@robinmordasiewicz/f5xc-terraform-mcp 2.3.0 → 2.4.3

package/dist/docs/guides/http-loadbalancer.md

@@ -0,0 +1,274 @@
+---
+page_title: "Guide: HTTP Load Balancer with Security Features"
+subcategory: "Guides"
+description: |-
+  Step-by-step guide to deploy a production-ready HTTP Load Balancer with WAF,
+  bot defense, and rate limiting using F5 Distributed Cloud and Terraform.
+---
+
+# HTTP Load Balancer with Security Features
+
+This guide walks you through deploying a complete HTTP Load Balancer on F5 Distributed Cloud. By the end, you'll have a production-ready load balancer with:
+
+- **Web Application Firewall (WAF)** - Blocks common web attacks (SQLi, XSS, etc.)
+- **Bot Defense** - Protects against automated attacks and scrapers
+- **Rate Limiting** - Prevents abuse by limiting requests per client
+- **JavaScript Challenge** - Client-side bot detection
+- **Automatic TLS Certificates** - HTTPS with auto-renewal
+- **Health Monitoring** - Active health checks on origin servers
+- **Threat Mesh** - Global threat intelligence sharing
+
+## Prerequisites
+
+Before you begin, ensure you have:
+
+- **F5 Distributed Cloud Account** - Sign up at <https://www.f5.com/cloud/products/distributed-cloud-console> if you don't have one
+- **API Token** - Generate credentials from the F5XC Console at <https://docs.cloud.f5.com/docs/how-to/user-mgmt/credentials>
+- **Terraform >= 1.8** - Download and install from <https://www.terraform.io/downloads>
+- **A Domain** - Domain you control for DNS configuration
+- **Backend Origin Server** - Your application server accessible from the internet
+
+## Quick Start
+
+### Step 1: Clone the Repository
+
+```bash
+git clone https://github.com/robinmordasiewicz/terraform-provider-f5xc.git
+cd terraform-provider-f5xc/examples/guides/http-loadbalancer
+```
+
+### Step 2: Set Environment Variables
+
+Configure authentication using environment variables. **Never commit credentials to version control.**
+
+```bash
+export F5XC_API_URL="https://your-tenant.console.ves.volterra.io"
+export F5XC_API_TOKEN="your-api-token"
+```
+
+-> **Tip:** Add these to your shell profile (`~/.bashrc` or `~/.zshrc`) for persistence across terminal sessions.
+
+### Step 3: Configure Your Deployment
+
+```bash
+cp terraform.tfvars.example terraform.tfvars
+```
+
+Edit `terraform.tfvars` with your values:
+
+```hcl
+# Your application's domain
+domain = "app.example.com"
+
+# Your backend server
+origin_server = "origin.example.com"
+origin_port   = 443
+
+# Namespace configuration
+namespace_name   = "example-app"
+create_namespace = true
+
+# Security features (all enabled by default)
+enable_waf           = true
+enable_bot_defense   = true
+enable_rate_limiting = true
+rate_limit_requests  = 100
+```
+
+### Step 4: Deploy
+
+```bash
+terraform init
+terraform plan
+terraform apply
+```
+
+Review the plan output, then type `yes` to confirm deployment.
+
+### Step 5: Configure DNS
+
+After deployment, Terraform outputs a CNAME target. Create a DNS record:
+
+| Type | Name | Value |
+|------|------|-------|
+| CNAME | app.example.com | ves-io-app-example-com.ac.vh.ves.io |
+
+~> **Note:** DNS propagation may take up to 48 hours, though typically completes within minutes.
