xcsh_site (Data Source)

Retrieves information about a Site resource in F5 Distributed Cloud for get of site. configuration. (read-only data source)

~> Note Please refer to Site API docs to learn more.

Example Usage

# Site Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing Site by name
data "xcsh_site" "example" {
  name      = "example-site"
  namespace = "staging"
}

output "site_id" {
  value = data.xcsh_site.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use empty block syntax field_name {}, never field_name = true. Boolean attributes (like add_hsts, http_redirect) use = true/false as normal.

Metadata Argument Reference

• name - Required String
Name of the Site to look up

• namespace - Required String
Namespace of the Site

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• address - Optional String
Site’s geographical address that can be used to determine its latitude and longitude

• admin_user_credentials - Optional String
Setup user credentials to manage access to nodes belonging to the site. When configured, ‘admin’ user will be setup and customers can access these nodes via either the node local WebUI or via SSH to access shell/CLI Ensure ‘Node Local Services’ are enabled to allow for required access

• annotations - Optional Map
Annotations

• bgp_peer_address - Optional String
Optional BGP peer address that can be used as parameter for BGP configuration when BGP is configured to fetch BGP peer address from site Object. This can be used to change peer address per site in fleet

• bgp_router_id - Optional String
Optional BGP router ID that can be used as parameter for BGP configuration when BGP is configured to fetch BGP router ID from site object. This can be used to change router ID per site in a fleet

• ce_site_mode - Optional String Defaults to CE_SITE_MODE_INGRESS_EGRESS_GW
Possible values are CE_SITE_MODE_INGRESS_EGRESS_GW, CE_SITE_MODE_INGRESS_GW, CE_SITE_MODE_EGRESS_GW, CE_SITE_MODE_DC_CLOUD_GW, CE_SITE_MODE_CPE
[Enum: CE_SITE_MODE_INGRESS_EGRESS_GW|CE_SITE_MODE_INGRESS_GW|CE_SITE_MODE_EGRESS_GW|CE_SITE_MODE_DC_CLOUD_GW|CE_SITE_MODE_CPE] If Site is CE, it can be in following modes Ingress Egress Gateway CE Ingress Gateway CE Egress Gateway CE DC Cloud Gateway CE CPE CE

• connected_re - Optional String
Following fields are only for customer edge sites List of REs to which to which this CE initiates IPsec/SSL connection to

• connected_re_for_config - Optional String
Valid only for CE site object List of REs which can send config to this CE site

• coordinates - Optional String
Coordinates of the site which provides the site physical location

• default_underlay_network - Optional String
Optional, virtual network to be used as underlay for different overlay protocols (SRv6, IP-in-IP tunnels for DC Cluster Group) Default is site-local-outside network

• description - Optional String
Description

• desired_pool_count - Optional String
Desired pool count represent desired number of worker(non master) nodes for manual scaling of public cloud(AWS, GCP, Azure) sites. The desired count must be less than or equal to the maximum size of the scaling group for a given public cloud. One may also have to increase maximum scaling group

• global_access_k8s_enabled - Optional String
Enable or disable functionality flag

• id - Optional String
Unique identifier

• inside_nameserver - Optional String
Optional IPv4 DNS server to be used for name resolution in inside network

• inside_vip - Optional String
Optional Virtual IP to be used as automatic VIP for site local inside network. See documentation for ‘VIP’ in advertise policy to see when Inside VIP is used. When configured, this is used as VIP (depending on advertise policy configuration)

• ipsec_ssl_nodes_fqdn - Optional String
FQDN resolves to responders node IP, if there are multiple nodes at site the resolution will give a list of all/some individual node IP. Multiple FQDN for same site is also allowed

• kubernetes_upgrade_drain - Optional String
Specify how worker nodes within a site will be upgraded

• labels - Optional Map
Labels

• local_access_k8s_enabled - Optional String
Enable or disable functionality flag

• local_k8s_access_enabled - Optional String
Lets user know if this site has local K8S cluster enabled via fleet configuration

• main_nodes - Optional String
Connectivity information of main/master nodes to create a full mesh of Phobos services across all CEs in a site-mesh-group or dc-cluster-group

• multus_enabled - Optional String
Indicates that Multus cni is enabled on the site

• operating_system_version - Optional String
Desired Operating System version for this site

• outside_nameserver - Optional String
Optional IPv4 DNS server to be used for name resolution in outside network

• outside_vip - Optional String
Optional Virtual IP to be used as automatic VIP for site local outside network. See documentation for ‘VIP’ in advertise policy to see when Outside VIP is used. When configured, this is used as VIP (depending on advertise policy configuration)

• private_connectivity - Optional String
Private Connectivity Information like ADN network name and cloud link information

