Skip to content

Commit e50cef7

Browse files
vkuma17Vipin KumarimprateekshShikha Maheshwari
authored
feat: Addressed DA improvements for better user experience<br> - pinned the addons version<br> - added more details in UI(catalog tile) regarding DA overview, features, architecture & variation<br> - updated DA architecture diagram to include on_by_default addons<br>* updated prefix input variable description and validation for DA (#667)
* feat: da improvement * feat: da improvement * modified catalog json * updated dependency version and input mappings * added notes for permissions * updated dependency versions * improvement * modified diagram * Update ibm_catalog.json * Update ibm_catalog.json * modified diagram * modified diagram * modified diagram * modified catalog * modified catalog * modified diagram * modified catalog json * modified catalog * removed go.work files pushed by mistake * modified diagram * modified prefix * modified diagram * added description for addons * added plan for secrets manager * Update ibm_catalog.json * addressed review comments * diagram link of PR branch for testing * addressed review comments * addressed review comments * addressed review comments * diagram dark mode * addressed review comments * addressed review comments * addressed review comments * modified diagram * addressed review comments * addressed review comments * updates in tile content and architecture desc * Update DA_docs.md * addressed review comments * addressed rally comments * addressed rally comments * modified diagram * Update variables.tf * changed default OS * modified diagram link * modified diagram * update ref arch diagram * update doc * ocp version changed to 4.17 in DA * reverted back 4.18 in module * rolled back example * removed 4.18 from catalog --------- Co-authored-by: Vipin Kumar <[email protected]> Co-authored-by: prateek <[email protected]> Co-authored-by: Shikha Maheshwari <[email protected]>
1 parent 3c4db1d commit e50cef7

File tree

7 files changed

+506
-284
lines changed

7 files changed

+506
-284
lines changed

‎ibm_catalog.json‎

Lines changed: 441 additions & 122 deletions
Large diffs are not rendered by default.

‎reference-architecture/deployable-architecture-ocp-cluster.svg‎

Lines changed: 1 addition & 1 deletion
Loading

‎solutions/fully-configurable/DA_docs.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -127,12 +127,12 @@ This variable defines the worker node pools for your OCP cluster, with each pool
127127
{
128128
vpc_subnets = [
129129
{
130-
id = "0717-a4b3c2d1-e5f6-g7h8-i9j0-k1l2m3n4o5p6" # pragma: allowlist secret
130+
id = "<REPLACE ME>"
131131
zone = "us-south-1"
132132
cidr_block = " "10.10.10.0/24"
133133
},
134134
{
135-
id = "0717-b4c3d2e1-f5g6-h7i8-j9k0-l1m2n3o4p5q6" # pragma: allowlist secret
135+
id = "<REPLACE ME>"
136136
zone = "us-south-2"
137137
cidr_block = "10.20.10.0/24"
138138
}
@@ -230,10 +230,10 @@ This variable allows you to provide a rule for the target service to enforce acc
230230
### Example for cbr_rules
231231

