From f8671cd780b0c6be513347bb5f787b012309ce13 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Mon, 10 Nov 2025 04:46:59 +0530 Subject: [PATCH 01/16] updated git ignore file --- .gitignore | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gitignore b/.gitignore index 97d93660..bec79e62 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,15 @@ .def.json .terraform +**/.terraform/* + *.tfstate +*.tfstate.* + +*.terraform.lock.hcl *.lock.hcl + .DS_Store .idea +*.tfvars +*.tfvars.json +*.log From e40c15b1b8c235208f8b7a32972b3e0b044660fb Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 11 Nov 2025 11:06:05 +0530 Subject: [PATCH 02/16] basic without app --- ibm_catalog.json | 527 +++++++++- .../catalogValidationValues.json.template | 4 + solutions/basic-2/stack_definition.json | 925 ++++++++++++++++++ 3 files changed, 1455 insertions(+), 1 deletion(-) create mode 100644 solutions/basic-2/catalogValidationValues.json.template create mode 100644 solutions/basic-2/stack_definition.json diff --git a/ibm_catalog.json b/ibm_catalog.json index fea8d919..298e8cc7 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -610,10 +610,535 @@ ], "install_type": "fullstack" }, + { + "label": "Basic without sample application (Deploy on Code Engine)", + "name": "basic-without-app", + "index": 2, + "working_directory": "solutions/basic-2", + "ignore_readme": true, + "compliance": { + "authority": "scc-v3", + "profiles": [ + { + "profile_name": "AI Security Guardrails 2.0", + "profile_version": "1.1.0" + } + ] + }, + "iam_permissions": [ + { + "service_name": "iam-groups", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "cloud-object-storage" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "iam-identity" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "atracker" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms" + }, + { + "service_name": "sysdig-secure", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "apprapp", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "pm-20" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "data-science-experience" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "aiopenscale" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "conversation" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "discovery" + }, + { + "service_name": "databases-for-elasticsearch", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "event-notifications", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "codeengine" + } + ], + "architecture": { + "features": [ + { + "title": " ", + "description": "Enables:" + }, + { + "title": "1. Code Engine for containerized and serverless workloads", + "description": " " + }, + { + "title": "2. Elasticsearch Enterprise for building and storing dense vector indexes or keyword search indexes", + "description": " " + }, + { + "title": "3. watsonx.ai in-memory vector store for RAG trial and exploration", + "description": " " + }, + { + "title": "4. watsonx.ai UI to upload documents", + "description": " " + }, + { + "title": "5. watsonx.ai Prompt Lab for inferencing and Prompt Templates", + "description": " " + }, + { + "title": "6. watsonx Assistant Conversational Search with embedded LLM", + "description": " " + } + ], + "diagrams": [ + { + "diagram": { + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", + "caption": "Reference architecture", + "type": "image/svg+xml", + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" + }, + "description": "Reference architecture" + }, + { + "diagram": { + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", + "caption": "Solution components", + "type": "image/svg+xml", + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" + }, + "description": "Solution components" + } + ] + }, + "configuration": [ + { + "key": "prefix", + "type": "string", + "default_value": "dev", + "random_string" : { + "length": 4 + }, + "description": "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). Used to avoid name clashes in the target account when deploying this solution multiple times.", + "required": true, + "value_constraints": [ + { + "type": "regex", + "description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters", + "value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$" + } + ] + }, + { + "key": "ibmcloud_api_key", + "type": "password", + "description": "The API Key used to provision all resources created in this solution.", + "required": true + }, + { + "key": "region", + "type": "string", + "default_value": "us-south", + "description": "The region in which all resources are deployed.", + "required": false, + "options": [ + { + "displayname": "Dallas (us-south)", + "value": "us-south" + }, + { + "displayname": "Frankfurt (eu-de)", + "value": "eu-de" + }, + { + "displayname": "London (eu-gb)", + "value": "eu-gb" + }, + { + "displayname": "Sydney (au-syd)", + "value": "au-syd" + }, + { + "displayname": "Tokyo (jp-tok)", + "value": "jp-tok" + }, + { + "displayname": "Toronto (ca-tor)", + "value": "ca-tor" + } + ] + }, + { + "key": "resource_group_name", + "type": "string", + "default_value": "rag-services", + "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", + "required": false + }, + { + "key": "existing_resource_group_name", + "type": "string", + "default_value": "__NULL__", + "description": "The name of an existing resource group that is used by this solution, takes precedence over `resource_group_name`. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", + "required": false, + "custom_config": { + "type": "resource_group", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "identifier": "rg_name" + } + } + }, + { + "key": "watsonx_admin_api_key", + "type": "password", + "description": "The API key used to provision the watson project resources. If not set, the API key used to deploy the solution is used.", + "required": false + }, + { + "key": "secrets_manager_service_plan", + "type": "string", + "default_value": "trial", + "description": "The service/pricing plan to use when provisioning a new Secrets Manager instance. Only one trial instance is allowed per account.", + "required": false, + "options": [ + { + "displayname": "Trial", + "value": "trial" + }, + { + "displayname": "Standard", + "value": "standard" + } + ] + }, + { + "key": "key_protect_plan", + "type": "string", + "default_value": "tiered-pricing", + "description": "The service plan of the Key Protect instance that will be provisioned by this solution. Only used if not supplying `existing_kms_instance_crn`. [Learn more](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan).", + "required": false, + "options": [ + { + "displayname": "Standard", + "value": "tiered-pricing" + }, + { + "displayname": "Cross-region Resiliency", + "value": "cross-region-resiliency" + } + ] + }, + { + "key": "cloud_monitoring_plan", + "type": "string", + "default_value": "graduated-tier", + "description": "The IBM Cloud Monitoring plan to provision. Available values are `lite` and `graduated-tier`. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-service_plans)", + "required": false, + "options": [ + { + "displayname": "Lite", + "value": "lite" + }, + { + "displayname": "Graduated Tier", + "value": "graduated-tier" + } + ] + }, + { + "key": "scc_workload_protection_service_plan", + "type": "string", + "default_value": "graduated-tier", + "description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.", + "required": false, + "options": [ + { + "displayname": "Graduated Tier", + "value": "graduated-tier" + }, + { + "displayname": "Free Trial", + "value": "free-trial" + } + ] + }, + { + "key": "secrets_manager_secret_groups", + "type": "array", + "default_value": "[\n {\n secret_group_name = \"General\"\n secret_group_description = \"A general purpose secrets group with an associated access group which has a secrets reader role\"\n create_access_group = true\n access_group_name = \"general-secrets-group-access-group\"\n access_group_roles = [\"SecretsReader\"]\n }\n ]", + "description": "Secret Manager secret group and access group configurations. If a prefix input variable is specified, it is added to the `access_group_name` value in the `-value` format. If you do not wish to create any groups, set the value to `[]`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md).", + "required": false, + "custom_config": { + "type": "code_editor", + "grouping": "deployment", + "original_grouping": "deployment" + } + }, + { + "key": "skip_secrets_manager_iam_auth_policy", + "display_name": "disable_secrets_manager_iam_credentials_engine", + "type": "boolean", + "default_value": false, + "description": "Whether to skip the creation of the IAM authorization policies required to enable the Secrets Manager IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service.", + "required": false + }, + { + "key": "enable_platform_metrics", + "type": "boolean", + "default_value": false, + "description": "Setting this to true will enable platform metrics for the Cloud Monitoring instance, including setting up a metrics routing route to the Cloud Monitoring instance. NOTE: You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location.", + "required": false + }, + { + "key": "logs_routing_tenant_regions", + "type": "array", + "default_value": [], + "description": "Pass a list of regions to create a tenant that is targeted to the Cloud Logs instance created by this solution. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "event_notifications_email_list", + "type": "array", + "default_value": [], + "description": "List of emails to configure event notifications.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_id", + "type": "string", + "default_value": "__NULL__", + "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", + "required": false + }, + { + "key": "enterprise_account_group_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_account_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "existing_secrets_manager_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing secret manager instance to use in this solution. If not set, a new secret manager instance is provisioned.", + "required": false + }, + { + "key": "existing_kms_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing KMS instance to use in this solution. If not set, a new KP instance is provisioned.", + "required": false + }, + { + "key": "existing_event_notifications_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing event notification instance to use in this solution. If not set, a new event notification instance is provisioned.", + "required": false + }, + { + "key": "existing_discovery_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS discovery instance to use in this solution. If not set, a new discovery instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_assistant_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS assistant instance to use in this solution. If not set, a new assistant instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_governance_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS governance instance to use in this solution. If not set, a new governance instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_studio_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS studio instance to use in this solution. If not set, a new studio instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_machine_learning_instance", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS machine learning instance to use in this solution. If not set, a new machine learning instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_elasticsearch_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing elasticsearch instance to use in this solution. If not set, a new elasticsearch instance is provisioned.", + "required": false + } + ], + "outputs": [ + { + "name": "cos_instance_crn", + "description": "Cloud Object Storage instance CRN" + }, + { + "name": "cos_instance_guid", + "description": "Cloud Object Storage instance GUID" + }, + { + "name": "cos_instance_name", + "description": "Cloud Object Storage instance name" + }, + { + "key": "elasticsearch_hostname", + "description": "The hostname of the Elasticsearch instance." + }, + { + "key": "elasticsearch_port", + "description": "The port of the Elasticsearch instance." + }, + { + "key": "elasticsearch_service_credentials_json", + "description": "The service credentials of the Elasticsearch instance." + }, + { + "key": "elasticsearch_crn", + "description": "The CRN of the Elasticsearch instance." + }, + { + "key": "watsonx_project_url", + "description": "The URL to the WatsonX project for the sample RAG application." + }, + { + "key": "watsonx_project_id", + "description": "The ID for the WatsonX project for the sample RAG application." + }, + { + "key": "watson_discovery_api_url", + "description": "The URL to the Watson Discovery API endpoint." + }, + { + "key": "watson_discovery_project_id", + "description": "The ID for the Watson Discovery project for the sample RAG application." + } + ], + "install_type": "fullstack" + }, { "label": "Standard with sample application (Deploy on Red Hat OpenShift)", "name": "standard", - "index": 2, + "index": 3, "working_directory": "solutions/standard", "ignore_readme": true, "compliance": { diff --git a/solutions/basic-2/catalogValidationValues.json.template b/solutions/basic-2/catalogValidationValues.json.template new file mode 100644 index 00000000..2d3d4bf2 --- /dev/null +++ b/solutions/basic-2/catalogValidationValues.json.template @@ -0,0 +1,4 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY, + "prefix": $PREFIX +} diff --git a/solutions/basic-2/stack_definition.json b/solutions/basic-2/stack_definition.json new file mode 100644 index 00000000..19f505a8 --- /dev/null +++ b/solutions/basic-2/stack_definition.json @@ -0,0 +1,925 @@ +{ + "inputs": [ + { + "name": "prefix", + "required": true, + "type": "string", + "hidden": false + }, + { + "name": "secrets_manager_service_plan", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "key_protect_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "cloud_monitoring_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "secrets_manager_secret_groups", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "skip_secrets_manager_iam_auth_policy", + "required": false, + "type": "boolean", + "hidden": false + }, + { + "name": "watsonx_admin_api_key", + "required": false, + "type": "password", + "hidden": false + }, + { + "name": "resource_group_name", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_resource_group_name", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "region", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_secrets_manager_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "event_notifications_email_list", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "existing_kms_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_event_notifications_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "enable_platform_metrics", + "required": false, + "type": "boolean", + "hidden": false + }, + { + "name": "logs_routing_tenant_regions", + "required": false, + "type": "array", + "hidden": false + }, + { + "name": "scc_workload_protection_service_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_id", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_account_group_ids_to_assign", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_account_ids_to_assign", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "existing_discovery_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_assistant_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_governance_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_studio_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_machine_learning_instance", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_elasticsearch_instance_crn", + "required": false, + "type": "string", + "hidden": false + } + ], + "members": [ + { + "name": "1 - Account