From e60edb5cd9aac314728731ef4364540f29675297 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Conall=20=C3=93=20Cofaigh?= Date: Wed, 28 Feb 2024 15:05:00 +0000 Subject: [PATCH] feat: Created DA solution (#418) --- .catalog-onboard-pipeline.yaml | 14 +++ .github/settings.yml | 2 +- .releaserc | 4 + .secrets.baseline | 4 +- README.md | 15 +++- cra-config.yaml | 9 +- ibm_catalog.json | 90 +++++++++++++++++++ images/key_protect_icon.svg | 38 ++++++++ reference-architecture/key_protect.svg | 4 + renovate.json | 16 +++- solutions/standard/README.md | 21 +++++ .../catalogValidationValues.json.template | 4 + solutions/standard/main.tf | 36 ++++++++ solutions/standard/outputs.tf | 48 ++++++++++ solutions/standard/provider.tf | 4 + solutions/standard/variables.tf | 89 ++++++++++++++++++ solutions/standard/version.tf | 10 +++ tests/go.mod | 1 + tests/go.sum | 9 ++ tests/pr_test.go | 38 ++++++++ variables.tf | 4 +- 21 files changed, 446 insertions(+), 14 deletions(-) create mode 100644 .catalog-onboard-pipeline.yaml create mode 100644 ibm_catalog.json create mode 100644 images/key_protect_icon.svg create mode 100644 reference-architecture/key_protect.svg create mode 100644 solutions/standard/README.md create mode 100644 solutions/standard/catalogValidationValues.json.template create mode 100644 solutions/standard/main.tf create mode 100644 solutions/standard/outputs.tf create mode 100644 solutions/standard/provider.tf create mode 100644 solutions/standard/variables.tf create mode 100644 solutions/standard/version.tf diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml new file mode 100644 index 0000000..b4bb9ec --- /dev/null +++ b/.catalog-onboard-pipeline.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: v1 +offerings: + - name: deploy-arch-ibm-kms + kind: solution + catalog_id: 7df1e4ca-d54c-4fd0-82ce-3d13247308cd + offering_id: 2cad4789-fa90-4886-9c9e-857081c273ee + variations: + - name: standard + mark_ready: true + install_type: fullstack + scc: + instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 + region: us-south diff --git a/.github/settings.yml b/.github/settings.yml index 5232858..087638f 100644 --- a/.github/settings.yml +++ b/.github/settings.yml @@ -23,4 +23,4 @@ repository: # Uncomment this description property # and update the description to the current repo description. description: "Creates a Key Protect instance, key rings for different services, and a key for each instance of the service." - topics: core-team, terraform, ibm-cloud, terraform-module, key-protect, kms, supported, graduated + topics: core-team, terraform, ibm-cloud, terraform-module, key-protect, kms, supported, graduated, deployable-architecture diff --git a/.releaserc b/.releaserc index 708916f..3c1f554 100644 --- a/.releaserc +++ b/.releaserc @@ -10,6 +10,10 @@ }], ["@semantic-release/exec", { "successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV" + }], + ["@semantic-release/exec", { + "successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV", + "publishCmd": "./ci/trigger-catalog-onboarding-pipeline.sh --version=v${nextRelease.version}" }] ] } diff --git a/.secrets.baseline b/.secrets.baseline index 4b8f476..c87434f 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "go.sum|^.secrets.baseline$", "lines": null }, - "generated_at": "2024-01-19T01:54:32Z", + "generated_at": "2024-02-28T10:49:36Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -82,7 +82,7 @@ "hashed_secret": "ff9ee043d85595eb255c05dfe32ece02a53efbb2", "is_secret": false, "is_verified": false, - "line_number": 63, + "line_number": 74, "type": "Secret Keyword", "verified_result": null } diff --git a/README.md b/README.md index 890a267..103bc32 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,17 @@ The following example shows a typical topology for a KMS instance: In this scenario `cos` and `ocp` represent different IBM Cloud Services that utilize KMS keys to encrypt data at rest, each of the keys represent a different bucket or cluster in your environment. +## Known limitations +There is currently a known issue with the IBM provider (https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5154) where the provider is always trying to use the public endpoint when communicating with the Key