xcsh_site (Data Source)
Retrieves information about a Site resource in F5 Distributed Cloud for get of site. configuration. (read-only data source)
~> Note: For more information, see the Site API documentation.
Example Usage
Section titled “Example Usage”# Site Data Source Example
terraform { required_version = ">= 1.0"
required_providers { xcsh = { source = "f5-sales-demo/xcsh" version = ">= 0.1.0" } }}
# Look up an existing Site by namedata "xcsh_site" "example" { name = "example-site" namespace = "staging"}
output "site_id" { value = data.xcsh_site.example.id}Argument Reference
Section titled “Argument Reference”-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.
Metadata Argument Reference
Section titled “Metadata Argument Reference”• name - Required String
Name of the Site to look up
• namespace - Required String
Namespace of the Site
Attributes Reference
Section titled “Attributes Reference”In addition to all arguments above, the following attributes are exported:
• address - Optional String
Site’s geographical address that can be used to determine its latitude and longitude
• admin_user_credentials - Optional String
Setup user credentials to manage access to nodes belonging to the site. When configured, ‘admin’ user will be setup and customers can access these nodes via either the node local WebUI or via SSH to access shell/CLI Ensure ‘Node Local Services’ are enabled to allow for required
access
• annotations - Optional Map
Annotations
• bgp_peer_address - Optional String
Optional BGP peer address that can be used as parameter for BGP configuration when BGP is configured to fetch BGP peer address from site Object. This can be used to change peer address per site in fleet
• bgp_router_id - Optional String
Optional BGP router ID that can be used as parameter for BGP configuration when BGP is configured to fetch BGP router ID from site object. This can be used to change router ID per site in a fleet
• ce_site_mode - Optional String Defaults to CE_SITE_MODE_INGRESS_EGRESS_GW
Possible values are CE_SITE_MODE_INGRESS_EGRESS_GW, CE_SITE_MODE_INGRESS_GW, CE_SITE_MODE_EGRESS_GW, CE_SITE_MODE_DC_CLOUD_GW, CE_SITE_MODE_CPE
[Enum:
CE_SITE_MODE_INGRESS_EGRESS_GW|CE_SITE_MODE_INGRESS_GW|CE_SITE_MODE_EGRESS_GW|CE_SITE_MODE_DC_CLOUD_GW|CE_SITE_MODE_CPE] If Site is CE, it can be in following modes Ingress Egress Gateway CE Ingress Gateway CE Egress Gateway CE DC Cloud Gateway CE CPE CE
• connected_re - Optional List
Following fields are only for customer edge sites List of REs to which to which this CE initiates IPsec/SSL connection to
• connected_re_for_config - Optional List
Valid only for CE site object List of REs which can send config to this CE site
• coordinates - Optional String
Coordinates of the site which provides the site physical location
• default_underlay_network - Optional String
Optional, virtual network to be used as underlay for different overlay protocols (SRv6, IP-in-IP tunnels for DC Cluster Group) Default is site-local-outside network
• description - Optional String
Description
• desired_pool_count - Optional Number
Desired pool count represent desired number of worker(non master) nodes for manual scaling of public cloud(AWS, GCP, Azure) sites. The desired count must be less than or equal to the maximum size of the scaling group for a given public cloud. One may also have to increase maximum scaling group
• global_access_k8s_enabled - Optional Bool
Enable or disable functionality flag
• id - Optional String
Unique identifier
• inside_nameserver - Optional String
Optional IPv4 DNS server to be used for name resolution in inside network
• inside_vip - Optional String
Optional Virtual IP to be used as automatic VIP for site local inside network. See documentation for ‘VIP’ in advertise policy to see when Inside VIP is used. When configured, this is used as VIP (depending on advertise policy configuration)
• ipsec_ssl_nodes_fqdn - Optional List
FQDN resolves to responders node IP, if there are multiple nodes at site the resolution will give a list of all/some individual node IP. Multiple FQDN for same site is also allowed