Configuration", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.0e456e60-9ca9-4e9e-8f28-6265f8a12f97-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "single_resource_group_name", + "value": "ref:../../inputs/existing_resource_group_name" + }, + { + "name": "security_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "audit_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "observability_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "management_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "workload_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "edge_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "devops_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "provision_trusted_profile_projects", + "value": false + } + ] + }, + { + "name": "2a - Essential Security - Encryption Key Management", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.fbb4dc92-6318-4f20-afc9-65cc586ac241-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/security_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../../inputs/existing_kms_instance_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "key_protect_plan", + "value": "ref:../../inputs/key_protect_plan" + } + ] + }, + { + "name": "2b - Essential Security - Cloud Object Storage", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.6433c58f-9e1b-4520-ae52-5ab4f4559cf9-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + } + ] + }, + { + "name": "2c - Essential Security - Cloud Monitoring", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.4c21c293-3f7d-454b-97bc-9808aee58bfe-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "enable_platform_metrics", + "value": "ref:../../inputs/enable_platform_metrics" + }, + { + "name": "enable_metrics_routing_to_cloud_monitoring", + "value": "ref:../../inputs/enable_platform_metrics" + }, + { + "name": "cloud_monitoring_plan", + "value": "ref:../../inputs/cloud_monitoring_plan" + } + ] + }, + { + "name": "3a - Essential Security - Event Notifications", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.29f017cd-7a6f-45cc-a4ed-5f23505380bf-global", + "inputs": [ + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_id" + }, + { + "name": "enable_collecting_failed_events", + "value": true + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "kms_endpoint_url", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../../inputs/existing_event_notifications_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + } + ] + }, + { + "name": "3b - Gen AI - WatsonX SaaS services", + "version_locator": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc.63f85fe2-082f-44fa-add2-6a0f93d130e8-global", + "inputs": [ + { + "name": "watsonx_admin_api_key", + "value": "ref:../../inputs/watsonx_admin_api_key" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "watson_machine_learning_plan", + "value": "v2-standard" + }, + { + "name": "existing_machine_learning_instance", + "value": "ref:../../inputs/existing_machine_learning_instance" + }, + { + "name": "watson_studio_plan", + "value": "professional-v1" + }, + { + "name": "existing_studio_instance", + "value": "ref:../../inputs/existing_studio_instance_crn" + }, + { + "name": "watson_discovery_plan", + "value": "do not install" + }, + { + "name": "existing_discovery_instance", + "value": "ref:../../inputs/existing_discovery_instance_crn" + }, + { + "name": "watsonx_assistant_plan", + "value": "plus" + }, + { + "name": "existing_assistant_instance", + "value": "ref:../../inputs/existing_assistant_instance_crn" + }, + { + "name": "watsonx_governance_plan", + "value": "do not install" + }, + { + "name": "existing_governance_instance", + "value": "ref:../../inputs/existing_governance_instance_crn" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "cos_kms_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "enable_cos_kms_encryption", + "value": true + } + ] + }, + { + "name": "4a - Essential Security - Cloud Logs for logging", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.b6bf9a7b-6ac3-4821-b3e4-f274293603f3-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instances", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn_list_object" + }, + { + "name": "logs_routing_tenant_regions", + "value": "ref:../../inputs/logs_routing_tenant_regions" + } + ] + }, + { + "name": "4b - Essential Security - App Configuration", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.bff2dc4d-9e19-4b2c-8890-4cda020ce39e-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/audit_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "app_config_service_plan", + "value": "enterprise" + }, + { + "name": "enable_config_aggregator", + "value": true + }, + { + "name": "config_aggregator_enterprise_id", + "value": "ref:../../inputs/enterprise_id" + }, + { + "name": "config_aggregator_enterprise_account_group_ids_to_assign", + "value": "ref:../../inputs/enterprise_account_group_ids_to_assign" + }, + { + "name": "config_aggregator_enterprise_account_ids_to_assign", + "value": "ref:../../inputs/enterprise_account_ids_to_assign" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_url", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "enable_event_notifications", + "value": true + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn" + }, + { + "name": "event_notifications_endpoint_url", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/event_notifications_private_endpoint" + }, + { + "name": "event_notifications_email_list", + "value": "ref:../../inputs/event_notifications_email_list" + } + ] + }, + { + "name": "4c - Essential Security - Secrets Manager", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.c7ba4599-f65a-4a9b-bd6b-120e52947652-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/security_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_secrets_manager_crn", + "value": "ref:../../inputs/existing_secrets_manager_crn" + }, + { + "name": "skip_secrets_manager_iam_auth_policy", + "value": "ref:../../inputs/skip_secrets_manager_iam_auth_policy" + }, + { + "name": "secret_groups", + "value": "ref:../../inputs/secrets_manager_secret_groups" + }, + { + "name": "service_plan", + "value": "ref:../../inputs/secrets_manager_service_plan" + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn" + } + ] + }, + { + "name": "4d - Essential Security - Cloud Logs for activity tracking", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.b6bf9a7b-6ac3-4821-b3e4-f274293603f3-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instances", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn_list_object" + }, + { + "name": "logs_routing_tenant_regions", + "value": "ref:../../inputs/logs_routing_tenant_regions" + }, + { + "name": "cloud_logs_data_cos_bucket_name", + "value": "at-cloud-logs-logs-bucket" + }, + { + "name": "cloud_logs_metrics_cos_bucket_name", + "value": "at-cloud-logs-metrics-bucket" + }, + { + "name": "cloud_logs_instance_name", + "value": "at-cloud-logs" + } + ] + }, + { + "name": "5a - Essential Security - Security and Compliance Center Workload Protection", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.e543e47d-1b78-4415-963c-3c59fcf5ef2b-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/audit_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "scc_workload_protection_service_plan", + "value": "ref:../../inputs/scc_workload_protection_service_plan" + }, + { + "name": "cspm_enabled", + "value": true + }, + { + "name": "app_config_crn", + "value": "ref:../4b - Essential Security - App Configuration/outputs/app_config_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + } + ] + }, + { + "name": "5b - Gen AI - Databases for Elasticsearch", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.2a25caea-0f63-4911-a5fb-c1ef792edea0-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "deletion_protection", + "value": false + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "plan", + "value": "enterprise" + }, + { + "name": "elasticsearch_version", + "value": "8.15" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "member_host_flavor", + "value": "multitenant" + }, + { + "name": "member_cpu_count", + "value": 0 + }, + { + "name": "service_credential_names", + "value": { + "elastic_db_admin": "Administrator", + "wxasst_db_user": "Editor" + } + }, + { + "name": "existing_elasticsearch_instance_crn", + "value": "ref:../../inputs/existing_elasticsearch_instance_crn" + }, + { + "name": "existing_secrets_manager_instance_crn", + "value": "ref:../4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" + } + ] + }, + { + "name": "5c - Essential Security - Activity Tracker Event Routing", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.1d61413e-c149-4a3a-bd6d-9207e0c60385-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_cloud_logs_instance_crn", + "value": "ref:../4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + }, + { + "name": "enable_activity_tracker_event_routing_to_cos_bucket", + "value": true + } + ] + } + ], + "outputs": [ + { + "name": "cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "cos_instance_guid", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" + }, + { + "name": "cos_instance_name", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" + }, + { + "name": "elasticsearch_hostname", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/hostname" + }, + { + "name": "elasticsearch_port", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/port" + }, + { + "name": "elasticsearch_service_credentials_json", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/service_credentials_json" + }, + { + "name": "elasticsearch_crn", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/crn" + }, + { + "name": "kms_instance_crn", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_private_endpoint", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "kms_public_endpoint", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_public_endpoint" + }, + { + "name": "event_notifications_instance_crn", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/crn" + }, + { + "name": "event_notifications_instance_name", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/event_notification_instance_name" + }, + { + "name": "event_notifications_instance_guid", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/guid" + }, + { + "name": "cloud_logs_for_logging_crn", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_logging_guid", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_guid" + }, + { + "name": "cloud_logs_for_activity_tracking_crn", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_activity_tracking_guid", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_guid" + }, + { + "name": "cloud_monitoring_crn", + "value": "ref:./members/2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "cloud_monitoring_guid", + "value": "ref:./members/2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_guid" + }, + { + "name": "secrets_manager_crn", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" + }, + { + "name": "secrets_manager_guid", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_guid" + }, + { + "name": "secrets_manager_name", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_name" + }, + { + "name": "app_config_crn", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_crn" + }, + { + "name": "app_config_guid", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_guid" + }, + { + "name": "scc_workload_protection_crn", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_crn" + }, + { + "name": "scc_workload_protection_id", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_id" + }, + { + "name": "watson_discovery_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_crn" + }, + { + "name": "watson_discovery_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_dashboard_url" + }, + { + "name": "watson_machine_learning_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_crn" + }, + { + "name": "watson_machine_learning_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_dashboard_url" + }, + { + "name": "watson_machine_learning_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_guid" + }, + { + "name": "watson_studio_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_crn" + }, + { + "name": "watson_studio_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_dashboard_url" + }, + { + "name": "watson_studio_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_guid" + }, + { + "name": "watsonx_assistant_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_assistant_crn" + }, + { + "name": "watsonx_assistant_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_assistant_dashboard_url" + }, + { + "name": "watsonx_data_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_crn" + }, + { + "name": "watsonx_data_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_dashboard_url" + }, + { + "name": "watsonx_data_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_guid" + }, + { + "name": "watson_discovery_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_guid" + } + ] +} From b5bfce3e124c68cd8b3ebdfc3f7af6a47d624638 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 11 Nov 2025 11:46:48 +0530 Subject: [PATCH 03/16] standard without app --- ibm_catalog.json | 733 ++++++++++++ .../catalogValidationValues.json.template | 4 + solutions/standard-2/stack_definition.json | 1021 +++++++++++++++++ 3 files changed, 1758 insertions(+) create mode 100644 solutions/standard-2/catalogValidationValues.json.template create mode 100644 solutions/standard-2/stack_definition.json diff --git a/ibm_catalog.json b/ibm_catalog.json index 298e8cc7..427593fd 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -1883,6 +1883,739 @@ } ], "install_type": "fullstack" + }, + { + "label": "Standard without sample application (Deploy on Red Hat OpenShift)", + "name": "standard-without-app", + "index": 4, + "working_directory": "solutions/standard-2", + "ignore_readme": true, + "compliance": { + "authority": "scc-v3", + "profiles": [ + { + "profile_name": "AI Security Guardrails 2.0", + "profile_version": "1.1.0" + } + ] + }, + "iam_permissions": [ + { + "service_name": "iam-groups", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "cloud-object-storage" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" + ], + "service_name": "iam-identity" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "atracker" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms" + }, + { + "service_name": "sysdig-secure", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "apprapp", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "pm-20" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "data-science-experience" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "aiopenscale" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "conversation" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "discovery" + }, + { + "service_name": "databases-for-elasticsearch", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "event-notifications", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "containers-kubernetes" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "is.vpc" + } + ], + "architecture": { + "features": [ + { + "title": " ", + "description": "Enables:" + }, + { + "title": "1. Red Hat OpenShift cluster for microservices workloads", + "description": " " + }, + { + "title": "2. Elasticsearch Platinum for building and storing sparse vectors, dense vector indexes or keyword search indexes", + "description": " " + }, + { + "title": "i. watsonx.ai use of Elasticsearch ELSER2 vector index for RAG", + "description": " " + }, + { + "title": "ii. watsonx Assistant Conversational Search with UI feature for uploading documents to create or use Elasticsearch ELSER2 vector index for RAG", + "description": " " + }, + { + "title": "3. watsonx.ai in-memory vector store for RAG trial and exploration", + "description": " " + }, + { + "title": "4. watsonx.ai UI to upload documents", + "description": " " + }, + { + "title": "5. watsonx.ai Prompt Lab for inferencing and Prompt Templates", + "description": " " + }, + { + "title": "6. watsonx Assistant Conversational Search with embedded LLM", + "description": " " + } + ], + "diagrams": [ + { + "diagram": { + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", + "caption": "Reference architecture", + "type": "image/svg+xml", + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" + }, + "description": "Reference architecture" + }, + { + "diagram": { + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", + "caption": "Solution components", + "type": "image/svg+xml", + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" + }, + "description": "Solution components" + } + ] + }, + "configuration": [ + { + "key": "prefix", + "type": "string", + "default_value": "dev", + "random_string" : { + "length": 4 + }, + "description": "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). Used to avoid name clashes in the target account when deploying this solution multiple times.", + "required": true, + "value_constraints": [ + { + "type": "regex", + "description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters", + "value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$" + } + ] + }, + { + "key": "ibmcloud_api_key", + "type": "password", + "description": "The API Key used to provision all resources created in this solution.", + "required": true + }, + { + "key": "region", + "type": "string", + "default_value": "us-south", + "description": "The region in which all resources are deployed.", + "required": false, + "options": [ + { + "displayname": "Dallas (us-south)", + "value": "us-south" + }, + { + "displayname": "Frankfurt (eu-de)", + "value": "eu-de" + }, + { + "displayname": "London (eu-gb)", + "value": "eu-gb" + }, + { + "displayname": "Sydney (au-syd)", + "value": "au-syd" + }, + { + "displayname": "Tokyo (jp-tok)", + "value": "jp-tok" + }, + { + "displayname": "Toronto (ca-tor)", + "value": "ca-tor" + } + ] + }, + { + "key": "resource_group_name", + "type": "string", + "default_value": "rag-services", + "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", + "required": false + }, + { + "key": "existing_resource_group_name", + "type": "string", + "default_value": "__NULL__", + "description": "The name of an existing resource group that is used by this solution, takes precedence over resource_group_name. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", + "required": false, + "custom_config": { + "type": "resource_group", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "identifier": "rg_name" + } + } + }, + { + "key": "watsonx_admin_api_key", + "type": "password", + "description": "The API key used to provision the watson project resources. If not set, the API key used to deploy the solution is used.", + "required": false + }, + { + "key": "secrets_manager_service_plan", + "type": "string", + "default_value": "standard", + "description": "The service/pricing plan to use when provisioning a new Secrets Manager instance. Only one trial instance is allowed per account.", + "required": false, + "options": [ + { + "displayname": "Trial", + "value": "trial" + }, + { + "displayname": "Standard", + "value": "standard" + } + ] + }, + { + "key": "key_protect_plan", + "type": "string", + "default_value": "tiered-pricing", + "description": "The service plan of the Key Protect instance that will be provisioned by this solution. Only used if not supplying `existing_kms_instance_crn`. [Learn more](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan).", + "required": false, + "options": [ + { + "displayname": "Standard", + "value": "tiered-pricing" + }, + { + "displayname": "Cross-region Resiliency", + "value": "cross-region-resiliency" + } + ] + }, + { + "key": "cloud_monitoring_plan", + "type": "string", + "default_value": "graduated-tier", + "description": "The IBM Cloud Monitoring plan to provision. Available values are `lite` and `graduated-tier`. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-service_plans)", + "required": false, + "options": [ + { + "displayname": "Lite", + "value": "lite" + }, + { + "displayname": "Graduated Tier", + "value": "graduated-tier" + } + ] + }, + { + "key": "scc_workload_protection_service_plan", + "type": "string", + "default_value": "graduated-tier", + "description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.", + "required": false, + "options": [ + { + "displayname": "Graduated Tier", + "value": "graduated-tier" + }, + { + "displayname": "Free Trial", + "value": "free-trial" + } + ] + }, + { + "key": "secrets_manager_secret_groups", + "type": "array", + "default_value": "[\n {\n secret_group_name = \"General\"\n secret_group_description = \"A general purpose secrets group with an associated access group which has a secrets reader role\"\n create_access_group = true\n access_group_name = \"general-secrets-group-access-group\"\n access_group_roles = [\"SecretsReader\"]\n }\n ]", + "description": "Secret Manager secret group and access group configurations. If a prefix input variable is specified, it is added to the `access_group_name` value in the `-value` format. If you do not wish to create any groups, set the value to `[]`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md).", + "required": false, + "custom_config": { + "type": "code_editor", + "grouping": "deployment", + "original_grouping": "deployment" + } + }, + { + "key": "skip_secrets_manager_iam_auth_policy", + "display_name": "disable_secrets_manager_iam_credentials_engine", + "type": "boolean", + "default_value": false, + "description": "Whether to skip the creation of the IAM authorization policies required to enable the Secrets Manager IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service.", + "required": false + }, + { + "key": "enable_platform_metrics", + "type": "boolean", + "default_value": false, + "description": "Setting this to true will enable platform metrics for the Cloud Monitoring instance, including setting up a metrics routing route to the Cloud Monitoring instance. NOTE: You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location.", + "required": false + }, + { + "key": "logs_routing_tenant_regions", + "type": "array", + "default_value": [], + "description": "Pass a list of regions to create a tenant that is targeted to the Cloud Logs instance created by this solution. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "event_notifications_email_list", + "type": "array", + "default_value": [], + "description": "List of emails to configure event notifications.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_id", + "type": "string", + "default_value": "__NULL__", + "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", + "required": false + }, + { + "key": "enterprise_account_group_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_account_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_id", + "type": "string", + "default_value": "__NULL__", + "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", + "required": false + }, + { + "key": "enterprise_account_group_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_account_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "sample_app_git_url", + "type": "string", + "default_value": "https://github.com/IBM/gen-ai-rag-watsonx-sample-application", + "description": "The URL to the public git repository containing the sample RAG application code.", + "required": false + }, + { + "key": "existing_secrets_manager_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing secret manager instance to use in this solution. If not set, a new secret manager instance is provisioned.", + "required": false + }, + { + "key": "existing_kms_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing KMS instance to use in this solution. If not set, a new KP instance is provisioned.", + "required": false + }, + { + "key": "existing_event_notifications_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing event notification instance to use in this solution. If not set, a new event notification instance is provisioned.", + "required": false + }, + { + "key": "existing_discovery_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS discovery instance to use in this solution. If not set, a new discovery instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_assistant_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS assistant instance to use in this solution. If not set, a new assistant instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_governance_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS governance instance to use in this solution. If not set, a new governance instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_studio_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS studio instance to use in this solution. If not set, a new studio instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_machine_learning_instance", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing WatsonX SaaS machine learning instance to use in this solution. If not set, a new machine learning instance is provisioned depending on which plan is selected.", + "required": false + }, + { + "key": "existing_elasticsearch_instance_crn", + "type": "string", + "default_value": "__NULL__", + "description": "The CRN of an existing elasticsearch instance to use in this solution. If not set, a new elasticsearch instance is provisioned.", + "required": false + } + ], + "outputs": [ + { + "name": "cos_instance_crn", + "description": "Cloud Object Storage instance CRN" + }, + { + "name": "cos_instance_guid", + "description": "Cloud Object Storage instance GUID" + }, + { + "name": "cos_instance_name", + "description": "Cloud Object Storage instance name" + }, + { + "key": "elasticsearch_hostname", + "description": "The hostname of the Elasticsearch instance." + }, + { + "key": "elasticsearch_port", + "description": "The port of the Elasticsearch instance." + }, + { + "key": "elasticsearch_service_credentials_json", + "description": "The service credentials of the Elasticsearch instance." + }, + { + "key": "elasticsearch_crn", + "description": "The CRN of the Elasticsearch instance." + }, + { + "key": "watsonx_project_url", + "description": "The URL to the WatsonX project for the sample RAG application." + }, + { + "key": "watsonx_project_id", + "description": "The ID for the WatsonX project for the sample RAG application." + }, + { + "key": "watson_discovery_api_url", + "description": "The URL to the Watson Discovery API endpoint." + }, + { + "key": "watson_discovery_project_id", + "description": "The ID for the Watson Discovery project for the sample RAG application." + }, + { + "key": "kms_instance_crn", + "description": "The CRN of the Hyper Protect Crypto Service instance or Key Protect instance" + }, + { + "key": "kms_private_endpoint", + "description": "Key Management Service instance private endpoint URL." + }, + { + "key": "kms_public_endpoint", + "description": "Key Management Service instance public endpoint URL." + }, + { + "key": "event_notifications_instance_crn", + "description": "Event Notifications crn" + }, + { + "key": "event_notifications_instance_name", + "description": "Event Notifications name" + }, + { + "key": "event_notifications_instance_guid", + "description": "Event Notifications guid" + }, + { + "key": "cloud_logs_for_logging_crn", + "description": "The id of the provisioned IBM Cloud Logs for logging instance." + }, + { + "key": "cloud_logs_for_logging_guid", + "description": "The guid of the provisioned IBM Cloud Logs for logging instance." + }, + { + "key": "cloud_logs_for_activity_tracking_crn", + "description": "The id of the provisioned IBM Cloud Logs for activity tracking instance." + }, + { + "key": "cloud_logs_for_activity_tracking_guid", + "description": "The guid of the provisioned IBM Cloud Logs for activity tracking instance." + }, + { + "key": "cloud_monitoring_crn", + "description": "The id of the provisioned IBM cloud monitoring instance." + }, + { + "key": "cloud_monitoring_guid", + "description": "The guid of the provisioned IBM cloud monitoring instance." + }, + { + "key": "secrets_manager_crn", + "description": "CRN of the Secrets Manager instance" + }, + { + "key": "secrets_manager_guid", + "description": "GUID of Secrets Manager instance" + }, + { + "key": "secrets_manager_name", + "description": "Name of the Secrets Manager instance" + }, + { + "key": "app_config_crn", + "description": "CRN of the App Configuration instance" + }, + { + "key": "app_config_guid", + "description": "GUID of the App Configuration instance" + }, + { + "key": "scc_workload_protection_crn", + "description": "SCC Workload Protection instance CRN" + }, + { + "key": "scc_workload_protection_guid", + "description": "SCC Workload Protection instance ID" + }, + { + "key": "watson_discovery_crn", + "description": "The CRN of the Watson Discovery instance." + }, + { + "key": "watson_discovery_dashboard_url", + "description": "The dashboard URL of the Watson Discovery instance." + }, + { + "key": "watson_machine_learning_crn", + "description": "The CRN of the Watson Machine Learning instance." + }, + { + "key": "watson_machine_learning_dashboard_url", + "description": "The dashboard URL of the Watson Machine Learning instance." + }, + { + "key": "watson_machine_learning_guid", + "description": "The GUID of the Watson Machine Learning instance." + }, + { + "key": "watson_studio_crn", + "description": "The CRN of the Watson Studio instance." + }, + { + "key": "watson_studio_dashboard_url", + "description": "The dashboard URL of the Watson Studio instance." + }, + { + "key": "watson_studio_guid", + "description": "The GUID of the Watson Studio instance." + }, + { + "key": "watsonx_assistant_crn", + "description": "The CRN of the watsonx Assistant instance." + }, + { + "key": "watsonx_assistant_dashboard_url", + "description": "The dashboard URL of the watsonx Assistant instance." + }, + { + "key": "watsonx_data_crn", + "description": "The CRN of the watsonx.data instance." + }, + { + "key": "watsonx_data_dashboard_url", + "description": "The dashboard URL of the watsonx.data instance." + }, + { + "key": "watsonx_data_guid", + "description": "The GUID of the watsonx.data instance." + }, + { + "key": "watson_discovery_guid", + "description": "The GUID of the Watson Discovery instance." + }, + { + "key": "workload_cluster_name", + "description": "The name of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." + }, + { + "key": "workload_cluster_id", + "description": "The id of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." + }, + { + "key": "workload_cluster_private_service_endpoint_url", + "description": "The private service endpoint URL of the Workload cluster, if not then null." + }, + { + "key": "workload_cluster_public_service_endpoint_url", + "description": "The public service endpoint URL of the Workload cluster, if not then null." + } + ], + "install_type": "fullstack" } ] } diff --git a/solutions/standard-2/catalogValidationValues.json.template b/solutions/standard-2/catalogValidationValues.json.template new file mode 100644 index 00000000..2d3d4bf2 --- /dev/null +++ b/solutions/standard-2/catalogValidationValues.json.template @@ -0,0 +1,4 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY, + "prefix": $PREFIX +} diff --git a/solutions/standard-2/stack_definition.json b/solutions/standard-2/stack_definition.json new file mode 100644 index 00000000..94b1a6cb --- /dev/null +++ b/solutions/standard-2/stack_definition.json @@ -0,0 +1,1021 @@ +{ + "inputs": [ + { + "name": "prefix", + "required": true, + "type": "string", + "hidden": false + }, + { + "name": "secrets_manager_service_plan", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "key_protect_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "cloud_monitoring_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "skip_secrets_manager_iam_auth_policy", + "required": false, + "type": "boolean", + "hidden": false + }, + { + "name": "watsonx_admin_api_key", + "required": false, + "type": "password", + "hidden": false + }, + { + "name": "resource_group_name", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_resource_group_name", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "region", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "secrets_manager_secret_groups", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "existing_secrets_manager_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "event_notifications_email_list", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "existing_kms_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_event_notifications_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "enable_platform_metrics", + "required": false, + "type": "boolean", + "hidden": false + }, + { + "name": "logs_routing_tenant_regions", + "required": false, + "type": "array", + "hidden": false + }, + { + "name": "scc_workload_protection_service_plan", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_id", + "required": false, + "type": "string", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_account_group_ids_to_assign", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "enterprise_account_ids_to_assign", + "required": false, + "type": "array", + "hidden": false, + "custom_config": {} + }, + { + "name": "existing_discovery_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_assistant_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_governance_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_studio_instance_crn", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_machine_learning_instance", + "required": false, + "type": "string", + "hidden": false + }, + { + "name": "existing_elasticsearch_instance_crn", + "required": false, + "type": "string", + "hidden": false + } + ], + "members": [ + { + "name": "1 - Account Configuration", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.0e456e60-9ca9-4e9e-8f28-6265f8a12f97-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "single_resource_group_name", + "value": "ref:../../inputs/existing_resource_group_name" + }, + { + "name": "security_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "audit_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "observability_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "management_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "workload_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "edge_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "devops_resource_group_name", + "value": "ref:../../inputs/resource_group_name" + }, + { + "name": "provision_trusted_profile_projects", + "value": false + } + ] + }, + { + "name": "2a - Essential Security - Encryption Key Management", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.fbb4dc92-6318-4f20-afc9-65cc586ac241-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/security_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../../inputs/existing_kms_instance_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "key_protect_plan", + "value": "ref:../../inputs/key_protect_plan" + } + ] + }, + { + "name": "2b - Essential Security - Cloud Object Storage", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.6433c58f-9e1b-4520-ae52-5ab4f4559cf9-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + } + ] + }, + { + "name": "2c - Essential Security - Cloud Monitoring", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.4c21c293-3f7d-454b-97bc-9808aee58bfe-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "enable_platform_metrics", + "value": "ref:../../inputs/enable_platform_metrics" + }, + { + "name": "enable_metrics_routing_to_cloud_monitoring", + "value": "ref:../../inputs/enable_platform_metrics" + }, + { + "name": "cloud_monitoring_plan", + "value": "ref:../../inputs/cloud_monitoring_plan" + } + ] + }, + { + "name": "3a - Essential Security - Event Notifications", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.29f017cd-7a6f-45cc-a4ed-5f23505380bf-global", + "inputs": [ + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "enable_collecting_failed_events", + "value": true + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "kms_endpoint_url", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../../inputs/existing_event_notifications_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + } + ] + }, + { + "name": "3b - Gen AI - WatsonX SaaS services", + "version_locator": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc.63f85fe2-082f-44fa-add2-6a0f93d130e8-global", + "inputs": [ + { + "name": "watsonx_admin_api_key", + "value": "ref:../../inputs/watsonx_admin_api_key" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "watson_machine_learning_plan", + "value": "v2-standard" + }, + { + "name": "existing_machine_learning_instance", + "value": "ref:../../inputs/existing_machine_learning_instance" + }, + { + "name": "watson_studio_plan", + "value": "professional-v1" + }, + { + "name": "existing_studio_instance", + "value": "ref:../../inputs/existing_studio_instance_crn" + }, + { + "name": "watson_discovery_plan", + "value": "do not install" + }, + { + "name": "existing_discovery_instance", + "value": "ref:../../inputs/existing_discovery_instance_crn" + }, + { + "name": "watsonx_assistant_plan", + "value": "plus" + }, + { + "name": "existing_assistant_instance", + "value": "ref:../../inputs/existing_assistant_instance_crn" + }, + { + "name": "watsonx_governance_plan", + "value": "do not install" + }, + { + "name": "existing_governance_instance", + "value": "ref:../../inputs/existing_governance_instance_crn" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "cos_kms_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "enable_cos_kms_encryption", + "value": true + } + ] + }, + { + "name": "3c - Workload - Compute Red Hat OpenShift Container Platform on VPC", + "version_locator": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc.cb341280-efa5-4bdf-8976-cea6ea62c3a4-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "vpcs", + "value": [ + "management", + "workload" + ] + }, + { + "name": "ignore_vpcs_for_cluster_deployment", + "value": [ + "management" + ] + }, + { + "name": "enable_transit_gateway", + "value": false + }, + { + "name": "add_atracker_route", + "value": false + }, + { + "name": "existing_kms_instance_name", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/key_protect_name" + }, + { + "name": "existing_kms_resource_group", + "value": "ref:../1 - Account Configuration/outputs/security_resource_group_name" + }, + { + "name": "existing_kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_cos_instance_name", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" + }, + { + "name": "existing_cos_resource_group", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/resource_group_name" + }, + { + "name": "use_existing_cos_for_vpc_flowlogs", + "value": true + }, + { + "name": "cluster_zones", + "value": "2" + }, + { + "name": "flavor", + "value": "bx2.4x16" + }, + { + "name": "workers_per_zone", + "value": 1 + } + ] + }, + { + "name": "4a - Essential Security - Cloud Logs for logging", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.b6bf9a7b-6ac3-4821-b3e4-f274293603f3-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instances", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn_list_object" + }, + { + "name": "logs_routing_tenant_regions", + "value": "ref:../../inputs/logs_routing_tenant_regions" + } + ] + }, + { + "name": "4b - Essential Security - App Configuration", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.bff2dc4d-9e19-4b2c-8890-4cda020ce39e-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/audit_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "app_config_service_plan", + "value": "enterprise" + }, + { + "name": "enable_config_aggregator", + "value": true + }, + { + "name": "config_aggregator_enterprise_id", + "value": "ref:../../inputs/enterprise_id" + }, + { + "name": "config_aggregator_enterprise_account_group_ids_to_assign", + "value": "ref:../../inputs/enterprise_account_group_ids_to_assign" + }, + { + "name": "config_aggregator_enterprise_account_ids_to_assign", + "value": "ref:../../inputs/enterprise_account_ids_to_assign" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_url", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "enable_event_notifications", + "value": true + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn" + }, + { + "name": "event_notifications_endpoint_url", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/event_notifications_private_endpoint" + }, + { + "name": "event_notifications_email_list", + "value": "ref:../../inputs/event_notifications_email_list" + } + ] + }, + { + "name": "4c - Essential Security - Secrets Manager", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.c7ba4599-f65a-4a9b-bd6b-120e52947652-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/security_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_secrets_manager_crn", + "value": "ref:../../inputs/existing_secrets_manager_crn" + }, + { + "name": "skip_secrets_manager_iam_auth_policy", + "value": "ref:../../inputs/skip_secrets_manager_iam_auth_policy" + }, + { + "name": "service_plan", + "value": "ref:../../inputs/secrets_manager_service_plan" + }, + { + "name": "secret_groups", + "value": "ref:../../inputs/secrets_manager_secret_groups" + }, + { + "name": "existing_event_notifications_instance_crn", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn" + } + ] + }, + { + "name": "4d - Essential Security - Cloud Logs for activity tracking", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.b6bf9a7b-6ac3-4821-b3e4-f274293603f3-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/observability_resource_group_name" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_event_notifications_instances", + "value": "ref:../3a - Essential Security - Event Notifications/outputs/crn_list_object" + }, + { + "name": "logs_routing_tenant_regions", + "value": "ref:../../inputs/logs_routing_tenant_regions" + }, + { + "name": "cloud_logs_data_cos_bucket_name", + "value": "at-cloud-logs-logs-bucket" + }, + { + "name": "cloud_logs_metrics_cos_bucket_name", + "value": "at-cloud-logs-metrics-bucket" + }, + { + "name": "cloud_logs_instance_name", + "value": "at-cloud-logs" + } + ] + }, + { + "name": "5a - Essential Security - Security and Compliance Center Workload Protection", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.e543e47d-1b78-4415-963c-3c59fcf5ef2b-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/audit_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "scc_workload_protection_service_plan", + "value": "ref:../../inputs/scc_workload_protection_service_plan" + }, + { + "name": "cspm_enabled", + "value": true + }, + { + "name": "app_config_crn", + "value": "ref:../4b - Essential Security - App Configuration/outputs/app_config_crn" + }, + { + "name": "existing_monitoring_crn", + "value": "ref:../2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + } + ] + }, + { + "name": "5b - Gen AI - Databases for Elasticsearch", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.2a25caea-0f63-4911-a5fb-c1ef792edea0-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "deletion_protection", + "value": false + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "plan", + "value": "enterprise" + }, + { + "name": "elasticsearch_version", + "value": "8.15" + }, + { + "name": "kms_encryption_enabled", + "value": true + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "member_host_flavor", + "value": "multitenant" + }, + { + "name": "member_cpu_count", + "value": 0 + }, + { + "name": "service_credential_names", + "value": { + "elastic_db_admin": "Administrator", + "wxasst_db_user": "Editor", + "toolchain_db_user": "Editor" + } + }, + { + "name": "existing_elasticsearch_instance_crn", + "value": "ref:../../inputs/existing_elasticsearch_instance_crn" + }, + { + "name": "existing_secrets_manager_instance_crn", + "value": "ref:../4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" + } + ] + }, + { + "name": "5c - Essential Security - Activity Tracker Event Routing", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.1d61413e-c149-4a3a-bd6d-9207e0c60385-global", + "inputs": [ + { + "name": "region", + "value": "ref:../../inputs/region" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "existing_kms_instance_crn", + "value": "ref:../2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_encryption_enabled_buckets", + "value": true + }, + { + "name": "kms_endpoint_type", + "value": "private" + }, + { + "name": "existing_cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "existing_cloud_logs_instance_crn", + "value": "ref:../4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + }, + { + "name": "enable_activity_tracker_event_routing_to_cos_bucket", + "value": true + } + ] + } + ], + "outputs": [ + { + "name": "kms_instance_crn", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" + }, + { + "name": "kms_private_endpoint", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_private_endpoint" + }, + { + "name": "kms_public_endpoint", + "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_public_endpoint" + }, + { + "name": "cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + }, + { + "name": "cos_instance_guid", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" + }, + { + "name": "cos_instance_name", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" + }, + { + "name": "cloud_monitoring_crn", + "value": "ref:./members/2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_crn" + }, + { + "name": "cloud_monitoring_guid", + "value": "ref:./members/2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_guid" + }, + { + "name": "event_notifications_instance_crn", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/crn" + }, + { + "name": "event_notifications_instance_name", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/event_notification_instance_name" + }, + { + "name": "event_notifications_instance_guid", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/guid" + }, + { + "name": "watsonx_project_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_project_url" + }, + { + "name": "watsonx_project_id", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_project_id" + }, + { + "name": "watson_discovery_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_crn" + }, + { + "name": "watson_discovery_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_dashboard_url" + }, + { + "name": "watson_machine_learning_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_crn" + }, + { + "name": "watson_machine_learning_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_dashboard_url" + }, + { + "name": "watson_machine_learning_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_machine_learning_guid" + }, + { + "name": "watson_studio_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_crn" + }, + { + "name": "watson_studio_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_dashboard_url" + }, + { + "name": "watson_studio_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_studio_guid" + }, + { + "name": "watsonx_assistant_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_assistant_crn" + }, + { + "name": "watsonx_assistant_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_assistant_dashboard_url" + }, + { + "name": "watsonx_data_crn", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_crn" + }, + { + "name": "watsonx_data_dashboard_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_dashboard_url" + }, + { + "name": "watsonx_data_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_data_guid" + }, + { + "name": "watson_discovery_guid", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_guid" + }, + { + "name": "workload_cluster_name", + "value": "ref:./members/3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_cluster_name" + }, + { + "name": "workload_cluster_id", + "value": "ref:./members/3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_cluster_id" + }, + { + "name": "workload_cluster_private_service_endpoint_url", + "value": "ref:./members/3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_cluster_private_service_endpoint_url" + }, + { + "name": "workload_cluster_public_service_endpoint_url", + "value": "ref:./members/3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_cluster_public_service_endpoint_url" + }, + { + "name": "cloud_logs_for_logging_crn", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_logging_guid", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_guid" + }, + { + "name": "app_config_crn", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_crn" + }, + { + "name": "app_config_guid", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_guid" + }, + { + "name": "secrets_manager_crn", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" + }, + { + "name": "secrets_manager_guid", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_guid" + }, + { + "name": "secrets_manager_name", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_name" + }, + { + "name": "cloud_logs_for_activity_tracking_crn", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_activity_tracking_guid", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_guid" + }, + { + "name": "scc_workload_protection_crn", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_crn" + }, + { + "name": "scc_workload_protection_guid", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_id" + }, + { + "name": "elasticsearch_hostname", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/hostname" + }, + { + "name": "elasticsearch_port", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/port" + }, + { + "name": "elasticsearch_service_credentials_json", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/service_credentials_json" + }, + { + "name": "elasticsearch_crn", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/crn" + } + ] +} From 