Protect instance, even if the instance has public endpoint disabled. You will see an error like below on apply: +``` +Error: [ERROR] Get Policies failed with error : kp.Error: correlation_id='1920e5b8-d5af-4b13-8e67-11872f43bc87', msg='Unauthorized: Either the user does not have access to the specified resource, the resource does not exist, or the region is incorrectly set' +``` +As a workaround, you can set the following environment variable before running apply: +``` +export IBMCLOUD_KP_API_ENDPOINT=https://private.REGION.kms.cloud.ibm.com +``` +where `REGION` is the value you have set for the `region` input variable. + ## Using HPCS instead of Key Protect This module supports creating key rings and keys for Key Protect or Hyper Protect Crypto Services (HPCS). By default the module creates a Key Protect instance and creates the key rings and keys in that service instance, but this can be modified to use an existing HPCS instance by providing the GUID of your HPCS instance in the `var.existing_kms_instance_guid` input variable, and then setting the `var.create_key_protect_instance` input variable to `false`. For more information on provisioning an HPCS instance, please see: @@ -159,12 +170,12 @@ No resources. | [access\_tags](#input\_access\_tags) | A list of access tags to apply to the Key Protect instance created by the module. | `list(string)` | `[]` | no | | [create\_key\_protect\_instance](#input\_create\_key\_protect\_instance) | A flag to control whether a Key Protect instance is created, defaults to true. | `bool` | `true` | no | | [dual\_auth\_delete\_enabled](#input\_dual\_auth\_delete\_enabled) | If set to true, Key Protect enables a dual authorization policy on the instance. Note: Once the dual authorization policy is set on the instance, it cannot be reverted. An instance with dual authorization policy enabled cannot be destroyed using Terraform. | `bool` | `false` | no | -| [enable\_metrics](#input\_enable\_metrics) | Set to true to enable metrics on the Key Protect instance (ignored is value for 'existing\_key\_protect\_instance\_guid' is passed). In order to view metrics, you will need a Monitoring (Sysdig) instance that is located in the same region as the Key Protect instance. Once you provision the Monitoring instance, you will need to enable platform metrics. | `bool` | `true` | no | +| [enable\_metrics](#input\_enable\_metrics) | Set to true to enable metrics on the Key Protect instance (ignored is value for 'existing\_kms\_instance\_guid' is passed). In order to view metrics, you will need a Monitoring (Sysdig) instance that is located in the same region as the Key Protect instance. Once you provision the Monitoring instance, you will need to enable platform metrics. | `bool` | `true` | no | | [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of an existing Key Protect or Hyper Protect Crypto Services instance, required if 'var.create\_key\_protect\_instance' is false. | `string` | `null` | no | | [key\_create\_import\_access\_enabled](#input\_key\_create\_import\_access\_enabled) | If set to true, Key Protect enables a key create import access policy on the instance | `bool` | `true` | no | | [key\_create\_import\_access\_settings](#input\_key\_create\_import\_access\_settings) | Key create import access policy settings to configure if var.enable\_key\_create\_import\_access\_policy is true. For more info see https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-keyCreateImportAccess | 
object({
    create_root_key     = optional(bool, true)
    create_standard_key = optional(bool, true)
    import_root_key     = optional(bool, true)
    import_standard_key = optional(bool, true)
    enforce_token       = optional(bool, false)
  })
