Go Other
Clone or download

README.md

terraform-provider-netscaler

Terraform Provider for Citrix NetScaler

Description

This project is a terraform custom provider for Citrix NetScaler. It uses the Nitro API to create/configure LB configurations.

Important note: The provider will not commit the config changes to NetScaler's persistent store.

Requirement

Usage

Running

  1. Copy the binary (either from the build or from the releases page) terraform-provider-netscaler to an appropriate location.

    Configure .terraformrc to use the netscaler provider. An example .terraformrc:

providers {
    netscaler = "<path-to-custom-providers>/terraform-provider-netscaler"
}
  1. Run terraform as usual
terraform plan
terraform apply
  1. The provider will not commit the config changes to NetScaler's persistent store. To do this, run the shell script ns_commit.sh:
export NS_URL=http://<host>:<port>/
export NS_USER=nsroot
export NS_PASSWORD=nsroot
./ns_commit.sh

To ensure that the config is saved on every run, we can use something like terraform apply && ns_commit.sh

Provider Configuration

provider "netscaler" {
    username = "${var.ns_user}"
    password = "${var.ns_password}"
    endpoint = "http://10.71.136.250/"
}

We can use a https URL and accept the untrusted authority certificate on the NetScaler by specifying insecure_skip_verify = true

Argument Reference

The following arguments are supported.

  • username - This is the user name to access to NetScaler. Defaults to nsroot unless environment variable NS_LOGIN has been set
  • password - This is the password to access to NetScaler. Defaults to nsroot unless environment variable NS_PASSWORD has been set
  • endpoint - (Required) Nitro API endpoint in the form http://<NS_IP>/ or http://<NS_IP>:<PORT>/. Can be specified in environment variable NS_URL
  • insecure_skip_verify - (Optional, true/false) Whether to accept the untrusted certificate on the NetScaler when the NetScaler endpoint is https

The username, password and endpoint can be provided in environment variables NS_LOGIN, NS_PASSWORD and NS_URL.

Resource Configuration

netscaler_lbvserver

resource "netscaler_lbvserver" "foo" {
  name = "sample_lb"
  ipv46 = "10.71.136.150"
  port = 443
  servicetype = "SSL"
  lbmethod = "ROUNDROBIN"
  persistencetype = "COOKIEINSERT"
  sslcertkey = "${netscaler_sslcertkey.foo.certkey}"
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/load-balancing/lbvserver.html for possible values for these arguments and for an exhaustive list of arguments. Additionally, you can specify the SSL certkey to be bound to this lbvserver using the sslcertkey parameter

netscaler_service

resource "netscaler_service" "backend_1" {
  ip = "10.33.44.55"
  port = 80
  servicetype = "HTTP"
  lbvserver = "${netscaler_lbvserver.foo.name}"
  lbmonitor = "${netscaler_lbmonitor.foo.name}"
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/basic/service.html for possible values for these arguments and for an exhaustive list of arguments. Additionally, you can specify the LB vserver to be bound to this service using the lbvserver parameter, and the lbmonitor parameter specifies the LB monitor to be bound.

netscaler_servicegroup

resource "netscaler_servicegroup" "backend_1" {
  servicegroupname = "backend_group_1"
  servicetype = "HTTP"
  lbvservers = ["${netscaler_lbvserver.foo.name}]"
  lbmonitor = "${netscaler_lbmonitor.foo.name}"
  servicegroupmembers = ["172.20.0.20:200:50","172.20.0.101:80:10",  "172.20.0.10:80:40"]

}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/basic/servicegroup.html for possible values for these arguments and for an exhaustive list of arguments. Additionally, you can specify the LB vservers to be bound to this service using the lbvservers parameter. The lbmonitor parameter specifies the LB monitor to be bound.

