Skip to content

Commit affe05f

Browse files
Soaib024Soaib024
authored
feat: add kms boot volume encryption (#76)
1 parent b2cc2c8 commit affe05f

File tree

10 files changed

+92
-42
lines changed

10 files changed

+92
-42
lines changed

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
[![Stable (With quality checks)](https://img.shields.io/badge/Status-Stable%20(With%20quality%20checks)-green)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)[![Build status](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/actions/workflows/ci.yml/badge.svg)](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/actions/workflows/ci.yml)[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-base-ocp-vpc?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/releases/latest)[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
1010
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
1111

12-
A module for provisioning an IBM Cloud Red Hat OpenShift cluster on VPC Gen2. The module either creates the required Cloud Object Storage instance or uses an existing instance. The module also supports optionally passing a key management configuration for secret encryption.
12+
A module for provisioning an IBM Cloud Red Hat OpenShift cluster on VPC Gen2. The module either creates the required Cloud Object Storage instance or uses an existing instance. The module also supports optionally passing a key management configuration for secret encryption and boot volume encryption
1313

1414
## Before you begin
1515

@@ -119,7 +119,7 @@ You need the following permissions to run this module.
119119
- [ Existing COS](examples/existing_cos)
120120
- [ 2 MZR clusters in same VPC](examples/multiple_mzr_clusters)
121121
- [ Single Zone Cluster](examples/single_zone_cluster)
122-
- [ Standard Example](examples/standard)
122+
- [ Standard Example With User Managed Boot Volume Encryption](examples/standard)
123123
<!-- END EXAMPLES HOOK -->
124124

125125
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -171,7 +171,7 @@ No modules.
171171
| <a name="input_verify_worker_network_readiness"></a> [verify\_worker\_network\_readiness](#input\_verify\_worker\_network\_readiness) | By setting this to true, a script will run kubectl commands to verify that all worker nodes can communicate successfully with the master. If the runtime does not have access to the kube cluster to run kubectl commands, this should be set to false. | `bool` | `true` | no |
172172
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | Id of the VPC instance where this cluster will be provisioned | `string` | n/a | yes |
173173
| <a name="input_vpc_subnets"></a> [vpc\_subnets](#input\_vpc\_subnets) | Metadata that describes the VPC's subnets. Obtain this information from the VPC where this cluster will be created | <pre>map(list(object({<br> id = string<br> zone = string<br> cidr_block = string<br> })))</pre> | n/a | yes |
174-
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = string<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> labels = optional(map(string))<br> }))</pre> | <pre>[<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "default",<br> "subnet_prefix": "zone-1",<br> "workers_per_zone": 2<br> },<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "zone-2",<br> "subnet_prefix": "zone-2",<br> "workers_per_zone": 2<br> },<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "zone-3",<br> "subnet_prefix": "zone-3",<br> "workers_per_zone": 2<br> }<br>]</pre> | no |
174+
| <a name="input_worker_pools"></a> [worker\_pools](#input\_worker\_pools) | List of worker pools | <pre>list(object({<br> subnet_prefix = string<br> pool_name = string<br> machine_type = string<br> workers_per_zone = number<br> resource_group_id = optional(string)<br> labels = optional(map(string))<br> boot_volume_encryption_kms_config = optional(object({<br> crk = string<br> kms_instance_id = string<br> kms_account_id = optional(string)<br> }))<br> }))</pre> | <pre>[<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "default",<br> "subnet_prefix": "zone-1",<br> "workers_per_zone": 2<br> },<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "zone-2",<br> "subnet_prefix": "zone-2",<br> "workers_per_zone": 2<br> },<br> {<br> "machine_type": "bx2.4x16",<br> "pool_name": "zone-3",<br> "subnet_prefix": "zone-3",<br> "workers_per_zone": 2<br> }<br>]</pre> | no |
175175
| <a name="input_worker_pools_taints"></a> [worker\_pools\_taints](#input\_worker\_pools\_taints) | Optional, Map of lists containing node taints by node-pool name | `map(list(object({ key = string, value = string, effect = string })))` | `null` | no |
176176

177177
## Outputs

‎common-dev-assets‎

‎examples/apply_taints/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,11 @@ variable "worker_pools" {
136136
workers_per_zone = number
137137
resource_group_id = optional(string)
138138
labels = optional(map(string))
139+
boot_volume_encryption_kms_config = optional(object({
140+
crk = string
141+
kms_instance_id = string
142+
kms_account_id = optional(string)
143+
}))
139144
}))
140145
description = "List of worker pools."
141146
default = [

‎examples/multiple_mzr_clusters/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,11 @@ variable "worker_pools" {
136136
workers_per_zone = number
137137
resource_group_id = optional(string)
138138
labels = optional(map(string))
139+
boot_volume_encryption_kms_config = optional(object({
140+
crk = string
141+
kms_instance_id = string
142+
kms_account_id = optional(string)
143+
}))
139144
}))
140145
default = [
141146
{

‎examples/standard/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Standard Example
1+
# Standard Example With User Managed Boot Volume Encryption
22

33
- The example will provision an OCP cluster with one extra worker pool inside a VPC.
4-
- The example also enables a key protect provider for the cluster, as well as the required COS instance.
4+
- The example also enables a key protect provider for the cluster and boot volume encryption, as well as the required COS instance.

‎examples/standard/main.tf‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,11 @@ module "kp_all_inclusive" {
3535
resource_group_id = module.resource_group.resource_group_id
3636
region = var.region
3737
resource_tags = var.resource_tags
38-
key_map = { "ocp" = ["${var.prefix}-cluster-key"] }
38+
key_map = { "ocp" = [
39+
"${var.prefix}-cluster-key",
40+
"${var.prefix}-default-pool-boot-volume-encryption-key",
41+
"${var.prefix}-other-pool-boot-volume-encryption-key"
42+
] }
3943
}
4044

4145
##############################################################################
@@ -59,6 +63,33 @@ locals {
5963
cidr_block = module.vpc.subnet_zone_list[2].cidr
6064
}]
6165
}
66+
67+
worker_pools = [
68+
{
69+
subnet_prefix = "zone-1"
70+
pool_name = "default" # ibm_container_vpc_cluster automatically names standard pool "standard" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
71+
machine_type = "bx2.4x16"
72+
workers_per_zone = 2
73+
labels = {}
74+
resource_group_id = module.resource_group.resource_group_id
75+
boot_volume_encryption_kms_config = {
76+
crk = module.kp_all_inclusive.keys["ocp.${var.prefix}-default-pool-boot-volume-encryption-key"].key_id
77+
kms_instance_id = module.kp_all_inclusive.key_protect_guid
78+
}
79+
},
80+
{
81+
subnet_prefix = "zone-2"
82+
pool_name = "zone-2"
83+
machine_type = "bx2.4x16"
84+
workers_per_zone = 2
85+
labels = {}
86+
resource_group_id = module.resource_group.resource_group_id
87+
boot_volume_encryption_kms_config = {
88+
crk = module.kp_all_inclusive.keys["ocp.${var.prefix}-other-pool-boot-volume-encryption-key"].key_id
89+
kms_instance_id = module.kp_all_inclusive.key_protect_guid
90+
}
91+
}
92+
]
6293
}
6394

6495
module "ocp_base" {
@@ -70,7 +101,7 @@ module "ocp_base" {
70101
force_delete_storage = true
71102
vpc_id = module.vpc.vpc_id
72103
vpc_subnets = local.cluster_vpc_subnets
73-
worker_pools = var.worker_pools
104+
worker_pools = length(var.worker_pools) > 0 ? var.worker_pools : local.worker_pools
74105
ocp_version = var.ocp_version
75106
tags = var.resource_tags
76107
kms_config = {

‎examples/standard/variables.tf‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -50,22 +50,14 @@ variable "worker_pools" {
5050
workers_per_zone = number
5151
resource_group_id = optional(string)
5252
labels = optional(map(string))
53+
boot_volume_encryption_kms_config = optional(object({
54+
crk = string
55+
kms_instance_id = string
56+
kms_account_id = optional(string)
57+
}))
5358
}))
5459
description = "List of worker pools."
55-
default = [
56-
{
57-
subnet_prefix = "zone-1"
58-
pool_name = "default" # ibm_container_vpc_cluster automatically names standard pool "standard" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
59-
machine_type = "bx2.4x16"
60-
workers_per_zone = 2
61-
},
62-
{
63-
subnet_prefix = "zone-2"
64-
pool_name = "zone-2"
65-
machine_type = "bx2.4x16"
66-
workers_per_zone = 2
67-
}
68-
]
60+
default = []
6961
}
7062

7163
##############################################################################

‎main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,9 @@ resource "ibm_container_vpc_cluster" "cluster" {
6464
force_delete_storage = var.force_delete_storage
6565
disable_public_service_endpoint = var.disable_public_endpoint
6666
worker_labels = local.default_pool.labels
67+
crk = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
68+
kms_instance_id = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
69+
kms_account_id = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
6770

6871
lifecycle {
6972
ignore_changes = [kube_version]
@@ -122,6 +125,9 @@ resource "ibm_container_vpc_cluster" "autoscaling_cluster" {
122125
force_delete_storage = var.force_delete_storage
123126
disable_public_service_endpoint = var.disable_public_endpoint
124127
worker_labels = local.default_pool.labels
128+
crk = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.crk
129+
kms_instance_id = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_instance_id
130+
kms_account_id = local.default_pool.boot_volume_encryption_kms_config == null ? null : local.default_pool.boot_volume_encryption_kms_config.kms_account_id
125131

126132
lifecycle {
127133
ignore_changes = [worker_count, kube_version]
@@ -211,6 +217,9 @@ resource "ibm_container_vpc_worker_pool" "pool" {
211217
flavor = each.value.machine_type
212218
worker_count = each.value.workers_per_zone
213219
labels = each.value.labels
220+
crk = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.crk
221+
kms_instance_id = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.kms_instance_id
222+
kms_account_id = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.kms_account_id
214223

215224
dynamic "zones" {
216225
for_each = var.vpc_subnets[each.value.subnet_prefix]
@@ -249,6 +258,9 @@ resource "ibm_container_vpc_worker_pool" "autoscaling_pool" {
249258
flavor = each.value.machine_type
250259
worker_count = each.value.workers_per_zone
251260
labels = each.value.labels
261+
crk = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.crk
262+
kms_instance_id = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.kms_instance_id
263+
kms_account_id = each.value.boot_volume_encryption_kms_config == null ? null : each.value.boot_volume_encryption_kms_config.kms_account_id
252264

253265
lifecycle {
254266
ignore_changes = [worker_count]

