Skip to content

Commit ba9de28

Browse files
cjschaefcjschaef
committed
OCPBUGS-24473: IBMCloud: Set IBM TF visibility based on URLs
Set the IBM Cloud Terraform visibility mode based on whether any ServiceEndpoints are suspected to be private (or direct for COS), based on their URL's. Related: https://issues.redhat.com/browse/OCPBUGS-24473
1 parent cf958f1 commit ba9de28

File tree

8 files changed

+156
-106
lines changed

8 files changed

+156
-106
lines changed

‎data/data/ibmcloud/bootstrap/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/master/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/network/common.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
locals {
22
description = "Created By OpenShift Installer"
3-
# If any Service Endpoints are being overridden, set visibility to 'private'
4-
# for IBM Terraform Provider to use the endpoints JSON file.
5-
endpoint_visibility = var.ibmcloud_endpoints_json_file != "" ? "private" : "public"
3+
# If specified, set visibility to 'private' for IBM Terraform Provider
4+
endpoint_visibility = var.ibmcloud_terraform_private_visibility ? "private" : "public"
65
public_endpoints = var.ibmcloud_publish_strategy == "External" ? true : false
76
tags = concat(
87
["kubernetes.io_cluster_${var.cluster_id}:owned"],

‎data/data/ibmcloud/variables-ibmcloud.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ variable "ibmcloud_image_filepath" {
5151
description = "The file path to the RHCOS image"
5252
}
5353

54+
variable "ibmcloud_terraform_private_visibility" {
55+
type = bool
56+
description = "Specified whether the IBM Cloud terraform provider visibility mode should be private, for endpoint usage."
57+
default = false
58+
}
59+
5460
#######################################
5561
# Top-level module variables (optional)
5662
#######################################

‎pkg/asset/cluster/tfvars.go‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -657,40 +657,52 @@ func (t *TerraformVariables) Generate(parents asset.Parents) error {
657657
// NOTE(cjschaef): If one or more ServiceEndpoint's are supplied, attempt to build the Terraform endpoint_file_path
658658
// https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints#file-structure-for-endpoints-file
659659
var endpointsJSONFile string
660+
// Set Terraform visibility mode if necessary
661+
terraformPrivateVisibility := false
660662
if len(installConfig.Config.Platform.IBMCloud.ServiceEndpoints) > 0 {
663+
// Determine if any endpoints require 'private' Terraform visibility mode (any contain 'private' or 'direct' for COS)
664+
// This is a requirement for the IBM Cloud Terraform provider, forcing 'public' or 'private' visibility mode.
665+
for _, endpoint := range installConfig.Config.Platform.IBMCloud.ServiceEndpoints {
666+
if strings.Contains(endpoint.URL, "private") || strings.Contains(endpoint.URL, "direct") {
667+
// If at least one endpoint is private (or direct) we expect to use Private visibility mode
668+
terraformPrivateVisibility = true
669+
break
670+
}
671+
}
672+
661673
endpointData, err := ibmcloudtfvars.CreateEndpointJSON(installConfig.Config.Platform.IBMCloud.ServiceEndpoints, installConfig.Config.Platform.IBMCloud.Region)
662674
if err != nil {
663675
return err
664676
}
665-
// While we should have already confirmed there are ServiceEndpoints, we can verify data did get created, requiring the JSON file gets created and passed along
666-
if endpointData == nil {
667-
return fmt.Errorf("failed to generate endpoint JSON with provided IBM Cloud ServiceEndpoints")
677+
// While service endpoints may not be empty, they may not be required for Terraform.
678+
// So, if we have not endpoint data, we don't need to generate the JSON override file.
679+
if endpointData != nil {
680+
// Add endpoint JSON data to list of generated files for Terraform
681+
t.FileList = append(t.FileList, &asset.File{
682+
Filename: ibmcloudtfvars.IBMCloudEndpointJSONFileName,
683+
Data: endpointData,
684+
})
685+
endpointsJSONFile = ibmcloudtfvars.IBMCloudEndpointJSONFileName
668686
}
669-
670-
// Add endpoint JSON data to list of generated files for Terraform
671-
t.FileList = append(t.FileList, &asset.File{
672-
Filename: ibmcloudtfvars.IBMCloudEndpointJSONFileName,
673-
Data: endpointData,
674-
})
675-
endpointsJSONFile = ibmcloudtfvars.IBMCloudEndpointJSONFileName
676687
}
677688