| `{}` | no | | [key\_endpoint\_type](#input\_key\_endpoint\_type) | The type of endpoint to be used for creating keys. Accepts 'public' or 'private' | `string` | `"public"` | no | -| [key\_protect\_allowed\_network](#input\_key\_protect\_allowed\_network) | The type of the allowed network to be set for the Key Protect instance. Possible values are 'private-only', or 'public-and-private'. Ignored is value for 'existing\_key\_protect\_instance\_guid' is passed. | `string` | `"public-and-private"` | no | +| [key\_protect\_allowed\_network](#input\_key\_protect\_allowed\_network) | The type of the allowed network to be set for the Key Protect instance. Possible values are 'private-only', or 'public-and-private'. Ignored is value for 'existing\_kms\_instance\_guid' is passed. | `string` | `"public-and-private"` | no | | [key\_protect\_instance\_name](#input\_key\_protect\_instance\_name) | The name to give the Key Protect instance that will be provisioned by this module. Only used if 'create\_key\_protect\_instance' is true | `string` | `null` | no | | [key\_protect\_plan](#input\_key\_protect\_plan) | Plan for the Key Protect instance. Currently only 'tiered-pricing' is supported. Only used if 'create\_key\_protect\_instance' is true | `string` | `"tiered-pricing"` | no | | [key\_ring\_endpoint\_type](#input\_key\_ring\_endpoint\_type) | The type of endpoint to be used for creating key rings. Accepts 'public' or 'private' | `string` | `"public"` | no | diff --git a/cra-config.yaml b/cra-config.yaml index 3463b46..c1971b9 100644 --- a/cra-config.yaml +++ b/cra-config.yaml @@ -1,11 +1,8 @@ # More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml version: "v1" CRA_TARGETS: - - CRA_TARGET: "examples/default" # Target directory for CRA scan. If not provided, the CRA Scan will not be run. + - CRA_TARGET: "solutions/standard" # Target directory for CRA scan. If not provided, the CRA Scan will not be run. CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json` PROFILE_ID: "0e6e7b5a-817d-4344-ab6f-e5d7a9c49520" # SCC profile ID (currently set to the FSCloud 1.4.0 profile). - # SCC_INSTANCE_ID: "" # The SCC instance ID to use to download profile for CRA scan. If not provided, a default global value will be used. - # SCC_REGION: "" # The IBM Cloud region that the SCC instance is in. If not provided, a default global value will be used. - # CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs. - # TF_VAR_sample: "sample value" - # TF_VAR_other: "another value" + CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs. + TF_VAR_resource_group_name: "test" diff --git a/ibm_catalog.json b/ibm_catalog.json new file mode 100644 index 0000000..2697856 --- /dev/null +++ b/ibm_catalog.json @@ -0,0 +1,90 @@ +{ + "products": [ + { + "name": "deploy-arch-ibm-kms", + "label": "Key Management Services", + "product_kind": "solution", + "tags": [ + "ibm_created", + "target_terraform", + "terraform", + "solution", + "security" + ], + "keywords": [ + "KMS", + "Key", + "Key Ring", + "Key Protect", + "IaC", + "infrastructure as code", + "terraform", + "solution" + ], + "short_description": "Creates and configures IBM Cloud Key Management resources", + "long_description": "This architecture supports creating and configuring an IBM Key Protect instance, Key Rings, and Keys.", + "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-kms-all-inclusive/blob/main/solutions/standard/README.md", + "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-kms-all-inclusive/main/images/key_protect_icon.svg", + "provider_name": "IBM", + "features": [ + { + "title": "Creates a Key Protect instance.", + "description": "Creates and configures a Key Protect instance." + }, + { + "title": "Creates Key Rings and Keys", + "description": "Creates Key Rings and Keys in a KMS instance (Key Protect or HPCS)." + } + ], + "flavors": [ + { + "label": "Standard", + "name": "standard", + "install_type": "fullstack", + "working_directory": "solutions/standard", + "compliance": { + "authority": "scc-v3", + "profiles": [ + { + "profile_name": "IBM Cloud Framework for Financial Services", + "profile_version": "1.5.0" + } + ] + }, + "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms" + } + ], + "architecture": { + "descriptions": "This architecture supports creating and configuring an Key Protect instance.", + "features": [ + { + "title": "Creates a Key Protect instance.", + "description": "Creates and configures a Key Protect instance." + }, + { + "title": "Creates Key Rings and Keys", + "description": "Creates Key Rings and Keys in a KMS instance (Key Protect or HPCS)." + } + ], + "diagrams": [ + { + "diagram": { + "caption": "IBM Key Management