feat: support for ocp v4.15 (#423)

Aashiq-J · web-flow · commit 9b2250afa0f3 · 2024-05-03T15:13:49.000+01:00
diff --git a/README.md b/README.md
@@ -194,7 +194,7 @@ Optionally, you need the following permissions to attach Access Management tags
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, < 1.7.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.63.0, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.64.0, < 2.0.0 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.16.1, < 3.0.0 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.1, < 4.0.0 |
 
@@ -244,6 +244,7 @@ Optionally, you need the following permissions to attach Access Management tags
 | <a name="input_cluster_ready_when"></a> [cluster\_ready\_when](#input\_cluster\_ready\_when) | The cluster is ready when one of the following: MasterNodeReady (not recommended), OneWorkerNodeReady, Normal, IngressReady | `string` | `"IngressReady"` | no |
 | <a name="input_cos_name"></a> [cos\_name](#input\_cos\_name) | Name of the COS instance to provision for OpenShift internal registry storage. New instance only provisioned if 'enable\_registry\_storage' is true and 'use\_existing\_cos' is false. Default: '<cluster\_name>\_cos' | `string` | `null` | no |
 | <a name="input_custom_security_group_ids"></a> [custom\_security\_group\_ids](#input\_custom\_security\_group\_ids) | Security groups to add to all worker nodes. This comes in addition to the IBM maintained security group if attach\_ibm\_managed\_security\_group is set to true. If this variable is set, the default VPC security group is NOT assigned to the worker nodes. | `list(string)` | `null` | no |
+| <a name="input_disable_outbound_traffic_protection"></a> [disable\_outbound\_traffic\_protection](#input\_disable\_outbound\_traffic\_protection) | Whether to allow public outbound access from the cluster workers. This is only applicable for `ocp_version` 4.15 | `bool` | `false` | no |
 | <a name="input_disable_public_endpoint"></a> [disable\_public\_endpoint](#input\_disable\_public\_endpoint) | Whether access to the public service endpoint is disabled when the cluster is created. Does not affect existing clusters. You can't disable a public endpoint on an existing cluster, so you can't convert a public cluster to a private cluster. To change a public endpoint to private, create another cluster with this input set to `true`. | `bool` | `false` | no |
 | <a name="input_enable_registry_storage"></a> [enable\_registry\_storage](#input\_enable\_registry\_storage) | Set to `true` to enable IBM Cloud Object Storage for the Red Hat OpenShift internal image registry. Set to `false` only for new cluster deployments in an account that is allowlisted for this feature. | `bool` | `true` | no |
 | <a name="input_existing_cos_id"></a> [existing\_cos\_id](#input\_existing\_cos\_id) | The COS id of an already existing COS instance to use for OpenShift internal registry storage. Only required if 'enable\_registry\_storage' and 'use\_existing\_cos' are true | `string` | `null` | no |
diff --git a/examples/add_rules_to_sg/version.tf b/examples/add_rules_to_sg/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = "1.63.0"
+      version = "1.64.0"
     }
   }
 }
diff --git a/examples/advanced/version.tf b/examples/advanced/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = ">= 1.63.0"
+      version = ">= 1.64.0"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
diff --git a/examples/basic/version.tf b/examples/basic/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = "1.63.0"
+      version = "1.64.0"
     }
   }
 }
diff --git a/examples/cross_kms_support/version.tf b/examples/cross_kms_support/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = ">= 1.63.0"
+      version = ">= 1.64.0"
     }
   }
 }
diff --git a/examples/custom_sg/version.tf b/examples/custom_sg/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = ">= 1.63.0"
+      version = ">= 1.64.0"
     }
   }
 }
diff --git a/examples/fscloud/version.tf b/examples/fscloud/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.63.0"
+      version = ">= 1.64.0"
     }
     logdna = {
       source  = "logdna/logdna"
diff --git a/examples/multiple_mzr_clusters/version.tf b/examples/multiple_mzr_clusters/version.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.63.0"
+      version = ">= 1.64.0"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
diff --git a/main.tf b/main.tf
@@ -86,24 +86,25 @@ resource "ibm_resource_tag" "cos_access_tag" {
 ##############################################################################
 
