xcsh_tunnel (Data Source)

Retrieves information about tunnel in a given namespace. If one already exist it will give a error in F5 Distributed Cloud. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# Tunnel Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing Tunnel by name
data "xcsh_tunnel" "example" {
  name      = "example-tunnel"
  namespace = "staging"
}

output "tunnel_id" {
  value = data.xcsh_tunnel.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Tunnel

• namespace - Required String
Namespace where the Tunnel exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• description - Optional String
Description of the Tunnel

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• local_ip - Optional String
Defines the OPTIONS to select local IP address and virtual network for tunnel object OPTIONS available are - 1. Local Interface - Network Interface from which IP address and network will be selected 2. IP Address - IP address and network can be configured explicitly

• params - Optional String
Tunnel configuration parameters for supported encapsulation 1. IPsec is supported with PSK for which PSK can be configured

• remote_ip - Optional String
Defines the OPTIONS to select remote IP address for tunnel object OPTIONS available are - 1. IP Address - Specifies the remote IP to which tunnel has to be connected 2. Remote endpoint - Is a map of IP address on per ver node basis

• tunnel_type - Optional String Defaults to IPSEC_PSK
Possible values are IPSEC_PSK, GRE
[Enum: IPSEC_PSK|GRE] Supported tunnel types are IPsec IPsec tunnel type with PSK GRE tunnel type

• intf - Optional String
Provides the local interface to pick up source IP and network for transporting encapsulated packet

• ip_address - Optional String
Provides the configuration to pick up source IP and network for transporting encapsulated packet

• local_intf - Optional List
Local interface to be used for filling in source information of IP and network for transport

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• auto - Optional Object
Enable this option

• ip_address - Optional String
IP Address used to specify an IPv4 or IPv6 address

• virtual_network_type - Optional String
Different types of virtual networks understood by the system

• ipv4 - Optional String
IPv4 address in dotted decimal notation (e.g., 192.0.2.1)

• ipv6 - Optional String
IPv6 Address specified as hexadecimal numbers separated by ’:’

• addr - Optional String
IPv4 Address in string form with dot-decimal notation

• addr - Optional String
IPv6 Address in form of string. IPv6 address must be specified as hexadecimal numbers separated by ’:’ The address can be compacted by suppressing zeros e.g. ‘2001:db8:0:0:0:0:2:1’ becomes ‘2001:db8::2:1’ or ‘2001:db8:0:0:0:2:0:0’ becomes ‘2001:db8::2::’

• public - Optional Object
Enable this option

• site_local - Optional Object
Enable this option

• site_local_inside - Optional Object
Enable this option

Params

A params block supports the following:

• ipsec - Optional String
Configuration for IPsec encapsulation are: 1. PSK - pre shared key to be used by IKE

Params Ipsec

An ipsec block (within params) supports the following:

• ipsec_psk - Optional String
SecretType is used in an object to indicate a sensitive/confidential field

Params Ipsec Ipsec Psk

An ipsec_psk block (within params.ipsec) supports the following:

• blindfold_secret_info - Optional String
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management

• clear_secret_info - Optional String
ClearSecretInfoType specifies information about the Secret that is not encrypted

Params Ipsec Ipsec Psk Blindfold Secret Info

A blindfold_secret_info block (within params.ipsec.ipsec_psk) supports the following:

• decryption_provider - Optional String
Name of the Secret Management Access object that contains information about the backend Secret Management service

• location - Optional String
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location

• store_provider - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

Params Ipsec Ipsec Psk Clear Secret Info

A clear_secret_info block (within params.ipsec.ipsec_psk) supports the following:

• provider_ref - Optional String
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///

• url - Optional String
URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding

Remote IP

A remote_ip block supports the following:

• endpoints - Optional String
Provides a map of ver node name to remote node attributes Ver node should use these attributes to configure as remote tunnel

• ip - Optional String
IP Address used to specify an IPv4 or IPv6 address

Remote IP Endpoints

An endpoints block (within remote_ip) supports the following:

• endpoints - Optional String
Map of remote attributes to which tunnel will be established on per site node basis Every node can have a different attributes and IP address to connect to Key is ver node name and value is Remote node attributes

Remote IP Endpoints Endpoints

An endpoints block (within remote_ip.endpoints) supports the following:

Remote IP IP

An ip block (within remote_ip) supports the following:

• ipv4 - Optional String
IPv4 address in dotted decimal notation (e.g., 192.0.2.1)

• ipv6 - Optional String
IPv6 Address specified as hexadecimal numbers separated by ’:‘

Remote IP IP IPv4

An ipv4 block (within remote_ip.ip) supports the following:

• addr - Optional String
IPv4 Address in string form with dot-decimal notation

Remote IP IP IPv6

An ipv6 block (within remote_ip.ip) supports the following:

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges