Skip to content

Commit 65ca5aa

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #7974 from Prajyot-Parab/k8s_power
Terraform for ibmcloud account management activities
2 parents 25a146c + 8598a40 commit 65ca5aa

File tree

9 files changed

+217
-4
lines changed

9 files changed

+217
-4
lines changed

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/secrets_manager/secrets_manager.tf‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,9 @@ resource "ibm_sm_iam_credentials_secret" "secret_rotator" {
6565
interval = 1
6666
unit = "day"
6767
}
68-
//The time-to-live (TTL) or lease duration of generated secret 93600seconds = 26hrs
69-
//The average job would run for ~2 hrs, hence we ensure secret remains alive post rotation period
70-
// rotation(24hrs)+job(2hrs) = 26hrs = 93600seconds
71-
ttl = "93600"
68+
69+
//The time-to-live (TTL) or lease duration of generated secret 86400seconds = 24hrs
70+
ttl = "86400"
7271
}
7372

7473
# RSA key of size 4096 bits

‎infra/ibmcloud/terraform/management-account/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# _TF: Management account_
2+
3+
The [Terraform](https://developer.hashicorp.com/terraform/language) language for the [Kubernetes](https://kubernetes.io) IBM Cloud organization management account is kept in this directory.

‎infra/ibmcloud/terraform/management-account/billing-users.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group_members" "billing" {
18+
access_group_id = ibm_iam_access_group.billing.id
19+
ibm_ids = [
20+
"[email protected]",
21+
"[email protected]",
22+
]
23+
}

‎infra/ibmcloud/terraform/management-account/billing.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group" "billing" {
18+
name = "billing"
19+
description = "Access group with viewer access to billing service."
20+
}
21+
22+
resource "ibm_iam_access_group_policy" "billing" {
23+
access_group_id = ibm_iam_access_group.billing.id
24+
roles = ["Viewer"]
25+
26+
resources {
27+
service = "billing"
28+
}
29+
}

‎infra/ibmcloud/terraform/management-account/providers.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
locals {
18+
key = var.ibmcloud_api_key
19+
region = "us-south"
20+
zone = "us-south"
21+
}
22+
23+
provider "ibm" {
24+
ibmcloud_api_key = local.key
25+
region = local.region
26+
zone = local.zone
27+
}

‎infra/ibmcloud/terraform/management-account/telemetry-users.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group_members" "telemetry" {
18+
access_group_id = ibm_iam_access_group.telemetry.id
19+
ibm_ids = [
20+
"[email protected]",
21+
]
22+
}

‎infra/ibmcloud/terraform/management-account/telemetry.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group" "telemetry" {
18+
name = "telemetry"
19+
description = "Access group with reader, viewer access to telemetry related services."
20+
}
21+
22+
resource "ibm_iam_access_group_policy" "telemetry_pvs" {
23+
access_group_id = ibm_iam_access_group.telemetry.id
24+
roles = ["Reader", "Viewer"]
25+
26+
resources {
27+
service = "power-iaas"
28+
}
29+
}
30+
31+
resource "ibm_iam_access_group_policy" "telemetry_cos" {
32+
access_group_id = ibm_iam_access_group.telemetry.id
33+
roles = ["Reader", "Viewer"]
34+
35+
resources {
36+
service = "cloud-object-storage"
37+
}
38+
}
39+
40+
resource "ibm_iam_access_group_policy" "telemetry_vpc" {
41+
access_group_id = ibm_iam_access_group.telemetry.id
42+
roles = ["Reader", "Viewer"]
43+
44+
resources {
45+
service = "is"
46+
}
47+
}

‎infra/ibmcloud/terraform/management-account/variables.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
variable "ibmcloud_api_key" {
18+
type = string
19+
description = "IBM Cloud API key associated with user's identity"
20+
sensitive = true
21+
22+
validation {
23+
condition = var.ibmcloud_api_key != ""
24+
error_message = "The ibmcloud_api_key is required and cannot be empty."
25+
}
26+
}

‎infra/ibmcloud/terraform/management-account/versions.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
backend "s3" {
19+
bucket = "k8s-infra-tf-states"
20+
key = "management-account/terraform.tfstate"
21+
region = "us-geo"
22+
skip_region_validation = true
23+
skip_requesting_account_id = true
24+
skip_credentials_validation = true
25+
skip_s3_checksum = true
26+
endpoints = {
27+
s3 = "https://s3.us.cloud-object-storage.appdomain.cloud"
28+
}
29+
secret_key = "<YOUR_SECRET_KEY>"
30+
access_key = "<YOUR_ACCESS_KEY>"
31+
}
32+
required_providers {
33+
ibm = {
34+
source = "IBM-Cloud/ibm"
35+
}
36+
}
37+
}

0 commit comments

Comments
 (0)