• re_select - Optional String
Selection criteria to connect the site with F5 Distributed Cloud Regional Edge(s)

• region - Optional String
Cloud Region. A region is a set of datacenters deployed within a latency-defined perimeter and connected through a dedicated regional low-latency network

• site_state - Optional String Defaults to ONLINE
Possible values are ONLINE, PROVISIONING, UPGRADING, STANDBY, FAILED, REREGISTRATION, WAITINGNODES, DECOMMISSIONING, WAITING_FOR_REGISTRATION, ORCHESTRATION_IN_PROGRESS, ORCHESTRATION_COMPLETE, ERROR_IN_ORCHESTRATION, DELETING_CLOUD_RESOURCES, DELETED_CLOUD_RESOURCES, ERROR_DELETING_CLOUD_RESOURCES, VALIDATION_IN_PROGRESS, VALIDATION_SUCCESS, VALIDATION_FAILED, FAILED_INACTIVE, UPDATING_CLOUD_RESOURCES, ERROR_UPDATING_CLOUD_RESOURCES, ORCHESTRATION_QUEUED, UPDATE_QUEUED, DELETE_QUEUED
[Enum: ONLINE|PROVISIONING|UPGRADING|STANDBY|FAILED|REREGISTRATION|WAITINGNODES|DECOMMISSIONING|WAITING_FOR_REGISTRATION|ORCHESTRATION_IN_PROGRESS|ORCHESTRATION_COMPLETE|ERROR_IN_ORCHESTRATION|DELETING_CLOUD_RESOURCES|DELETED_CLOUD_RESOURCES|ERROR_DELETING_CLOUD_RESOURCES|VALIDATION_IN_PROGRESS|VALIDATION_SUCCESS|VALIDATION_FAILED|FAILED_INACTIVE|UPDATING_CLOUD_RESOURCES|ERROR_UPDATING_CLOUD_RESOURCES|ORCHESTRATION_QUEUED|UPDATE_QUEUED|DELETE_QUEUED] State of Site defines in which operational state site itself is. Site is online and operational. Site is in provisioning state. For instance during site deployment or switching to different connected Regional Edge. Site is in process of upgrade

• site_subtype - Optional String Defaults to NO_SUBTYPE
Possible values are NO_SUBTYPE, VES_IO_USE_RE, VES_IO_CE_IN_K8S, VES_IO_HIDDEN_RE
[Enum: NO_SUBTYPE|VES_IO_USE_RE|VES_IO_CE_IN_K8S|VES_IO_HIDDEN_RE] Sit Subtype No Subtype Regional Edge isn’t ready yet. Configuration isn’t propagated for this site. Regional Edge which is hidden from customer. Configuration will be propagated. CE running in Kubernetes

• site_to_site_network_type - Optional String Defaults to VIRTUAL_NETWORK_SITE_LOCAL
Possible values are VIRTUAL_NETWORK_SITE_LOCAL, VIRTUAL_NETWORK_SITE_LOCAL_INSIDE, VIRTUAL_NETWORK_PER_SITE, VIRTUAL_NETWORK_PUBLIC, VIRTUAL_NETWORK_GLOBAL, VIRTUAL_NETWORK_SITE_SERVICE, VIRTUAL_NETWORK_VER_INTERNAL, VIRTUAL_NETWORK_SITE_LOCAL_INSIDE_OUTSIDE, VIRTUAL_NETWORK_IP_AUTO, VIRTUAL_NETWORK_VOLTADN_PRIVATE_NETWORK, VIRTUAL_NETWORK_SRV6_NETWORK, VIRTUAL_NETWORK_IP_FABRIC, VIRTUAL_NETWORK_SEGMENT, VIRTUAL_NETWORK_MANAGEMENT
[Enum: VIRTUAL_NETWORK_SITE_LOCAL|VIRTUAL_NETWORK_SITE_LOCAL_INSIDE|VIRTUAL_NETWORK_PER_SITE|VIRTUAL_NETWORK_PUBLIC|VIRTUAL_NETWORK_GLOBAL|VIRTUAL_NETWORK_SITE_SERVICE|VIRTUAL_NETWORK_VER_INTERNAL|VIRTUAL_NETWORK_SITE_LOCAL_INSIDE_OUTSIDE|VIRTUAL_NETWORK_IP_AUTO|VIRTUAL_NETWORK_VOLTADN_PRIVATE_NETWORK|VIRTUAL_NETWORK_SRV6_NETWORK|VIRTUAL_NETWORK_IP_FABRIC|VIRTUAL_NETWORK_SEGMENT|VIRTUAL_NETWORK_MANAGEMENT] Different types of virtual networks understood by the system Virtual-network of type VIRTUAL_NETWORK_SITE_LOCAL provides connectivity to public (outside) network. This is an insecure network and is connected to public internet via NAT Gateways/firwalls Virtual-network of this type is local to

