Skip to content

Commit 6fb8241

Browse files
daniel-butler-irldaniel-butler-irl
authored
feat: added fscloud submodule (#147)
1 parent 318dc10 commit 6fb8241

File tree

15 files changed

+709
-3
lines changed

15 files changed

+709
-3
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,4 @@ jobs:
1111
secrets: inherit
1212
with:
1313
craSCCv2: true
14-
craTarget: "examples/standard"
15-
craRuleIgnoreFile: "cra-tf-validate-ignore-rules.json"
14+
craConfigYamlFile: "cra-config.yaml"

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ A module for provisioning an IBM Cloud Red Hat OpenShift cluster on VPC Gen2. Th
1919
- Make sure that you have a recent version of the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started)
2020
- Make sure that you have a recent version of the [IBM Cloud Kubernetes service CLI](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli)
2121

22+
23+
2224
## Usage
2325
```hcl
2426
# Replace "master" with a GIT release version to lock into a specific release
@@ -126,6 +128,7 @@ Optionally, you need the following permissions to attach Access Management tags
126128
- [ Add Rules to Security Groups Example](examples/add_rules_to_sg)
127129
- [ Apply Taints Example](examples/apply_taints)
128130
- [ Existing COS](examples/existing_cos)
131+
- [ Financial Services Cloud profile example](examples/fscloud)
129132
- [ 2 MZR clusters in same VPC](examples/multiple_mzr_clusters)
130133
- [ Single zone autoscaling cluster example](examples/single_zone_autoscale_cluster)
131134
- [ Standard Example With User Managed Boot Volume Encryption](examples/standard)

‎cra-config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
version: "v1"
2+
CRA_TARGETS:
3+
- CRA_TARGET: "examples/fscloud"
4+
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"

‎examples/fscloud/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Financial Services Cloud profile example
2+
3+
An end-to-end example that uses the [Profile for IBM Cloud Framework for Financial Services](../../modules/fscloud) to deploy an instance of the base OCP VPC module.
4+
5+
The example uses the IBM Cloud Terraform provider to create the following infrastructure:
6+
7+
- A resource group, if one is not passed in
8+
- A sample virtual private cloud (VPC)
9+
- A COS instance for use by the OCP cluster
10+
- A context-based restriction (CBR) rule to only allow COS Instance to be accessible from within the VPC
11+
- OCP cluster in a VPC with the default worker pool deployed across 3 availability zones
12+
- Also uses Hyper Protect Crypto Service for the cluster and boot volume encryption
13+
14+
15+
:exclamation: **Important:** OCP provisions a COS bucket, but you cannot use your own encryption keys. This will fail the requirement for Cloud Object Storage to be enabled with customer-managed encryption and Keep Your Own Key (KYOK).
16+
Once the service supports this the profile will be updated. Until that time it is for educational purposes only.
17+
18+
Outside the OCP Cluster, other parts of the infrastructure do not necessarily comply.
19+
20+
## Before you begin
21+
22+
- You need a Hyper Protect Crypto Services instance and keys for the worker and master encryption available in the region that you want to deploy your OCP Cluster instance to.

‎examples/fscloud/main.tf‎

Lines changed: 249 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,249 @@
1+
2+
##############################################################################
3+
# Provision an OCP cluster with one extra worker pool inside a VPC
4+
##############################################################################
5+
6+
module "resource_group" {
7+
source = "terraform-ibm-modules/resource-group/ibm"
8+
version = "1.0.6"
9+
# if an existing resource group is not set (null) create a new one using prefix
10+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
11+
existing_resource_group_name = var.resource_group
12+
}
13+
14+
module "cos_fscloud" {
15+
source = "terraform-ibm-modules/cos/ibm"
16+
version = "6.10.0"
17+
resource_group_id = module.resource_group.resource_group_id
18+
create_cos_bucket = false
19+
cos_instance_name = "${var.prefix}-cos"
