Merge branch 'main' into audit

Aashiq-J · web-flow · commit 72bdce3b4445 · 2025-04-09T00:18:07.000+05:30
diff --git a/README.md b/README.md
@@ -248,7 +248,7 @@ Optionally, you need the following permissions to attach Access Management tags
 | <a name="module_attach_sg_to_master_vpe"></a> [attach\_sg\_to\_master\_vpe](#module\_attach\_sg\_to\_master\_vpe) | terraform-ibm-modules/security-group/ibm | 2.6.2 |
 | <a name="module_attach_sg_to_registry_vpe"></a> [attach\_sg\_to\_registry\_vpe](#module\_attach\_sg\_to\_registry\_vpe) | terraform-ibm-modules/security-group/ibm | 2.6.2 |
 | <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.29.0 |
-| <a name="module_cos_instance"></a> [cos\_instance](#module\_cos\_instance) | terraform-ibm-modules/cos/ibm | 8.21.6 |
+| <a name="module_cos_instance"></a> [cos\_instance](#module\_cos\_instance) | terraform-ibm-modules/cos/ibm | 8.21.8 |
 
 ### Resources
 
diff --git a/common-dev-assets b/common-dev-assets
@@ -1 +1 @@
-Subproject commit 3c7573a5e79fd029d97ae69755183e58078a3050
+Subproject commit 34d851c430194cd9431aced7aa2bae758b35b705
diff --git a/examples/add_rules_to_sg/main.tf b/examples/add_rules_to_sg/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
diff --git a/examples/advanced/main.tf b/examples/advanced/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
@@ -22,7 +22,7 @@ locals {
 
 module "kp_all_inclusive" {
   source                    = "terraform-ibm-modules/kms-all-inclusive/ibm"
-  version                   = "4.21.3"
+  version                   = "4.21.6"
   key_protect_instance_name = "${var.prefix}-kp-instance"
   resource_group_id         = module.resource_group.resource_group_id
   region                    = var.region
diff --git a/examples/basic/main.tf b/examples/basic/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
diff --git a/examples/cross_kms_support/main.tf b/examples/cross_kms_support/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
diff --git a/examples/custom_sg/main.tf b/examples/custom_sg/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
diff --git a/examples/fscloud/main.tf b/examples/fscloud/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
@@ -16,7 +16,7 @@ module "resource_group" {
 
 module "cos_fscloud" {
   source                        = "terraform-ibm-modules/cos/ibm"
-  version                       = "8.21.6"
+  version                       = "8.21.8"
   resource_group_id             = module.resource_group.resource_group_id
   create_cos_bucket             = false
   cos_instance_name             = "${var.prefix}-cos"
@@ -30,7 +30,7 @@ module "cos_fscloud" {
 
 module "flowlogs_bucket" {
   source  = "terraform-ibm-modules/cos/ibm//modules/buckets"
-  version = "8.21.6"
+  version = "8.21.8"
 
   bucket_configs = [
     {
@@ -52,7 +52,7 @@ module "flowlogs_bucket" {
 module "vpc" {
   depends_on        = [module.flowlogs_bucket]
   source            = "terraform-ibm-modules/landing-zone-vpc/ibm"
-  version           = "7.22.2"
+  version           = "7.22.7"
   resource_group_id = module.resource_group.resource_group_id
   region            = var.region
   prefix            = var.prefix
diff --git a/examples/multiple_mzr_clusters/main.tf b/examples/multiple_mzr_clusters/main.tf
@@ -4,7 +4,7 @@
 
 module "resource_group" {
   source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.1.6"
+  version = "1.2.0"
   # if an existing resource group is not set (null) create a new one using prefix
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
diff --git a/ibm_catalog.json b/ibm_catalog.json
@@ -163,7 +163,21 @@
             },
             {
               "key": "default_worker_pool_operating_system",
-              "required": true
+              "required": true,
+              "options": [
+                {
+                  "displayname": "RHEL 9",
+                  "value": "RHEL_9_64"
+                },
+                {
+                  "displayname": "Red Hat CoreOS",
+                  "value": "RHCOS"
+                },
+                {
+                  "displayname": "RHEL 8",
+                  "value": "REDHAT_8_64"
+                }
+              ]
             },
             {
               "key": "provider_visibility",
diff --git a/main.tf b/main.tf
@@ -108,7 +108,7 @@ module "cos_instance" {
   count = var.enable_registry_storage && !var.use_existing_cos ? 1 : 0
 
   source                 = "terraform-ibm-modules/cos/ibm"
-  version                = "8.21.6"
+  version                = "8.21.8"
   cos_instance_name      = local.cos_name
   resource_group_id      = var.resource_group_id
   cos_plan               = local.cos_plan
diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md
@@ -17,7 +17,7 @@ The following resources are provisioned by this example:
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.9.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.76.2 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.76.3 |
 