+
+### Step 6: Verify
+
+1. **Wait for TLS provisioning** - Auto-cert typically provisions within 5 minutes
+2. **Access your application** - Navigate to `https://your-domain.com`
+3. **Check the console** - View traffic and security events in F5 Distributed Cloud Console
+
+## Configuration Options
+
+### Using an Existing Namespace
+
+To deploy into an existing namespace instead of creating a new one:
+
+```hcl
+namespace_name   = "example-namespace"
+create_namespace = false
+```
+
+### Customizing Security Features
+
+Each security feature can be enabled or disabled independently:
+
+```hcl
+# Disable WAF for testing (not recommended for production)
+enable_waf = false
+
+# Disable bot defense
+enable_bot_defense = false
+
+# Disable rate limiting
+enable_rate_limiting = false
+```
+
+### Adjusting Rate Limits
+
+Fine-tune rate limiting for your application's needs:
+
+```hcl
+rate_limit_requests = 200  # requests per minute per client
+```
+
+The default burst multiplier is 10x, allowing temporary spikes above the limit.
+
+### Custom Labels
+
+Add labels for organization and filtering:
+
+```hcl
+labels = {
+  environment = "production"
+  team        = "platform"
+  cost_center = "engineering"
+}
+```
+
+## Architecture
+
+This guide creates the following resources:
+
+```
+                    ┌─────────────────────────────────────────┐
+                    │        F5 Distributed Cloud             │
+                    │                                         │
+ Users ──────────►  │  ┌─────────────────────────────────┐   │
+                    │  │    HTTP Load Balancer           │   │
+                    │  │  ┌──────────────────────────┐   │   │
+                    │  │  │ • TLS Termination        │   │   │
+                    │  │  │ • JavaScript Challenge   │   │   │
+                    │  │  │ • WAF (blocking mode)    │   │   │
+                    │  │  │ • Bot Defense            │   │   │
+                    │  │  │ • Rate Limiting          │   │   │
+                    │  │  │ • Threat Mesh            │   │   │
+                    │  │  └──────────────────────────┘   │   │
+                    │  └──────────────┬──────────────────┘   │
+                    │                 │                       │
+                    │  ┌──────────────▼──────────────────┐   │
+                    │  │         Origin Pool             │   │
+                    │  │  ┌──────────────────────────┐   │   │
+                    │  │  │ • Health Checks          │   │   │
+                    │  │  │ • TLS to Origin          │   │   │
+                    │  │  │ • Load Balancing         │   │   │
+                    │  │  └──────────────────────────┘   │   │
+                    │  └──────────────┬──────────────────┘   │
+                    └─────────────────┼───────────────────────┘
+                                      │
+                                      ▼
+                              Your Origin Server
+```
+
+### Resources Created
+
+| Resource | Purpose |
+|----------|---------|
+| `f5xc_namespace` | Isolates resources (optional) |
+| `f5xc_healthcheck` | Monitors origin server health |
+| `f5xc_origin_pool` | Defines backend servers |
+| `f5xc_app_firewall` | WAF configuration |
+| `f5xc_rate_limiter` | Rate limiting policy |
+| `f5xc_http_loadbalancer` | Main load balancer |
+
+## Troubleshooting
+
+### Certificate Not Provisioning
+
+**Symptom:** HTTPS returns certificate errors after deployment.
+
+**Solutions:**
+
+1. Verify DNS CNAME is correctly configured
+2. Wait up to 10 minutes for certificate provisioning
+3. Check the Load Balancer status in F5XC Console
+
+### 502 Bad Gateway
+
+**Symptom:** Load balancer returns 502 errors.
+
+**Solutions:**
+
+1. Verify `origin_server` is accessible from the internet
+2. Check health check path returns HTTP 200
+3. Verify origin port is correct
+4. Check origin server TLS configuration
+
+### WAF Blocking Legitimate Traffic
+
+**Symptom:** Valid requests are blocked by WAF.
+
+**Solutions:**
+
+1. Check Security Analytics in F5XC Console
+2. Review blocked request details
+3. Consider temporarily setting WAF to monitoring mode:
+
+   ```hcl
+   enable_waf = false  # Disable in Terraform
+   ```
+
+### Rate Limiting Too Aggressive
+
+**Symptom:** Users hitting rate limits during normal usage.