• kubernetes_upgrade_drain - Optional String
Specify how worker nodes within a site will be upgraded
• labels - Optional Map
Labels
• local_access_k8s_enabled - Optional Bool
Enable or disable functionality flag
• local_k8s_access_enabled - Optional Bool
Lets user know if this site has local K8S cluster enabled via fleet configuration
• main_nodes - Optional List
Connectivity information of main/master nodes to create a full mesh of Phobos services across all CEs in a site-mesh-group or dc-cluster-group
• multus_enabled - Optional Bool
Indicates that Multus cni is enabled on the site
• operating_system_version - Optional String
Desired Operating System version for this site
• outside_nameserver - Optional String
Optional IPv4 DNS server to be used for name resolution in outside network
• outside_vip - Optional String
Optional Virtual IP to be used as automatic VIP for site local outside network. See documentation for ‘VIP’ in advertise policy to see when Outside VIP is used. When configured, this is used as VIP (depending on advertise policy configuration)
• private_connectivity - Optional String
Private Connectivity Information like ADN network name and cloud link information
• re_select - Optional String
Selection criteria to connect the site with F5 Distributed Cloud Regional Edge(s)
• region - Optional String
Cloud Region. A region is a set of datacenters deployed within a latency-defined perimeter and connected through a dedicated regional low-latency network
• site_state - Optional String Defaults to ONLINE
Possible values are ONLINE, PROVISIONING, UPGRADING, STANDBY, FAILED, REREGISTRATION, WAITINGNODES, DECOMMISSIONING, WAITING_FOR_REGISTRATION, ORCHESTRATION_IN_PROGRESS, ORCHESTRATION_COMPLETE, ERROR_IN_ORCHESTRATION, DELETING_CLOUD_RESOURCES, DELETED_CLOUD_RESOURCES,
ERROR_DELETING_CLOUD_RESOURCES, VALIDATION_IN_PROGRESS, VALIDATION_SUCCESS, VALIDATION_FAILED, FAILED_INACTIVE, UPDATING_CLOUD_RESOURCES, ERROR_UPDATING_CLOUD_RESOURCES, ORCHESTRATION_QUEUED, UPDATE_QUEUED, DELETE_QUEUED
[Enum:
ONLINE|PROVISIONING|UPGRADING|STANDBY|FAILED|REREGISTRATION|WAITINGNODES|DECOMMISSIONING|WAITING_FOR_REGISTRATION|ORCHESTRATION_IN_PROGRESS|ORCHESTRATION_COMPLETE|ERROR_IN_ORCHESTRATION|DELETING_CLOUD_RESOURCES|DELETED_CLOUD_RESOURCES|ERROR_DELETING_CLOUD_RESOURCES|VALIDATION_IN_PROGRESS|VALIDATION_SUCCESS|VALIDATION_FAILED|FAILED_INACTIVE|UPDATING_CLOUD_RESOURCES|ERROR_UPDATING_CLOUD_RESOURCES|ORCHESTRATION_QUEUED|UPDATE_QUEUED|DELETE_QUEUED]
State of Site defines in which operational state site itself is. Site is online and operational. Site is in provisioning state. For instance during site deployment or switching to different connected Regional Edge. Site is in process of upgrade
• site_subtype - Optional String Defaults to NO_SUBTYPE
Possible values are NO_SUBTYPE, VES_IO_USE_RE, VES_IO_CE_IN_K8S, VES_IO_HIDDEN_RE
[Enum: NO_SUBTYPE|VES_IO_USE_RE|VES_IO_CE_IN_K8S|VES_IO_HIDDEN_RE] Sit Subtype No Subtype Regional Edge isn’t ready yet. Configuration isn’t propagated for this site. Regional Edge which is
hidden from customer. Configuration will be propagated. CE running in Kubernetes
• site_to_site_network_type - Optional String Defaults to VIRTUAL_NETWORK_SITE_LOCAL
Possible values are VIRTUAL_NETWORK_SITE_LOCAL, VIRTUAL_NETWORK_SITE_LOCAL_INSIDE, VIRTUAL_NETWORK_PER_SITE, VIRTUAL_NETWORK_PUBLIC, VIRTUAL_NETWORK_GLOBAL, VIRTUAL_NETWORK_SITE_SERVICE, VIRTUAL_NETWORK_VER_INTERNAL,
VIRTUAL_NETWORK_SITE_LOCAL_INSIDE_OUTSIDE, VIRTUAL_NETWORK_IP_AUTO, VIRTUAL_NETWORK_VOLTADN_PRIVATE_NETWORK, VIRTUAL_NETWORK_SRV6_NETWORK, VIRTUAL_NETWORK_IP_FABRIC, VIRTUAL_NETWORK_SEGMENT, VIRTUAL_NETWORK_MANAGEMENT
[Enum:
VIRTUAL_NETWORK_SITE_LOCAL|VIRTUAL_NETWORK_SITE_LOCAL_INSIDE|VIRTUAL_NETWORK_PER_SITE|VIRTUAL_NETWORK_PUBLIC|VIRTUAL_NETWORK_GLOBAL|VIRTUAL_NETWORK_SITE_SERVICE|VIRTUAL_NETWORK_VER_INTERNAL|VIRTUAL_NETWORK_SITE_LOCAL_INSIDE_OUTSIDE|VIRTUAL_NETWORK_IP_AUTO|VIRTUAL_NETWORK_VOLTADN_PRIVATE_NETWORK|VIRTUAL_NETWORK_SRV6_NETWORK|VIRTUAL_NETWORK_IP_FABRIC|VIRTUAL_NETWORK_SEGMENT|VIRTUAL_NETWORK_MANAGEMENT]