netscaler_csvserver

resource "netscaler_csvserver" "foo" {
  name = "sample_cs"
  ipv46 = "10.71.139.151"
  servicetype = "SSL"
  port = 443
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/content-switching/csvserver.html for possible values for these arguments and for an exhaustive list of arguments. Additionally, you can specify the SSL cert to be bound using the sslcertkey parameter

netscaler_sslcertkey

resource "netscaler_sslcertkey" "foo" {
  certkey = "sample_ssl_cert"
  cert = "/var/certs/server.crt"
  key = "/var/certs/server.key"
  expirymonitor = "ENABLED"
  notificationperiod = 90
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/ssl/sslcertkey.html for possible values for these arguments and for an exhaustive list of arguments.

netscaler_cspolicy

resource "netscaler_cspolicy" "foo" {
  policyname = "sample_cspolicy"
  url = "/cart/*"
  csvserver = "${netscaler_csvserver.foo.name}"
  targetlbvserver = "${netscaler_lbvserver.foo.name}"
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/content-switching/cspolicy.html for possible values for these arguments and for an exhaustive list of arguments.

netscaler_lbmonitor

resource "netscaler_lbmonitor" "foo" {
  monitorname = "sample_lb_monitor"
  type = "HTTP"
  interval = 350
  resptimeout = 250
}
Argument Reference

See https://docs.citrix.com/en-us/netscaler/11-1/nitro-api/nitro-rest/api-reference/configuration/load-balancing/lbmonitor.html for possible values for these arguments and for an exhaustive list of arguments.

netscaler_nsacls

resource "netscaler_nsacls" "allacls" {
  aclsname = "foo"
  "acl" {
  	aclname = "restrict"
  	protocol = "TCP"
  	aclaction = "DENY"
  	destipval = "192.168.1.20"
  	srcportval = "49-1024"
        priority = 100
	}
  "acl"  {
  	aclname = "restrictvlan"
  	aclaction = "DENY"
  	vlan = "2000"
        priority = 130
  }
}

Argument Reference

You can have only one element of type netscaler_nsacls. Encapsulating every nsacl inside the netscaler_nsacls resource so that Terraform will automatically call apply on the nsacls.

See https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/ns/nsacl/nsacl/#nsacl for possible values for these arguments and for an exhaustive list of arguments.

netscaler_inat

resource "netscaler_inat" "foo" {
  
  name = "ip4ip4"
  privateip = "192.168.2.5"
  publicip = "172.17.1.2"
}

See https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/network/inat/inat/#inat for possible values for these arguments and for an exhaustive list of arguments.

netscaler_rnat

resource "netscaler_rnat" "allrnat" {
  depends_on = ["netscaler_nsacls.allacls"]

  rnatsname = "rnatsall"

  rnat  {
      network = "192.168.88.0"
      netmask = "255.255.255.0"
      natip = "172.17.0.2"
  }

  rnat  {
      aclname = "RNAT_ACL_1"
  }
}

Argument Reference

You can have only one element of type netscaler_rnat. Encapsulate every rnat inside the netscaler_rnat resource.

See https://developer-docs.citrix.com/projects/netscaler-nitro-api/en/12.0/configuration/network/rnat/rnat/#rnat for possible values for these arguments and for an exhaustive list of arguments.

Using remote-exec for one-time tasks

Terraform is useful for maintaining desired state for a set of resources. It is less useful for tasks such as network configuration which don't change. Network configuration is like using a provisioner inside Terraform. The directory examples/remote-exec show examples of how Terraform can use ssh to accomplish these one-time tasks.

Building

Assumption

  • You have (some) experience with Terraform, the different provisioners and providers that come out of the box, its configuration files, tfstate files, etc.
  • You are comfortable with the Go language and its code organization.
  1. Install terraform from https://www.terraform.io/downloads.html
  2. Install dep (https://github.com/golang/dep)
  3. Check out this code: git clone https://<>
  4. Build this code using make build

Samples

See the examples directory for various LB topologies that can be driven from this terraform provider.