+
+**Solutions:**
+
+1. Increase the rate limit:
+
+   ```hcl
+   rate_limit_requests = 500
+   ```
+
+2. Review rate limiting events in the console
+3. Consider user identification beyond IP address
+
+## Clean Up
+
+To remove all resources created by this guide:
+
+```bash
+terraform destroy
+```
+
+Type `yes` to confirm destruction.
+
+!> **Warning:** This will immediately remove the load balancer and all associated resources. Traffic to your domain will no longer be handled by F5XC.
+
+## Next Steps
+
+Now that you have a basic HTTP Load Balancer deployed, consider exploring:
+
+- [Origin Pool Resource](../resources/origin_pool) - Add multiple origins for redundancy
+- [App Firewall Resource](../resources/app_firewall) - Customize WAF rules
+- [Service Policy Resource](../resources/service_policy) - Add custom access control
+- [TCP Load Balancer Resource](../resources/tcp_loadbalancer) - For non-HTTP applications
+
+## Support
+
+- **Provider Documentation:** [F5XC Provider](../index)
+- **F5 Documentation:** [F5 Distributed Cloud Docs](https://docs.cloud.f5.com/)
+- **Issues:** [GitHub Issues](https://github.com/robinmordasiewicz/terraform-provider-f5xc/issues)

package/dist/docs/resources/addon_subscription.md

@@ -0,0 +1,136 @@
+---
+page_title: "f5xc_addon_subscription Resource - terraform-provider-f5xc"
+subcategory: "Subscriptions"
+description: |-
+  [Namespace: required] Manages new Addon Subscription with Addon Subscription State in F5 Distributed Cloud.
+---
+
+# f5xc_addon_subscription (Resource)
+
+[Namespace: required] Manages new Addon Subscription with Addon Subscription State in F5 Distributed Cloud.
+
+~> **Note** Please refer to [Addon Subscription API docs](https://docs.cloud.f5.com/docs-v2/api/pbac-addon-subscription) to learn more.
+
+## Example Usage
+
+```terraform
+# Addon Subscription Resource Example
+# [Namespace: required] Manages new Addon Subscription with Addon Subscription State in F5 Distributed Cloud.
+
+# Basic Addon Subscription configuration
+resource "f5xc_addon_subscription" "example" {
+  name      = "example-addon-subscription"
+  namespace = "staging"
+
+  labels = {
+    environment = "production"
+    managed_by  = "terraform"
+  }
+
+  annotations = {
+    "owner" = "platform-team"
+  }
+
+  # Resource-specific configuration
+  # Object reference. This type establishes a direct referenc...
+  addon_service {
+    # Configure addon_service settings
+  }
+  # Notification Preference. NotificationPreference preferenc...
+  notification_preference {
+    # Configure notification_preference settings
+  }
+  # Addon Subscription Associated Emails. Addon Subscription ...
+  emails {
+    # Configure emails settings
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Argument Reference
+
+### Metadata Argument Reference
+
+<a id="name"></a>&#x2022; [`name`](#name) - Required String<br>Name of the Addon Subscription. Must be unique within the namespace
+
+<a id="namespace"></a>&#x2022; [`namespace`](#namespace) - Required String<br>Namespace where the Addon Subscription will be created
+
+<a id="annotations"></a>&#x2022; [`annotations`](#annotations) - Optional Map<br>Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata
+
+<a id="description"></a>&#x2022; [`description`](#description) - Optional String<br>Human readable description for the object
+
+<a id="disable"></a>&#x2022; [`disable`](#disable) - Optional Bool<br>A value of true will administratively disable the object
+
+<a id="labels"></a>&#x2022; [`labels`](#labels) - Optional Map<br>Labels is a user defined key value map that can be attached to resources for organization and filtering
+
+### Spec Argument Reference
+
+<a id="addon-service"></a>&#x2022; [`addon_service`](#addon-service) - Optional Block<br>Object reference. This type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name<br>See [Addon Service](#addon-service) below for details.