 ### Modules
 
@@ -27,16 +27,16 @@ The following resources are provisioned by this example:
 | <a name="module_existing_cluster_kms_key_crn_parser"></a> [existing\_cluster\_kms\_key\_crn\_parser](#module\_existing\_cluster\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_kms_crn_parser"></a> [existing\_kms\_crn\_parser](#module\_existing\_kms\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_vpc_crn_parser"></a> [existing\_vpc\_crn\_parser](#module\_existing\_vpc\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
-| <a name="module_kms"></a> [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 4.21.2 |
+| <a name="module_kms"></a> [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 4.21.6 |
 | <a name="module_ocp_base"></a> [ocp\_base](#module\_ocp\_base) | ../.. | n/a |
-| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.6 |
+| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.2.0 |
 
 ### Resources
 
 | Name | Type |
 |------|------|
-| [ibm_is_subnet.subnets](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.76.2/docs/data-sources/is_subnet) | data source |
-| [ibm_is_subnets.vpc_subnets](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.76.2/docs/data-sources/is_subnets) | data source |
+| [ibm_is_subnet.subnets](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.76.3/docs/data-sources/is_subnet) | data source |
+| [ibm_is_subnets.vpc_subnets](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.76.3/docs/data-sources/is_subnets) | data source |
 
 ### Inputs
 
diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf
@@ -3,7 +3,7 @@
 #######################################################################################################################
 module "resource_group" {
   source                       = "terraform-ibm-modules/resource-group/ibm"
-  version                      = "1.1.6"
+  version                      = "1.2.0"
   existing_resource_group_name = var.existing_resource_group_name
 }
 
@@ -93,9 +93,9 @@ module "kms" {
   providers = {
     ibm = ibm.kms
   }
-  count                       = (var.kms_encryption_enabled_boot_volume || var.kms_encryption_enabled_cluster) && var.existing_cluster_kms_key_crn == null ? 1 : 0
+  count                       = (var.kms_encryption_enabled_boot_volume && var.existing_boot_volume_kms_key_crn == null) || (var.kms_encryption_enabled_cluster && var.existing_cluster_kms_key_crn == null) ? 1 : 0
   source                      = "terraform-ibm-modules/kms-all-inclusive/ibm"
-  version                     = "4.21.2"
+  version                     = "4.21.6"
   create_key_protect_instance = false
   region                      = local.cluster_kms_region
   existing_kms_instance_crn   = var.existing_kms_instance_crn
@@ -167,21 +167,30 @@ locals {
       }
       additional_security_group_ids = var.additional_security_group_ids
     }
-    ], [for pool in var.additional_worker_pools : pool if length(pool.vpc_subnets) > 0],
+    ], [for pool in var.additional_worker_pools : merge(pool, { resource_group_id = module.resource_group.resource_group_id
+      boot_volume_encryption_kms_config = {
+        crk             = local.boot_volume_kms_key_id
+        kms_instance_id = local.boot_volume_existing_kms_guid
+        kms_account_id  = local.boot_volume_kms_account_id
+    } }) if length(pool.vpc_subnets) > 0],
     [for pool in var.additional_worker_pools : {
-      pool_name                         = pool.pool_name
-      machine_type                      = pool.machine_type
-      workers_per_zone                  = pool.workers_per_zone
-      resource_group_id                 = pool.resource_group_id
-      operating_system                  = pool.operating_system
-      labels                            = pool.labels
-      minSize                           = pool.minSize
-      secondary_storage                 = pool.secondary_storage
-      maxSize                           = pool.maxSize
-      enableAutoscaling                 = pool.enableAutoscaling
-      boot_volume_encryption_kms_config = pool.boot_volume_encryption_kms_config
-      additional_security_group_ids     = pool.additional_security_group_ids
-      subnet_prefix                     = "default"
+      pool_name         = pool.pool_name
+      machine_type      = pool.machine_type
+      workers_per_zone  = pool.workers_per_zone
+      resource_group_id = module.resource_group.resource_group_id
+      operating_system  = pool.operating_system
+      labels            = pool.labels
+      minSize           = pool.minSize
+      secondary_storage = pool.secondary_storage
+      maxSize           = pool.maxSize
+      enableAutoscaling = pool.enableAutoscaling
+      boot_volume_encryption_kms_config = {
+        crk             = local.boot_volume_kms_key_id
+        kms_instance_id = local.boot_volume_existing_kms_guid
+        kms_account_id  = local.boot_volume_kms_account_id
+      }
+      additional_security_group_ids = pool.additional_security_group_ids
+      subnet_prefix                 = "default"
   } if length(pool.vpc_subnets) == 0])
 }
 