Different types of virtual networks understood by the system Virtual-network of type VIRTUAL_NETWORK_SITE_LOCAL provides connectivity to public (outside) network. This is an insecure network and is connected to public internet via NAT Gateways/firwalls Virtual-network of this type is local to
• site_to_site_tunnel_ip - Optional String
Optionsl, VIP in the site_to_site_network_type configured above used for terminating IPsec/SSL tunnels created with SiteMeshGroup
• site_type - Optional String
Possible values are INVALID, REGIONAL_EDGE, CUSTOMER_EDGE, NGINX_ONE
[Enum: INVALID|REGIONAL_EDGE|CUSTOMER_EDGE|NGINX_ONE] Site Type which can either RE or CE Invalid type of site Regional Edge site Customer Edge site
• tunnel_dead_timeout - Optional Number
Time interval, in millisec, within which any IPsec / SSL connection from the site going down is detected. When not set (== 0), a default value of 10000 msec will be used
• tunnel_type - Optional String Defaults to SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL
Possible values are SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL, SITE_TO_SITE_TUNNEL_IPSEC, SITE_TO_SITE_TUNNEL_SSL
[Enum: SITE_TO_SITE_TUNNEL_IPSEC_OR_SSL|SITE_TO_SITE_TUNNEL_IPSEC|SITE_TO_SITE_TUNNEL_SSL] Tunnel encapsulation to be used between sites Tunnel can
operate in both IPsec and SSL, with IPsec being preferred over SSL. Tunnel is of type IPsec Tunnel is of type SSL
• vip_params_per_az - Optional List
Optional Publish VIP Parameters Per AZ for public cloud sites. See documentation for ‘VIP’ in advertise policy to see when Inside VIP or Outside VIP is used. When configured, the VIP(s) defined will be used to publish to external systems like K8S, Consul
• vip_vrrp_mode - Optional String Defaults to VIP_VRRP_INVALID
Possible values are VIP_VRRP_INVALID, VIP_VRRP_ENABLE, VIP_VRRP_DISABLE
[Enum: VIP_VRRP_INVALID|VIP_VRRP_ENABLE|VIP_VRRP_DISABLE] VRRP advertisement mode for VIP Invalid VRRP mode
• vm_enabled - Optional Bool
Indicates that virtual machine support is enabled on the site
• volterra_software_override - Optional String Defaults to SITE_SOFTWARE_OVERRIDE_SITE
Possible values are SITE_SOFTWARE_OVERRIDE_SITE, SITE_SOFTWARE_OVERRIDE_NEWER, SITE_SOFTWARE_OVERRIDE_FLEET
[Enum: SITE_SOFTWARE_OVERRIDE_SITE|SITE_SOFTWARE_OVERRIDE_NEWER|SITE_SOFTWARE_OVERRIDE_FLEET] Decide which
software version takes effect in case of conflict between site and fleet Software version in site will take precedence. Between site and fleet newer software version will take precedence. Software version in fleet will take precedence
• volterra_software_version - Optional String
Desired F5XC software version for this site, a string matching released set of software components
• admin_password - Optional String
SecretType is used in an object to indicate a sensitive/confidential field
• ssh_key - Optional String
Provided Public SSH key can be used for accessing nodes of the site. When provided, customers can SSH to the nodes of this Customer Edge site using admin as the user
• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management
• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted
• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service
• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location
• store_provider - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///
• provider_ref - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///
• url - Optional String
URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding
• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)
• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name
• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace
• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant
• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid
• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)
• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name
• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace
• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant
• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid
Coordinates
