Skip to content

Commit c7a53c8

Browse files
jor2jor2
authored
feat: updated the DA to support configuring the private and public cert engines (#90)
1 parent 16a3001 commit c7a53c8

File tree

12 files changed

+214
-16
lines changed

12 files changed

+214
-16
lines changed

‎examples/basic/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ variable "ibmcloud_api_key" {
77
variable "prefix" {
88
type = string
99
description = "Prefix for sm instance"
10-
default = "secrets-manager-basic"
10+
default = "sm-bas"
1111
}
1212

1313
variable "region" {

‎examples/complete/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ No resources.
2929
|------|-------------|------|---------|:--------:|
3030
| <a name="input_en_region"></a> [en\_region](#input\_en\_region) | Region where event notification will be created | `string` | `"au-syd"` | no |
3131
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key this account authenticates to | `string` | n/a | yes |
32-
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for sm instance | `string` | `"secrets-manager-test"` | no |
32+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for sm instance | `string` | `"sm-com"` | no |
3333
| <a name="input_region"></a> [region](#input\_region) | Region where resources will be created | `string` | `"us-east"` | no |
3434
| <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | An existing resource group name to use for this example, if unset a new resource group will be created | `string` | `null` | no |
3535
| <a name="input_resource_tags"></a> [resource\_tags](#input\_resource\_tags) | Optional list of tags to be added to created resources | `list(string)` | `[]` | no |

‎examples/complete/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ variable "ibmcloud_api_key" {
77
variable "prefix" {
88
type = string
99
description = "Prefix for sm instance"
10-
default = "secrets-manager-test"
10+
default = "sm-com"
1111
}
1212
variable "sm_service_plan" {
1313
type = string

‎examples/fscloud/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
14
module "resource_group" {
2-
source = "terraform-ibm-modules/resource-group/ibm"
3-
version = "1.1.4"
4-
resource_group_name = var.existing_resource_group == false ? var.resource_group : null
5-
existing_resource_group_name = var.existing_resource_group == true ? var.resource_group : null
5+
source = "terraform-ibm-modules/resource-group/ibm"
6+
version = "1.1.5"
7+
# if an existing resource group is not set (null) create a new one using prefix
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
9+
existing_resource_group_name = var.resource_group
610
}
711

812
##############################################################################

‎examples/fscloud/variables.tf

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ variable "ibmcloud_api_key" {
77
variable "prefix" {
88
type = string
99
description = "Prefix for sm instance"
10-
default = "secrets-manager-test"
10+
default = "sm-fsc"
1111
}
1212

1313
variable "region" {
@@ -16,16 +16,10 @@ variable "region" {
1616
default = "us-south"
1717
}
1818

19-
variable "existing_resource_group" {
20-
type = bool
21-
description = "Whether to use an existing resource group."
22-
default = false
23-
}
24-
2519
variable "resource_group" {
2620
type = string
2721
description = "A resource group name to use for this example, if `existing_resource_group` is false a new resource group will be created"
28-
default = "sm-fscloud"
22+
default = null
2923
}
3024

3125
variable "resource_tags" {

‎ibm_catalog.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,45 @@
121121
{
122122
"key": "iam_engine_name"
123123
},
124+
{
125+
"key": "public_engine_enabled"
126+
},
127+
{
128+
"key": "public_engine_name"
129+
},
130+
{
131+
"key": "cis_id"
132+
},
133+
{
134+
"key": "dns_provider_name"
135+
},
136+
{
137+
"key": "ca_name"
138+
},
139+
{
140+
"key": "acme_letsencrypt_private_key"
141+
},
142+
{
143+
"key": "private_engine_enabled"
144+
},
145+
{
146+
"key": "private_engine_name"
147+
},
148+
{
149+
"key": "root_ca_name"
150+
},
151+
{
152+
"key": "root_ca_common_name"
153+
},
154+
{
155+
"key": "root_ca_max_ttl"
156+
},
157+
{
158+
"key": "intermediate_ca_name"
159+
},
160+
{
161+
"key": "certificate_template_name"
162+
},
124163
{
125164
"key": "skip_kms_iam_authorization_policy"
126165
},

