Skip to content

Commit 31504ce

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #7805 from cjschaef/ocpbugs-24473
OCPBUGS-24473: IBMCloud: Set IBM TF visibility based on URLs
2 parents fe3520c + ba9de28 commit 31504ce

File tree

8 files changed

+156
-106
lines changed

8 files changed

+156
-106
lines changed

‎data/data/ibmcloud/bootstrap/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/master/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/network/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/variables-ibmcloud.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ variable "ibmcloud_image_filepath" {
5151
description = "The file path to the RHCOS image"
5252
}
5353

54+
variable "ibmcloud_terraform_private_visibility" {
55+
type = bool
56+
description = "Specified whether the IBM Cloud terraform provider visibility mode should be private, for endpoint usage."
57+
default = false
58+
}
59+
5460
#######################################
5561
# Top-level module variables (optional)
5662
#######################################

‎pkg/asset/cluster/tfvars.go‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -657,40 +657,52 @@ func (t *TerraformVariables) Generate(parents asset.Parents) error {
657657
// NOTE(cjschaef): If one or more ServiceEndpoint's are supplied, attempt to build the Terraform endpoint_file_path
658658
// https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints#file-structure-for-endpoints-file
659659
var endpointsJSONFile string
660+
// Set Terraform visibility mode if necessary
661+
terraformPrivateVisibility := false
660662
if len(installConfig.Config.Platform.IBMCloud.ServiceEndpoints) > 0 {
663+
// Determine if any endpoints require 'private' Terraform visibility mode (any contain 'private' or 'direct' for COS)
664+
// This is a requirement for the IBM Cloud Terraform provider, forcing 'public' or 'private' visibility mode.
665+
for _, endpoint := range installConfig.Config.Platform.IBMCloud.ServiceEndpoints {
666+
if strings.Contains(endpoint.URL, "private") || strings.Contains(endpoint.URL, "direct") {
667+
// If at least one endpoint is private (or direct) we expect to use Private visibility mode
668+
terraformPrivateVisibility = true
669+
break
670+
}
671+
}
672+
661673
endpointData, err := ibmcloudtfvars.CreateEndpointJSON(installConfig.Config.Platform.IBMCloud.ServiceEndpoints, installConfig.Config.Platform.IBMCloud.Region)
662674
if err != nil {
663675
return err
664676
}
665-
// While we should have already confirmed there are ServiceEndpoints, we can verify data did get created, requiring the JSON file gets created and passed along
666-
if endpointData == nil {
667-
return fmt.Errorf("failed to generate endpoint JSON with provided IBM Cloud ServiceEndpoints")
677+
// While service endpoints may not be empty, they may not be required for Terraform.
678+
// So, if we have not endpoint data, we don't need to generate the JSON override file.
679+
if endpointData != nil {
680+
// Add endpoint JSON data to list of generated files for Terraform
681+
t.FileList = append(t.FileList, &asset.File{
682+
Filename: ibmcloudtfvars.IBMCloudEndpointJSONFileName,
683+
Data: endpointData,
684+
})
685+
endpointsJSONFile = ibmcloudtfvars.IBMCloudEndpointJSONFileName
668686
}
669-
670-
// Add endpoint JSON data to list of generated files for Terraform
671-
t.FileList = append(t.FileList, &asset.File{
672-
Filename: ibmcloudtfvars.IBMCloudEndpointJSONFileName,
673-
Data: endpointData,
674-
})
675-
endpointsJSONFile = ibmcloudtfvars.IBMCloudEndpointJSONFileName
676687
}
677688

678689
data, err = ibmcloudtfvars.TFVars(
679690
ibmcloudtfvars.TFVarsSources{
680-
Auth: auth,
681-
CISInstanceCRN: cisCRN,
682-
DNSInstanceID: dnsID,
683-
EndpointsJSONFile: endpointsJSONFile,
684-
ImageURL: string(*rhcosImage),
685-
MasterConfigs: masterConfigs,
686-
MasterDedicatedHosts: masterDedicatedHosts,
687-
NetworkResourceGroupName: installConfig.Config.Platform.IBMCloud.NetworkResourceGroupName,
688-
PreexistingVPC: preexistingVPC,
689-
PublishStrategy: installConfig.Config.Publish,
690-
ResourceGroupName: installConfig.Config.Platform.IBMCloud.ResourceGroupName,
691-
VPCPermitted: vpcPermitted,
692-
WorkerConfigs: workerConfigs,
693-
WorkerDedicatedHosts: workerDedicatedHosts,
691+
Auth: auth,
692+
CISInstanceCRN: cisCRN,
693+
DNSInstanceID: dnsID,
694+
EndpointsJSONFile: endpointsJSONFile,
695+
ImageURL: string(*rhcosImage),
696+
MasterConfigs: masterConfigs,
697+
MasterDedicatedHosts: masterDedicatedHosts,
698+
NetworkResourceGroupName: installConfig.Config.Platform.IBMCloud.NetworkResourceGroupName,
699+
PreexistingVPC: preexistingVPC,
700+
PublishStrategy: installConfig.Config.Publish,
701+
ResourceGroupName: installConfig.Config.Platform.IBMCloud.ResourceGroupName,
702+
TerraformPrivateVisibility: terraformPrivateVisibility,
703+
VPCPermitted: vpcPermitted,
704+
WorkerConfigs: workerConfigs,
705+
WorkerDedicatedHosts: workerDedicatedHosts,
694706
},
695707
)
696708
if err != nil {

‎pkg/destroy/bootstrap/bootstrap.go‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,17 +68,15 @@ func Destroy(ctx context.Context, dir string) (err error) {
6868
if err != nil {
6969
return fmt.Errorf("failed generating endpoint override JSON data for bootstrap destroy: %w", err)
7070
}
71-
// Since there are ServiceEndpoints, we expect JSON data to be generated.
72-
if jsonData == nil {
73-
return fmt.Errorf("no endpoint override JSON data generated for set of endpoint overrides")
74-
}
7571

7672
// If JSON data was generated, create the JSON file for IBM Cloud Terraform provider to use during destroy.
77-
endpointsFilePath := filepath.Join(dir, ibmcloudtfvars.IBMCloudEndpointJSONFileName)
78-
if err := os.WriteFile(endpointsFilePath, jsonData, 0o600); err != nil {
79-
return fmt.Errorf("failed to write IBM Cloud service endpoint override JSON file for bootstrap destroy: %w", err)
73+
if jsonData != nil {
74+
endpointsFilePath := filepath.Join(dir, ibmcloudtfvars.IBMCloudEndpointJSONFileName)
75+
if err := os.WriteFile(endpointsFilePath, jsonData, 0o600); err != nil {
76+
return fmt.Errorf("failed to write IBM Cloud service endpoint override JSON file for bootstrap destroy: %w", err)
77+
}
78+
logrus.Debugf("generated ibm endpoint overrides file: %s", endpointsFilePath)
8079
}
81-
logrus.Debugf("generated ibm endpoint overrides file: %s", endpointsFilePath)
8280
}
8381

8482
fg := featuregates.FeatureGateFromFeatureSets(configv1.FeatureSets, metadata.FeatureSet, metadata.CustomFeatureSet)

0 commit comments

Comments
 (0)