20+
skip_iam_authorization_policy = true
21+
22+
sysdig_crn = module.observability_instances.sysdig_crn
23+
activity_tracker_crn = local.at_crn
24+
# Don't set CBR rules here as we don't want to create a circular dependency with the VPC module
25+
}
26+
27+
module "flowlogs_bucket" {
28+
source = "terraform-ibm-modules/cos/ibm//modules/buckets"
29+
version = "6.10.0"
30+
31+
bucket_configs = [
32+
{
33+
bucket_name = "${var.prefix}-vpc-flowlogs"
34+
kms_encryption_enabled = true
35+
kms_guid = var.hpcs_instance_guid
36+
kms_key_crn = var.hpcs_key_crn_cluster
37+
region_location = var.region
38+
resource_instance_id = module.cos_fscloud.cos_instance_id
39+
resource_group_id = module.resource_group.resource_group_id
40+
}
41+
]
42+
}
43+
44+
##############################################################################
45+
# VPC
46+
##############################################################################
47+
module "vpc" {
48+
depends_on = [module.flowlogs_bucket]
49+
source = "terraform-ibm-modules/landing-zone-vpc/ibm"
50+
version = "7.3.2"
51+
resource_group_id = module.resource_group.resource_group_id
52+
region = var.region
53+
prefix = var.prefix
54+
tags = []
55+
name = var.vpc_name
56+
address_prefixes = {
57+
zone-1 = ["10.10.10.0/24"]
58+
zone-2 = ["10.20.10.0/24"]
59+
zone-3 = ["10.30.10.0/24"]
60+
}
61+
clean_default_acl = true
62+
clean_default_security_group = true
63+
enable_vpc_flow_logs = true
64+
create_authorization_policy_vpc_to_cos = true
65+
existing_storage_bucket_name = module.flowlogs_bucket.bucket_configs[0].bucket_name
66+
security_group_rules = []
67+
existing_cos_instance_guid = module.cos_fscloud.cos_instance_guid
68+
subnets = {
69+
zone-1 = [
70+
{
71+
acl_name = "vpc-acl"
72+
name = "zone-1"
73+
cidr = "10.10.10.0/24"
74+
}
75+
],
76+
zone-2 = [
77+
{
78+
acl_name = "vpc-acl"
79+
name = "zone-2"
80+
cidr = "10.20.10.0/24"
81+
}
82+
],
83+
zone-3 = [
84+
{
85+
acl_name = "vpc-acl"
86+
name = "zone-3"
87+
cidr = "10.30.10.0/24"
88+
}
89+
] }
90+
use_public_gateways = {
91+
zone-1 = false
92+
zone-2 = false
93+
zone-3 = false
94+
}
95+
ibmcloud_api_key = var.ibmcloud_api_key
96+
}
97+
98+
##############################################################################
99+
# Observability Instances (Sysdig + AT)
100+
##############################################################################
101+
102+
locals {
103+
existing_at = var.existing_at_instance_crn != null ? true : false
104+
at_crn = var.existing_at_instance_crn == null ? module.observability_instances.activity_tracker_crn : var.existing_at_instance_crn
105+
}
106+
107+
108+
# Create Sysdig and Activity Tracker instance
109+
module "observability_instances" {
110+
source = "terraform-ibm-modules/observability-instances/ibm"
111+
version = "2.7.0"
112+
providers = {
113+
logdna.at = logdna.at
114+
logdna.ld = logdna.ld
115+
}
116+
region = var.region
117+
resource_group_id = module.resource_group.resource_group_id
118+
sysdig_instance_name = "${var.prefix}-sysdig"
119+
sysdig_plan = "graduated-tier"
120+
enable_platform_logs = false
121+
enable_platform_metrics = false
122+
logdna_provision = false
123+
activity_tracker_instance_name = "${var.prefix}-at"
124+
activity_tracker_plan = "7-day"
125+
activity_tracker_provision = !local.existing_at
126+
}
127+
128+
##############################################################################
129+
# Get Cloud Account ID
130+
##############################################################################
131+
132+
data "ibm_iam_account_settings" "iam_account_settings" {
133+
}
134+
135+
136+
##############################################################################
137+
# Create CBR Zone and Rules
138+
##############################################################################
139+
module "cbr_zone" {
140+
source = "terraform-ibm-modules/cbr/ibm//cbr-zone-module"
141+
version = "1.2.0"
142+
name = "${var.prefix}-VPC-network-zone"
143+
zone_description = "CBR Network zone containing VPC"
144+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
145+
addresses = [{
146+
type = "vpc", # to bind a specific vpc to the zone
147+
value = module.vpc.vpc_crn,
148+
}]