+
+<a id="notification-preference"></a>&#x2022; [`notification_preference`](#notification-preference) - Optional Block<br>Notification Preference. NotificationPreference preference for receiving addon subscription notifications<br>See [Notification Preference](#notification-preference) below for details.
+
+<a id="status"></a>&#x2022; [`status`](#status) - Optional String  Defaults to `SUBSCRIPTION_PENDING`<br>Possible values are `SUBSCRIPTION_PENDING`, `SUBSCRIPTION_ENABLED`, `SUBSCRIPTION_DISABLE_PENDING`, `SUBSCRIPTION_DISABLED`<br>[Enum: SUBSCRIPTION_PENDING|SUBSCRIPTION_ENABLED|SUBSCRIPTION_DISABLE_PENDING|SUBSCRIPTION_DISABLED] Addon Subscription Type. Represents the different states of an addon subscription. - SUBSCRIPTION_PENDING: Subscription Pending Indicates that the subscription is pending enablement. - SUBSCRIPTION_ENABLED: Subscription Enabled Indicates that the subscription is currently enabled and active. - SUBSCRIPTION_DISABLE_PENDING: Subscription Disable Pending Indicates that the addon disable process is pending. - SUBSCRIPTION_DISABLED: Subscription Disabled Indicates that the addon has been disabled
+
+<a id="timeouts"></a>&#x2022; [`timeouts`](#timeouts) - Optional Block<br>See [Timeouts](#timeouts) below for details.
+
+### Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+<a id="id"></a>&#x2022; [`id`](#id) - Optional String<br>Unique identifier for the resource
+
+---
+
+#### Addon Service
+
+An [`addon_service`](#addon-service) block supports the following:
+
+<a id="addon-service-name"></a>&#x2022; [`name`](#addon-service-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="addon-service-namespace"></a>&#x2022; [`namespace`](#addon-service-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="addon-service-tenant"></a>&#x2022; [`tenant`](#addon-service-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Notification Preference
+
+A [`notification_preference`](#notification-preference) block supports the following:
+
+<a id="notification-preference-emails"></a>&#x2022; [`emails`](#notification-preference-emails) - Optional Block<br>Addon Subscription Associated Emails. Addon Subscription Emails associated with the Addon Subscription<br>See [Emails](#notification-preference-emails) below.
+
+<a id="notification-preference-support-ticket-id"></a>&#x2022; [`support_ticket_id`](#notification-preference-support-ticket-id) - Optional Block<br>Support Ticket ID. SupportTicketId gives the information about ticket created for managed addon subscription<br>See [Support Ticket ID](#notification-preference-support-ticket-id) below.
+
+#### Notification Preference Emails
+
+An [`emails`](#notification-preference-emails) block (within [`notification_preference`](#notification-preference)) supports the following:
+
+<a id="notification-preference-emails-email-ids"></a>&#x2022; [`email_ids`](#notification-preference-emails-email-ids) - Optional List<br>Emails. Email ids associated with the Addon Subscription
+
+#### Notification Preference Support Ticket ID
+
+A [`support_ticket_id`](#notification-preference-support-ticket-id) block (within [`notification_preference`](#notification-preference)) supports the following:
+
+<a id="notification-preference-support-ticket-id-subscription-ticket-id"></a>&#x2022; [`subscription_ticket_id`](#notification-preference-support-ticket-id-subscription-ticket-id) - Optional String<br>Subscription Ticket ID. subscription_ticket_id associated with the Addon Subscription subscription
+
+<a id="notification-preference-support-ticket-id-unsubscription-ticket-id"></a>&#x2022; [`unsubscription_ticket_id`](#notification-preference-support-ticket-id-unsubscription-ticket-id) - Optional String<br>Unsubscription Ticket ID. unsubscription_ticket_id associated with the Addon Subscription unsubscription
+
+#### Timeouts
+
+A [`timeouts`](#timeouts) block supports the following:
+
+<a id="timeouts-create"></a>&#x2022; [`create`](#timeouts-create) - Optional String (Defaults to `10 minutes`)<br>Used when creating the resource
+
+<a id="timeouts-delete"></a>&#x2022; [`delete`](#timeouts-delete) - Optional String (Defaults to `10 minutes`)<br>Used when deleting the resource
+
+<a id="timeouts-read"></a>&#x2022; [`read`](#timeouts-read) - Optional String (Defaults to `5 minutes`)<br>Used when retrieving the resource
+
+<a id="timeouts-update"></a>&#x2022; [`update`](#timeouts-update) - Optional String (Defaults to `10 minutes`)<br>Used when updating the resource
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import using namespace/name format
+terraform import f5xc_addon_subscription.example system/example
+```

package/dist/docs/resources/address_allocator.md

@@ -0,0 +1,106 @@
+---
+page_title: "f5xc_address_allocator Resource - terraform-provider-f5xc"
+subcategory: "Cloud Resources"
+description: |-
+  [Namespace: required] Manages Address Allocator will create an address allocator object in 'system' namespace of the user in F5 Distributed Cloud.