‎solutions/standard/main.tf

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,45 @@ module "iam_secrets_engine" {
8787
secrets_manager_guid = module.secrets_manager.secrets_manager_guid
8888
endpoint_type = var.allowed_network == "private-only" ? "private" : "public"
8989
}
90+
91+
locals {
92+
# tflint-ignore: terraform_unused_declarations
93+
validate_public_secret_engine = var.public_engine_enabled && var.public_engine_name == null ? tobool("When setting var.public_engine_enabled to true, a value must be passed for var.public_engine_name") : true
94+
# tflint-ignore: terraform_unused_declarations
95+
validate_private_secret_engine = var.private_engine_enabled && var.private_engine_name == null ? tobool("When setting var.private_engine_enabled to true, a value must be passed for var.private_engine_name") : true
96+
}
97+
98+
# Configure an IBM Secrets Manager public certificate engine for an existing IBM Secrets Manager instance.
99+
module "secrets_manager_public_cert_engine" {
100+
count = var.public_engine_enabled ? 1 : 0
101+
source = "terraform-ibm-modules/secrets-manager-public-cert-engine/ibm"
102+
version = "1.0.0"
103+
providers = {
104+
ibm = ibm
105+
ibm.secret-store = ibm
106+
}
107+
secrets_manager_guid = module.secrets_manager.secrets_manager_guid
108+
region = module.secrets_manager.secrets_manager_region
109+
internet_services_crn = var.cis_id
110+
ibmcloud_cis_api_key = var.ibmcloud_api_key
111+
dns_config_name = var.dns_provider_name
112+
ca_config_name = var.ca_name
113+
acme_letsencrypt_private_key = var.acme_letsencrypt_private_key
114+
service_endpoints = var.allowed_network == "private-only" ? "private" : "public"
115+
}
116+
117+
118+
# Configure an IBM Secrets Manager private certificate engine for an existing IBM Secrets Manager instance.
119+
module "private_secret_engine" {
120+
count = var.private_engine_enabled ? 1 : 0
121+
source = "terraform-ibm-modules/secrets-manager-private-cert-engine/ibm"
122+
version = "1.3.0"
123+
secrets_manager_guid = module.secrets_manager.secrets_manager_guid
124+
region = var.region
125+
root_ca_name = var.root_ca_name
126+
root_ca_common_name = var.root_ca_common_name
127+
root_ca_max_ttl = var.root_ca_max_ttl
128+
intermediate_ca_name = var.intermediate_ca_name
129+
certificate_template_name = var.certificate_template_name
130+
endpoint_type = var.allowed_network == "private-only" ? "private" : "public"
131+
}

‎solutions/standard/variables.tf

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,87 @@ variable "secret_manager_tags" {
6767
default = []
6868
}
6969

70+
variable "public_engine_enabled" {
71+
type = bool
72+
description = "Set this to true to to configure an IBM Secrets Manager public certificate engine for an existing IBM Secrets Manager instance. If set to false, no public certificate engine will be configured for your secrets manager instance. For more details, see https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificates."
73+
default = false
74+
}
75+
76+
# Public cert engine config
77+
variable "public_engine_name" {
78+
type = string
79+
description = "The name of the IAM Engine used to configure an IBM Secrets Manager public certificate engine for an existing IBM Secrets Manager instance."
80+
default = "public-engine-sm"
81+
}
82+
83+
variable "cis_id" {
84+
type = string
85+
description = "Cloud Internet Service ID"
86+
default = null
87+
}
88+
89+
variable "dns_provider_name" {
90+
type = string
91+
description = "Name of the DNS provider for the public_cert secrets engine"
92+
default = "certificate-dns"
93+
}
94+
95+
variable "ca_name" {
96+
type = string
97+
description = "Secret Managers certificate authority name"
98+
default = "cert-auth"
99+
}
100+
101+
variable "acme_letsencrypt_private_key" {
102+
type = string
103+
description = "The private key generated by the ACME account creation tool."
104+
sensitive = true
105+
default = null
106+
}
107+
108+
# Private cert engine config
109+
variable "private_engine_enabled" {
110+
type = bool
111+
description = "Set this to true to to configure an IBM Secrets Manager private certificate engine for an existing IBM Secrets Manager instance. If set to false, no private certificate engine will be configured for your secrets manager instance. For more details, see https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-create-certificates#:~:text=In%20Secrets%20Manager%2C%20the%20private,and%20manage%20in%20the%20service."
112+
default = false
113+
}
114+
115+
variable "private_engine_name" {
116+
type = string
117+
description = "The name of the IAM Engine used to configure an IBM Secrets Manager private certificate engine for an existing IBM Secrets Manager instance."
118+
default = "private-engine-sm"
119+
}
120+
121+
variable "root_ca_name" {
122+
type = string
123+
description = "Name of the Root CA to create for a private_cert secret engine"
124+
default = "root-ca"
125+
}
126+
127+
variable "root_ca_common_name" {
128+
type = string
129+
description = "Fully qualified domain name or host domain name for the certificate to be created"
130+
default = "terraform-modules.ibm.com"
131+
}
132+
133+
variable "root_ca_max_ttl" {
134+
type = string
135+
description = "Maximum TTL value for the root CA"
136+
default = "87600h"
137+
}
138+
139+
variable "intermediate_ca_name" {
140+
type = string
141+
description = "A human-readable unique name to assign to the intermediate CA configuration."
142+
default = "intermediate-ca"
143+
}
144+
145+
variable "certificate_template_name" {
146+
type = string
147+
description = "The name of the certificate template."
148+
default = "default-cert-template"
149+
}
150+
70151
variable "iam_engine_enabled" {
71152
type = bool
72153
description = "Set this to true to to configure an IBM Secrets Manager IAM credentials engine. If set to false, no iam engine will be configured for your secrets manager instance. For more details, see https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-configure-iam-engine."