232232
```hcl
233-
cbr_rules = [
233+
[
234234
{
235235
description = "Event Notifications can be accessed from xyz"
236-
account_id = "defc0df06b644a9cabc6e44f55b3880s."
236+
account_id = "<REPLACE ME>"
237237
rule_contexts= [{
238238
attributes = [
239239
{
@@ -242,11 +242,11 @@ cbr_rules = [
242242
},
243243
{
244244
name = "networkZoneId"
245-
value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret
245+
value = "<REPLACE ME>"
246246
}
247247
]
248248
}
249-
]
249+
]
250250
enforcement_mode = "enabled"
251251
operations = [{
252252
api_types = [{

‎solutions/fully-configurable/README.md‎

Lines changed: 2 additions & 130 deletions
Large diffs are not rendered by default.

‎solutions/fully-configurable/main.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ locals {
3939
cluster_existing_kms_guid = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_cluster ? module.existing_kms_crn_parser[0].service_instance : var.existing_cluster_kms_key_crn != null ? module.existing_cluster_kms_key_crn_parser[0].service_instance : null
4040
cluster_kms_account_id = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_cluster ? module.existing_kms_crn_parser[0].account_id : var.existing_cluster_kms_key_crn != null ? module.existing_cluster_kms_key_crn_parser[0].account_id : null
4141
cluster_kms_key_id = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_cluster ? module.kms[0].keys[format("%s.%s", local.cluster_key_ring_name, local.cluster_key_name)].key_id : var.existing_cluster_kms_key_crn != null ? module.existing_cluster_kms_key_crn_parser[0].resource : null
42-
cluster_key_ring_name = "${local.prefix}${var.cluster_key_ring_name}"
43-
cluster_key_name = "${local.prefix}${var.cluster_key_name}"
42+
cluster_key_ring_name = "${local.prefix}${var.cluster_kms_key_ring_name}"
43+
cluster_key_name = "${local.prefix}${var.cluster_kms_key_name}"
4444

45-
boot_volume_key_ring_name = "${local.prefix}${var.boot_volume_key_ring_name}"
46-
boot_volume_key_name = "${local.prefix}${var.boot_volume_key_name}"
45+
boot_volume_key_ring_name = "${local.prefix}${var.boot_volume_kms_key_ring_name}"
46+
boot_volume_key_name = "${local.prefix}${var.boot_volume_kms_key_name}"
4747
boot_volume_existing_kms_guid = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_boot_volume ? module.existing_kms_crn_parser[0].service_instance : var.existing_boot_volume_kms_key_crn != null ? module.existing_boot_volume_kms_key_crn_parser[0].service_instance : null
4848
boot_volume_kms_account_id = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_boot_volume ? module.existing_kms_crn_parser[0].account_id : var.existing_boot_volume_kms_key_crn != null ? module.existing_boot_volume_kms_key_crn_parser[0].account_id : null
4949
boot_volume_kms_key_id = var.existing_kms_instance_crn != null && var.kms_encryption_enabled_boot_volume ? module.kms[0].keys[format("%s.%s", local.boot_volume_key_ring_name, local.boot_volume_key_name)].key_id : var.existing_boot_volume_kms_key_crn != null ? module.existing_boot_volume_kms_key_crn_parser[0].resource : null

‎solutions/fully-configurable/provider.tf‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,24 @@
33
########################################################################################################################
44

55
provider "ibm" {
6-
ibmcloud_api_key = var.ibmcloud_api_key
7-
region = local.vpc_region
8-
visibility = var.provider_visibility
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = local.vpc_region
8+
visibility = var.provider_visibility
9+
private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
910
}
1011

1112
provider "ibm" {
12-
alias = "kms"
13-
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
14-
region = local.cluster_kms_region
15-
visibility = var.provider_visibility
13+
alias = "kms"
14+
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
15+
region = local.cluster_kms_region
16+
visibility = var.provider_visibility
17+
private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
1618
}
1719

1820
provider "ibm" {
19-
alias = "secrets_manager"
20-
ibmcloud_api_key = var.ibmcloud_api_key
21-
region = var.enable_secrets_manager_integration ? module.existing_secrets_manager_instance_parser[0].region : local.vpc_region
22-
visibility = var.provider_visibility
21+
alias = "secrets_manager"
22+
ibmcloud_api_key = var.ibmcloud_api_key
23+
region = var.enable_secrets_manager_integration ? module.existing_secrets_manager_instance_parser[0].region : local.vpc_region
24+
visibility = var.provider_visibility
25+
private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
2326
}

‎solutions/fully-configurable/variables.tf‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,32 @@ variable "ibmcloud_api_key" {
1313

1414
variable "prefix" {
1515
type = string
16-
description = "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To not use any prefix value, you can set this value to `null` or an empty string."
1716
nullable = true
17+
description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-0405-ocp. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)."
18+
1819
validation {
19-
condition = (var.prefix == null ? true :
