diff --git a/released/discovery_center/mission_4441/step1/README.md b/released/discovery_center/mission_4441/step1/README.md new file mode 100644 index 00000000..b606c4e0 --- /dev/null +++ b/released/discovery_center/mission_4441/step1/README.md @@ -0,0 +1,64 @@ +# Discovery Center Mission: Get Started with SAP Build Code and Joule using Generative AI (4441) + +## Overview + +This sample shows how to create a landscape for the Discovery Center Mission - [Get Started with SAP Build Code and Joule using Generative AI](https://discovery-center.cloud.sap/missiondetail/4441/) + +## Content of setup + +The setup comprises the following resources: + +- Creation of the SAP BTP subaccount +- Entitlements of services +- Subscriptions to applications +- Role collection assignments to users +- Management of users and roles on org and space level + +## Deploying the resources + +Make sure that you are familiar with SAP BTP and know both the [Get Started with btp-terraform-samples](https://github.com/SAP-samples/btp-terraform-samples/blob/main/GET_STARTED.md) and the [Get Started with the Terraform Provider for BTP](https://developers.sap.com/tutorials/btp-terraform-get-started.html) + +To deploy the resources you must: + +1. Set your credentials as environment variables + + ```bash + export BTP_USERNAME ='' + export BTP_PASSWORD ='' + export CF_USER ='' + export CF_PASSWORD ='' + ``` + +2. Change the variables in the `sample.tfvars` file to meet your requirements + + > The minimal set of parameters you should specify (besides user_email and password) is global account (i.e. its subdomain) and the used custom_idp and all user assignments + + > ⚠ NOTE: You should pay attention **specifically** to the users defined in the samples.tfvars whether they already exist in your SAP BTP accounts. Otherwise, you might get error messages like, e.g., `Error: The user could not be found: jane.doe@test.com`. + + +3. Initialize your workspace: + + ```bash + terraform init + ``` + +4. You can check what Terraform plans to apply based on your configuration: + + ```bash + terraform plan -var-file="sample.tfvars" + ``` + +5. Apply your configuration to provision the resources: + + ```bash + terraform apply -var-file="sample.tfvars" + ``` + ``` + +## In the end + +You probably want to remove the assets after trying them out to avoid unnecessary costs. To do so execute the following command: + +```bash +terraform destroy -var-file="sample.tfvars" +``` \ No newline at end of file diff --git a/released/discovery_center/mission_4441/step1/main.tf b/released/discovery_center/mission_4441/step1/main.tf new file mode 100644 index 00000000..f998132c --- /dev/null +++ b/released/discovery_center/mission_4441/step1/main.tf @@ -0,0 +1,347 @@ +# ------------------------------------------------------------------------------------------------------ +# SUBACCOUNT SETUP +# ------------------------------------------------------------------------------------------------------ +# Setup subaccount domain (to ensure uniqueness in BTP global account) +resource "random_uuid" "uuid" {} + +# ------------------------------------------------------------------------------------------------------ +# Creation of subaccount +# ------------------------------------------------------------------------------------------------------ +resource "btp_subaccount" "dc_mission" { + name = var.subaccount_name + subdomain = join("-", ["dc-mission-4441", random_uuid.uuid.result]) + region = lower(var.region) +} + +# ------------------------------------------------------------------------------------------------------ +# Assign custom IDP to sub account (if custom_idp is set) +# ------------------------------------------------------------------------------------------------------ +resource "btp_subaccount_trust_configuration" "fully_customized" { + # Only create trust configuration if custom_idp has been set + count = var.custom_idp == "" ? 0 : 1 + subaccount_id = btp_subaccount.dc_mission.id + identity_provider = var.custom_idp +} +# ------------------------------------------------------------------------------------------------------ +# CLOUDFOUNDRY PREPARATION +# ------------------------------------------------------------------------------------------------------ +# +# Fetch all available environments for the subaccount +data "btp_subaccount_environments" "all" { + subaccount_id = btp_subaccount.dc_mission.id +} +# ------------------------------------------------------------------------------------------------------ +# Take the landscape label from the first CF environment if no environment label is provided +# (this replaces the previous null_resource) +# ------------------------------------------------------------------------------------------------------ +resource "terraform_data" "cf_landscape_label" { + input = length(var.cf_landscape_label) > 0 ? var.cf_landscape_label : [for env in data.btp_subaccount_environments.all.values : env if env.service_name == "cloudfoundry" && env.environment_type == "cloudfoundry"][0].landscape_label +} +# ------------------------------------------------------------------------------------------------------ +# Create the Cloud Foundry environment instance +# ------------------------------------------------------------------------------------------------------ +resource "btp_subaccount_environment_instance" "cloudfoundry" { + subaccount_id = btp_subaccount.dc_mission.id + name = "cf-${random_uuid.uuid.result}" + environment_type = "cloudfoundry" + service_name = "cloudfoundry" + plan_name = "standard" + landscape_label = terraform_data.cf_landscape_label.output + + parameters = jsonencode({ + instance_name = "cf-${random_uuid.uuid.result}" + }) +} + +# ------------------------------------------------------------------------------------------------------ +# SERVICES +# ------------------------------------------------------------------------------------------------------ +# +# ------------------------------------------------------------------------------------------------------ +# Setup cicd-service (not running in CF environment) +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "cicd_service" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "cicd-service" + plan_name = "default" +} +# Get serviceplan_id for cicd-service with plan_name "default" +data "btp_subaccount_service_plan" "cicd_service" { + subaccount_id = btp_subaccount.dc_mission.id + offering_name = "cicd-service" + name = "default" + depends_on = [btp_subaccount_entitlement.cicd_service] +} +# Create service instance +resource "btp_subaccount_service_instance" "cicd_service" { + subaccount_id = btp_subaccount.dc_mission.id + serviceplan_id = data.btp_subaccount_service_plan.cicd_service.id + name = "default_cicd-service" + # Subscription to the cicd-app subscription is required for creating the service instance + # See as well https://help.sap.com/docs/continuous-integration-and-delivery/sap-continuous-integration-and-delivery/optional-enabling-api-usage?language=en-US + depends_on = [btp_subaccount_subscription.cicd_app] +} +# Create service key +resource "random_uuid" "service_key_cicd_service" {} +resource "btp_subaccount_service_binding" "cicd_service" { + subaccount_id = btp_subaccount.dc_mission.id + service_instance_id = btp_subaccount_service_instance.cicd_service.id + name = join("_", ["defaultKey", random_uuid.service_key_cicd_service.result]) + depends_on = [btp_subaccount_service_instance.cicd_service] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup destination +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "destination" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "destination" + plan_name = "lite" +} +# Get serviceplan_id for cicd-service with plan_name "default" +data "btp_subaccount_service_plan" "destination" { + subaccount_id = btp_subaccount.dc_mission.id + offering_name = "destination" + name = "lite" + depends_on = [btp_subaccount_entitlement.destination] +} +# Create service instance +resource "btp_subaccount_service_instance" "destination" { + subaccount_id = btp_subaccount.dc_mission.id + serviceplan_id = data.btp_subaccount_service_plan.destination.id + name = "destination" + depends_on = [btp_subaccount_service_binding.cicd_service, data.btp_subaccount_service_plan.destination] + parameters = jsonencode({ + HTML5Runtime_enabled = true + init_data = { + subaccount = { + existing_destinations_policy = "update" + destinations = [ + # This is the destination to the cicd-service binding + { + Description = "[Do not delete] SAP Continuous Integration and Delivery" + Type = "HTTP" + clientId = "${jsondecode(btp_subaccount_service_binding.cicd_service.credentials)["uaa"]["clientid"]}" + clientSecret = "${jsondecode(btp_subaccount_service_binding.cicd_service.credentials)["uaa"]["clientsecret"]}" + "HTML5.DynamicDestination" = true + Authentication = "OAuth2JWTBearer" + Name = "cicd-backend" + tokenServiceURL = "${jsondecode(btp_subaccount_service_binding.cicd_service.credentials)["uaa"]["url"]}" + ProxyType = "Internet" + URL = "${jsondecode(btp_subaccount_service_binding.cicd_service.credentials)["url"]}" + tokenServiceURLType = "Dedicated" + } + ] + } + } + }) +} + +# ------------------------------------------------------------------------------------------------------ +# APP SUBSCRIPTIONS +# ------------------------------------------------------------------------------------------------------ +# +# ------------------------------------------------------------------------------------------------------ +# Setup build-code +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "build_code" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "build-code" + plan_name = "standard" +} +# Subscribe +resource "btp_subaccount_subscription" "build_code" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "build-code" + plan_name = "standard" + depends_on = [btp_subaccount_entitlement.build_code] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup sapappstudio +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "sapappstudio" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "sapappstudio" + plan_name = "build-code" +} +# Subscribe (depends on subscription of build-code) +resource "btp_subaccount_subscription" "sapappstudio" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "sapappstudio" + plan_name = "build-code" + depends_on = [btp_subaccount_subscription.build_code, btp_subaccount_entitlement.sapappstudio] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup SAPLaunchpad (SAP Build Work Zone, standard edition) +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "sap_launchpad" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "SAPLaunchpad" + plan_name = "standard" +} +# Subscribe +resource "btp_subaccount_subscription" "sap_launchpad" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "SAPLaunchpad" + plan_name = "standard" + depends_on = [btp_subaccount_entitlement.sap_launchpad] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup cicd-app (Continuous Integration & Delivery) +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "cicd_app" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "cicd-app" + plan_name = "build-code" +} +# Subscribe +resource "btp_subaccount_subscription" "cicd_app" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "cicd-app" + plan_name = "build-code" + depends_on = [btp_subaccount_subscription.build_code, btp_subaccount_entitlement.cicd_app] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup feature-flags-dashboard (Feature Flags Service) +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "feature_flags_dashboard" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "feature-flags-dashboard" + plan_name = "dashboard" +} +# Subscribe +resource "btp_subaccount_subscription" "feature_flags_dashboard" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "feature-flags-dashboard" + plan_name = "dashboard" + depends_on = [btp_subaccount_entitlement.feature_flags_dashboard] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup sdm-web (Document Management Service) +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "sdm-web" { + subaccount_id = btp_subaccount.dc_mission.id + service_name = "sdm-web" + plan_name = "build-code" +} +# Subscribe +resource "btp_subaccount_subscription" "sdm-web" { + subaccount_id = btp_subaccount.dc_mission.id + app_name = "sdm-web" + plan_name = "build-code" + depends_on = [btp_subaccount_subscription.build_code, btp_subaccount_entitlement.sdm-web] +} + +# ------------------------------------------------------------------------------------------------------ +# USERS AND ROLES +# ------------------------------------------------------------------------------------------------------ +# +# Get all available subaccount roles +data "btp_subaccount_roles" "all" { + subaccount_id = btp_subaccount.dc_mission.id + depends_on = [btp_subaccount_subscription.build_code, btp_subaccount_subscription.cicd_app, btp_subaccount_subscription.sap_launchpad, btp_subaccount_subscription.sapappstudio, btp_subaccount_subscription.feature_flags_dashboard, btp_subaccount_subscription.sdm-web] +} +# ------------------------------------------------------------------------------------------------------ +# Assign role collection for Build Code Administrator +# ------------------------------------------------------------------------------------------------------ +# Assign roles to the role collection "Build Code Administrator" +resource "btp_subaccount_role_collection" "build_code_administrator" { + subaccount_id = btp_subaccount.dc_mission.id + name = "Build Code Administrator" + description = "The role collection for an administrator on SAP Build Code" + + roles = [ + for role in data.btp_subaccount_roles.all.values : { + name = role.name + role_template_app_id = role.app_id + role_template_name = role.role_template_name + } if contains(["Business_Application_Studio_Administrator", "Administrator", "FeatureFlags_Dashboard_Administrator", "RegistryAdmin"], role.role_template_name) + ] +} +# Assign users to the role collection "Build Code Administrator" +resource "btp_subaccount_role_collection_assignment" "build_code_administrator" { + for_each = toset("${var.build_code_admins}") + subaccount_id = btp_subaccount.dc_mission.id + role_collection_name = "Build Code Administrator" + user_name = each.value + depends_on = [btp_subaccount_role_collection.build_code_administrator] +} + +# ------------------------------------------------------------------------------------------------------ +# Assign role collection "Build Code Developer" +# ------------------------------------------------------------------------------------------------------ +# Create role collection "Build Code Developer" +resource "btp_subaccount_role_collection" "build_code_developer" { + subaccount_id = btp_subaccount.dc_mission.id + name = "Build Code Developer" + description = "The role collection for a developer on SAP Build Code" + + roles = [ + for role in data.btp_subaccount_roles.all.values : { + name = role.name + role_template_app_id = role.app_id + role_template_name = role.role_template_name + } if contains(["Business_Application_Studio_Developer", "Developer", "FeatureFlags_Dashboard_Auditor", "RegistryDeveloper"], role.role_template_name) + ] +} +# Assign users to the role collection "Build Code Developer" +resource "btp_subaccount_role_collection_assignment" "build_code_developer" { + for_each = toset("${var.build_code_developers}") + subaccount_id = btp_subaccount.dc_mission.id + role_collection_name = "Build Code Developer" + user_name = each.value + depends_on = [btp_subaccount_role_collection.build_code_developer] +} + +# ------------------------------------------------------------------------------------------------------ +# Assign role collection "Subaccount Administrator" +# ------------------------------------------------------------------------------------------------------ +resource "btp_subaccount_role_collection_assignment" "subaccount_admin" { + for_each = toset("${var.subaccount_admins}") + subaccount_id = btp_subaccount.dc_mission.id + role_collection_name = "Subaccount Administrator" + user_name = each.value + depends_on = [btp_subaccount.dc_mission] +} + +# ------------------------------------------------------------------------------------------------------ +# Create tfvars file for step 2 (if variable `create_tfvars_file_for_step2` is set to true) +# ------------------------------------------------------------------------------------------------------ +resource "local_file" "output_vars_step1" { + count = var.create_tfvars_file_for_step2 ? 1 : 0 + content = <<-EOT + globalaccount = "${var.globalaccount}" + cli_server_url = ${jsonencode(var.cli_server_url)} + + subaccount_id = "${btp_subaccount.dc_mission.id}" + + cf_api_url = "${jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["API Endpoint"]}" + + cf_org_id = "${jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["Org ID"]}" + cf_org_name = "${jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["Org Name"]}" + + origin = "${var.origin}" + + cf_space_name = "${var.cf_space_name}" + + cf_org_admins = ${jsonencode(var.cf_org_admins)} + cf_space_developers = ${jsonencode(var.cf_space_developers)} + cf_space_managers = ${jsonencode(var.cf_space_managers)} + + + EOT + filename = "../step2/terraform.tfvars" +} diff --git a/released/discovery_center/mission_4441/step1/outputs.tf b/released/discovery_center/mission_4441/step1/outputs.tf new file mode 100644 index 00000000..e119f441 --- /dev/null +++ b/released/discovery_center/mission_4441/step1/outputs.tf @@ -0,0 +1,55 @@ +output "globalaccount" { + value = var.globalaccount + description = "The Global Account subdomain." +} + +output "cli_server_url" { + value = var.cli_server_url + description = "The BTP CLI server URL." +} + +output "subaccount_id" { + value = btp_subaccount.dc_mission.id + description = "The Global Account subdomain id." +} + +output "cf_api_url" { + value = jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["API Endpoint"] + description = "The Cloudfoundry API URL." +} + + +output "cf_landscape_label" { + value = terraform_data.cf_landscape_label.output + description = "The Cloudfoundry landscape label." +} + +output "cf_org_id" { + value = jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["Org ID"] + description = "The Cloudfoundry org id." +} + +output "cf_org_name" { + value = jsondecode(btp_subaccount_environment_instance.cloudfoundry.labels)["Org Name"] + description = "The Cloudfoundry org name." +} + +output "custom_idp" { + value = var.custom_idp + description = "The custom identity provider." +} + +output "cf_org_admins" { + value = var.cf_org_admins + description = "List of users to set as Cloudfoundry org administrators." +} + +output "cf_space_developers" { + value = var.cf_space_developers + description = "List of users to set as Cloudfoundry space developers." +} + +output "cf_space_managers" { + value = var.cf_space_managers + description = "List of users to set as Cloudfoundry space managers." +} diff --git a/released/discovery_center/mission_4441/step1/provider.tf b/released/discovery_center/mission_4441/step1/provider.tf new file mode 100644 index 00000000..7ceab97d --- /dev/null +++ b/released/discovery_center/mission_4441/step1/provider.tf @@ -0,0 +1,13 @@ +terraform { + required_providers { + btp = { + source = "SAP/btp" + version = "~> 1.4.0" + } + } +} + +provider "btp" { + globalaccount = var.globalaccount + cli_server_url = var.cli_server_url +} diff --git a/released/discovery_center/mission_4441/step1/sample.tfvars b/released/discovery_center/mission_4441/step1/sample.tfvars new file mode 100644 index 00000000..8947e2e4 --- /dev/null +++ b/released/discovery_center/mission_4441/step1/sample.tfvars @@ -0,0 +1,29 @@ +# ------------------------------------------------------------------------------------------------------ +# Provider configuration +# ------------------------------------------------------------------------------------------------------ +# Your global account subdomain +globalaccount = "xxxxxxxx-xxxxxxx-xxxxxxx-xxxxxxxx-xxxxxx" + +# The CLI server URL (needs to be set to null if you are using the default CLI server) +cli_server_url = null + +# Region for your subaccount +region = "us10" + +# Name of your sub account +subaccount_name = "SAP Discovery Center Mission 4441 (SAP Build Code)" + +# ------------------------------------------------------------------------------------------------------ +# Create tfvars file for the step 2 +# ------------------------------------------------------------------------------------------------------ +create_tfvars_file_for_step2 = true + +# ------------------------------------------------------------------------------------------------------ +# USER ROLES +# ------------------------------------------------------------------------------------------------------ +subaccount_admins = ["another.user@test.com"] +cf_org_admins = ["another.user@test.com"] +cf_space_manager = ["another.user@test.com", "you@test.com"] +cf_space_developer = ["another.user@test.com", "you@test.com"] +build_code_admins = ["another.user@test.com", "you@test.com"] +build_code_developers = ["another.user@test.com", "you@test.com"] diff --git a/released/discovery_center/mission_4441/step1/variables.tf b/released/discovery_center/mission_4441/step1/variables.tf new file mode 100644 index 00000000..5eb5efb6 --- /dev/null +++ b/released/discovery_center/mission_4441/step1/variables.tf @@ -0,0 +1,167 @@ +variable "globalaccount" { + type = string + description = "The globalaccount subdomain where the sub account shall be created." +} + +variable "subaccount_id" { + type = string + description = "The subaccount ID." + default = "" +} + +variable "subaccount_name" { + type = string + description = "The subaccount name." + default = "My SAP Build Code subaccount." +} + +variable "cli_server_url" { + type = string + description = "The BTP CLI server URL." + default = "https://cli.btp.cloud.sap" +} + +variable "custom_idp" { + type = string + description = "Defines the custom IdP" + default = "" +} + +variable "origin" { + type = string + description = "Defines the origin key of the identity provider" + default = "sap.ids" + # The value for the origin_key can be defined + # but are normally set to "sap.ids", "sap.default" or "sap.custom" +} + + +variable "cf_org_name" { + type = string + description = "Name of the Cloud Foundry org." + default = "mission-4441-sap-build-code" + + validation { + condition = can(regex("^.{1,255}$", var.cf_org_name)) + error_message = "The Cloud Foundry org name must not be emtpy and not exceed 255 characters." + } +} + + + + +variable "cf_space_name" { + type = string + description = "Name of the Cloud Foundry space." + default = "dev" + + validation { + condition = can(regex("^.{1,255}$", var.cf_space_name)) + error_message = "The Cloud Foundry space name must not be emtpy and not exceed 255 characters." + } +} + +variable "region" { + type = string + description = "The region where the subaccount shall be created in." + default = "us10" +} + +variable "subaccount_admins" { + type = list(string) + description = "Defines the colleagues who are added to each subaccount as emergency administrators." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.subaccount_admins : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.subaccount_admins) + error_message = "Please enter a valid email address for the subaccount admins." + } +} + +variable "subaccount_service_admins" { + type = list(string) + description = "Defines the colleagues who are added to each subaccount as subaccount service administrators." + default = ["jane.doe@test.com", "john.doe@test.com"] + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.subaccount_service_admins : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.subaccount_service_admins) + error_message = "Please enter a valid email address for the CF space managers." + } +} + +variable "cf_org_admins" { + type = list(string) + description = "List of users to set as Cloudfoundry org administrators." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_org_admins : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_org_admins) + error_message = "Please enter a valid email address for the CF Org admins." + } +} + +variable "cf_space_managers" { + type = list(string) + description = "Defines the colleagues who are added to a CF space as space manager." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_space_managers : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_space_managers) + error_message = "Please enter a valid email address for the CF space managers." + } +} + +variable "cf_space_developers" { + type = list(string) + description = "Defines the colleagues who are added to a CF space as space developer." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_space_developers : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_space_developers) + error_message = "Please enter a valid email address for the CF space developers." + } +} + + + +variable "build_code_admins" { + type = list(string) + description = "Defines the colleagues who are admins for SAP Build Code." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.build_code_admins : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.build_code_admins) + error_message = "Please enter a valid email address for the Build Code admins." + } +} +variable "build_code_developers" { + type = list(string) + description = "Defines the colleagues who are developers for SAP Build Code." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.build_code_developers : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.build_code_developers) + error_message = "Please enter a valid email address for the Build Code developers." + } +} + +variable "cf_landscape_label" { + type = string + description = "In case there are multiple environments available for a subaccount, you can use this label to choose with which one you want to go. If nothing is given, we take by default the first available." + default = "" +} + +variable "origin_key" { + type = string + description = "Defines the origin key of the identity provider" + default = "sap.ids" + # The value for the origin_key can be defined + # but are normally set to "sap.ids", "sap.default" or "sap.custom" +} + +variable "create_tfvars_file_for_step2" { + type = bool + description = "Switch to enable the creation of the tfvars file for step 2." + default = false +} \ No newline at end of file diff --git a/released/discovery_center/mission_4441/step2/README.md b/released/discovery_center/mission_4441/step2/README.md new file mode 100644 index 00000000..dc1a6ebf --- /dev/null +++ b/released/discovery_center/mission_4441/step2/README.md @@ -0,0 +1,55 @@ +# Setting up a subaccount with the SAP Build Code deployed - Step 2 + +## Overview + +This script shows how to create a SAP BTP subaccount with `SAP Build Code` deployed. Step 2 comprises all activities that depend on the Cloud Foundry environment created in step 1. + +## Deploying the resources + +To deploy the resources you must: + +1. If you did not create a `tfvars` file in step 1 (via the variable `create_tfvars_file_for_step2`) you must manually Take the output of step 1 and transfer it in a `tfvars` file e.g. `sample.tfvars` file to meet your requirements. Of course you can also further adjust the generated `tfvars` file from step 1. + +2. If not already done in step 1, initialize your workspace: + + ```bash + terraform init + ``` + +3. You can check what Terraform plans to apply based on your configuration. If you use the generated `tfvars` file from step 1 you do not need need to explicitly add the filename to the command: + + ```bash + terraform plan + ``` + + In case you manually created the `tfvars` file you need to add the filename to the command: + + ```bash + terraform plan -var-file="sample.tfvars" + ``` + +4. According to the variants of step 3. apply your configuration to provision the resources either via: + + ```bash + terraform apply + ``` + + or via: + + ```bash + terraform apply -var-file="sample.tfvars" + ``` + +## In the end + +You probably want to remove the assets after trying them out to avoid unnecessary costs. To do so execute the command fitting your setup: + +```bash +terraform destroy +``` + +or: + +```bash +terraform destroy -var-file="sample.tfvars" +``` diff --git a/released/discovery_center/mission_4441/step2/main.tf b/released/discovery_center/mission_4441/step2/main.tf new file mode 100644 index 00000000..33803ff4 --- /dev/null +++ b/released/discovery_center/mission_4441/step2/main.tf @@ -0,0 +1,255 @@ +# ------------------------------------------------------------------------------------------------------ +# Create the Cloud Foundry space +# ------------------------------------------------------------------------------------------------------ +resource "cloudfoundry_space" "dev" { + name = "dev" + org = var.cf_org_id +} + +# ------------------------------------------------------------------------------------------------------ +# SETUP ALL SERVICES FOR CF USAGE +# ------------------------------------------------------------------------------------------------------ +# ------------------------------------------------------------------------------------------------------ +# Setup sdm +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "sdm" { + subaccount_id = var.subaccount_id + service_name = "sdm" + plan_name = "build-code" +} +# Create the service instance +data "cloudfoundry_service" "sdm" { + name = "sdm" + depends_on = [btp_subaccount_entitlement.sdm] +} +resource "cloudfoundry_service_instance" "sdm" { + name = "default_sdm" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.sdm.service_plans["build-code"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.sdm] +} +# Create service key +resource "random_uuid" "service_key_sdm" {} +resource "cloudfoundry_service_credential_binding" "sdm" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_sdm.result]) + service_instance = cloudfoundry_service_instance.sdm.id +} + +# ------------------------------------------------------------------------------------------------------ +# Setup mobile-services +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "mobile_services" { + subaccount_id = var.subaccount_id + service_name = "mobile-services" + plan_name = "build-code" +} +# Create the service instance +data "cloudfoundry_service" "mobile_services" { + name = "mobile-services" + depends_on = [btp_subaccount_entitlement.mobile_services] +} +resource "cloudfoundry_service_instance" "mobile_services" { + name = "default_mobile-services" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.mobile_services.service_plans["build-code"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.mobile_services] +} +# Create service key +resource "random_uuid" "service_key_mobile_services" {} +resource "cloudfoundry_service_credential_binding" "mobile_services" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_mobile_services.result]) + service_instance = cloudfoundry_service_instance.mobile_services.id +} + +# ------------------------------------------------------------------------------------------------------ +# Setup cloud-logging +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "cloud_logging" { + subaccount_id = var.subaccount_id + service_name = "cloud-logging" + plan_name = "build-code" +} +# Create the service instance +data "cloudfoundry_service" "cloud_logging" { + name = "cloud-logging" + depends_on = [btp_subaccount_entitlement.cloud_logging] +} +resource "cloudfoundry_service_instance" "cloud_logging" { + name = "default_cloud-logging" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.cloud_logging.service_plans["build-code"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.cloud_logging] +} +# Create service key +resource "random_uuid" "service_key_cloud_logging" {} +resource "cloudfoundry_service_credential_binding" "cloud_logging" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_cloud_logging.result]) + service_instance = cloudfoundry_service_instance.cloud_logging.id +} + +# ------------------------------------------------------------------------------------------------------ +# Setup alert-notification +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "alert_notification" { + subaccount_id = var.subaccount_id + service_name = "alert-notification" + plan_name = "build-code" +} +# Create the service instance +data "cloudfoundry_service" "alert_notification" { + name = "alert-notification" + depends_on = [btp_subaccount_entitlement.alert_notification] +} +resource "cloudfoundry_service_instance" "alert_notification" { + name = "default_alert-notification" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.alert_notification.service_plans["build-code"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.alert_notification] +} +# Create service key +resource "random_uuid" "service_key_alert_notification" {} +resource "cloudfoundry_service_credential_binding" "alert_notification" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_alert_notification.result]) + service_instance = cloudfoundry_service_instance.alert_notification.id +} + +# ------------------------------------------------------------------------------------------------------ +# Setup transport +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "transport" { + subaccount_id = var.subaccount_id + service_name = "transport" + plan_name = "standard" +} +# Create the service instance +data "cloudfoundry_service" "transport" { + name = "transport" + depends_on = [btp_subaccount_entitlement.transport] +} +resource "cloudfoundry_service_instance" "transport" { + name = "default_transport" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.transport.service_plans["standard"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.transport] +} +# Create service key +resource "random_uuid" "service_key_transport" {} +resource "cloudfoundry_service_credential_binding" "transport" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_transport.result]) + service_instance = cloudfoundry_service_instance.transport.id +} + +# ------------------------------------------------------------------------------------------------------ +# Setup autoscaler +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "autoscaler" { + subaccount_id = var.subaccount_id + service_name = "autoscaler" + plan_name = "standard" +} +data "cloudfoundry_service" "autoscaler" { + name = "autoscaler" + depends_on = [btp_subaccount_entitlement.autoscaler] +} +# Create the service instance +resource "cloudfoundry_service_instance" "autoscaler" { + name = "default_autoscaler" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.autoscaler.service_plans["standard"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.autoscaler] +} + +# ------------------------------------------------------------------------------------------------------ +# Setup feature-flags +# ------------------------------------------------------------------------------------------------------ +# Entitle +resource "btp_subaccount_entitlement" "feature_flags" { + subaccount_id = var.subaccount_id + service_name = "feature-flags" + plan_name = "standard" +} +# Create the service instance +data "cloudfoundry_service" "feature_flags" { + name = "feature-flags" + depends_on = [btp_subaccount_entitlement.feature_flags] +} +resource "cloudfoundry_service_instance" "feature_flags" { + name = "default_feature-flags" + space = cloudfoundry_space.dev.id + type = "managed" + service_plan = data.cloudfoundry_service.feature_flags.service_plans["standard"] + depends_on = [cloudfoundry_space_role.space_manager, cloudfoundry_space_role.space_developer, cloudfoundry_org_role.organization_manager, btp_subaccount_entitlement.feature_flags] +} +# Create service key +resource "random_uuid" "service_key_feature_flags" {} +resource "cloudfoundry_service_credential_binding" "feature_flags" { + type = "key" + name = join("_", ["defaultKey", random_uuid.service_key_feature_flags.result]) + service_instance = cloudfoundry_service_instance.feature_flags.id +} + +# ------------------------------------------------------------------------------------------------------ +# USERS AND ROLES +# ------------------------------------------------------------------------------------------------------ +# +# ------------------------------------------------------------------------------------------------------ +# Assign CF Org roles to the admin users +# ------------------------------------------------------------------------------------------------------ +# Define Org User role +resource "cloudfoundry_org_role" "organization_user" { + for_each = toset("${var.cf_org_admins}") + username = each.value + type = "organization_user" + org = var.cf_org_id + origin = var.origin_key +} +# Define Org Manager role +resource "cloudfoundry_org_role" "organization_manager" { + for_each = toset("${var.cf_org_admins}") + username = each.value + type = "organization_manager" + org = var.cf_org_id + origin = var.origin_key + depends_on = [cloudfoundry_org_role.organization_user] +} + +# ------------------------------------------------------------------------------------------------------ +# Assign CF space roles to the users +# ------------------------------------------------------------------------------------------------------ +# Define Space Manager role +resource "cloudfoundry_space_role" "space_manager" { + for_each = toset(var.cf_space_managers) + + username = each.value + type = "space_manager" + space = cloudfoundry_space.dev.id + origin = var.origin_key + depends_on = [cloudfoundry_org_role.organization_manager] +} +# Define Space Developer role +resource "cloudfoundry_space_role" "space_developer" { + for_each = toset(var.cf_space_managers) + + username = each.value + type = "space_developer" + space = cloudfoundry_space.dev.id + origin = var.origin_key + depends_on = [cloudfoundry_org_role.organization_manager] +} diff --git a/released/discovery_center/mission_4441/step2/provider.tf b/released/discovery_center/mission_4441/step2/provider.tf new file mode 100644 index 00000000..313e748d --- /dev/null +++ b/released/discovery_center/mission_4441/step2/provider.tf @@ -0,0 +1,22 @@ +terraform { + required_providers { + cloudfoundry = { + source = "SAP/cloudfoundry" + version = "0.2.1-beta" + } + btp = { + source = "SAP/btp" + version = "~> 1.4.0" + } + } +} + +provider "btp" { + globalaccount = var.globalaccount + cli_server_url = var.cli_server_url +} + + +provider "cloudfoundry" { + api_url = var.cf_api_url +} diff --git a/released/discovery_center/mission_4441/step2/variables.tf b/released/discovery_center/mission_4441/step2/variables.tf new file mode 100644 index 00000000..79a6f192 --- /dev/null +++ b/released/discovery_center/mission_4441/step2/variables.tf @@ -0,0 +1,91 @@ +# Description: This file contains the input variables for the SAP Build Code step 2.check + +# The globalaccount subdomain where the sub account shall be created. +variable "globalaccount" { + type = string + description = "The globalaccount subdomain where the sub account shall be created." +} + +# The subaccount id +variable "subaccount_id" { + type = string + description = "The Global Account subdomain id." +} + +# The BTP CLI server URL +variable "cli_server_url" { + type = string + description = "The BTP CLI server URL." + default = "https://cli.btp.cloud.sap" +} + +variable "cf_api_url" { + type = string + description = "The Cloud Foundry API endpoint from the Cloud Foundry environment instance." +} + +variable "origin_key" { + type = string + description = "Defines the origin key of the identity provider" + default = "sap.ids" + # The value for the origin_key can be defined + # but are normally set to "sap.ids", "sap.default" or "sap.custom" +} + +# The CF Org ID from the Cloud Foundry environment instance +variable "cf_org_id" { + type = string + description = "The Cloud Foundry Org ID from the Cloud Foundry environment instance." +} + +# The CF Org name from the Cloud Foundry environment instance +variable "cf_org_name" { + type = string + description = "The Cloud Foundry Org name from the Cloud Foundry environment instance." + +} + + +variable "cf_space_name" { + type = string + description = "Name of the Cloud Foundry space." + default = "dev" + + validation { + condition = can(regex("^.{1,255}$", var.cf_space_name)) + error_message = "The Cloud Foundry space name must not be emtpy and not exceed 255 characters." + } +} + +variable "cf_org_admins" { + type = list(string) + description = "Defines the colleagues who are added to a CF org as administrators." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_org_admins : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_org_admins) + error_message = "Please enter a valid email address for the CF Org admins." + } +} + +variable "cf_space_managers" { + type = list(string) + description = "Defines the colleagues who are added to a CF space as space manager." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_space_managers : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_space_managers) + error_message = "Please enter a valid email address for the CF space managers." + } +} + +variable "cf_space_developers" { + type = list(string) + description = "Defines the colleagues who are added to a CF space as space developer." + + # add validation to check if admins contains a list of valid email addresses + validation { + condition = length([for email in var.cf_space_developers : can(regex("^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", email))]) == length(var.cf_space_developers) + error_message = "Please enter a valid email address for the admins." + } +}