Skip to content

Commit ab617f2

Browse files
akocbekakocbek
authored
feat: DA updates:<br>- existing_resource_group has been renamed to use_existing_resource_group<br>- kms_region input has been removed, its not porgrammtically determined<br>- existing_kms_guid has been renamed to existing_kms_instance_crn and now required CRN value to be passed (#101)
1 parent 52fbdd3 commit ab617f2

File tree

7 files changed

+119
-23
lines changed

7 files changed

+119
-23
lines changed

‎cra-config.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/fscloud" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "solutions/standard" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
PROFILE_ID: "bfacb71d-4b84-41ac-9825-e8a3a3eb7405" # SCC profile ID (currently set to IBM Cloud Framework for Financial Services 1.6.0 profile).
77
# SCC_INSTANCE_ID: "" # The SCC instance ID to use to download profile for CRA scan. If not provided, a default global value will be used.
88
# SCC_REGION: "" # The IBM Cloud region that the SCC instance is in. If not provided, a default global value will be used.
99
CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs.
10-
TF_VAR_existing_kms_instance_guid: "e6dce284-e80f-46e1-a3c1-830f7adff7a9" # hpcs_south
11-
TF_VAR_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533" # hpcs_south_root_key_crn
10+
TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/xxx:xxxx::"
11+
TF_VAR_resource_group_name: "test"

‎ibm_catalog.json

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,105 @@
5757
}
5858
]
5959
},
60+
"configuration" : [
61+
{
62+
"key": "ibmcloud_api_key"
63+
},
64+
{
65+
"key": "use_existing_resource_group"
66+
},
67+
{
68+
"key": "resource_group_name"
69+
},
70+
{
71+
"custom_config": {
72+
"config_constraints": {
73+
"generationType": "2"
74+
},
75+
"grouping": "deployment",
76+
"original_grouping": "deployment",
77+
"type": "region"
78+
},
79+
"key": "region",
80+
"required": true,
81+
"type": "string"
82+
},
83+
{
84+
"key": "prefix"
85+
},
86+
{
87+
"key": "secrets_manager_instance_name"
88+
},
89+
{
90+
"key": "service_plan",
91+
"options": [
92+
{
93+
"displayname": "Standard",
94+
"value": "standard"
95+
},
96+
{
97+
"displayname": "Trial",
98+
"value": "trial"
99+
}
100+
]
101+
},
102+
{
103+
"key": "allowed_network",
104+
"options": [
105+
{
106+
"displayname": "Public and private",
107+
"value": "public-and-private"
108+
},
109+
{
110+
"displayname": "Private only",
111+
"value": "private-only"
112+
}
113+
]
114+
},
115+
{
116+
"key": "secret_manager_tags"
117+
},
118+
{
119+
"key": "iam_engine_enabled"
120+
},
121+
{
122+
"key": "iam_engine_name"
123+
},
124+
{
125+
"key": "skip_kms_iam_authorization_policy"
126+
},
127+
{
128+
"key": "existing_secrets_manager_kms_key_crn"
129+
},
130+
{
131+
"key": "existing_kms_instance_crn"
132+
},
133+
{
134+
"key": "kms_endpoint_type",
135+
"options": [
136+
{
137+
"displayname": "Public",
138+
"value": "public"
139+
},
140+
{
141+
"displayname": "Private",
142+
"value": "private"
143+
}
144+
]
145+
},
146+
{
147+
"key": "kms_key_ring_name"
148+
},
149+
{
150+
"key": "kms_key_name"
151+
},
152+
{
153+
"key": "existing_event_notification_instance_crn"
154+
},
155+
{
156+
"key": "skip_event_notification_iam_authorization_policy"
157+
}
158+
],
60159
"architecture": {
61160
"descriptions": "This architecture supports creating and configuring a Secrets Manager instance.",
62161
"features": [

‎solutions/standard/catalogValidationValues.json.template

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,5 @@
22
"ibmcloud_api_key": $VALIDATION_APIKEY,
33
"resource_group_name": $PREFIX,
44
"service_plan": "trial",
5-
"existing_kms_guid": $HPCS_US_SOUTH_GUID,
6-
"kms_region": "us-south"
5+
"existing_kms_instance_crn": $HPCS_US_SOUTH_CRN
76
}

‎solutions/standard/main.tf

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
module "resource_group" {
66
source = "terraform-ibm-modules/resource-group/ibm"
77
version = "1.1.4"
8-
resource_group_name = var.existing_resource_group == false ? (var.prefix != null ? "${var.prefix}-${var.resource_group_name}" : var.resource_group_name) : null
9-
existing_resource_group_name = var.existing_resource_group == true ? var.resource_group_name : null
8+
resource_group_name = var.use_existing_resource_group == false ? (var.prefix != null ? "${var.prefix}-${var.resource_group_name}" : var.resource_group_name) : null
9+
existing_resource_group_name = var.use_existing_resource_group == true ? var.resource_group_name : null
1010
}
1111