• site_to_site_tunnel_ip - Optional String
Optionsl, VIP in the site_to_site_network_type configured above used for terminating IPsec/SSL tunnels created with SiteMeshGroup

• site_type - Optional String
Possible values are INVALID, REGIONAL_EDGE, CUSTOMER_EDGE, NGINX_ONE
[Enum: INVALID|REGIONAL_EDGE|CUSTOMER_EDGE|NGINX_ONE] Site Type which can either RE or CE Invalid type of site Regional Edge site Customer Edge site

• tunnel_dead_timeout - Optional String
Time interval, in millisec, within which any IPsec / SSL connection from the site going down is detected. When not set (== 0), a default value of 10000 msec will be used

• tunnel_type - Optional String Defaults to SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL
Possible values are SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL, SITE_TO_SITE_TUNNEL_IPSEC, SITE_TO_SITE_TUNNEL_SSL
[Enum: SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL|SITE_TO_SITE_TUNNEL_IPSEC|SITE_TO_SITE_TUNNEL_SSL] Tunnel encapsulation to be used between sites Tunnel can operate in both IPsec and SSL, with IPsec being preferred over SSL. Tunnel is of type IPsec Tunnel is of type SSL

• vip_params_per_az - Optional String
Optional Publish VIP Parameters Per AZ for public cloud sites. See documentation for ‘VIP’ in advertise policy to see when Inside VIP or Outside VIP is used. When configured, the VIP(s) defined will be used to publish to external systems like K8S, Consul

• vip_vrrp_mode - Optional String Defaults to VIP_VRRP_INVALID
Possible values are VIP_VRRP_INVALID, VIP_VRRP_ENABLE, VIP_VRRP_DISABLE
[Enum: VIP_VRRP_INVALID|VIP_VRRP_ENABLE|VIP_VRRP_DISABLE] VRRP advertisement mode for VIP Invalid VRRP mode

• vm_enabled - Optional String
Indicates that virtual machine support is enabled on the site

• volterra_software_override - Optional String Defaults to SITE_SOFTWARE_OVERRIDE_SITE
Possible values are SITE_SOFTWARE_OVERRIDE_SITE, SITE_SOFTWARE_OVERRIDE_NEWER, SITE_SOFTWARE_OVERRIDE_FLEET
[Enum: SITE_SOFTWARE_OVERRIDE_SITE|SITE_SOFTWARE_OVERRIDE_NEWER|SITE_SOFTWARE_OVERRIDE_FLEET] Decide which software version takes effect in case of conflict between site and fleet Software version in site will take precedence. Between site and fleet newer software version will take precedence. Software version in fleet will take precedence

• volterra_software_version - Optional String
Desired F5XC software version for this site, a string matching released set of software components

---

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
name	String	Name of the referenced object
namespace	String	Namespace containing the referenced object
tenant	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
LOWER_CASE	Convert to lowercase
UPPER_CASE	Convert to uppercase
BASE64_DECODE	Decodebase64 content
NORMALIZE_PATH	Normalize URL path
REMOVE_WHITESPACE	Remove whitespace characters
URL_DECODE	Decode URL-encoded characters
TRIM_LEFT	Trim leading whitespace
TRIM_RIGHT	Trim trailing whitespace
TRIM	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
ANY	Match any HTTP method
GET	HTTP GET request
HEAD	HTTP HEAD request
POST	HTTP POST request
PUT	HTTP PUT request
DELETE	HTTP DELETE request
CONNECT	HTTP CONNECT request
OPTIONS	HTTP OPTIONS request
TRACE	HTTP TRACE request
PATCH	HTTP PATCH request
COPY	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
TLS_FINGERPRINT_NONE	No fingerprint matching
ANY_MALICIOUS_FINGERPRINT	Match any known malicious fingerprint
ADWARE	Adware-associated fingerprints
DRIDEX	Dridex malware fingerprints
GOOTKIT	Gootkit malware fingerprints
RANSOMWARE	Ransomware-associated fingerprints
TRICKBOT	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
SPAM_SOURCES	Known spam sources
WINDOWS_EXPLOITS	Windows exploit sources
WEB_ATTACKS	Web attack sources
BOTNETS	Known botnet IPs
SCANNERS	Network scanner IPs
REPUTATION	Poor reputation IPs
PHISHING	Phishing-related IPs
PROXY	Anonymous proxy IPs
MOBILE_THREATS	Mobile threat sources
TOR_PROXY	Tor exit nodes
DENIAL_OF_SERVICE	DoS attack sources
NETWORK	Known bad network ranges