added enable_instance_principal parameter for admin module

Signed-off-by: Ali Mukadam <[email protected]>

Author: hyder

locals.tf

@@ -57,12 +57,13 @@ locals {
   }
 
   oci_admin = {
-    admin_enabled       = var.oci_base_admin.admin_enabled
-    admin_image_id      = var.oci_base_admin.admin_image_id
-    admin_shape         = var.oci_base_admin.admin_shape
-    admin_upgrade       = var.oci_base_admin.admin_upgrade
-    ssh_public_key_path = var.oci_base_admin.ssh_public_key_path
-    timezone            = var.oci_base_admin.timezone
+    admin_enabled             = var.oci_base_admin.admin_enabled
+    admin_image_id            = var.oci_base_admin.admin_image_id
+    admin_shape               = var.oci_base_admin.admin_shape
+    admin_upgrade             = var.oci_base_admin.admin_upgrade
+    enable_instance_principal = var.oci_base_admin.enable_instance_principal
+    ssh_public_key_path       = var.oci_base_admin.ssh_public_key_path
+    timezone                  = var.oci_base_admin.timezone
   }
 
   oci_admin_notification = {

modules/admin/instance_principal.tf

@@ -28,7 +28,7 @@ resource "oci_identity_dynamic_group" "admin_instance_principal" {
   description    = "dynamic group to allow instances to call services for 1 admin"
   matching_rule  = "ALL {instance.id = '${join(",", data.oci_core_instance.admin.*.id)}'}"
   name           = "${var.oci_admin_general.label_prefix}-admin_instance_principal"
-  count          = var.oci_admin.admin_enabled == true ? 1 : 0
+  count          = var.oci_admin.admin_enabled == true && var.oci_admin.enable_instance_principal == true ? 1 : 0
 }
 
 resource "oci_identity_policy" "admin_instance_principal" {
@@ -37,5 +37,5 @@ resource "oci_identity_policy" "admin_instance_principal" {
   description    = "policy to allow admin host to call services"
   name           = "${var.oci_admin_general.label_prefix}-admin_instance_principal"
   statements     = ["Allow dynamic-group ${oci_identity_dynamic_group.admin_instance_principal[0].name} to manage all-resources in compartment id ${data.oci_identity_compartments.compartments_id.compartments.0.id}"]
-  count          = var.oci_admin.admin_enabled == true ? 1 : 0
+  count          = var.oci_admin.admin_enabled == true && var.oci_admin.enable_instance_principal == true ? 1 : 0
 }

modules/admin/outputs.tf

@@ -6,5 +6,5 @@ output "admin_private_ip" {
 }
 
 output "admin_instance_principal_group_name" {
-  value = oci_identity_dynamic_group.admin_instance_principal[0].name
+  value = var.oci_admin.admin_enabled == true && var.oci_admin.enable_instance_principal == true ? oci_identity_dynamic_group.admin_instance_principal[0].name : null
 }

modules/admin/variables.tf

@@ -25,12 +25,13 @@ variable "oci_admin_general" {
 
 variable "oci_admin" {
   type = object({
-    admin_image_id      = string
-    admin_shape         = string
-    admin_upgrade       = bool
-    admin_enabled       = bool
-    ssh_public_key_path = string
-    timezone            = string
+    admin_image_id            = string
+    admin_shape               = string
+    admin_upgrade             = bool
+    admin_enabled             = bool
+    enable_instance_principal = bool
+    ssh_public_key_path       = string
+    timezone                  = string
   })
 }
 
@@ -52,6 +53,5 @@ variable "oci_admin_notification" {
     notification_endpoint = string
     notification_protocol = string
     notification_topic    = string
-
   })
 }