149+
}
150+
151+
module "cbr_rules" {
152+
source = "terraform-ibm-modules/cbr/ibm//cbr-rule-module"
153+
version = "1.2.0"
154+
rule_description = "${var.prefix} rule for vpc flow log access to cos"
155+
enforcement_mode = "enabled"
156+
resources = [{
157+
attributes = [
158+
{
159+
name = "accountId"
160+
value = data.ibm_iam_account_settings.iam_account_settings.account_id
161+
operator = "stringEquals"
162+
},
163+
{
164+
name = "resourceGroupId",
165+
value = module.resource_group.resource_group_id
166+
operator = "stringEquals"
167+
},
168+
{
169+
name = "serviceInstance"
170+
value = module.cos_fscloud.cos_instance_id
171+
operator = "stringEquals"
172+
},
173+
{
174+
name = "serviceName"
175+
value = "cloud-object-storage"
176+
operator = "stringEquals"
177+
}
178+
],
179+
}]
180+
rule_contexts = [{
181+
attributes = [
182+
{
183+
"name" : "endpointType",
184+
"value" : "private"
185+
},
186+
{
187+
name = "networkZoneId"
188+
value = module.cbr_zone.zone_id
189+
}]
190+
}]
191+
}
192+
193+
194+
195+
##############################################################################
196+
# Base OCP Cluster
197+
##############################################################################
198+
locals {
199+
cluster_hpcs_worker_pool_key_id = regex("key:(.*)", var.hpcs_key_crn_worker_pool)[0]
200+
cluster_hpcs_cluster_key_id = regex("key:(.*)", var.hpcs_key_crn_cluster)[0]
201+
cluster_vpc_subnets = {
202+
default = [
203+
for subnet in module.vpc.subnet_zone_list :
204+
{
205+
id = subnet.id
206+
zone = subnet.zone
207+
cidr_block = subnet.cidr
208+
}
209+
]
210+
}
211+
212+
worker_pools = [
213+
{
214+
subnet_prefix = "default"
215+
pool_name = "default" # ibm_container_vpc_cluster automatically names default pool "default" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
216+
machine_type = "bx2.4x16"
217+
workers_per_zone = 2
218+
labels = {}
219+
resource_group_id = module.resource_group.resource_group_id
220+
boot_volume_encryption_kms_config = {
221+
crk = local.cluster_hpcs_worker_pool_key_id
222+
kms_instance_id = var.hpcs_instance_guid
223+
private_endpoint = true
224+
}
225+
}
226+
]
227+
}
228+
229+
module "ocp_fscloud" {
230+
source = "../../modules/fscloud"
231+
cluster_name = var.prefix
232+
ibmcloud_api_key = var.ibmcloud_api_key
233+
resource_group_id = module.resource_group.resource_group_id
234+
region = "us-south"
235+
force_delete_storage = true
236+
vpc_id = module.vpc.vpc_id
237+
vpc_subnets = local.cluster_vpc_subnets
238+
existing_cos_id = module.cos_fscloud.cos_instance_id
239+
worker_pools = local.worker_pools
240+
tags = var.resource_tags
241+
verify_worker_network_readiness = false # No access from public internet to check worker network readiness
242+
kms_config = {
243+
instance_id = var.hpcs_instance_guid
244+
crk_id = local.cluster_hpcs_cluster_key_id
245+
private_endpoint = true
246+
}
247+
}
248+
249+
##############################################################################

‎examples/fscloud/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "cluster_name" {
6+
value = module.ocp_fscloud.cluster_name
7+
description = "The name of the provisioned cluster."
8+
}
9+
10+
##############################################################################

‎examples/fscloud/provider.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
##############################################################################
2+
# Terraform providers
3+
##############################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}
9+
10+
locals {
11+
at_endpoint = "https://api.${var.region}.logging.cloud.ibm.com"
12+
}
13+
14+
provider "logdna" {
15+
alias = "at"
16+
servicekey = module.observability_instances.activity_tracker_resource_key != null ? module.observability_instances.activity_tracker_resource_key : ""
17+
url = local.at_endpoint
18+
}
19+
20+
provider "logdna" {
21+
alias = "ld"
22+
servicekey = module.observability_instances.logdna_resource_key != null ? module.observability_instances.logdna_resource_key : ""
23+
url = local.at_endpoint
24+
}
25+
##############################################################################

0 commit comments

Comments
 (0)