+---
+
+# f5xc_address_allocator (Resource)
+
+[Namespace: required] Manages Address Allocator will create an address allocator object in 'system' namespace of the user in F5 Distributed Cloud.
+
+~> **Note** Please refer to [Address Allocator API docs](https://docs.cloud.f5.com/docs-v2/api/address-allocator) to learn more.
+
+## Example Usage
+
+```terraform
+# Address Allocator Resource Example
+# [Namespace: required] Manages Address Allocator will create an address allocator object in 'system' namespace of the user in F5 Distributed Cloud.
+
+# Basic Address Allocator configuration
+resource "f5xc_address_allocator" "example" {
+  name      = "example-address-allocator"
+  namespace = "staging"
+
+  labels = {
+    environment = "production"
+    managed_by  = "terraform"
+  }
+
+  annotations = {
+    "owner" = "platform-team"
+  }
+
+  # Resource-specific configuration
+  # Address Allocation Scheme. Decides the scheme to be used ...
+  address_allocation_scheme {
+    # Configure address_allocation_scheme settings
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Argument Reference
+
+### Metadata Argument Reference
+
+<a id="name"></a>&#x2022; [`name`](#name) - Required String<br>Name of the Address Allocator. Must be unique within the namespace
+
+<a id="namespace"></a>&#x2022; [`namespace`](#namespace) - Required String<br>Namespace where the Address Allocator will be created
+
+<a id="annotations"></a>&#x2022; [`annotations`](#annotations) - Optional Map<br>Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata
+
+<a id="description"></a>&#x2022; [`description`](#description) - Optional String<br>Human readable description for the object
+
+<a id="disable"></a>&#x2022; [`disable`](#disable) - Optional Bool<br>A value of true will administratively disable the object
+
+<a id="labels"></a>&#x2022; [`labels`](#labels) - Optional Map<br>Labels is a user defined key value map that can be attached to resources for organization and filtering
+
+### Spec Argument Reference
+
+<a id="address-allocation-scheme"></a>&#x2022; [`address_allocation_scheme`](#address-allocation-scheme) - Optional Block<br>Address Allocation Scheme. Decides the scheme to be used to allocate addresses from the configured address pool<br>See [Address Allocation Scheme](#address-allocation-scheme) below for details.
+
+<a id="address-pool"></a>&#x2022; [`address_pool`](#address-pool) - Optional List<br>Address Pool. Address pool from which the allocator carves out subnets or addresses to its clients
+
+<a id="mode"></a>&#x2022; [`mode`](#mode) - Optional String  Defaults to `LOCAL`<br>Possible values are `LOCAL`, `GLOBAL_PER_SITE_NODE`<br>[Enum: LOCAL|GLOBAL_PER_SITE_NODE] Allocator Mode. Mode of the address allocator Address allocator is for VERs within the local cluster or site Allocation is per site and then per node
+
+<a id="timeouts"></a>&#x2022; [`timeouts`](#timeouts) - Optional Block<br>See [Timeouts](#timeouts) below for details.