Services", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-kms-all-inclusive/main/reference-architecture/key_protect.svg", + "type": "image/svg+xml" + }, + "description": "This architecture supports creating and configuring IBM Key Management resources" + } + ] + } + } + ] + } + ] +} diff --git a/images/key_protect_icon.svg b/images/key_protect_icon.svg new file mode 100644 index 0000000..b5c6f07 --- /dev/null +++ b/images/key_protect_icon.svg @@ -0,0 +1,38 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/reference-architecture/key_protect.svg b/reference-architecture/key_protect.svg new file mode 100644 index 0000000..0af0cb6 --- /dev/null +++ b/reference-architecture/key_protect.svg @@ -0,0 +1,4 @@ + + + +
IBM Cloud
Region
Resource Group
Key Protect
Key Ring A
Key Ring B
Root Key A
Root Key B
Root Key A
Root Key B
 \ No newline at end of file diff --git a/renovate.json b/renovate.json index 8954b60..3b65dac 100644 --- a/renovate.json +++ b/renovate.json @@ -1,4 +1,18 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": ["github>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"] + "extends": ["github>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"], + "packageRules": [ + { + "description": "Allow the locked in provider version to be updated to the latest for deployable architectures", + "enabled": true, + "matchFileNames": ["solutions/**"], + "matchManagers": ["terraform"], + "matchDepTypes": ["required_provider"], + "rangeStrategy": "bump", + "semanticCommitType": "fix", + "group": true, + "groupName": "required_provider", + "commitMessageExtra": "to latest for the deployable architecture solution" + } + ] } diff --git a/solutions/standard/README.md b/solutions/standard/README.md new file mode 100644 index 0000000..0236492 --- /dev/null +++ b/solutions/standard/README.md @@ -0,0 +1,21 @@ +# KMS standard solution + +This solution supports the following: +- Creating a new resource group, or taking in an existing one. +- Provisioning of a Key Protect instance (private and public-and-private), or taking in an existing KMS instance (Key Protect or Hyper Protect Crypto Services). +- Creation of a KMS Key Rings and Keys. + +**NB:** This solution is not intended to be called by one or more other modules since it contains a provider configurations, meaning it is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers) + +## Known limitations +There is currently a known issue with the IBM provider (https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5154) where the provider is always trying to use the public endpoint when communicating with the Key Protect instance, even if the instance has public endpoint disabled. You will see an error like below on apply: +``` +Error: [ERROR] Get Policies failed with error : kp.Error: correlation_id='1920e5b8-d5af-4b13-8e67-11872f43bc87', msg='Unauthorized: Either the user does not have access to the specified resource, the resource does not exist, or the region is incorrectly set' +``` +As a workaround, you can set the following environment variable before running apply: +``` +export IBMCLOUD_KP_API_ENDPOINT=https://private.REGION.kms.cloud.ibm.com +``` +where `REGION` is the value you have set for the `region` input variable. + +![key-protect](https://github.com/terraform-ibm-modules/terraform-ibm-kms-all-inclusive/blob/main/reference-architecture/key_protect.svg) diff --git a/solutions/standard/catalogValidationValues.json.template b/solutions/standard/catalogValidationValues.json.template new file mode 100644 index 0000000..6dbf420 --- /dev/null +++ b/solutions/standard/catalogValidationValues.json.template @@ -0,0 +1,4 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY, + "resource_group_name": $PREFIX +} diff --git a/solutions/standard/main.tf b/solutions/standard/main.tf new file mode 100644 index 0000000..069e58b --- /dev/null +++ b/solutions/standard/main.tf @@ -0,0 +1,36 @@ +######################################################################################################################## +# Resource Group +######################################################################################################################## + +module "resource_group" { + source = "terraform-ibm-modules/resource-group/ibm" + version = "1.1.4" + resource_group_name = var.existing_resource_group == false ? var.resource_group_name : null + existing_resource_group_name = var.existing_resource_group == true ? var.resource_group_name : null +} + +######################################################################################################################## +# KMS +######################################################################################################################## + +module "kms" { + source = "../.." + resource_group_id = module.resource_group.resource_group_id + region = var.region + create_key_protect_instance = var.existing_kms_guid != null ? false : true + key_protect_instance_name = var.key_protect_instance_name + key_protect_plan = "tiered-pricing" + rotation_enabled = true + rotation_interval_month = 3 + dual_auth_delete_enabled = false + enable_metrics = true + key_create_import_access_enabled = false + key_create_import_access_settings = {} # TBC - should this be exposed to consumer? Or hard coded to best practise? + key_protect_allowed_network = var.service_endpoints == "private" ? "private-only" : var.service_endpoints + key_ring_endpoint_type = var.service_endpoints == "public-and-private" ? "public" : var.service_endpoints + key_endpoint_type = var.service_endpoints == "public-and-private" ? "public" : var.service_endpoints + existing_kms_instance_guid = var.existing_kms_guid + resource_tags = var.resource_tags + access_tags = var.access_tags + keys = var.keys +} diff --git a/solutions/standard/outputs.tf b/solutions/standard/outputs.tf new file mode 100644 index 0000000..e0c4033 --- /dev/null +++ b/solutions/standard/outputs.tf @@ -0,0 +1,48 @@ +######################################################################################################################## +# Outputs +######################################################################################################################## + +output "resource_group_name" { + description = "Resource group name" + value = module.resource_group.resource_group_name +} + +output "resource_group_id" { + description = "Resource group ID" + value = module.resource_group.resource_group_id +} + +output "kms_guid" { + description = "KMS GUID" + value = module.kms.kms_guid +} + +output "key_protect_name" { + description = "Key Protect name" + value = module.kms.key_protect_name +} + +output "key_protect_instance_policies" { + description = "Instance Polices of the Key Protect instance" + value = module.kms.key_protect_instance_policies +} + +output "key_rings" { + description = "IDs of Key Rings created by the solution" + value = module.kms.key_rings +} + +output "keys" { + description = "Keys created by the solution" + value = module.kms.keys +} + +output "kp_private_endpoint" { + description = "Instance private endpoint URL" + value = module.kms.kp_private_endpoint +} + +output "kp_public_endpoint" { + description = "Instance public endpoint URL" + value = module.kms.kp_public_endpoint +} diff --git a/solutions/standard/provider.tf b/solutions/standard/provider.tf new file mode 100644 index 0000000..df45ef5 --- /dev/null +++ b/solutions/standard/provider.tf @@ -0,0 +1,4 @@ +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region +} diff --git a/solutions/standard/variables.tf b/solutions/standard/variables.tf new file mode 100644 index 0000000..b52f4f6 --- /dev/null +++ b/solutions/standard/variables.tf @@ -0,0 +1,89 @@ +######################################################################################################################## +# Common variables +######################################################################################################################## + +variable "ibmcloud_api_key" { + type = string + description = "The API Key to use for IBM Cloud." + sensitive = true +} + +variable "existing_resource_group" { + type = bool + description = "Whether to use an existing resource group." + default = false +} + +variable "resource_group_name" { + type = string + description = "The name of a new or an existing resource group in which to provision KMS resources to." +} + +variable "region" { + type = string + default = "us-south" + description = "The region in which to provision KMS resources. If using existing KMS, set this to the region in which it