Section titled “Coordinates”A coordinates block supports the following:
• latitude - Optional Number
Latitude. Latitude of the site location
• longitude - Optional Number
Longitude. Longitude of site location
Default Underlay Network
Section titled “Default Underlay Network”A default_underlay_network block supports the following:
• site_local_inside - Optional Object
Enable this option
• site_local_outside - Optional Object
Enable this option
Default Underlay Network Site Local Inside
Section titled “Default Underlay Network Site Local Inside”A site_local_inside block (within default_underlay_network) supports the following:
Default Underlay Network Site Local Outside
Section titled “Default Underlay Network Site Local Outside”A site_local_outside block (within default_underlay_network) supports the following:
Kubernetes Upgrade Drain
Section titled “Kubernetes Upgrade Drain”A kubernetes_upgrade_drain block supports the following:
• disable_upgrade_drain - Optional Object
Configuration parameter for disable upgrade drain
• enable_upgrade_drain - Optional String
Specify batch upgrade settings for worker nodes within a site
Kubernetes Upgrade Drain Disable Upgrade Drain
Section titled “Kubernetes Upgrade Drain Disable Upgrade Drain”A disable_upgrade_drain block (within kubernetes_upgrade_drain) supports the following:
Kubernetes Upgrade Drain Enable Upgrade Drain
Section titled “Kubernetes Upgrade Drain Enable Upgrade Drain”An enable_upgrade_drain block (within kubernetes_upgrade_drain) supports the following:
• disable_vega_upgrade_mode - Optional Object
Configuration parameter for disable vega upgrade mode
• drain_max_unavailable_node_count - Optional Number
Node Batch Size Count
• drain_max_unavailable_node_percentage - Optional Number
Maximum percentage of nodes unavailable during upgrade draining
• drain_node_timeout - Optional Number
Seconds to wait before initiating upgrade on the next set of nodes. Setting it to 0 will wait indefinitely for all services on nodes to be upgraded gracefully before proceeding to the next set of nodes. (Warning: It may block upgrade if services on a node cannot be gracefully upgraded. It is
• enable_vega_upgrade_mode - Optional Object
Configuration parameter for enable vega upgrade mode
Kubernetes Upgrade Drain Enable Upgrade Drain Disable Vega Upgrade Mode
Section titled “Kubernetes Upgrade Drain Enable Upgrade Drain Disable Vega Upgrade Mode”Deeply nested Mode block collapsed for readability.
Kubernetes Upgrade Drain Enable Upgrade Drain Enable Vega Upgrade Mode
Section titled “Kubernetes Upgrade Drain Enable Upgrade Drain Enable Vega Upgrade Mode”Deeply nested Mode block collapsed for readability.
Main Nodes
Section titled “Main Nodes”A main_nodes block supports the following:
• name - Optional String
Name of the master/main node on the site
• sli_address - Optional String
Site Local Inside IP addresses. Site Local Inside IP address
• slo_address - Optional String
Site Local Outside IP addresses. Site Local Outside IP address
Private Connectivity
Section titled “Private Connectivity”A private_connectivity block supports the following:
• cloud_link - Optional String
Information related to cloud link used by the site
• private_network_name - Optional String
ADN Network Name for private access connectivity to F5XC ADN
Private Connectivity Cloud Link
Section titled “Private Connectivity Cloud Link”A cloud_link block (within private_connectivity) supports the following:
• name - Optional String
Name of the the CloudLink used with this site
• state - Optional String Defaults to UP
Possible values are UP, DOWN, DEGRADED, NOT_APPLICABLE
[Enum: UP|DOWN|DEGRADED|NOT_APPLICABLE] State of the CloudLink connections - UP: Up CloudLink and their corresponding Direct Connect connections are up and healthy - DOWN: Down CloudLink and their
corresponding Direct Connect connections are down - DEGRADED: Degraded Some of Direct Connect connections with the CloudLink are down
RE Select
Section titled “RE Select”A re_select block supports the following:
• geo_proximity - Optional Object
Configuration parameter for geo proximity