+
+### Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+<a id="id"></a>&#x2022; [`id`](#id) - Optional String<br>Unique identifier for the resource
+
+---
+
+#### Address Allocation Scheme
+
+An [`address_allocation_scheme`](#address-allocation-scheme) block supports the following:
+
+<a id="address-allocation-scheme-allocation-unit"></a>&#x2022; [`allocation_unit`](#address-allocation-scheme-allocation-unit) - Optional Number<br>Allocation Unit. Prefix length indicating the size of each allocated subnet. For example, if this is specified as 30, subnets of /30 will be allocated from the given address pool
+
+<a id="address-allocation-scheme-local-interface-address-offset"></a>&#x2022; [`local_interface_address_offset`](#address-allocation-scheme-local-interface-address-offset) - Optional Number<br>Local Interface Address Offset. This is used to derive address for the local interface from the allocated subnet. If Local Interface Address Type is set to 'Offset from beginning of Subnet', this offset value is added to the allocated subnet and used as the local interface address. For example, if the allocated subnet is 169.254.0.0/30 and offset is set to 2 with Local Interface Address Type set to 'Offset from beginning of Subnet', local interface address of 169.254.0.2 is used. If Local Interface Address Type is set to 'Offset from end of Subnet', this offset value is subtracted from the end of the allocated subnet and used as the local interface address. For example, if the allocated subnet is 169.254.0.0/30 and offset is set to 1 with Local Interface Address Type set to 'Offset from end of Subnet', local interface address of 169.254.0.2 is used
+
+<a id="address-allocation-scheme-local-interface-address-type"></a>&#x2022; [`local_interface_address_type`](#address-allocation-scheme-local-interface-address-type) - Optional String  Defaults to `LOCAL_INTERFACE_ADDRESS_OFFSET_FROM_SUBNET_BEGIN`<br>Possible values are `LOCAL_INTERFACE_ADDRESS_OFFSET_FROM_SUBNET_BEGIN`, `LOCAL_INTERFACE_ADDRESS_OFFSET_FROM_SUBNET_END`, `LOCAL_INTERFACE_ADDRESS_FROM_PREFIX`<br>[Enum: LOCAL_INTERFACE_ADDRESS_OFFSET_FROM_SUBNET_BEGIN|LOCAL_INTERFACE_ADDRESS_OFFSET_FROM_SUBNET_END|LOCAL_INTERFACE_ADDRESS_FROM_PREFIX] Local Interface Address Type. Dictates how local interface address is derived from the allocated subnet Use Nth address of the allocated subnet as the local interface address, N being the Local Interface Address Offset. For example, if the allocated subnet is 169.254.0.0/30, Local Interface Address Offset is set to 2 and Local Interface Address Type is set to 'Offset from beginning of Subnet', local address of 169.254.0.2 is used. Use Nth last address of the allocated subnet as the local interface address, N being the Local Interface Address Offset. For example, if the allocated subnet is 169.254.0.0/30, Local Interface Address Offset is set to 1 and Local Interface Address Type is set to 'Offset from end of Subnet', local address of 169.254.0.2 is used. This case is used for external_connector
+
+#### Timeouts
+
+A [`timeouts`](#timeouts) block supports the following:
+
+<a id="timeouts-create"></a>&#x2022; [`create`](#timeouts-create) - Optional String (Defaults to `10 minutes`)<br>Used when creating the resource
+
+<a id="timeouts-delete"></a>&#x2022; [`delete`](#timeouts-delete) - Optional String (Defaults to `10 minutes`)<br>Used when deleting the resource
+
+<a id="timeouts-read"></a>&#x2022; [`read`](#timeouts-read) - Optional String (Defaults to `5 minutes`)<br>Used when retrieving the resource
+
+<a id="timeouts-update"></a>&#x2022; [`update`](#timeouts-update) - Optional String (Defaults to `10 minutes`)<br>Used when updating the resource
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import using namespace/name format
+terraform import f5xc_address_allocator.example system/example
+```