‎solutions/standard/version.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
ibm = {
66
source = "IBM-Cloud/ibm"
7-
version = "1.64.0"
7+
version = "1.64.2"
88
}
99
}
1010
}

‎tests/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ require (
2222
github.com/IBM/go-sdk-core/v5 v5.16.3 // indirect
2323
github.com/IBM/platform-services-go-sdk v0.62.2 // indirect
2424
github.com/IBM/schematics-go-sdk v0.2.3 // indirect
25+
github.com/IBM/secrets-manager-go-sdk/v2 v2.0.4 // indirect
2526
github.com/IBM/vpc-go-sdk v1.0.2 // indirect
2627
github.com/Microsoft/go-winio v0.6.1 // indirect
2728
github.com/ProtonMail/go-crypto v1.0.0 // indirect

‎tests/go.sum

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,8 @@ github.com/IBM/platform-services-go-sdk v0.62.2 h1:MgngCFHBLrlvM1HS522agIMnjshHR
203203
github.com/IBM/platform-services-go-sdk v0.62.2/go.mod h1:fd7gUOmsuQYhYLTZVLL+posObT/ISxVV+6JzsfDs5qE=
204204
github.com/IBM/schematics-go-sdk v0.2.3 h1:lgTt0Sbudii3cuSk1YSQgrtiZAXDbBABAoVj3eQuBrU=
205205
github.com/IBM/schematics-go-sdk v0.2.3/go.mod h1:Tw2OSAPdpC69AxcwoyqcYYaGTTW6YpERF9uNEU+BFRQ=
206+
github.com/IBM/secrets-manager-go-sdk/v2 v2.0.4 h1:xa9e+POVqaXxXHXkSMCOVAbKdUNEu86jQmo5hcpd+L4=
207+
github.com/IBM/secrets-manager-go-sdk/v2 v2.0.4/go.mod h1:5gq8D8uWOIbqOm1uztay6lpOysgJaxxEsaVZLWGWb40=
206208
github.com/IBM/vpc-go-sdk v1.0.2 h1:WhI1Cb8atA8glUdFg0SEUh9u8afjnKHxZAj9onQBi04=
207209
github.com/IBM/vpc-go-sdk v1.0.2/go.mod h1:42NO/XCXsyrYqpvtxoX5xwSEv/jBU1MKEoyaYkIUico=
208210
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=

‎tests/pr_test.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import (
77
"os"
88
"testing"
99

10+
"github.com/IBM/go-sdk-core/v5/core"
11+
"github.com/IBM/secrets-manager-go-sdk/v2/secretsmanagerv2"
1012
"github.com/stretchr/testify/assert"
1113
"github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/common"
1214
"github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testhelper"
@@ -112,6 +114,11 @@ func TestRunDASolutionSchematics(t *testing.T) {
112114
t.Parallel()
113115

114116
const region = "us-south"
117+
acme_letsencrypt_private_key := GetSecretsManagerKey( // pragma: allowlist secret
118+
permanentResources["acme_letsencrypt_private_key_sm_id"].(string),
119+
permanentResources["acme_letsencrypt_private_key_sm_region"].(string),
120+
permanentResources["acme_letsencrypt_private_key_secret_id"].(string),
121+
)
115122

116123
// Set up a schematics test
117124
options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{
@@ -135,8 +142,36 @@ func TestRunDASolutionSchematics(t *testing.T) {
135142
{Name: "allowed_network", Value: "private-only", DataType: "string"},
136143
{Name: "existing_kms_instance_crn", Value: permanentResources["hpcs_south_crn"], DataType: "string"},
137144
{Name: "iam_engine_enabled", Value: true, DataType: "bool"},
145+
{Name: "public_engine_enabled", Value: true, DataType: "bool"},
146+
{Name: "private_engine_enabled", Value: true, DataType: "bool"},
147+
{Name: "cis_id", Value: permanentResources["cisInstanceId"], DataType: "string"},
148+
{Name: "ca_name", Value: permanentResources["certificateAuthorityName"], DataType: "string"},
149+
{Name: "dns_provider_name", Value: permanentResources["dnsProviderName"], DataType: "string"},
150+
{Name: "acme_letsencrypt_private_key", Value: *acme_letsencrypt_private_key, DataType: "string"},
138151
}
139152

140153
err := options.RunSchematicTest()
141154
assert.NoError(t, err, "Schematic Test had unexpected error")
142155
}
156+
157+
func GetSecretsManagerKey(sm_id string, sm_region string, sm_key_id string) *string {
158+
secretsManagerService, err := secretsmanagerv2.NewSecretsManagerV2(&secretsmanagerv2.SecretsManagerV2Options{
159+
URL: fmt.Sprintf("https://%s.%s.secrets-manager.appdomain.cloud", sm_id, sm_region),
160+
Authenticator: &core.IamAuthenticator{
161+
ApiKey: os.Getenv("TF_VAR_ibmcloud_api_key"),
162+
},
163+
})
164+
if err != nil {
165+
panic(err)
166+
}
167+
168+
getSecretOptions := secretsManagerService.NewGetSecretOptions(
169+
sm_key_id,
170+
)
171+
172+
secret, _, err := secretsManagerService.GetSecret(getSecretOptions)
173+
if err != nil {
174+
panic(err)
175+
}
176+
return secret.(*secretsmanagerv2.ArbitrarySecret).Payload
177+
}

0 commit comments

Comments
 (0)