 resource "ibm_container_vpc_cluster" "cluster" {
-  depends_on                      = [null_resource.reset_api_key]
-  count                           = var.ignore_worker_pool_size_changes ? 0 : 1
-  name                            = var.cluster_name
-  vpc_id                          = var.vpc_id
-  tags                            = var.tags
-  kube_version                    = local.ocp_version
-  flavor                          = local.default_pool.machine_type
-  entitlement                     = var.ocp_entitlement
-  cos_instance_crn                = local.cos_instance_crn
-  worker_count                    = local.default_pool.workers_per_zone
-  resource_group_id               = var.resource_group_id
-  wait_till                       = var.cluster_ready_when
-  force_delete_storage            = var.force_delete_storage
-  disable_public_service_endpoint = var.disable_public_endpoint
-  worker_labels                   = local.default_pool.labels
-  crk                             = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
-  kms_instance_id                 = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
-  kms_account_id                  = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
+  depends_on                          = [null_resource.reset_api_key]
+  count                               = var.ignore_worker_pool_size_changes ? 0 : 1
+  name                                = var.cluster_name
+  vpc_id                              = var.vpc_id
+  tags                                = var.tags
+  kube_version                        = local.ocp_version
+  flavor                              = local.default_pool.machine_type
+  entitlement                         = var.ocp_entitlement
+  cos_instance_crn                    = local.cos_instance_crn
+  worker_count                        = local.default_pool.workers_per_zone
+  resource_group_id                   = var.resource_group_id
+  wait_till                           = var.cluster_ready_when
+  force_delete_storage                = var.force_delete_storage
+  disable_public_service_endpoint     = var.disable_public_endpoint
+  worker_labels                       = local.default_pool.labels
+  disable_outbound_traffic_protection = var.disable_outbound_traffic_protection
+  crk                                 = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
+  kms_instance_id                     = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
+  kms_account_id                      = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
 
   security_groups = local.cluster_security_groups
 
@@ -151,24 +152,25 @@ resource "ibm_container_vpc_cluster" "cluster" {
 
 # copy of the cluster resource above which ignores changes to the worker pool for use in autoscaling scenarios
 resource "ibm_container_vpc_cluster" "autoscaling_cluster" {
-  depends_on                      = [null_resource.reset_api_key]
-  count                           = var.ignore_worker_pool_size_changes ? 1 : 0
-  name                            = var.cluster_name
-  vpc_id                          = var.vpc_id
-  tags                            = var.tags
-  kube_version                    = local.ocp_version
-  flavor                          = local.default_pool.machine_type
-  entitlement                     = var.ocp_entitlement
-  cos_instance_crn                = local.cos_instance_crn
-  worker_count                    = local.default_pool.workers_per_zone
-  resource_group_id               = var.resource_group_id
-  wait_till                       = var.cluster_ready_when
-  force_delete_storage            = var.force_delete_storage
-  disable_public_service_endpoint = var.disable_public_endpoint
-  worker_labels                   = local.default_pool.labels
-  crk                             = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
-  kms_instance_id                 = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
-  kms_account_id                  = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
+  depends_on                          = [null_resource.reset_api_key]
+  count                               = var.ignore_worker_pool_size_changes ? 1 : 0
+  name                                = var.cluster_name
+  vpc_id                              = var.vpc_id
+  tags                                = var.tags
+  kube_version                        = local.ocp_version
+  flavor                              = local.default_pool.machine_type
+  entitlement                         = var.ocp_entitlement
+  cos_instance_crn                    = local.cos_instance_crn
+  worker_count                        = local.default_pool.workers_per_zone
+  resource_group_id                   = var.resource_group_id
+  wait_till                           = var.cluster_ready_when
+  force_delete_storage                = var.force_delete_storage
+  disable_public_service_endpoint     = var.disable_public_endpoint
+  worker_labels                       = local.default_pool.labels
+  disable_outbound_traffic_protection = var.disable_outbound_traffic_protection
+  crk                                 = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
+  kms_instance_id                     = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
+  kms_account_id                      = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
 