is provisioned in." +} + +######################################################################################################################## +# Key Protect instance variables +######################################################################################################################## + +variable "key_protect_instance_name" { + type = string + default = "base-security-services-kms" + description = "The name to give the Key Protect instance that will be provisioned by this solution. Only used if not supplying an existing KMS instance." +} + +variable "service_endpoints" { + type = string + default = "public-and-private" # TODO: Default this to private when https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5154 is fixed + description = "The service endpoints to enable for the Key Protect instance deployed by this solution. Allowed values are `private` or `public-and-private`. If selecting `public-and-private`, communication to the instance will all be done over the public endpoints. Ensure to enable virtual routing and forwarding (VRF) in your account if using `private`, and that the terraform runtime has access to the the IBM Cloud private network." + validation { + condition = contains(["private", "public-and-private"], var.service_endpoints) + error_message = "The specified service_endpoints is not a valid selection. Allowed values are `private` or `public-and-private`." + } +} + +variable "resource_tags" { + type = list(string) + description = "Optional list of tags to be added to the Key Protect instance. Only used if not supplying an existing KMS instance." + default = [] +} + +variable "access_tags" { + type = list(string) + description = "Optional list of access tags to apply to the Key Protect instance. Only used if not supplying an existing KMS instance." + default = [] +} + +######################################################################################################################## +# Existing KMS variables +######################################################################################################################## + +variable "existing_kms_guid" { + type = string + default = null + description = "The GUID of an existing KMS instance to use. If not supplied, a new Key Protect instance will be created." +} + +######################################################################################################################## +# Key Ring / Key variables +######################################################################################################################## + +variable "keys" { + type = list(object({ + key_ring_name = string + existing_key_ring = optional(bool, false) + force_delete_key_ring = optional(bool, true) + keys = list(object({ + key_name = string + standard_key = optional(bool, false) + rotation_interval_month = optional(number, 1) + dual_auth_delete_enabled = optional(bool, false) + force_delete = optional(bool, true) + })) + })) + description = "A list of objects which contain the key ring name, a flag indicating if this key ring already exists, and a flag to enable force deletion of the key ring. In addition, this object contains a list of keys with all of the information on the keys to be created in that key ring." + default = [] +} diff --git a/solutions/standard/version.tf b/solutions/standard/version.tf new file mode 100644 index 0000000..5805a4f --- /dev/null +++ b/solutions/standard/version.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.3.0, <1.6.0" + # Lock DA into an exact provider version - renovate automation will keep it updated + required_providers { + ibm = { + source = "IBM-Cloud/ibm" + version = "1.62.0" + } + } +} diff --git a/tests/go.mod b/tests/go.mod index cca91de..e0cbce3 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -21,6 +21,7 @@ require ( github.com/IBM/cloud-databases-go-sdk v0.5.0 // indirect github.com/IBM/go-sdk-core/v5 v5.15.2 // indirect github.com/IBM/platform-services-go-sdk v0.59.1 // indirect + github.com/IBM/schematics-go-sdk v0.2.3 // indirect github.com/IBM/vpc-go-sdk v1.0.2 // indirect github.com/Microsoft/go-winio v0.6.1 // indirect github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect diff --git a/tests/go.sum b/tests/go.sum