f5xc_network_policy_view Resource - terraform-provider-f5xc

f5xc_network_policy_view (Resource)

Manages a Network Policy View resource in F5 Distributed Cloud for network policy view specification. configuration.

~> Note For more information about this resource, please refer to the F5 XC API Documentation.

Example Usage

# Network Policy View Resource Example
# Manages a Network Policy View resource in F5 Distributed Cloud for network policy view specification. configuration.

terraform {
  required_version = ">= 1.0"

  required_providers {
    f5xc = {
      source  = "f5xc-salesdemos/f5xc"
      version = ">= 0.1.0"
    }
  }
}

# Basic Network Policy View configuration
resource "f5xc_network_policy_view" "example" {
  name      = "example-network-policy-view"
  namespace = "staging"

  labels = {
    environment = "production"
    managed_by  = "terraform"
  }

  annotations = {
    "owner" = "platform-team"
  }

  # Resource-specific configuration
  # Ordered list of rules applied to connections from policy ...
  egress_rules {
    # Configure egress_rules settings
  }
  # Network Policy Rule Advanced Action provides additional O...
  adv_action {
    # Configure adv_action settings
  }
  # Configuration parameter for all tcp traffic.
  all_tcp_traffic {
    # Configure all_tcp_traffic settings
  }
}

Argument Reference

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Network Policy View. Must be unique within the namespace

• namespace - Required String
Namespace where the Network Policy View will be created

• annotations - Optional Map
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata

• description - Optional String
Human readable description for the object

• disable - Optional Bool
A value of true will administratively disable the object

• labels - Optional Map
Labels is a user defined key value map that can be attached to resources for organization and filtering

Spec Argument Reference

• egress_rules - Optional Block
Ordered list of rules applied to connections from policy endpoints
See Egress Rules below for details.

• endpoint - Optional Block
Shape of the endpoint choices for a view
See Endpoint below for details.

• ingress_rules - Optional Block
Ordered list of rules applied to connections to policy endpoints
See Ingress Rules below for details.

• timeouts - Optional Block
See Timeouts below for details.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id - Optional String
Unique identifier for the resource

Egress Rules

An egress_rules block supports the following:

• action - Optional String Defaults to DENY
Possible values are DENY, ALLOW
[Enum: DENY|ALLOW] Network policy rule action configures the action to be taken on rule match Apply deny action on rule match Apply allow action on rule match

• adv_action - Optional Block
Network Policy Rule Advanced Action provides additional OPTIONS along with RuleAction and PBRRuleAction
See Adv Action below.

• all_tcp_traffic - Optional Block
Configuration parameter for all TCP traffic

• all_traffic - Optional Block
Configuration parameter for all traffic

• all_udp_traffic - Optional Block
Configuration parameter for all UDP traffic

• any - Optional Block
Enable this option

• applications - Optional Block
Configuration parameter for applications
See Applications below.

• inside_endpoints - Optional Block
Enable this option

• ip_prefix_set - Optional Block
List of references to ip_prefix_set objects
See IP Prefix Set below.

• label_matcher - Optional Block
Label matcher specifies a list of label keys whose values need to match for source/client and destination/server. Note that the actual label values are not specified and do not matter. This allows an ability to scope grouping by the label key name
See Label Matcher below.

• label_selector - Optional Block
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects
See Label Selector below.

• metadata - Optional Block
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create
See Metadata below.

• outside_endpoints - Optional Block
Enable this option

• prefix_list - Optional Block
List of IPv4 prefixes that represent an endpoint
See Prefix List below.

• protocol_port_range - Optional Block
Protocol and Port. Protocol and Port ranges
See Protocol Port Range below.

Egress Rules Adv Action

An adv_action block (within egress_rules) supports the following:

• action - Optional String Defaults to NOLOG
Possible values are NOLOG, LOG
[Enum: NOLOG|LOG] Choice to choose logging or no logging This works together with option selected via NetworkPolicyRuleAction or any other action specified x-

Egress Rules Applications

An applications block (within egress_rules) supports the following:

• applications - Optional List Defaults to APPLICATION_HTTP
Possible values are APPLICATION_HTTP, APPLICATION_HTTPS, APPLICATION_SNMP, APPLICATION_DNS
[Enum: APPLICATION_HTTP|APPLICATION_HTTPS|APPLICATION_SNMP|APPLICATION_DNS] Application Protocols. Application protocols like HTTP, SNMP

Egress Rules IP Prefix Set

An ip_prefix_set block (within egress_rules) supports the following:

• ref - Optional Block
List of references to ip_prefix_set objects
See Ref below.