diff --git a/solutions/fully-configurable/version.tf b/solutions/fully-configurable/version.tf
@@ -5,7 +5,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = "1.76.2"
+      version = "1.76.3"
     }
   }
 }
diff --git a/tests/existing-resources/main.tf b/tests/existing-resources/main.tf
@@ -3,7 +3,7 @@
 #############################################################################
 module "resource_group" {
   source                       = "terraform-ibm-modules/resource-group/ibm"
-  version                      = "1.1.6"
+  version                      = "1.2.0"
   resource_group_name          = var.resource_group == null ? "${var.prefix}-resource-group" : null
   existing_resource_group_name = var.resource_group
 }
@@ -14,7 +14,7 @@ module "resource_group" {
 
 module "vpc" {
   source            = "terraform-ibm-modules/landing-zone-vpc/ibm"
-  version           = "7.19.1"
+  version           = "7.22.7"
   resource_group_id = module.resource_group.resource_group_id
   region            = var.region
   name              = "vpc"
@@ -38,7 +38,7 @@ module "vpc" {
 
 module "cos" {
   source                 = "terraform-ibm-modules/cos/ibm"
-  version                = "8.16.5"
+  version                = "8.21.8"
   resource_group_id      = module.resource_group.resource_group_id
   region                 = var.region
   cos_instance_name      = "${var.prefix}-cos"
diff --git a/tests/go.mod b/tests/go.mod
@@ -2,12 +2,12 @@ module github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc
 
 go 1.23.0
 
-toolchain go1.24.1
+toolchain go1.24.2
 
 require (
 	github.com/gruntwork-io/terratest v0.48.2
 	github.com/stretchr/testify v1.10.0
-	github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.47.1
+	github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.48.1
 )
 
 require (
diff --git a/tests/go.sum b/tests/go.sum
@@ -295,8 +295,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.47.1 h1:tNFE95ARyd8tTjP0zSmIJIFKBf7Kdl8Cuwp5NZ1xqUo=
-github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.47.1/go.mod h1:be/us5lpuIvNmni1CXR0nJcAiFJkvluQDM0iFe960s8=
+github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.48.1 h1:NeQESr9QRqT/37JZHtt7Hi7t+KpBV1SsMNwRL8xIuwc=
+github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.48.1/go.mod h1:K6530rYZw/YRBECIkEPfIET/SUSI9zuVVderX31w8fM=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/tmccombs/hcl2json v0.6.4 h1:/FWnzS9JCuyZ4MNwrG4vMrFrzRgsWEOVi+1AyYUVLGw=
 github.com/tmccombs/hcl2json v0.6.4/go.mod h1:+ppKlIW3H5nsAsZddXPy2iMyvld3SHxyjswOZhavRDk=
diff --git a/tests/pr_test.go b/tests/pr_test.go
@@ -117,6 +117,7 @@ func TestRunFullyConfigurableInSchematics(t *testing.T) {
 		{Name: "existing_vpc_crn", Value: terraform.Output(t, existingTerraformOptions, "vpc_crn"), DataType: "string"},
 		{Name: "kms_encryption_enabled_cluster", Value: "true", DataType: "bool"},
 		{Name: "existing_kms_instance_crn", Value: permanentResources["hpcs_south_crn"], DataType: "string"},
+		{Name: "kms_encryption_enabled_boot_volume", Value: "true", DataType: "bool"},
 	}
 	require.NoError(t, options.RunSchematicTest(), "This should not have errored")
 	cleanupTerraform(t, existingTerraformOptions, prefix)