index b2cbc56..6bee92d 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -196,10 +196,13 @@ github.com/IBM-Cloud/power-go-client v1.5.9/go.mod h1:ZJXBj6/gc5tszHMZMzm3MjPy79 github.com/IBM/cloud-databases-go-sdk v0.5.0 h1:Bie6MnT1jLchQmtKVA20HHETTPdlOR+i11P2kJ55viM= github.com/IBM/cloud-databases-go-sdk v0.5.0/go.mod h1:nCIVfeZnhBYIiwByT959dFP4VWUeNLxomDYy63tTC6M= github.com/IBM/go-sdk-core/v5 v5.9.2/go.mod h1:YlOwV9LeuclmT/qi/LAK2AsobbAP42veV0j68/rlZsE= +github.com/IBM/go-sdk-core/v5 v5.10.2/go.mod h1:WZPFasUzsKab/2mzt29xPcfruSk5js2ywAPwW4VJjdI= github.com/IBM/go-sdk-core/v5 v5.15.2 h1:b/lXZ2IGOAHmmSA/bJRCXMRWwi9+6F8bU8gHGy2w1hw= github.com/IBM/go-sdk-core/v5 v5.15.2/go.mod h1:ee+AZaB15yUwZigJdRCwZZ3u7HIvEQzxNUdxVpnJHY8= github.com/IBM/platform-services-go-sdk v0.59.1 h1:qyXJX1sNgbDDrXb5M9LrjMjCm2w9dkSEtBGAfZJlT0Y= github.com/IBM/platform-services-go-sdk v0.59.1/go.mod h1:cLKLn9Bd1YcTM/micLQmikjZDDQvRgfhdAHKOeulILg= +github.com/IBM/schematics-go-sdk v0.2.3 h1:lgTt0Sbudii3cuSk1YSQgrtiZAXDbBABAoVj3eQuBrU= +github.com/IBM/schematics-go-sdk v0.2.3/go.mod h1:Tw2OSAPdpC69AxcwoyqcYYaGTTW6YpERF9uNEU+BFRQ= github.com/IBM/vpc-go-sdk v1.0.2 h1:WhI1Cb8atA8glUdFg0SEUh9u8afjnKHxZAj9onQBi04= github.com/IBM/vpc-go-sdk v1.0.2/go.mod h1:42NO/XCXsyrYqpvtxoX5xwSEv/jBU1MKEoyaYkIUico= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= @@ -301,6 +304,7 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre github.com/go-openapi/analysis v0.21.5 h1:3tHfEBh6Ia8eKc4M7khOGjPOAlWKJ10d877Cr9teujI= github.com/go-openapi/analysis v0.21.5/go.mod h1:25YcZosX9Lwz2wBsrFrrsL8bmjjXdlyP6zsr2AMy29M= github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M= +github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M= github.com/go-openapi/errors v0.20.3/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk= github.com/go-openapi/errors v0.21.0 h1:FhChC/duCnfoLj1gZ0BgaBmzhJC2SL/sJr8a2vAobSY= github.com/go-openapi/errors v0.21.0/go.mod h1:jxNTMUxRCKj65yb/okJGEtahVd7uvWnuWfj53bse4ho= @@ -315,6 +319,7 @@ github.com/go-openapi/runtime v0.26.0/go.mod h1:QgRGeZwrUcSHdeh4Ka9Glvo0ug1LC5Wy github.com/go-openapi/spec v0.20.12 h1:cgSLbrsmziAP2iais+Vz7kSazwZ8rsUZd6TUzdDgkVI= github.com/go-openapi/spec v0.20.12/go.mod h1:iSCgnBcwbMW9SfzJb8iYynXvcY6C/QFrI7otzF7xGM4= github.com/go-openapi/strfmt v0.21.1/go.mod h1:I/XVKeLc5+MM5oPNN7P6urMOpuLXEcNrCX/rPGuWb0k= +github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg= github.com/go-openapi/strfmt v0.21.7/go.mod h1:adeGTkxE44sPyLk0JV235VQAO/ZXUr8KAzYjclFs3ew= github.com/go-openapi/strfmt v0.22.0 h1:Ew9PnEYc246TwrEspvBdDHS4BVKXy/AOVsfqGDgAcaI= github.com/go-openapi/strfmt v0.22.0/go.mod h1:HzJ9kokGIju3/K6ap8jL+OlGAbjpSv27135Yr9OivU4= @@ -455,6 +460,7 @@ github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrj github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= github.com/hashicorp/go-retryablehttp v0.7.0/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY= +github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY= github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M= github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo= @@ -530,6 +536,7 @@ github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9k github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= +github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c= github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c= github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU= github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk= @@ -550,6 +557,7 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.10.5/go.mod h1:gza4q3jKQJijlu05nKWRCW/GavJumGt8aNRxWg7mt48= github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY= +github.com/onsi/gomega v1.18.0/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs= github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo= github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc= @@ -630,6 +638,7 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t github.com/zclconf/go-cty v1.14.1 h1:t9fyA35fwjjUMcmL5hLER+e/rEPqrbCK1/OSE4SI9KA= github.com/zclconf/go-cty v1.14.1/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= go.mongodb.org/mongo-driver v1.7.5/go.mod