1212
#######################################################################################################################
@@ -16,7 +16,12 @@ locals {
1616
kms_key_crn = var.existing_secrets_manager_kms_key_crn != null ? var.existing_secrets_manager_kms_key_crn : module.kms[0].keys[format("%s.%s", local.kms_key_ring_name, local.kms_key_name)].crn
1717
kms_key_ring_name = var.prefix != null ? "${var.prefix}-${var.kms_key_ring_name}" : var.kms_key_ring_name
1818
kms_key_name = var.prefix != null ? "${var.prefix}-${var.kms_key_name}" : var.kms_key_name
19+
20+
parsed_existing_kms_instance_crn = var.existing_kms_instance_crn != null ? split(":", var.existing_kms_instance_crn) : []
21+
kms_region = length(local.parsed_existing_kms_instance_crn) > 0 ? local.parsed_existing_kms_instance_crn[5] : null
22+
existing_kms_guid = length(local.parsed_existing_kms_instance_crn) > 0 ? local.parsed_existing_kms_instance_crn[7] : null
1923
}
24+
2025
# KMS root key for Secrets Manager secret encryption
2126
module "kms" {
2227
providers = {
@@ -26,8 +31,8 @@ module "kms" {
2631
source = "terraform-ibm-modules/kms-all-inclusive/ibm"
2732
version = "4.8.5"
2833
create_key_protect_instance = false
29-
region = var.kms_region
30-
existing_kms_instance_guid = var.existing_kms_guid
34+
region = local.kms_region
35+
existing_kms_instance_guid = local.existing_kms_guid
3136
key_ring_endpoint_type = var.kms_endpoint_type
3237
key_endpoint_type = var.kms_endpoint_type
3338
keys = [
@@ -62,7 +67,7 @@ module "secrets_manager" {
6267
sm_tags = var.secret_manager_tags
6368
# kms dependency
6469
kms_encryption_enabled = true
65-
existing_kms_instance_guid = var.existing_kms_guid
70+
existing_kms_instance_guid = local.existing_kms_guid
6671
kms_key_crn = local.kms_key_crn
6772
skip_kms_iam_authorization_policy = var.skip_kms_iam_authorization_policy
6873
# event notifications dependency

‎solutions/standard/provider.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ provider "ibm" {
66
provider "ibm" {
77
alias = "kms"
88
ibmcloud_api_key = var.ibmcloud_api_key
9-
region = var.kms_region
9+
region = local.kms_region
1010
}

‎solutions/standard/variables.tf

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ variable "ibmcloud_api_key" {
88
sensitive = true
99
}
1010

11-
variable "existing_resource_group" {
11+
variable "use_existing_resource_group" {
1212
type = bool
1313
description = "Whether to use an existing resource group."
1414
default = false
@@ -85,7 +85,7 @@ variable "iam_engine_name" {
8585

8686
variable "skip_kms_iam_authorization_policy" {
8787
type = bool
88-
description = "Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the existing_kms_instance_guid variable."
88+
description = "Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the existing_kms_instance_crn variable."
8989
default = false
9090
}
9191

@@ -99,16 +99,10 @@ variable "existing_secrets_manager_kms_key_crn" {
9999
# KMS properties required when creating an encryption key, rather than passing an existing key CRN.
100100
########################################################################################################################
101101

102-
variable "kms_region" {
103-
type = string
104-
default = "us-south"
105-
description = "The region in which KMS instance exists. Only required if not supplying an existing KMS root key CRN."
106-
}
107-
108-
variable "existing_kms_guid" {
102+
variable "existing_kms_instance_crn" {
109103
type = string
110104
default = null
111-
description = "The GUID of of the KMS instance used for the Secrets Manager root Key. Only required if not supplying an existing KMS root key CRN and if 'skip_kms_iam_authorization_policy' is true."
105+
description = "The CRN of the existed Hyper Protect Crypto Services or Key Protect instance. Only required if not supplying an existing KMS key to use for Secrets Manager."
112106
}
113107

114108
variable "kms_endpoint_type" {

‎tests/pr_test.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,7 @@ func TestRunDASolutionSchematics(t *testing.T) {
133133
{Name: "resource_group_name", Value: options.Prefix, DataType: "string"},
134134
{Name: "service_plan", Value: "trial", DataType: "string"},
135135
{Name: "allowed_network", Value: "private-only", DataType: "string"},
136-
{Name: "existing_kms_guid", Value: permanentResources["hpcs_south"], DataType: "string"},
137-
{Name: "kms_region", Value: "us-south", DataType: "string"}, // KMS instance is in us-south
136+
{Name: "existing_kms_instance_crn", Value: permanentResources["hpcs_south_crn"], DataType: "string"},
138137
{Name: "iam_engine_enabled", Value: true, DataType: "bool"},
139138
}
140139

0 commit comments

Comments
 (0)