• specific_geography - Optional String
Geographic selection for the site’s Regional Edge connections
• specific_re - Optional String
Select specific REs. This is useful when a site needs to deterministically connect to a set of REs. A site will always be connected to 2 REs
RE Select Geo Proximity
Section titled “RE Select Geo Proximity”A geo_proximity block (within re_select) supports the following:
RE Select Specific RE
Section titled “RE Select Specific RE”A specific_re block (within re_select) supports the following:
• backup_re - Optional String
Select backup RE for this site, cannot be the same as Primary RE
• primary_re - Optional String
Primary RE Geography. Select primary RE for this site
VIP Params Per Az
Section titled “VIP Params Per Az”A vip_params_per_az block supports the following:
• az_name - Optional String
AZ Name. Name of the Availability zone
• inside_vip - Optional List
Inside VIP(s). List of Inside VIPs for an AZ
• inside_vip_cname - Optional String
CNAME value for the inside VIP, These are usually public cloud generated CNAME
• inside_vip_v6 - Optional List
Optional list of Inside IPv6 VIPs for an AZ
• outside_vip - Optional List
Outside VIP(s). List of Outside VIPs for an AZ
• outside_vip_cname - Optional String
CNAME value for the outside VIP These are usually public cloud generated CNAME
• outside_vip_v6 - Optional List
Optional list of Outside IPv6 VIPs for an AZ
Common Types
Section titled “Common Types”The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.
Object Reference {#common-object-reference}
Section titled “Object Reference {#common-object-reference}”Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.
| Field | Type | Description |
|---|---|---|
name | String | Name of the referenced object |
namespace | String | Namespace containing the referenced object |
tenant | String | Tenant of the referenced object (system-managed) |
Transformers {#common-transformers}
Section titled “Transformers {#common-transformers}”Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.
| Value | Description |
|---|---|
LOWER_CASE | Convert to lowercase |
UPPER_CASE | Convert to uppercase |
BASE64_DECODE | Decodebase64 content |
NORMALIZE_PATH | Normalize URL path |
REMOVE_WHITESPACE | Remove whitespace characters |
URL_DECODE | Decode URL-encoded characters |
TRIM_LEFT | Trim leading whitespace |
TRIM_RIGHT | Trim trailing whitespace |
TRIM | Trim both leading and trailing whitespace |
HTTP Methods {#common-http-methods}
Section titled “HTTP Methods {#common-http-methods}”HTTP methods used for request matching.
| Value | Description |
|---|---|
ANY | Match any HTTP method |
GET | HTTP GET request |
HEAD | HTTP HEAD request |
POST | HTTP POST request |
PUT | HTTP PUT request |
DELETE | HTTP DELETE request |
CONNECT | HTTP CONNECT request |
OPTIONS | HTTP OPTIONS request |
TRACE | HTTP TRACE request |
PATCH | HTTP PATCH request |
COPY | HTTP COPY request (WebDAV) |
TLS Fingerprints {#common-tls-fingerprints}
Section titled “TLS Fingerprints {#common-tls-fingerprints}”TLS fingerprint categories for malicious client detection.
| Value | Description |
|---|---|
TLS_FINGERPRINT_NONE | No fingerprint matching |
ANY_MALICIOUS_FINGERPRINT | Match any known malicious fingerprint |
ADWARE | Adware-associated fingerprints |
DRIDEX | Dridex malware fingerprints |
GOOTKIT | Gootkit malware fingerprints |
RANSOMWARE | Ransomware-associated fingerprints |
TRICKBOT | Trickbot malware fingerprints |
IP Threat Categories {#common-ip-threat-categories}
Section titled “IP Threat Categories {#common-ip-threat-categories}”IP address threat categories for security filtering.
| Value | Description |
|---|---|
SPAM_SOURCES | Known spam sources |
WINDOWS_EXPLOITS | Windows exploit sources |
WEB_ATTACKS | Web attack sources |
BOTNETS | Known botnet IPs |
SCANNERS | Network scanner IPs |
REPUTATION | Poor reputation IPs |
PHISHING | Phishing-related IPs |
PROXY | Anonymous proxy IPs |
MOBILE_THREATS | Mobile threat sources |
TOR_PROXY | Tor exit nodes |
DENIAL_OF_SERVICE | DoS attack sources |
NETWORK | Known bad network ranges |