‎module-metadata.json‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
],
2828
"pos": {
2929
"filename": "variables.tf",
30-
"line": 105
30+
"line": 110
3131
}
3232
},
3333
"cos_name": {
@@ -36,7 +36,7 @@
3636
"description": "Name of the COS instance to provision. New instance only provisioned if `use_existing_cos = false`. Default: `\u003ccluster_name\u003e_cos`",
3737
"pos": {
3838
"filename": "variables.tf",
39-
"line": 135
39+
"line": 140
4040
}
4141
},
4242
"disable_public_endpoint": {
@@ -50,7 +50,7 @@
5050
],
5151
"pos": {
5252
"filename": "variables.tf",
53-
"line": 117
53+
"line": 122
5454
}
5555
},
5656
"existing_cos_id": {
@@ -59,7 +59,7 @@
5959
"description": "The COS id of an already existing COS instance. Only required if 'use_existing_cos = true'",
6060
"pos": {
6161
"filename": "variables.tf",
62-
"line": 147
62+
"line": 152
6363
}
6464
},
6565
"force_delete_storage": {
@@ -73,7 +73,7 @@
7373
],
7474
"pos": {
7575
"filename": "variables.tf",
76-
"line": 129
76+
"line": 134
7777
}
7878
},
7979
"ibmcloud_api_key": {
@@ -98,7 +98,7 @@
9898
],
9999
"pos": {
100100
"filename": "variables.tf",
101-
"line": 81
101+
"line": 86
102102
}
103103
},
104104
"kms_config": {
@@ -107,7 +107,7 @@
107107
"description": "Use to attach a Key Protect instance to the cluster",
108108
"pos": {
109109
"filename": "variables.tf",
110-
"line": 153
110+
"line": 158
111111
}
112112
},
113113
"ocp_entitlement": {
@@ -121,7 +121,7 @@
121121
],
122122
"pos": {
123123
"filename": "variables.tf",
124-
"line": 123
124+
"line": 128
125125
}
126126
},
127127
"ocp_version": {
@@ -130,7 +130,7 @@
130130
"description": "The version of the OpenShift cluster that should be provisioned (format 4.x). This is only used during initial cluster provisioning, but ignored for future updates. If no value is passed, or the string 'latest' is passed, the current latest OCP version will be used.",
131131
"pos": {
132132
"filename": "variables.tf",
133-
"line": 87
133+
"line": 92
134134
}
135135
},
136136
"region": {
@@ -198,7 +198,7 @@
198198
],
199199
"pos": {
200200
"filename": "variables.tf",
201-
"line": 141
201+
"line": 146
202202
}
203203
},
204204
"verify_worker_network_readiness": {
@@ -211,7 +211,7 @@
211211
],
212212
"pos": {
213213
"filename": "variables.tf",
214-
"line": 169
214+
"line": 174
215215
}
216216
},
217217
"vpc_id": {
@@ -227,7 +227,7 @@
227227
],
228228
"pos": {
229229
"filename": "variables.tf",
230-
"line": 164
230+
"line": 169
231231
},
232232
"immutable": true
233233
},
@@ -243,7 +243,7 @@
243243
},
244244
"worker_pools": {
245245
"name": "worker_pools",
246-
"type": "list(object({\n subnet_prefix = string\n pool_name = string\n machine_type = string\n workers_per_zone = number\n resource_group_id = optional(string)\n labels = optional(map(string))\n }))",
246+
"type": "list(object({\n subnet_prefix = string\n pool_name = string\n machine_type = string\n workers_per_zone = number\n resource_group_id = optional(string)\n labels = optional(map(string))\n boot_volume_encryption_kms_config = optional(object({\n crk = string\n kms_instance_id = string\n kms_account_id = optional(string)\n }))\n }))",
247247
"description": "List of worker pools",
248248
"default": [
249249
{
@@ -276,7 +276,7 @@
276276
"description": "Optional, Map of lists containing node taints by node-pool name",
277277
"pos": {
278278
"filename": "variables.tf",
279-
"line": 75
279+
"line": 80
280280
}
281281
}
282282
},
@@ -417,7 +417,7 @@
417417
},
418418
"pos": {
419419
"filename": "main.tf",
420-
"line": 110
420+
"line": 113
421421
}
422422
},
423423
"ibm_container_vpc_cluster.cluster": {
@@ -456,7 +456,7 @@
456456
},
457457
"pos": {
458458
"filename": "main.tf",
459-
"line": 243
459+
"line": 252
460460
}
461461
},
462462
"ibm_container_vpc_worker_pool.pool": {
@@ -472,7 +472,7 @@
472472
},
473473
"pos": {
474474
"filename": "main.tf",
475-
"line": 205
475+
"line": 211
476476
}
477477
},
478478
"ibm_resource_instance.cos_instance": {
@@ -503,7 +503,7 @@
503503
},
504504
"pos": {
505505
"filename": "main.tf",
506-
"line": 300
506+
"line": 312
507507
}
508508
},
509509
"null_resource.reset_api_key": {
@@ -515,7 +515,7 @@
515515
},
516516
"pos": {
517517
"filename": "main.tf",
518-
"line": 181
518+
"line": 187
519519
}
520520
}
521521
},
@@ -532,7 +532,7 @@
532532
},
533533
"pos": {
534534
"filename": "main.tf",
535-
"line": 195
535+
"line": 201
536536
}
537537
},
538538
"data.ibm_container_cluster_versions.cluster_versions": {

‎variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ variable "worker_pools" {
4848
workers_per_zone = number
4949
resource_group_id = optional(string)
5050
labels = optional(map(string))
51+
boot_volume_encryption_kms_config = optional(object({
52+
crk = string
53+
kms_instance_id = string
54+
kms_account_id = optional(string)
55+
}))
5156
}))
5257
default = [
5358
{

0 commit comments

Comments
 (0)