678689
data, err = ibmcloudtfvars.TFVars(
679690
ibmcloudtfvars.TFVarsSources{
680-
Auth: auth,
681-
CISInstanceCRN: cisCRN,
682-
DNSInstanceID: dnsID,
683-
EndpointsJSONFile: endpointsJSONFile,
684-
ImageURL: string(*rhcosImage),
685-
MasterConfigs: masterConfigs,
686-
MasterDedicatedHosts: masterDedicatedHosts,
687-
NetworkResourceGroupName: installConfig.Config.Platform.IBMCloud.NetworkResourceGroupName,
688-
PreexistingVPC: preexistingVPC,
689-
PublishStrategy: installConfig.Config.Publish,
690-
ResourceGroupName: installConfig.Config.Platform.IBMCloud.ResourceGroupName,
691-
VPCPermitted: vpcPermitted,
692-
WorkerConfigs: workerConfigs,
693-
WorkerDedicatedHosts: workerDedicatedHosts,
691+
Auth: auth,
692+
CISInstanceCRN: cisCRN,
693+
DNSInstanceID: dnsID,
694+
EndpointsJSONFile: endpointsJSONFile,
695+
ImageURL: string(*rhcosImage),
696+
MasterConfigs: masterConfigs,
697+
MasterDedicatedHosts: masterDedicatedHosts,
698+
NetworkResourceGroupName: installConfig.Config.Platform.IBMCloud.NetworkResourceGroupName,
699+
PreexistingVPC: preexistingVPC,
700+
PublishStrategy: installConfig.Config.Publish,
701+
ResourceGroupName: installConfig.Config.Platform.IBMCloud.ResourceGroupName,
702+
TerraformPrivateVisibility: terraformPrivateVisibility,
703+
VPCPermitted: vpcPermitted,
704+
WorkerConfigs: workerConfigs,
705+
WorkerDedicatedHosts: workerDedicatedHosts,
694706
},
695707
)
696708
if err != nil {

‎pkg/destroy/bootstrap/bootstrap.go‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,17 +68,15 @@ func Destroy(ctx context.Context, dir string) (err error) {
6868
if err != nil {
6969
return fmt.Errorf("failed generating endpoint override JSON data for bootstrap destroy: %w", err)
7070
}
71-
// Since there are ServiceEndpoints, we expect JSON data to be generated.
72-
if jsonData == nil {
73-
return fmt.Errorf("no endpoint override JSON data generated for set of endpoint overrides")
74-
}
7571

7672
// If JSON data was generated, create the JSON file for IBM Cloud Terraform provider to use during destroy.
77-
endpointsFilePath := filepath.Join(dir, ibmcloudtfvars.IBMCloudEndpointJSONFileName)
78-
if err := os.WriteFile(endpointsFilePath, jsonData, 0o600); err != nil {
79-
return fmt.Errorf("failed to write IBM Cloud service endpoint override JSON file for bootstrap destroy: %w", err)
73+
if jsonData != nil {
74+
endpointsFilePath := filepath.Join(dir, ibmcloudtfvars.IBMCloudEndpointJSONFileName)
75+
if err := os.WriteFile(endpointsFilePath, jsonData, 0o600); err != nil {
76+
return fmt.Errorf("failed to write IBM Cloud service endpoint override JSON file for bootstrap destroy: %w", err)
77+
}
78+
logrus.Debugf("generated ibm endpoint overrides file: %s", endpointsFilePath)
8079
}
81-
logrus.Debugf("generated ibm endpoint overrides file: %s", endpointsFilePath)
8280
}
8381

8482
fg := featuregates.FeatureGateFromFeatureSets(configv1.FeatureSets, metadata.FeatureSet, metadata.CustomFeatureSet)

0 commit comments

Comments
 (0)