0caba2ccc96c0f8f9d2bda945ef5dffbe7797359 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 11 Nov 2025 12:01:43 +0530 Subject: [PATCH 04/16] added watsonx project output in basic-2 --- solutions/basic-2/stack_definition.json | 144 +++++++++++++----------- 1 file changed, 76 insertions(+), 68 deletions(-) diff --git a/solutions/basic-2/stack_definition.json b/solutions/basic-2/stack_definition.json index 19f505a8..f91d2853 100644 --- a/solutions/basic-2/stack_definition.json +++ b/solutions/basic-2/stack_definition.json @@ -761,34 +761,6 @@ } ], "outputs": [ - { - "name": "cos_instance_crn", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" - }, - { - "name": "cos_instance_guid", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" - }, - { - "name": "cos_instance_name", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" - }, - { - "name": "elasticsearch_hostname", - "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/hostname" - }, - { - "name": "elasticsearch_port", - "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/port" - }, - { - "name": "elasticsearch_service_credentials_json", - "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/service_credentials_json" - }, - { - "name": "elasticsearch_crn", - "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/crn" - }, { "name": "kms_instance_crn", "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_instance_crn" @@ -802,32 +774,16 @@ "value": "ref:./members/2a - Essential Security - Encryption Key Management/outputs/kms_public_endpoint" }, { - "name": "event_notifications_instance_crn", - "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/crn" - }, - { - "name": "event_notifications_instance_name", - "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/event_notification_instance_name" - }, - { - "name": "event_notifications_instance_guid", - "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/guid" - }, - { - "name": "cloud_logs_for_logging_crn", - "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_crn" - }, - { - "name": "cloud_logs_for_logging_guid", - "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_guid" + "name": "cos_instance_crn", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" }, { - "name": "cloud_logs_for_activity_tracking_crn", - "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + "name": "cos_instance_guid", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" }, { - "name": "cloud_logs_for_activity_tracking_guid", - "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_guid" + "name": "cos_instance_name", + "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" }, { "name": "cloud_monitoring_crn", @@ -838,32 +794,24 @@ "value": "ref:./members/2c - Essential Security - Cloud Monitoring/outputs/cloud_monitoring_guid" }, { - "name": "secrets_manager_crn", - "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" - }, - { - "name": "secrets_manager_guid", - "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_guid" - }, - { - "name": "secrets_manager_name", - "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_name" + "name": "event_notifications_instance_crn", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/crn" }, { - "name": "app_config_crn", - "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_crn" + "name": "event_notifications_instance_name", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/event_notification_instance_name" }, { - "name": "app_config_guid", - "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_guid" + "name": "event_notifications_instance_guid", + "value": "ref:./members/3a - Essential Security - Event Notifications/outputs/guid" }, { - "name": "scc_workload_protection_crn", - "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_crn" + "name": "watsonx_project_url", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_project_url" }, { - "name": "scc_workload_protection_id", - "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_id" + "name": "watsonx_project_id", + "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watsonx_project_id" }, { "name": "watson_discovery_crn", @@ -920,6 +868,66 @@ { "name": "watson_discovery_guid", "value": "ref:./members/3b - Gen AI - WatsonX SaaS services/outputs/watson_discovery_guid" + }, + { + "name": "cloud_logs_for_logging_crn", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_logging_guid", + "value": "ref:./members/4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_guid" + }, + { + "name": "app_config_crn", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_crn" + }, + { + "name": "app_config_guid", + "value": "ref:./members/4b - Essential Security - App Configuration/outputs/app_config_guid" + }, + { + "name": "secrets_manager_crn", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_crn" + }, + { + "name": "secrets_manager_guid", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_guid" + }, + { + "name": "secrets_manager_name", + "value": "ref:./members/4c - Essential Security - Secrets Manager/outputs/secrets_manager_name" + }, + { + "name": "cloud_logs_for_activity_tracking_crn", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_crn" + }, + { + "name": "cloud_logs_for_activity_tracking_guid", + "value": "ref:./members/4d - Essential Security - Cloud Logs for activity tracking/outputs/cloud_logs_guid" + }, + { + "name": "scc_workload_protection_crn", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_crn" + }, + { + "name": "scc_workload_protection_id", + "value": "ref:./members/5a - Essential Security - Security and Compliance Center Workload Protection/outputs/scc_workload_protection_id" + }, + { + "name": "elasticsearch_hostname", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/hostname" + }, + { + "name": "elasticsearch_port", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/port" + }, + { + "name": "elasticsearch_service_credentials_json", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/service_credentials_json" + }, + { + "name": "elasticsearch_crn", + "value": "ref:./members/5b - Gen AI - Databases for Elasticsearch/outputs/crn" } ] } From 08017baaba1717cce68dbb0bc91f51c209993a18 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 11 Nov 2025 12:23:36 +0530 Subject: [PATCH 05/16] updated rag stack diagram --- ibm_catalog.json | 8 ++++---- reference-architectures/rag-stack-without-app-and-alm.svg | 4 ++++ 2 files changed, 8 insertions(+), 4 deletions(-) create mode 100644 reference-architectures/rag-stack-without-app-and-alm.svg diff --git a/ibm_catalog.json b/ibm_catalog.json index 427593fd..dd73088a 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -767,10 +767,10 @@ }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" }, "description": "Solution components" } @@ -2055,10 +2055,10 @@ }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" }, "description": "Solution components" } diff --git a/reference-architectures/rag-stack-without-app-and-alm.svg b/reference-architectures/rag-stack-without-app-and-alm.svg new file mode 100644 index 00000000..52ae651e --- /dev/null +++ b/reference-architectures/rag-stack-without-app-and-alm.svg @@ -0,0 +1,4 @@ + + + + \ No newline at end of file From 0973a44f9ba6a64dea34efe45c3e9def7000bd20 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 18 Nov 2025 11:14:12 +0530 Subject: [PATCH 06/16] updated diagram --- reference-architectures/rag-stack-without-app-and-alm.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/rag-stack-without-app-and-alm.svg b/reference-architectures/rag-stack-without-app-and-alm.svg index 52ae651e..bde6addb 100644 --- a/reference-architectures/rag-stack-without-app-and-alm.svg +++ b/reference-architectures/rag-stack-without-app-and-alm.svg @@ -1,4 +1,4 @@ - \ No newline at end of file +
Account Structure
watsonx.ai
watsonx.data
watsonx.governance
Watson Discovery
watsonx Assistant / 
Security and Compliance Center - Workload Protection
Key Protect
Secrets Manager
Object Storage
Monitoring
Logging
Event Notifications
Code Engine
Red Hat Openshift (ROKS)
Elasticsearch
Orchestrate
 \ No newline at end of file From 6ffbb3d47a7d130b8e02074e2b145b7a97ed8b80 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 18 Nov 2025 12:07:43 +0530 Subject: [PATCH 07/16] updated catalog.json --- README.md | 18 +- ibm_catalog.json | 712 +++++++++++++++++++++++------------------------ 2 files changed, 363 insertions(+), 367 deletions(-) diff --git a/README.md b/README.md index 150cd123..4718252c 100644 --- a/README.md +++ b/README.md @@ -6,23 +6,31 @@ This deployable architecture provides a comprehensive foundation for trust, obse ## Variations -Two variations are available for this deployable architecture: -1. Basic variation: +Although four but primarily two variations are available for this deployable architecture: + +1. Basic variation - With sample application: - Code Engine Project: Provisions a Code Engine project, providing a fully managed platform for containerized applications. - Application Deployment: Deploys the application on the provisioned Code Engine project. - Elasticsearch Enterprise: Provisions an Elasticsearch [enterprise](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elastic-offerings) instance for search and analytics capabilities. -2. Standard variation: +2. Basic variation - Without sample application: + - Code Engine Project: Provisions a Code Engine project, providing a fully managed platform for containerized applications. + - Elasticsearch Enterprise: Provisions an Elasticsearch [enterprise](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elastic-offerings) instance for search and analytics capabilities. + +3. Standard variation - With sample application: - IBM Cloud OpenShift Cluster: Provisions an [IBM Cloud OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-overview) - VPC Network Infrastructure: Sets up the underlying VPC network infrastructure to support the OpenShift cluster. - Application Deployment: Deploys the application on the provisioned OpenShift cluster. - ElasticSearch Platinum Plan: Leverages the platinum plan of ElasticSearch, which includes the [ELSER](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elser-embeddings-elasticsearch) model for advanced vector generation capabilities. - +4. Standard variation - Without sample application: + - IBM Cloud OpenShift Cluster: Provisions an [IBM Cloud OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-overview) + - VPC Network Infrastructure: Sets up the underlying VPC network infrastructure to support the OpenShift cluster. + - ElasticSearch Platinum Plan: Leverages the platinum plan of ElasticSearch, which includes the [ELSER](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elser-embeddings-elasticsearch) model for advanced vector generation capabilities. ## Objective and benefits -This deployable architecture is designed to showcase a fully automated deployment of a retrieval augmented generation application through IBM Cloud Projects. It provides a flexible and customizable foundation for your own watsonx applications on IBM Cloud. This architecture deploys the following [sample application](https://github.com/IBM/gen-ai-rag-watsonx-sample-application) by default. +This deployable architecture is designed to showcase a fully automated deployment of a retrieval augmented generation application through IBM Cloud Projects. It provides a flexible and customizable foundation for your own watsonx applications on IBM Cloud. This architecture deploys the following [sample application](https://github.com/IBM/gen-ai-rag-watsonx-sample-application) by default for the variations that allow provisioning sample application. By using this architecture, you can accelerate your deployment and tailor it to meet your business needs and enterprise goals. diff --git a/ibm_catalog.json b/ibm_catalog.json index 1ebc3d18..f42fa450 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -66,6 +66,7 @@ "label": "Basic with sample application (Deploy on Code Engine)", "name": "basic", "index": 1, + "short_description": "Ideal for Code Engine users who want serverless simplicity with a reliable starting point.", "working_directory": "solutions/basic", "ignore_readme": true, "dependency_version_2": true, @@ -603,20 +604,13 @@ "install_type": "fullstack" }, { - "label": "Basic without sample application (Deploy on Code Engine)", - "name": "basic-without-app", + "label": "Standard with sample application (Deploy on Red Hat OpenShift)", + "name": "standard", "index": 2, - "working_directory": "solutions/basic-2", + "short_description": "Ideal for Red Hat OpenShift users who want enterprise‑grade flexibility with a reliable starting point.", + "working_directory": "solutions/standard", "ignore_readme": true, - "compliance": { - "authority": "scc-v3", - "profiles": [ - { - "profile_name": "AI Security Guardrails 2.0", - "profile_version": "1.1.0" - } - ] - }, + "dependency_version_2": true, "iam_permissions": [ { "service_name": "iam-groups", @@ -633,7 +627,8 @@ }, { "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], "service_name": "iam-identity" }, @@ -710,10 +705,15 @@ }, { "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Writer", - "crn:v1:bluemix:public:iam::::role:Editor" + "crn:v1:bluemix:public:iam::::role:Administrator" ], - "service_name": "codeengine" + "service_name": "containers-kubernetes" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "is.vpc" } ], "architecture": { @@ -723,11 +723,19 @@ "description": "Enables:" }, { - "title": "1. Code Engine for containerized and serverless workloads", + "title": "1. Red Hat OpenShift cluster for microservices workloads", "description": " " }, { - "title": "2. Elasticsearch Enterprise for building and storing dense vector indexes or keyword search indexes", + "title": "2. Elasticsearch Platinum for building and storing sparse vectors, dense vector indexes or keyword search indexes", + "description": " " + }, + { + "title": "i. watsonx.ai use of Elasticsearch ELSER2 vector index for RAG", + "description": " " + }, + { + "title": "ii. watsonx Assistant Conversational Search with UI feature for uploading documents to create or use Elasticsearch ELSER2 vector index for RAG", "description": " " }, { @@ -745,6 +753,10 @@ { "title": "6. watsonx Assistant Conversational Search with embedded LLM", "description": " " + }, + { + "title": "7. Build your own data processing, ingestion pipeline and indexes", + "description": " " } ], "diagrams": [ @@ -759,10 +771,10 @@ }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" }, "description": "Solution components" } @@ -792,6 +804,18 @@ "description": "The API Key used to provision all resources created in this solution.", "required": true }, + { + "key": "signing_key", + "type": "password", + "description": "The key used to sign the application image built by the CI pipeline deployed in this solution; please refer to the documentation at https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/blob/main/README.md for generating the key; if not set, all resources will deploy successfully, but the initial CI pipeline execution will fail at the signing step.", + "default_value": "replace", + "required": false, + "custom_config": { + "type": "multiline_secure_value", + "grouping": "deployment", + "original_grouping": "deployment" + } + }, { "key": "region", "type": "string", @@ -829,14 +853,14 @@ "key": "resource_group_name", "type": "string", "default_value": "rag-services", - "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", + "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", "required": false }, { "key": "existing_resource_group_name", "type": "string", "default_value": "__NULL__", - "description": "The name of an existing resource group that is used by this solution, takes precedence over `resource_group_name`. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", + "description": "The name of an existing resource group that is used by this solution, takes precedence over resource_group_name. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", "required": false, "custom_config": { "type": "resource_group", @@ -856,7 +880,7 @@ { "key": "secrets_manager_service_plan", "type": "string", - "default_value": "trial", + "default_value": "standard", "description": "The service/pricing plan to use when provisioning a new Secrets Manager instance. Only one trial instance is allowed per account.", "required": false, "options": [ @@ -1015,6 +1039,52 @@ } } }, + { + "key": "enterprise_id", + "type": "string", + "default_value": "__NULL__", + "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", + "required": false + }, + { + "key": "enterprise_account_group_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enterprise_account_ids_to_assign", + "type": "array", + "default_value": [ + "all" + ], + "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", + "required": false, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "sample_app_git_url", + "type": "string", + "default_value": "https://github.com/IBM/gen-ai-rag-watsonx-sample-application", + "description": "The URL to the public git repository containing the sample RAG application code.", + "required": false + }, { "key": "existing_secrets_manager_crn", "type": "string", @@ -1123,162 +1193,293 @@ { "key": "watson_discovery_project_id", "description": "The ID for the Watson Discovery project for the sample RAG application." - } - ], - "install_type": "fullstack" - }, - { - "label": "Standard with sample application (Deploy on Red Hat OpenShift)", - "name": "standard", - "index": 3, - "working_directory": "solutions/standard", - "ignore_readme": true, - "dependency_version_2": true, - "iam_permissions": [ + }, { - "service_name": "iam-groups", - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ] + "key": "kms_instance_crn", + "description": "The CRN of the Hyper Protect Crypto Service instance or Key Protect instance" }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "cloud-object-storage" + "key": "kms_private_endpoint", + "description": "Key Management Service instance private endpoint URL." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator", - "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" - ], - "service_name": "iam-identity" + "key": "kms_public_endpoint", + "description": "Key Management Service instance public endpoint URL." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Writer", - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "service_name": "atracker" + "key": "event_notifications_instance_crn", + "description": "Event Notifications crn" }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "kms" + "key": "event_notifications_instance_name", + "description": "Event Notifications name" }, { - "service_name": "sysdig-secure", - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ] + "key": "event_notifications_instance_guid", + "description": "Event Notifications guid" }, { - "service_name": "apprapp", - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ] + "key": "cloud_logs_for_logging_crn", + "description": "The id of the provisioned IBM Cloud Logs for logging instance." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "pm-20" + "key": "cloud_logs_for_logging_guid", + "description": "The guid of the provisioned IBM Cloud Logs for logging instance." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "data-science-experience" + "key": "cloud_logs_for_activity_tracking_crn", + "description": "The id of the provisioned IBM Cloud Logs for activity tracking instance." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "aiopenscale" + "key": "cloud_logs_for_activity_tracking_guid", + "description": "The guid of the provisioned IBM Cloud Logs for activity tracking instance." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "conversation" + "key": "cloud_monitoring_crn", + "description": "The id of the provisioned IBM cloud monitoring instance." }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "discovery" + "key": "cloud_monitoring_guid", + "description": "The guid of the provisioned IBM cloud monitoring instance." }, { - "service_name": "databases-for-elasticsearch", - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ] + "key": "secrets_manager_crn", + "description": "CRN of the Secrets Manager instance" }, { - "service_name": "event-notifications", - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ] + "key": "secrets_manager_guid", + "description": "GUID of Secrets Manager instance" }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "service_name": "containers-kubernetes" + "key": "secrets_manager_name", + "description": "Name of the Secrets Manager instance" }, { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "service_name": "is.vpc" - } - ], - "architecture": { - "features": [ - { - "title": " ", - "description": "Enables:" - }, - { - "title": "1. Red Hat OpenShift cluster for microservices workloads", - "description": " " - }, - { - "title": "2. Elasticsearch Platinum for building and storing sparse vectors, dense vector indexes or keyword search indexes", - "description": " " - }, - { - "title": "i. watsonx.ai use of Elasticsearch ELSER2 vector index for RAG", - "description": " " - }, - { - "title": "ii. watsonx Assistant Conversational Search with UI feature for uploading documents to create or use Elasticsearch ELSER2 vector index for RAG", - "description": " " - }, - { - "title": "3. watsonx.ai in-memory vector store for RAG trial and exploration", - "description": " " - }, - { - "title": "4. watsonx.ai UI to upload documents", - "description": " " - }, - { - "title": "5. watsonx.ai Prompt Lab for inferencing and Prompt Templates", + "key": "app_config_crn", + "description": "CRN of the App Configuration instance" + }, + { + "key": "app_config_guid", + "description": "GUID of the App Configuration instance" + }, + { + "key": "scc_workload_protection_crn", + "description": "SCC Workload Protection instance CRN" + }, + { + "key": "scc_workload_protection_guid", + "description": "SCC Workload Protection instance ID" + }, + { + "key": "watson_discovery_crn", + "description": "The CRN of the Watson Discovery instance." + }, + { + "key": "watson_discovery_dashboard_url", + "description": "The dashboard URL of the Watson Discovery instance." + }, + { + "key": "watson_machine_learning_crn", + "description": "The CRN of the Watson Machine Learning instance." + }, + { + "key": "watson_machine_learning_dashboard_url", + "description": "The dashboard URL of the Watson Machine Learning instance." + }, + { + "key": "watson_machine_learning_guid", + "description": "The GUID of the Watson Machine Learning instance." + }, + { + "key": "watson_studio_crn", + "description": "The CRN of the Watson Studio instance." + }, + { + "key": "watson_studio_dashboard_url", + "description": "The dashboard URL of the Watson Studio instance." + }, + { + "key": "watson_studio_guid", + "description": "The GUID of the Watson Studio instance." + }, + { + "key": "watsonx_assistant_crn", + "description": "The CRN of the watsonx Assistant instance." + }, + { + "key": "watsonx_assistant_dashboard_url", + "description": "The dashboard URL of the watsonx Assistant instance." + }, + { + "key": "watsonx_data_crn", + "description": "The CRN of the watsonx.data instance." + }, + { + "key": "watsonx_data_dashboard_url", + "description": "The dashboard URL of the watsonx.data instance." + }, + { + "key": "watsonx_data_guid", + "description": "The GUID of the watsonx.data instance." + }, + { + "key": "watson_discovery_guid", + "description": "The GUID of the Watson Discovery instance." + }, + { + "key": "workload_cluster_name", + "description": "The name of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." + }, + { + "key": "workload_cluster_id", + "description": "The id of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." + }, + { + "key": "workload_cluster_private_service_endpoint_url", + "description": "The private service endpoint URL of the Workload cluster, if not then null." + }, + { + "key": "workload_cluster_public_service_endpoint_url", + "description": "The public service endpoint URL of the Workload cluster, if not then null." + } + ], + "install_type": "fullstack" + }, + { + "label": "Basic without sample application (Deploy on Code Engine)", + "name": "basic-without-app", + "index": 3, + "short_description": "Ideal for Code Engine users who want serverless simplicity with a reliable starting point.", + "working_directory": "solutions/basic-2", + "ignore_readme": true, + "dependency_version_2": true, + "iam_permissions": [ + { + "service_name": "iam-groups", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "cloud-object-storage" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "iam-identity" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "atracker" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms" + }, + { + "service_name": "sysdig-secure", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "apprapp", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "pm-20" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "data-science-experience" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "aiopenscale" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "conversation" + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "discovery" + }, + { + "service_name": "databases-for-elasticsearch", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "event-notifications", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "codeengine" + } + ], + "architecture": { + "features": [ + { + "title": " ", + "description": "Enables:" + }, + { + "title": "1. Code Engine for containerized and serverless workloads", "description": " " }, { - "title": "6. watsonx Assistant Conversational Search with embedded LLM", + "title": "2. Elasticsearch Enterprise for building and storing dense vector indexes or keyword search indexes", "description": " " }, { - "title": "7. Build your own data processing, ingestion pipeline and indexes", + "title": "3. watsonx.ai in-memory vector store for RAG trial and exploration", + "description": " " + }, + { + "title": "4. watsonx.ai UI to upload documents", + "description": " " + }, + { + "title": "5. watsonx.ai Prompt Lab for inferencing and Prompt Templates", + "description": " " + }, + { + "title": "6. watsonx Assistant Conversational Search with embedded LLM", "description": " " } ], @@ -1294,10 +1495,10 @@ }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" }, "description": "Solution components" } @@ -1327,18 +1528,6 @@ "description": "The API Key used to provision all resources created in this solution.", "required": true }, - { - "key": "signing_key", - "type": "password", - "description": "The key used to sign the application image built by the CI pipeline deployed in this solution; please refer to the documentation at https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/blob/main/README.md for generating the key; if not set, all resources will deploy successfully, but the initial CI pipeline execution will fail at the signing step.", - "default_value": "replace", - "required": false, - "custom_config": { - "type": "multiline_secure_value", - "grouping": "deployment", - "original_grouping": "deployment" - } - }, { "key": "region", "type": "string", @@ -1376,14 +1565,14 @@ "key": "resource_group_name", "type": "string", "default_value": "rag-services", - "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", + "description": "The name of the resource group that is created by this solution. The actual name is prefixed with the value of the input 'prefix'. All resources created by this solution are deployed in this resource group.", "required": false }, { "key": "existing_resource_group_name", "type": "string", "default_value": "__NULL__", - "description": "The name of an existing resource group that is used by this solution, takes precedence over resource_group_name. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", + "description": "The name of an existing resource group that is used by this solution, takes precedence over `resource_group_name`. Prefix is NOT used for existing resource group. All resources created by this solution are deployed in this resource group.", "required": false, "custom_config": { "type": "resource_group", @@ -1403,7 +1592,7 @@ { "key": "secrets_manager_service_plan", "type": "string", - "default_value": "standard", + "default_value": "trial", "description": "The service/pricing plan to use when provisioning a new Secrets Manager instance. Only one trial instance is allowed per account.", "required": false, "options": [ @@ -1562,52 +1751,6 @@ } } }, - { - "key": "enterprise_id", - "type": "string", - "default_value": "__NULL__", - "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", - "required": false - }, - { - "key": "enterprise_account_group_ids_to_assign", - "type": "array", - "default_value": [ - "all" - ], - "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", - "required": false, - "custom_config": { - "grouping": "deployment", - "original_grouping": "deployment", - "config_constraints": { - "type": "string" - } - } - }, - { - "key": "enterprise_account_ids_to_assign", - "type": "array", - "default_value": [ - "all" - ], - "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", - "required": false, - "custom_config": { - "grouping": "deployment", - "original_grouping": "deployment", - "config_constraints": { - "type": "string" - } - } - }, - { - "key": "sample_app_git_url", - "type": "string", - "default_value": "https://github.com/IBM/gen-ai-rag-watsonx-sample-application", - "description": "The URL to the public git repository containing the sample RAG application code.", - "required": false - }, { "key": "existing_secrets_manager_crn", "type": "string", @@ -1716,154 +1859,6 @@ { "key": "watson_discovery_project_id", "description": "The ID for the Watson Discovery project for the sample RAG application." - }, - { - "key": "kms_instance_crn", - "description": "The CRN of the Hyper Protect Crypto Service instance or Key Protect instance" - }, - { - "key": "kms_private_endpoint", - "description": "Key Management Service instance private endpoint URL." - }, - { - "key": "kms_public_endpoint", - "description": "Key Management Service instance public endpoint URL." - }, - { - "key": "event_notifications_instance_crn", - "description": "Event Notifications crn" - }, - { - "key": "event_notifications_instance_name", - "description": "Event Notifications name" - }, - { - "key": "event_notifications_instance_guid", - "description": "Event Notifications guid" - }, - { - "key": "cloud_logs_for_logging_crn", - "description": "The id of the provisioned IBM Cloud Logs for logging instance." - }, - { - "key": "cloud_logs_for_logging_guid", - "description": "The guid of the provisioned IBM Cloud Logs for logging instance." - }, - { - "key": "cloud_logs_for_activity_tracking_crn", - "description": "The id of the provisioned IBM Cloud Logs for activity tracking instance." - }, - { - "key": "cloud_logs_for_activity_tracking_guid", - "description": "The guid of the provisioned IBM Cloud Logs for activity tracking instance." - }, - { - "key": "cloud_monitoring_crn", - "description": "The id of the provisioned IBM cloud monitoring instance." - }, - { - "key": "cloud_monitoring_guid", - "description": "The guid of the provisioned IBM cloud monitoring instance." - }, - { - "key": "secrets_manager_crn", - "description": "CRN of the Secrets Manager instance" - }, - { - "key": "secrets_manager_guid", - "description": "GUID of Secrets Manager instance" - }, - { - "key": "secrets_manager_name", - "description": "Name of the Secrets Manager instance" - }, - { - "key": "app_config_crn", - "description": "CRN of the App Configuration instance" - }, - { - "key": "app_config_guid", - "description": "GUID of the App Configuration instance" - }, - { - "key": "scc_workload_protection_crn", - "description": "SCC Workload Protection instance CRN" - }, - { - "key": "scc_workload_protection_guid", - "description": "SCC Workload Protection instance ID" - }, - { - "key": "watson_discovery_crn", - "description": "The CRN of the Watson Discovery instance." - }, - { - "key": "watson_discovery_dashboard_url", - "description": "The dashboard URL of the Watson Discovery instance." - }, - { - "key": "watson_machine_learning_crn", - "description": "The CRN of the Watson Machine Learning instance." - }, - { - "key": "watson_machine_learning_dashboard_url", - "description": "The dashboard URL of the Watson Machine Learning instance." - }, - { - "key": "watson_machine_learning_guid", - "description": "The GUID of the Watson Machine Learning instance." - }, - { - "key": "watson_studio_crn", - "description": "The CRN of the Watson Studio instance." - }, - { - "key": "watson_studio_dashboard_url", - "description": "The dashboard URL of the Watson Studio instance." - }, - { - "key": "watson_studio_guid", - "description": "The GUID of the Watson Studio instance." - }, - { - "key": "watsonx_assistant_crn", - "description": "The CRN of the watsonx Assistant instance." - }, - { - "key": "watsonx_assistant_dashboard_url", - "description": "The dashboard URL of the watsonx Assistant instance." - }, - { - "key": "watsonx_data_crn", - "description": "The CRN of the watsonx.data instance." - }, - { - "key": "watsonx_data_dashboard_url", - "description": "The dashboard URL of the watsonx.data instance." - }, - { - "key": "watsonx_data_guid", - "description": "The GUID of the watsonx.data instance." - }, - { - "key": "watson_discovery_guid", - "description": "The GUID of the Watson Discovery instance." - }, - { - "key": "workload_cluster_name", - "description": "The name of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." - }, - { - "key": "workload_cluster_id", - "description": "The id of the workload cluster. If the cluster name does not exactly match the prefix-workload-cluster pattern it will be null." - }, - { - "key": "workload_cluster_private_service_endpoint_url", - "description": "The private service endpoint URL of the Workload cluster, if not then null." - }, - { - "key": "workload_cluster_public_service_endpoint_url", - "description": "The public service endpoint URL of the Workload cluster, if not then null." } ], "install_type": "fullstack" @@ -1872,17 +1867,10 @@ "label": "Standard without sample application (Deploy on Red Hat OpenShift)", "name": "standard-without-app", "index": 4, + "short_description": "Ideal for Red Hat OpenShift users who want enterprise‑grade flexibility with a reliable starting point.", "working_directory": "solutions/standard-2", "ignore_readme": true, - "compliance": { - "authority": "scc-v3", - "profiles": [ - { - "profile_name": "AI Security Guardrails 2.0", - "profile_version": "1.1.0" - } - ] - }, + "dependency_version_2": true, "iam_permissions": [ { "service_name": "iam-groups", From c528181aee603d7c0feafaa88471e1234dd967b3 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 18 Nov 2025 13:31:12 +0530 Subject: [PATCH 08/16] updated catalog.json --- ibm_catalog.json | 2 +- solutions/basic-2/stack_definition.json | 54 +++++++++++++++++++--- solutions/standard-2/stack_definition.json | 54 +++++++++++++++++++--- 3 files changed, 95 insertions(+), 15 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index f42fa450..80114981 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -60,7 +60,7 @@ "description": "Ensures trust by configuring the IBM Cloud account to align with compliance settings as defined in the Financial Services framework." } ], - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues). Please note this product is not supported via the IBM Cloud Support Center.", + "support_details": "This product is in the community registry, as such support is handled through the [originated repo](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation). If you experience issues, please open an [issue]([https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues]) in that repository. Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ { "label": "Basic with sample application (Deploy on Code Engine)", diff --git a/solutions/basic-2/stack_definition.json b/solutions/basic-2/stack_definition.json index f91d2853..0d735187 100644 --- a/solutions/basic-2/stack_definition.json +++ b/solutions/basic-2/stack_definition.json @@ -202,10 +202,6 @@ "name": "edge_resource_group_name", "value": "ref:../../inputs/resource_group_name" }, - { - "name": "devops_resource_group_name", - "value": "ref:../../inputs/resource_group_name" - }, { "name": "provision_trusted_profile_projects", "value": false @@ -282,6 +278,50 @@ } ] }, + { + "name": "2d - Workload - Code Engine Project for CI", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.8f2dddee-2211-4330-bd2d-74c84a72601d-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "code_engine_project_name", + "value": "Generative_AI_Basic_Project" + }, + { + "name": "region", + "value": "ref:../../inputs/region" + } + ] + }, + { + "name": "2e - Workload - Container Registry", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.4ddd4d03-09ea-45c0-a591-53dbbed95eeb-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "namespace_name", + "value": "ref:../../inputs/region" + }, + { + "name": "upgrade_to_standard_plan", + "value": true + } + ] + }, { "name": "3a - Essential Security - Event Notifications", "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.29f017cd-7a6f-45cc-a4ed-5f23505380bf-global", @@ -775,15 +815,15 @@ }, { "name": "cos_instance_crn", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" }, { "name": "cos_instance_guid", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" }, { "name": "cos_instance_name", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" }, { "name": "cloud_monitoring_crn", diff --git a/solutions/standard-2/stack_definition.json b/solutions/standard-2/stack_definition.json index 94b1a6cb..0b70e539 100644 --- a/solutions/standard-2/stack_definition.json +++ b/solutions/standard-2/stack_definition.json @@ -202,10 +202,6 @@ "name": "edge_resource_group_name", "value": "ref:../../inputs/resource_group_name" }, - { - "name": "devops_resource_group_name", - "value": "ref:../../inputs/resource_group_name" - }, { "name": "provision_trusted_profile_projects", "value": false @@ -282,6 +278,28 @@ } ] }, + { + "name": "2d - Workload - Container Registry", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.4ddd4d03-09ea-45c0-a591-53dbbed95eeb-global", + "inputs": [ + { + "name": "existing_resource_group_name", + "value": "ref:../1 - Account Configuration/outputs/workload_resource_group_name" + }, + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "namespace_name", + "value": "ref:../../inputs/region" + }, + { + "name": "upgrade_to_standard_plan", + "value": true + } + ] + }, { "name": "3a - Essential Security - Event Notifications", "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.29f017cd-7a6f-45cc-a4ed-5f23505380bf-global", @@ -830,6 +848,28 @@ "value": true } ] + }, + { + "name": "5d - Workload Essential Security - Red Hat OpenShift logging agent", + "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.6a32a898-804a-4e6f-833d-0dde755e1261-global", + "inputs": [ + { + "name": "prefix", + "value": "ref:../../inputs/prefix" + }, + { + "name": "cluster_id", + "value": "ref:../3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_cluster_id" + }, + { + "name": "cluster_resource_group_id", + "value": "ref:../3c - Workload - Compute Red Hat OpenShift Container Platform on VPC/outputs/workload_rg_id" + }, + { + "name": "cloud_logs_ingress_endpoint", + "value": "ref:./4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_ingress_private_endpoint" + } + ] } ], "outputs": [ @@ -847,15 +887,15 @@ }, { "name": "cos_instance_crn", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_crn" }, { "name": "cos_instance_guid", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_guid" }, { "name": "cos_instance_name", - "value": "ref:../2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" + "value": "ref:./members/2b - Essential Security - Cloud Object Storage/outputs/cos_instance_name" }, { "name": "cloud_monitoring_crn", From 72e817d7e8dd16a06a24702575a5567ff95b5154 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 18 Nov 2025 14:51:05 +0530 Subject: [PATCH 09/16] renamed direcrtory --- ibm_catalog.json | 4 ++-- .../catalogValidationValues.json.template | 0 .../stack_definition.json | 0 .../catalogValidationValues.json.template | 0 .../stack_definition.json | 0 5 files changed, 2 insertions(+), 2 deletions(-) rename solutions/{basic-2 => basic-without-sample-app}/catalogValidationValues.json.template (100%) rename solutions/{basic-2 => basic-without-sample-app}/stack_definition.json (100%) rename solutions/{standard-2 => standard-without-sample-app}/catalogValidationValues.json.template (100%) rename solutions/{standard-2 => standard-without-sample-app}/stack_definition.json (100%) diff --git a/ibm_catalog.json b/ibm_catalog.json index 80114981..eb289604 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -1350,7 +1350,7 @@ "name": "basic-without-app", "index": 3, "short_description": "Ideal for Code Engine users who want serverless simplicity with a reliable starting point.", - "working_directory": "solutions/basic-2", + "working_directory": "solutions/basic-without-sample-app", "ignore_readme": true, "dependency_version_2": true, "iam_permissions": [ @@ -1868,7 +1868,7 @@ "name": "standard-without-app", "index": 4, "short_description": "Ideal for Red Hat OpenShift users who want enterprise‑grade flexibility with a reliable starting point.", - "working_directory": "solutions/standard-2", + "working_directory": "solutions/standard-without-sample-app", "ignore_readme": true, "dependency_version_2": true, "iam_permissions": [ diff --git a/solutions/basic-2/catalogValidationValues.json.template b/solutions/basic-without-sample-app/catalogValidationValues.json.template similarity index 100% rename from solutions/basic-2/catalogValidationValues.json.template rename to solutions/basic-without-sample-app/catalogValidationValues.json.template diff --git a/solutions/basic-2/stack_definition.json b/solutions/basic-without-sample-app/stack_definition.json similarity index 100% rename from solutions/basic-2/stack_definition.json rename to solutions/basic-without-sample-app/stack_definition.json diff --git a/solutions/standard-2/catalogValidationValues.json.template b/solutions/standard-without-sample-app/catalogValidationValues.json.template similarity index 100% rename from solutions/standard-2/catalogValidationValues.json.template rename to solutions/standard-without-sample-app/catalogValidationValues.json.template diff --git a/solutions/standard-2/stack_definition.json b/solutions/standard-without-sample-app/stack_definition.json similarity index 100% rename from solutions/standard-2/stack_definition.json rename to solutions/standard-without-sample-app/stack_definition.json From b03291521899713bf11aeebd47a30a81fd4000f5 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Wed, 19 Nov 2025 12:47:03 +0530 Subject: [PATCH 10/16] doc: added known limitation --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 4718252c..b374f180 100644 --- a/README.md +++ b/README.md @@ -247,3 +247,9 @@ To use your own app, remove the `Workload - Sample RAG Application` member confi 1. Delete the project. To undeploy the infrastructure created by the deployable architecture, follow the steps in [Deleting a project](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-delete-project) in the IBM Cloud docs. + +## Known Issues + +- [The Standard (OpenShift) variation is currently not idempotent](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues/247). + + Both the `Landing zone` Deployable Architecture (DA) and the `Landing zone for cloud-native AI applications` Deployable Architecture (DA) attempt to manage the same `Access Control Lists (ACLs)`. This may result in duplicate or conflicting updates. From 86019f45aa7e14dda5f2489bfed2ee30d27a3278 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Thu, 20 Nov 2025 19:24:53 +0530 Subject: [PATCH 11/16] resolved review comments --- README.md | 14 +++++++------- ibm_catalog.json | 12 ++++++------ .../stack_definition.json | 2 +- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index b374f180..78801bcf 100644 --- a/README.md +++ b/README.md @@ -6,24 +6,24 @@ This deployable architecture provides a comprehensive foundation for trust, obse ## Variations -Although four but primarily two variations are available for this deployable architecture: +This deployable architecture is available in four variations, grouped into two categories (Basic and Standard). Each category offers an option with or without a sample application deployment or pipeline: 1. Basic variation - With sample application: - Code Engine Project: Provisions a Code Engine project, providing a fully managed platform for containerized applications. - Application Deployment: Deploys the application on the provisioned Code Engine project. - Elasticsearch Enterprise: Provisions an Elasticsearch [enterprise](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elastic-offerings) instance for search and analytics capabilities. -2. Basic variation - Without sample application: - - Code Engine Project: Provisions a Code Engine project, providing a fully managed platform for containerized applications. - - Elasticsearch Enterprise: Provisions an Elasticsearch [enterprise](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elastic-offerings) instance for search and analytics capabilities. - -3. Standard variation - With sample application: +2. Standard variation - With sample application: - IBM Cloud OpenShift Cluster: Provisions an [IBM Cloud OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-overview) - VPC Network Infrastructure: Sets up the underlying VPC network infrastructure to support the OpenShift cluster. - Application Deployment: Deploys the application on the provisioned OpenShift cluster. - ElasticSearch Platinum Plan: Leverages the platinum plan of ElasticSearch, which includes the [ELSER](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elser-embeddings-elasticsearch) model