Merge pull request #262 from sassoftware/staging

7.5.0 - May 8, 2025

Author: PhanikumarThodupunoori

.github/workflows/linter-analysis.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run Hadolint Action
         uses: jbergstroem/[email protected]
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Run ShellCheck Action
         uses: ludeeus/action-shellcheck@master
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cache Plugin Directory
         uses: actions/cache@v4
@@ -53,7 +53,7 @@ jobs:
           terraform_wrapper: false
 
       - name: Setup TFLint
-        uses: terraform-linters/setup-tflint@v3.0.0
+        uses: terraform-linters/setup-tflint@v4.1.1
         with:
           tflint_version: latest
           github_token: ${{ secrets.LINTER_TOKEN }}

CONTRIBUTING.md

@@ -6,14 +6,49 @@ We just ask that you follow our contribution guidelines when you do.
 Contributions to this project must be accompanied by a signed [Contributor Agreement](ContributorAgreement.txt).
 You (or your employer) retain the copyright to your contribution; this simply grants us permission to use and redistribute your contributions as part of the project.
 
-## Code reviews
-All submissions to this project—including submissions from project members—require review.
-Our review process typically involves performing unit tests, development tests, integration tests, and security scans using internal SAS infrastructure.
-For this reason, we don’t often merge pull requests directly from GitHub.
+## Code Reviews
+All submissions to this project—including submissions from project members—require
+review. Our review process typically involves performing unit tests, development
+tests, integration tests, and security scans.
 
-Instead, we work with submissions internally first, vetting them to ensure they meet our security and quality standards.
-We’ll do our best to work with contributors in public issues and pull requests; however, to ensure our code meets our internal compliance standards, we may need to incorporate your submission into a solution we push ourselves.
+## Pull Request Requirement
 
-This does not mean we don’t value or appreciate your contribution.
-We simply need to review your code internally before merging it.
-We work to ensure all contributors receive appropriate recognition for their contributions, at least by acknowledging them in our release notes.
+### Conventional Commits
+All pull requests must follow the [Conventional Commit](https://www.conventionalcommits.org/en/v1.0.0/)
+standard for commit messages. This helps maintain a consistent and meaningful
+commit history. Pull requests with commits that do not follow the Conventional
+Commit format will not be merged.
+
+### Developer Certificate of Origin Sign-Off
+This project requires all commits to be signed off in accordance with the [Developer Certificate of Origin (DCO)](https://developercertificate.org/).
+By signing off your commits, you certify that you have the right to submit the
+contribution under the open source license used by this project.
+
+To sign off your commits, use the --signoff flag with git commit:
+
+```bash
+git commit --signoff -m "Your commit message"
+```
+
+This will add a Signed-off-by line to your commit message, e.g.:
+
+```bash
+Signed-off-by: You Name <[email protected]>
+```
+
+For more information, please refer to https://probot.github.io/apps/dco/
+
+### Linter Analysis Checks
+All pull requests must pass our automated analysis checks before they can be
+merged. These checks include:
+
+- **Hadolint** – for Dockerfile best practices
+- **ShellCheck** – for shell script issues
+- **TFLint** – for Terraform code quality
+
+## Security Scans
+To ensure that all submissions meet our security and quality standards, we perform
+security scans using internal SAS infrastructure. Contributions might be subjected
+to security scans before they can be accepted. Reporting of any Common Vulnerabilities
+and Exposures (CVEs) that are detected is not available in this project at this
+time.

docs/CONFIG-VARS.md

@@ -269,11 +269,31 @@ postgres_servers = {
 
 **NOTE**: The `default = {}` elements is always required when creating external databases. This is the systems default database server.
 