20+
# - null and empty string is allowed
21+
# - Must not contain consecutive hyphens (--): length(regexall("--", var.prefix)) == 0
22+
# - Starts with a lowercase letter: [a-z]
23+
# - Contains only lowercase letters (a–z), digits (0–9), and hyphens (-)
24+
# - Must not end with a hyphen (-): [a-z0-9]
25+
condition = (var.prefix == null || var.prefix == "" ? true :
2026
alltrue([
21-
can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)),
22-
length(regexall("^.*--.*", var.prefix)) == 0
27+
can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)),
28+
length(regexall("--", var.prefix)) == 0
2329
])
2430
)
25-
error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters."
31+
error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')."
32+
}
33+
34+
validation {
35+
# must not exceed 16 characters in length
36+
condition = length(var.prefix) <= 16
37+
error_message = "Prefix must not exceed 16 characters."
2638
}
2739
}
2840

41+
2942
variable "existing_resource_group_name" {
3043
type = string
3144
description = "The name of an existing resource group to provision the cluster."
@@ -118,7 +131,7 @@ variable "addons" {
118131
parameters_json = optional(string)
119132
}))
120133
})
121-
description = "Map of OCP cluster add-on versions to install (NOTE: The 'vpc-block-csi-driver' add-on is installed by default for VPC clusters and 'ibm-storage-operator' is installed by default in OCP 4.15 and later, however you can explicitly specify it here if you wish to choose a later version than the default one). For full list of all supported add-ons and versions, see https://cloud.ibm.com/docs/containers?topic=containers-supported-cluster-addon-versions. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/fully-configurable/DA_docs.md#options-with-addons)"
134+
description = "Map of OCP cluster add-on versions to install (NOTE: The 'vpc-block-csi-driver' add-on is installed by default for VPC clusters and 'ibm-storage-operator' is installed by default in OCP 4.15 and later, however you can explicitly specify it here if you wish to choose a later version than the default one). [Check supported addons and versions here](https://cloud.ibm.com/docs/containers?topic=containers-supported-cluster-addon-versions). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/solutions/fully-configurable/DA_docs.md#options-with-addons)"
122135
nullable = false
123136
default = {}
124137
}
@@ -406,13 +419,13 @@ variable "kms_endpoint_type" {
406419
}
407420
}
408421

409-
variable "cluster_key_ring_name" {
422+
variable "cluster_kms_key_ring_name" {
410423
type = string
411424
default = "cluster-key-ring"
412425
description = "The name of the key ring to be created for the cluster's Object Storage bucket encryption key. Applies only if not specifying an existing key. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
413426
}
414427

415-
variable "cluster_key_name" {
428+
variable "cluster_kms_key_name" {
416429
type = string
417430
default = "cluster-key"
418431
description = "The name of the key to be created for the cluster's Object Storage bucket encryption. Applies only if not specifying an existing key. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
@@ -461,13 +474,13 @@ variable "existing_boot_volume_kms_key_crn" {
461474
}
462475
}
463476

464-
variable "boot_volume_key_ring_name" {
477+
variable "boot_volume_kms_key_ring_name" {
465478
type = string
466479
default = "boot-volume-key-ring"
467480
description = "The name for the key ring created for the block storage volumes key. Applies only if not specifying an existing key. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
468481
}
469482

470-
variable "boot_volume_key_name" {
483+
variable "boot_volume_kms_key_name" {
471484
type = string
472485
default = "boot-volume-key"
473486
description = "The name for the key created for the block storage volumes. Applies only if not specifying an existing key. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
@@ -538,6 +551,21 @@ variable "secrets_manager_endpoint_type" {
538551
}
539552
}
540553

554+
# tflint-ignore: all
555+
variable "secrets_manager_service_plan" {
556+
type = string
557+
description = "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)."
558+
default = "standard"
559+
validation {
560+
condition = contains(["standard", "trial"], var.secrets_manager_service_plan)
561+
error_message = "Only 'standard' and 'trial' are allowed values for 'service_plan'. Applies only if not providing a value for the 'existing_secrets_manager_instance_crn' input."
562+
}
563+
validation {
564+
condition = var.existing_secrets_manager_instance_crn == null && var.enable_secrets_manager_integration ? var.secrets_manager_service_plan != null : true
565+
error_message = "A value for 'service_plan' is required if not providing a value for 'existing_secrets_manager_instance_crn'"
566+
}
567+
}
568+
541569
variable "skip_ocp_secrets_manager_iam_auth_policy" {
542570
type = bool
543571
description = "To skip creating auth policy that allows OCP cluster 'Manager' role access in the existing Secrets Manager instance for managing ingress certificates."

0 commit comments

Comments
 (0)