for advanced vector generation capabilities. -4. Standard variation - Without sample application: +3. Basic variation: + - Code Engine Project: Provisions a Code Engine project, providing a fully managed platform for containerized applications. + - Elasticsearch Enterprise: Provisions an Elasticsearch [enterprise](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elastic-offerings) instance for search and analytics capabilities. + +4. Standard variation: - IBM Cloud OpenShift Cluster: Provisions an [IBM Cloud OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-overview) - VPC Network Infrastructure: Sets up the underlying VPC network infrastructure to support the OpenShift cluster. - ElasticSearch Platinum Plan: Leverages the platinum plan of ElasticSearch, which includes the [ELSER](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-elser-embeddings-elasticsearch) model for advanced vector generation capabilities. diff --git a/ibm_catalog.json b/ibm_catalog.json index eb289604..a38d5934 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -66,7 +66,7 @@ "label": "Basic with sample application (Deploy on Code Engine)", "name": "basic", "index": 1, - "short_description": "Ideal for Code Engine users who want serverless simplicity with a reliable starting point.", + "short_description": "Provides Code Engine users with serverless simplicity plus a hosted sample app and CI/CD pipeline.", "working_directory": "solutions/basic", "ignore_readme": true, "dependency_version_2": true, @@ -607,7 +607,7 @@ "label": "Standard with sample application (Deploy on Red Hat OpenShift)", "name": "standard", "index": 2, - "short_description": "Ideal for Red Hat OpenShift users who want enterprise‑grade flexibility with a reliable starting point.", + "short_description": "Offers Red Hat OpenShift users enterprise-grade flexibility along with a hosted sample app and automated pipeline deployment.", "working_directory": "solutions/standard", "ignore_readme": true, "dependency_version_2": true, @@ -1346,10 +1346,10 @@ "install_type": "fullstack" }, { - "label": "Basic without sample application (Deploy on Code Engine)", + "label": "Basic (Deploy on Code Engine)", "name": "basic-without-app", "index": 3, - "short_description": "Ideal for Code Engine users who want serverless simplicity with a reliable starting point.", + "short_description": "Designed for Code Engine users who want serverless simplicity without deploying a sample app or pipeline.", "working_directory": "solutions/basic-without-sample-app", "ignore_readme": true, "dependency_version_2": true, @@ -1864,10 +1864,10 @@ "install_type": "fullstack" }, { - "label": "Standard without sample application (Deploy on Red Hat OpenShift)", + "label": "Standard (Deploy on Red Hat OpenShift)", "name": "standard-without-app", "index": 4, - "short_description": "Ideal for Red Hat OpenShift users who want enterprise‑grade flexibility with a reliable starting point.", + "short_description": "Ideal for Red Hat OpenShift users seeking enterprise-grade flexibility without a sample app or pipeline included.", "working_directory": "solutions/standard-without-sample-app", "ignore_readme": true, "dependency_version_2": true, diff --git a/solutions/standard-without-sample-app/stack_definition.json b/solutions/standard-without-sample-app/stack_definition.json index 0b70e539..9445415c 100644 --- a/solutions/standard-without-sample-app/stack_definition.json +++ b/solutions/standard-without-sample-app/stack_definition.json @@ -867,7 +867,7 @@ }, { "name": "cloud_logs_ingress_endpoint", - "value": "ref:./4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_ingress_private_endpoint" + "value": "ref:../4a - Essential Security - Cloud Logs for logging/outputs/cloud_logs_ingress_private_endpoint" } ] } From f90f2ba01e1a4c7a81a13e991ce1407abe7c42a3 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Thu, 20 Nov 2025 19:44:54 +0530 Subject: [PATCH 12/16] updated known issue section --- README.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 78801bcf..6d6a4dfe 100644 --- a/README.md +++ b/README.md @@ -250,6 +250,17 @@ To use your own app, remove the `Workload - Sample RAG Application` member confi ## Known Issues -- [The Standard (OpenShift) variation is currently not idempotent](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues/247). +[The Standard (OpenShift) variation is currently not idempotent](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues/247). - Both the `Landing zone` Deployable Architecture (DA) and the `Landing zone for cloud-native AI applications` Deployable Architecture (DA) attempt to manage the same `Access Control Lists (ACLs)`. This may result in duplicate or conflicting updates. +Both the `Landing zone` Deployable Architecture (DA) and the `Landing zone for cloud-native AI applications` Deployable Architecture (DA) attempt to manage the same `Access Control Lists (ACLs)`. +This may result in duplicate or conflicting updates as the same ACL resource is updated from two independent Terraform states. + +**Impact:** + +- Non‑idempotent applies: `terraform apply` may produce updates even when no configuration changes exist. + +- Unexpected diffs: Terraform may show differences in ACL rules because another state has modified the resource. + +- Apply failures: Concurrent updates from both DAs may trigger errors such as “object changed outside of Terraform. + +These issues occur only in environments where both DAs are applied independently and target the same ACL resource. From 9bd0b70776fb321632db6d7a1c754e5001bee905 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 25 Nov 2025 18:15:53 +0530 Subject: [PATCH 13/16] updated diagram --- reference-architectures/rag-stack-without-app-and-alm.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/rag-stack-without-app-and-alm.svg b/reference-architectures/rag-stack-without-app-and-alm.svg index bde6addb..e8dadded 100644 --- a/reference-architectures/rag-stack-without-app-and-alm.svg +++ b/reference-architectures/rag-stack-without-app-and-alm.svg @@ -1,4 +1,4 @@ -
Account Structure
watsonx.ai
watsonx.data
watsonx.governance
Watson Discovery
watsonx Assistant / 
Security and Compliance Center - Workload Protection
Key Protect
Secrets Manager
Object Storage
Monitoring
Logging
Event Notifications
Code Engine
Red Hat Openshift (ROKS)
Elasticsearch
Orchestrate
 \ No newline at end of file +
Account Structure
watsonx.ai
watsonx.data
watsonx.governance
Watson Discovery
watsonx Assistant / Orchestrate 
Security and Compliance Center -
Workload Protection
Key Protect
Secrets Manager
Object Storage
Monitoring
Logging
Event Notifications
Code Engine
Red Hat Openshift (ROKS)
Elasticsearch
App Configuration
 ibm-cloud--key-protect \ No newline at end of file From 30632fc1db568d549b53a03e6ff642c517893173 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 25 Nov 2025 18:27:31 +0530 Subject: [PATCH 14/16] fixed security issue and bumped common dev assets --- .pre-commit-config.yaml | 2 +- README.md | 2 +- common-dev-assets | 2 +- tests/pr_test.go | 7 +++---- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 60ecfd74..32155edc 120000 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1 +1 @@ -common-dev-assets/stack-assets/.pre-commit-config.yaml \ No newline at end of file +common-dev-assets/module-assets/.pre-commit-config.yaml \ No newline at end of file diff --git a/README.md b/README.md index 6d6a4dfe..c02ef102 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ The following [deployable architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understand-module-da#what-is-da) automates the deployment of a sample gen AI Pattern on IBM Cloud, including all underlying IBM Cloud and WatsonX infrastructure. This architecture implements the best practices for watsonx gen AI Pattern deployment on IBM Cloud, as described in the [reference architecture](https://cloud.ibm.com/docs/pattern-genai-rag?topic=pattern-genai-rag-genai-pattern). -This deployable architecture provides a comprehensive foundation for trust, observability, security, and regulatory compliance. The architecture configures an IBM Cloud account to align with compliance settings. It also deploys key management and secrets management services and the infrastructure to support continuous integration (CI), continuous delivery (CD), and continuous compliance (CC) pipelines for secure management of the application lifecycle. It also deploys the WatsonX services suite and IBM Cloud Elasticsearch to faciliate a RAG pattern. These pipelines facilitate the deployment of the application, check for vulnerabilities and auditability, and help ensure a secure and trustworthy deployment of generative AI applications on IBM Cloud. +This deployable architecture provides a comprehensive foundation for trust, observability, security, and regulatory compliance. The architecture configures an IBM Cloud account to align with compliance settings. It also deploys key management and secrets management services and the infrastructure to support continuous integration (CI), continuous delivery (CD), and continuous compliance (CC) pipelines for secure management of the application lifecycle. It also deploys the WatsonX services suite and IBM Cloud Elasticsearch to facilitate a RAG pattern. These pipelines facilitate the deployment of the application, check for vulnerabilities and auditability, and help ensure a secure and trustworthy deployment of generative AI applications on IBM Cloud. ## Variations diff --git a/common-dev-assets b/common-dev-assets index 6a351e62..191c3ec3 160000 --- a/common-dev-assets +++ b/common-dev-assets @@ -1 +1 @@ -Subproject commit 6a351e62a04ea8bf074d4933c86cd28671154d3b +Subproject commit 191c3ec328a8bc402b28104c9ed5249ee5fafab3 diff --git a/tests/pr_test.go b/tests/pr_test.go index 92a1e114..d609bae5 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -3,7 +3,6 @@ package tests import ( "fmt" "log" - "math/rand" "os" "strings" "testing" @@ -60,7 +59,7 @@ func TestProjectsBasicFullTest(t *testing.T) { } options.StackInputs = map[string]interface{}{ "resource_group_name": options.ResourceGroup, - "region": validRegions[rand.Intn(len(validRegions))], + "region": validRegions[common.CryptoIntn(len(validRegions))], "ibmcloud_api_key": options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], "prefix": options.Prefix, "signing_key": privateKey, @@ -96,7 +95,7 @@ func TestProjectsBasicExistingResourcesTest(t *testing.T) { TerraformDir: tempTerraformDir, Vars: map[string]interface{}{ "prefix": prefix, - "region": validRegions[rand.Intn(len(validRegions))], + "region": validRegions[common.CryptoIntn(len(validRegions))], }, // Set Upgrade to true to ensure latest version of providers and modules are used by terratest. // This is the same as setting the -upgrade=true flag with terraform. @@ -177,7 +176,7 @@ func TestProjectsStandardFullTest(t *testing.T) { } options.StackInputs = map[string]interface{}{ "resource_group_name": options.ResourceGroup, - "region": validRegions[rand.Intn(len(validRegions))], + "region": validRegions[common.CryptoIntn(len(validRegions))], "ibmcloud_api_key": options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], "prefix": options.Prefix, "signing_key": privateKey, From 1726a619021e8bd38f90dfcafa923027bf004dde Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 25 Nov 2025 18:56:46 +0530 Subject: [PATCH 15/16] updated repo name --- README.md | 2 +- ibm_catalog.json | 18 +++++++++--------- .../stack_definition.json | 2 +- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index c02ef102..2bf8346f 100644 --- a/README.md +++ b/README.md @@ -250,7 +250,7 @@ To use your own app, remove the `Workload - Sample RAG Application` member confi ## Known Issues -[The Standard (OpenShift) variation is currently not idempotent](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues/247). +[The Standard (OpenShift) variation is currently not idempotent](https://github.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/issues/247). Both the `Landing zone` Deployable Architecture (DA) and the `Landing zone for cloud-native AI applications` Deployable Architecture (DA) attempt to manage the same `Access Control Lists (ACLs)`. This may result in duplicate or conflicting updates as the same ACL resource is updated from two independent Terraform states. diff --git a/ibm_catalog.json b/ibm_catalog.json index 81938815..41f83b0d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -60,7 +60,7 @@ "description": "Ensures trust by configuring the IBM Cloud account to align with compliance settings as defined in the Financial Services framework." } ], - "support_details": "This product is in the community registry, as such support is handled through the [originated repo](https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation). If you experience issues, please open an [issue]([https://github.com/terraform-ibm-modules/stack-retrieval-augmented-generation/issues]) in that repository. Please note this product is not supported via the IBM Cloud Support Center.", + "support_details": "This product is in the community registry, as such support is handled through the [originated repo](https://github.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation). If you experience issues, please open an [issue]([https://github.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/issues]) in that repository. Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ { "label": "Basic with sample application (Deploy on Code Engine)", @@ -1478,19 +1478,19 @@ "diagrams": [ { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", "caption": "Reference architecture", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" }, "description": "Reference architecture" }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" }, "description": "Solution components" } @@ -2010,19 +2010,19 @@ "diagrams": [ { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg", "caption": "Reference architecture", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-pattern.svg" }, "description": "Reference architecture" }, { "diagram": { - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg", "caption": "Solution components", "type": "image/svg+xml", - "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" + "thumbnail_url": "https://raw.githubusercontent.com/terraform-ibm-modules/stack-ibm-retrieval-augmented-generation/main/reference-architectures/rag-stack-without-app-and-alm.svg" }, "description": "Solution components" } diff --git a/solutions/basic-without-sample-app/stack_definition.json b/solutions/basic-without-sample-app/stack_definition.json index 0d735187..5ab0738a 100644 --- a/solutions/basic-without-sample-app/stack_definition.json +++ b/solutions/basic-without-sample-app/stack_definition.json @@ -279,7 +279,7 @@ ] }, { - "name": "2d - Workload - Code Engine Project for CI", + "name": "2d - Workload - Code Engine Project", "version_locator": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3.8f2dddee-2211-4330-bd2d-74c84a72601d-global", "inputs": [ { From 00629d2b478dcf68e70c57073ce751478332ca51 Mon Sep 17 00:00:00 2001 From: Prateek-Sharma13 Date: Tue, 25 Nov 2025 19:27:05 +0530 Subject: [PATCH 16/16] updated .catalog-onboarding file --- .catalog-onboard-pipeline.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml index a57b29f9..c213621a 100644 --- a/.catalog-onboard-pipeline.yaml +++ b/.catalog-onboard-pipeline.yaml @@ -22,3 +22,19 @@ offerings: scc: instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 region: us-south + - name: basic-without-sample-app + mark_ready: false + install_type: fullstack + format_kind: stack + validation_type: projects + scc: + instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 + region: us-south + - name: standard-without-sample-app + mark_ready: false + install_type: fullstack + format_kind: stack + validation_type: projects + scc: + instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 + region: us-south