-Each server element, like `foo = {}`, can contain none, some, or all of the parameters listed below:
+Each server element, like `foo = {}`, can contain none, some, or all of the parameters listed below. The `machine_type` and `edition` parameters must be explicitly specified and will be validated based on the `server_version`:
+
+- For PostgreSQL 16+:
+  - `edition` must be `"ENTERPRISE_PLUS"`
+  - `machine_type` must start with `"db-perf-optimized-N-"`
+- For PostgreSQL < 16:
+  - `edition` must be `"ENTERPRISE"`
+  - `machine_type` must start with `"db-custom-"`
+
+*NOTE*: The default = {} elements is always required when creating external databases. This is the systems default database server.
+
+If you provide an empty block for default, the following default values will be used:
+terraform
+postgres_servers = {
+  default = {
+    server_version = "15"
+    edition        = "ENTERPRISE"
+    machine_type   = "db-custom-4-16384"
+  }
+}
 
 | Name | Description | Type | Default | Notes |
 | :--- | ---: | ---: | ---: | ---: |
-| machine_type| The machine type for the PostgreSQL server VMs" | string | "db-custom-4-16384" | Google Cloud Postgres supports only shared-core machine types such as db-f1-micro, and custom machine types such as db-custom-2-13312. |
+| machine_type| The machine type for the PostgreSQL server VMs" | string | "db-custom-4-16384" | Google Cloud Postgres supports only shared-core machine types such as db-f1-micro, and custom machine types such as db-custom-2-13312. Must match the PostgreSQL version requirements. |
+| edition | Cloud SQL edition type | string | "ENTERPRISE" | Must be `"ENTERPRISE"` for PostgreSQL < 16 or `"ENTERPRISE_PLUS"` for PostgreSQL 16+. |
 | storage_gb | Minimum storage allowed for the PostgreSQL server | number | 128 | |
 | backups_enabled | Enables postgres backups | bool | true | |
 | backups_start_time | Start time for postgres backups | string | "21:00" | |
@@ -289,15 +309,18 @@ Each server element, like `foo = {}`, can contain none, some, or all of the para
 
 Multiple SAS offerings require a second PostgreSQL instance referred to as SAS Common Data Store, or CDS PostgreSQL. For more information, see [Common Customizations](https://documentation.sas.com/?cdcId=itopscdc&cdcVersion=default&docsetId=dplyml0phy0dkr&docsetTarget=n08u2yg8tdkb4jn18u8zsi6yfv3d.htm#p0wkxxi9s38zbzn19ukjjaxsc0kl). A list of SAS offerings that require CDS PostgreSQL is provided in [SAS Common Data Store Requirements](https://documentation.sas.com/?cdcId=itopscdc&cdcVersion=default&docsetId=itopssr&docsetTarget=p05lfgkwib3zxbn1t6nyihexp12n.htm#n03wzanutmc6gon1val5fykas9aa). To create and configure an external CDS PostgreSQL instance in addition to the external platform PostgreSQL instance named `default`, specify `cds-postgres` as a second PostgreSQL instance, as shown in the example below.
 