   security_groups = local.cluster_security_groups
 
diff --git a/modules/fscloud/README.md b/modules/fscloud/README.md
@@ -13,7 +13,7 @@ It has been scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, < 1.7.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.63.0, < 2.0.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.64.0, < 2.0.0 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.16.1, < 3.0.0 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.1, < 4.0.0 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |
diff --git a/modules/fscloud/version.tf b/modules/fscloud/version.tf
@@ -12,7 +12,7 @@ terraform {
     # tflint-ignore: terraform_unused_required_providers
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.63.0, < 2.0.0"
+      version = ">= 1.64.0, < 2.0.0"
     }
     # tflint-ignore: terraform_unused_required_providers
     null = {
diff --git a/tests/other_test.go b/tests/other_test.go
@@ -11,7 +11,7 @@ import (
 func TestRunBasicExample(t *testing.T) {
 	t.Parallel()
 
-	options := setupOptions(t, "base-ocp", basicExampleDir, ocpVersion3)
+	options := setupOptions(t, "base-ocp", basicExampleDir, ocpVersion4)
 
 	output, err := options.RunTestConsistency()
 
@@ -133,7 +133,7 @@ func TestCrossKmsSupportExample(t *testing.T) {
 			"kms_instance_guid":    permanentResources["kp_us_south_guid"],
 			"kms_key_id":           permanentResources["kp_us_south_root_key_id"],
 			"kms_cross_account_id": permanentResources["ge_ops_account_id"],
-			"ocp_version":          ocpVersion2,
+			"ocp_version":          ocpVersion3,
 		},
 	})
 
diff --git a/tests/pr_test.go b/tests/pr_test.go
@@ -26,9 +26,10 @@ const customsgExampleDir = "examples/custom_sg"
 const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml"
 
 // Ensure there is one test per supported OCP version
-const ocpVersion1 = "4.14" // used by TestRunUpgradeAdvancedExample, TestFSCloudInSchematic and TestRunMultiClusterExample
-const ocpVersion2 = "4.13" // used by TestRunAdvancedExample, TestCrossKmsSupportExample and TestRunAddRulesToSGExample
-const ocpVersion3 = "4.12" // used by TestRunBasicExample
+const ocpVersion1 = "4.15" // used by TestRunUpgradeAdvancedExample, TestFSCloudInSchematic and TestRunMultiClusterExample
+const ocpVersion2 = "4.14" // used by TestRunAdvancedExample and TestRunAddRulesToSGExample
+const ocpVersion3 = "4.13" // used by TestCrossKmsSupportExample
+const ocpVersion4 = "4.12" // used by TestRunBasicExample
 
 var sharedInfoSvc *cloudinfo.CloudInfoService
 var permanentResources map[string]interface{}
diff --git a/variables.tf b/variables.tf
@@ -160,6 +160,7 @@ variable "ocp_version" {
       var.ocp_version == "4.12",
       var.ocp_version == "4.13",
       var.ocp_version == "4.14",
+      var.ocp_version == "4.15",
     ])
     error_message = "The specified ocp_version is not of the valid versions."
   }
@@ -241,6 +242,12 @@ variable "access_tags" {
   }
 }
 
+variable "disable_outbound_traffic_protection" {
+  type        = bool
+  description = "Whether to allow public outbound access from the cluster workers. This is only applicable for `ocp_version` 4.15"
+  default     = false
+}
+
 # VPC Variables
 variable "vpc_id" {
   type        = string
diff --git a/version.tf b/version.tf
@@ -4,7 +4,7 @@ terraform {
     # Use "greater than or equal to" range in modules
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = ">= 1.63.0, < 2.0.0"
+      version = ">= 1.64.0, < 2.0.0"
     }
     null = {
       source  = "hashicorp/null"

Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ terraform {`
`6`	`6`	`required_providers {`
`7`	`7`	`ibm = {`
`8`	`8`	`source = "IBM-Cloud/ibm"`
`9`		`- version = "1.63.0"`
	`9`	`+ version = "1.64.0"`
`10`	`10`	`}`
`11`	`11`	`}`
`12`	`12`	`}`