h1:VXEWRZ6URJIkUq2SCAyapmhH0ZLRBP+FT4xhp5Zvxng= +go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8= go.mongodb.org/mongo-driver v1.11.3/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g= go.mongodb.org/mongo-driver v1.13.1 h1:YIc7HTYsKndGK4RFzJ3covLz1byri52x0IoMB0Pt/vk= go.mongodb.org/mongo-driver v1.13.1/go.mod h1:wcDf1JBCXy2mOW0bWHwO/IOYqdca1MPCwDtFu/Z9+eo= diff --git a/tests/pr_test.go b/tests/pr_test.go index c2c4456..a7047b8 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -9,12 +9,14 @@ import ( "github.com/stretchr/testify/assert" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/common" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testhelper" + "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testschematic" ) // Use existing resource group for tests const resourceGroup = "geretain-test-key-protect-all-inclusive" const defaultExampleDir = "examples/default" const existingResourcesExampleDir = "examples/existing-resources" +const solutionDADir = "solutions/standard" // Define a struct with fields that match the structure of the YAML data const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml" @@ -87,3 +89,39 @@ func TestRunUpgradeExample(t *testing.T) { assert.NotNil(t, output, "Expected some output") } } + +func TestDASolutionInSchematics(t *testing.T) { + t.Parallel() + + const region = "us-south" + + options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ + Testing: t, + Prefix: "kp-solution", + TarIncludePatterns: []string{ + "*.tf", + solutionDADir + "/*.tf", + }, + ResourceGroup: resourceGroup, + TemplateFolder: solutionDADir, + Tags: []string{"test-schematic"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 60, + Region: region, + }) + + // Workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5154 + options.AddWorkspaceEnvVar("IBMCLOUD_KP_API_ENDPOINT", "https://private."+region+".kms.cloud.ibm.com", false, false) + + options.TerraformVars = []testschematic.TestSchematicTerraformVar{ + {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, + {Name: "resource_group_name", Value: options.Prefix, DataType: "string"}, + {Name: "service_endpoints", Value: "private", DataType: "string"}, + {Name: "resource_tags", Value: options.Tags, DataType: "list(string)"}, + {Name: "access_tags", Value: permanentResources["accessTags"], DataType: "list(string)"}, + {Name: "keys", Value: []map[string]interface{}{{"key_ring_name": "my-key-ring", "keys": []map[string]interface{}{{"key_name": "some-key-name-1"}, {"key_name": "some-key-name-2"}}}}, DataType: "list(object)"}, + } + + err := options.RunSchematicTest() + assert.Nil(t, err, "This should not have errored") +} diff --git a/variables.tf b/variables.tf index a15639c..7d876ed 100644 --- a/variables.tf +++ b/variables.tf @@ -55,7 +55,7 @@ variable "dual_auth_delete_enabled" { variable "enable_metrics" { type = bool - description = "Set to true to enable metrics on the Key Protect instance (ignored is value for 'existing_key_protect_instance_guid' is passed). In order to view metrics, you will need a Monitoring (Sysdig) instance that is located in the same region as the Key Protect instance. Once you provision the Monitoring instance, you will need to enable platform metrics." + description = "Set to true to enable metrics on the Key Protect instance (ignored is value for 'existing_kms_instance_guid' is passed). In order to view metrics, you will need a Monitoring (Sysdig) instance that is located in the same region as the Key Protect instance. Once you provision the Monitoring instance, you will need to enable platform metrics." default = true } @@ -79,7 +79,7 @@ variable "key_create_import_access_settings" { variable "key_protect_allowed_network" { type = string - description = "The type of the allowed network to be set for the Key Protect instance. Possible values are 'private-only', or 'public-and-private'. Ignored is value for 'existing_key_protect_instance_guid' is passed." + description = "The type of the allowed network to be set for the Key Protect instance. Possible values are 'private-only', or 'public-and-private'. Ignored is value for 'existing_kms_instance_guid' is passed." default = "public-and-private" validation { condition = can(regex("private-only|public-and-private", var.key_protect_allowed_network))