Egress Rules IP Prefix Set Ref

A ref block (within egress_rules.ip_prefix_set) supports the following:

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

Egress Rules Label Matcher

A label_matcher block (within egress_rules) supports the following:

• keys - Optional List
The list of label key names that have to match

Egress Rules Label Selector

A label_selector block (within egress_rules) supports the following:

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

Egress Rules Metadata

A metadata block (within egress_rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Egress Rules Prefix List

A prefix_list block (within egress_rules) supports the following:

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

Egress Rules Protocol Port Range

A protocol_port_range block (within egress_rules) supports the following:

• port_ranges - Optional List
List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192

• protocol - Optional String
Protocol in IP packet to be used as match criteria Values are TCP, UDP, and ICMP

Endpoint

An endpoint block supports the following:

• any - Optional Block
Enable this option

• inside_endpoints - Optional Block
Enable this option

• outside_endpoints - Optional Block
Enable this option

• prefix_list - Optional Block
List of IPv4 prefixes that represent an endpoint
See Prefix List below.

Endpoint Label Selector

A label_selector block (within endpoint) supports the following:

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

Endpoint Prefix List

A prefix_list block (within endpoint) supports the following:

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

Ingress Rules

An ingress_rules block supports the following:

• adv_action - Optional Block
Network Policy Rule Advanced Action provides additional OPTIONS along with RuleAction and PBRRuleAction
See Adv Action below.

• all_tcp_traffic - Optional Block
Configuration parameter for all TCP traffic

• all_traffic - Optional Block
Configuration parameter for all traffic

• all_udp_traffic - Optional Block
Configuration parameter for all UDP traffic

• any - Optional Block
Enable this option

• applications - Optional Block
Configuration parameter for applications
See Applications below.

• inside_endpoints - Optional Block
Enable this option

• ip_prefix_set - Optional Block
List of references to ip_prefix_set objects
See IP Prefix Set below.

• outside_endpoints - Optional Block
Enable this option

• prefix_list - Optional Block
List of IPv4 prefixes that represent an endpoint
See Prefix List below.

• protocol_port_range - Optional Block
Protocol and Port. Protocol and Port ranges
See Protocol Port Range below.

Ingress Rules Adv Action

An adv_action block (within ingress_rules) supports the following:

Ingress Rules Applications

An applications block (within ingress_rules) supports the following:

Ingress Rules IP Prefix Set

An ip_prefix_set block (within ingress_rules) supports the following:

• ref - Optional Block
List of references to ip_prefix_set objects
See Ref below.

Ingress Rules IP Prefix Set Ref

A ref block (within ingress_rules.ip_prefix_set) supports the following:

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

Ingress Rules Label Matcher

A label_matcher block (within ingress_rules) supports the following:

• keys - Optional List
The list of label key names that have to match

Ingress Rules Label Selector

A label_selector block (within ingress_rules) supports the following:

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

Ingress Rules Metadata

A metadata block (within ingress_rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Ingress Rules Prefix List

A prefix_list block (within ingress_rules) supports the following:

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

Ingress Rules Protocol Port Range

A protocol_port_range block (within ingress_rules) supports the following:

• port_ranges - Optional List
List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192

• protocol - Optional String
Protocol in IP packet to be used as match criteria Values are TCP, UDP, and ICMP

Timeouts

A timeouts block supports the following:

• create - Optional String (Defaults to 10 minutes)
Used when creating the resource

• delete - Optional String (Defaults to 10 minutes)
Used when deleting the resource

• read - Optional String (Defaults to 5 minutes)
Used when retrieving the resource

• update - Optional String (Defaults to 10 minutes)
Used when updating the resource

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges

Import

Import is supported using the following syntax:

# Import using namespace/name format
terraform import f5xc_network_policy_view.example system/example