-Here is an example of the `postgres_servers` variable with the `default` server entry overriding only the `administrator_password` parameter and the `cds-postgres` entry overriding all of the parameters:
+Here is an example of the `postgres_servers` variable with the `default` server entry and the `cds-postgres` entry, both with explicit edition and machine type configurations that match their PostgreSQL versions:
 
 ```terraform
 postgres_servers = {
   default = {
     administrator_password       = "D0ntL00kTh1sWay"
+    server_version              = "16"  # PostgreSQL 16
+    machine_type                = "db-perf-optimized-N-8"  # Required for PostgreSQL 16+
+    edition                     = "ENTERPRISE_PLUS"  # Required for PostgreSQL 16+
   },
   cds-postgres = {
-    machine_type                           = "db-custom-4-16384"
+    machine_type                           = "db-custom-4-16384"  # Required for PostgreSQL < 16
     storage_gb                             = 128
     backups_enabled                        = true
     backups_start_time                     = "21:00"
@@ -306,7 +329,8 @@ postgres_servers = {
     backup_count                           = 7 # Number of backups to retain, not in days
     administrator_login                    = "cdsadmin"
     administrator_password                 = "my$up3rS3cretPassw0rd"
-    server_version                         = "15"
+    server_version                         = "15"  # PostgreSQL 15
+    edition                                = "ENTERPRISE"  # Required for PostgreSQL < 16
     availability_type                      = "ZONAL"
     ssl_enforcement_enabled                = true
     database_flags                         = [{ name = "cloudsql.enable_pg_cron", value = "true"}, { name = "cloudsql.enable_pgaudit", value = "true"}]

examples/sample-input.tfvars

@@ -22,9 +22,10 @@ tags = {} # e.g., { "key1" = "value1", "key2" = "value2" }
 # Postgres config - By having this entry a database server is created. If you do not
 #                   need an external database server remove the 'postgres_servers'
 #                   block below.
+
 postgres_servers = {
   default = {},
-}
+},
 
 # GKE config
 kubernetes_version         = "1.31"

main.tf

@@ -256,7 +256,9 @@ module "postgresql" {
   deletion_protection = false
   module_depends_on   = [google_service_networking_connection.private_vpc_connection]
 
-  tier      = each.value.machine_type
+  edition = each.value.edition
+  tier    = each.value.machine_type
+
   disk_size = each.value.storage_gb
 
   enable_default_db        = false
@@ -317,4 +319,4 @@ module "google_netapp" {
   volume_path        = "${var.prefix}-${var.netapp_volume_path}"
   allowed_clients    = join(",", [local.gke_subnet_cidr, local.misc_subnet_cidr])
   depends_on         = [ module.gke ]
-}
+}

variables.tf

@@ -332,6 +332,7 @@ variable "node_pools" {
 #   Potentially we upgrade Terraform modules and versions and we bump our minimum required terraform version to be >1.3
 #   then at that time I can deprecate this variable and instead allow the user to configure node_locations per node pool.
 #   Refer to https://github.com/hashicorp/terraform/issues/29407#issuecomment-1150491619
+
 variable "nodepools_locations" {
   description = "GCP zone(s) where the additional node pools will allocate nodes in. Comma separated list."
   type        = string
@@ -382,6 +383,7 @@ variable "postgres_server_defaults" {
     availability_type                      = "ZONAL"
     ssl_enforcement_enabled                = true
     database_flags                         = []
+    edition                                = "ENTERPRISE"
   }
 }
 
@@ -390,7 +392,7 @@ variable "postgres_servers" {
   description = "Map of PostgreSQL server objects"
   type        = any
   default     = null
-
+ 
   # Checking for user provided "default" server
   validation {
     condition     = var.postgres_servers != null ? length(var.postgres_servers) != 0 ? contains(keys(var.postgres_servers), "default") : false : true
@@ -409,9 +411,23 @@ variable "postgres_servers" {
     error_message = "ERROR: The database server name must start with a letter, cannot end with a hyphen, must be between 1-88 characters in length, and can only contain hyphens, letters, and numbers."
   }
 
-  # Checking user provided login
-
-  # Checking user provided password
+  # Validate edition and machine type based on PostgreSQL version
+  validation {
+    condition = var.postgres_servers != null ? length(var.postgres_servers) != 0 ? alltrue([
+      for k, v in var.postgres_servers : (
+        # If the object is empty, use default values
+        length(keys(v)) == 0 ? true : (
+          can(try(v.server_version, null)) && 
+          can(try(v.edition, null)) && 
+          can(try(v.machine_type, null)) && (
+            (tonumber(try(v.server_version, "15")) >= 16 && try(v.edition, "ENTERPRISE") == "ENTERPRISE_PLUS" && can(regex("^db-perf-optimized-N-", try(v.machine_type, "")))) ||
+            (tonumber(try(v.server_version, "15")) < 16 && try(v.edition, "ENTERPRISE") == "ENTERPRISE" && can(regex("^db-custom-", try(v.machine_type, ""))))
+          )
+        )
+      )
+    ]) : false : true
+    error_message = "ERROR: Invalid PostgreSQL configuration:\n* PostgreSQL 16+ requires ENTERPRISE_PLUS edition and db-perf-optimized-N-* machine type\n* PostgreSQL < 16 requires ENTERPRISE edition and db-custom-* machine type"
+  }
 }
 
 ## filestore
@@ -578,7 +594,6 @@ variable "gke_network_policy" {
   default     = false
 }
 
-
 variable "create_static_kubeconfig" {
   description = "Allows the user to create a provider / service account based kube config file"
   type        = bool
@@ -589,4 +604,4 @@ variable "cluster_node_pool_mode" {
   description = "Flag for predefined cluster node configurations - Values : default, minimal"
   type        = string
   default     = "default"
-}
+}