDR:
    value: { get_param: WAN_CIDR }
  LAN_CIDR:
    value: { get_param: LAN_CIDR }
  NET01_CIDR:
    value: { get_param: Web_Server_CIDR }
  HA_CIDR:
    value: { get_param: HA_CIDR }