feat: add support for install deps #867

Aashiq-J · 2025-11-14T09:20:58Z

Description

Add script to install binaries which are required by the scripts in the module.

Release required?

No release
Patch release (x.x.X)
Minor release (x.X.x)
Major release (X.x.x)

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

If relevant, a test for the change is included or updated with this PR.
If relevant, documentation for the change is included or updated with this PR.

For mergers

Use a conventional commit message to set the release level. Follow the guidelines.
Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
Use the Squash and merge option.

…form-ibm-base-ocp-vpc into install-deps

Aashiq-J · 2025-11-18T06:01:51Z

/run pipeline

Aashiq-J · 2025-11-18T08:26:38Z

/run pipeline

Aashiq-J · 2025-11-24T04:23:49Z

/run pipeline

Aashiq-J · 2025-11-24T08:22:36Z

/run pipeline

Aashiq-J · 2025-11-24T08:46:04Z

/run pipeline

Aashiq-J · 2025-11-24T11:14:40Z

/run pipeline

Aashiq-J · 2025-11-25T03:57:59Z

/run pipeline

Aashiq-J · 2025-11-25T06:38:37Z

/run pipeline

Aashiq-J · 2025-11-25T11:00:30Z

/run pipeline

Aashiq-J · 2025-11-26T03:29:20Z

/run pipeline

ocofaigh

Too much code duplication - lets sync up to see how we can handle here. Especially since this code would even be duplicated across multiple repos too. Perhaps time to leverage https://github.com/terraform-ibm-modules/common-bash-library

ocofaigh

Why do we have scripts/install-deps.sh and modules/kube-audit/scripts/install-deps.sh? We should only have 1 script that should be used by all the modules in this repo. If needed update the script to support only installing certain binaries if required

modules/kube-audit/scripts/confirm-rollout-status.sh

ocofaigh · 2025-11-26T11:31:36Z

modules/kube-audit/main.tf

+  count = var.install_dependencies ? 1 : 0
+  # change trigger to run every time
+  triggers = {
+    build_number = timestamp()


I don't think we need this to trigger every time. It only need to trigger if the null resource has to run again

I guess thats not possible, if we set triggers to other null_resource blocks, the install script will run after there is a change in the other null_resource block and not before.

I think we should look into this. I don’t like the fact we will always install as part of every plan. Perhaps there is some pre condition or lifecycle feature we could leverage in terraform?

ocofaigh · 2025-11-26T11:34:31Z

scripts/install-deps.sh

+# Optional custom URL prefix for all binaries
+CUSTOM_KUBECTL_URL="${CUSTOM_KUBECTL_URL:-}"
+CUSTOM_JQ_URL="${CUSTOM_JQ_URL:-}"
+CUSTOM_OC_URL="${CUSTOM_OC_URL:-}"


This is not documented anywhere? We should probably list the environment variabl overrides in the variable descrption.

I would also rename them to:

CUSTOM_KUBECTL_URL -> KUBECTL_DOWNLOAD_URL

CUSTOM_JQ_URL -> JQ_DOWNLOAD_URL

I'm just thinking that there might be authentication required for someones custom URL, but I guess its on them to make sure that handled.

I added the documentation to the main README

ocofaigh · 2025-11-26T11:36:28Z

scripts/install-deps.sh

+# Install: kubectl
+#######################################
+
+# renovate: datasource=github-releases depName=kubernetes/kubernetes


you will need to add a custom renovate rule in renovate.json for this to work (copy the one in common-dev-asstes)

scripts/install-deps.sh

variables.tf

Aashiq-J · 2025-11-26T13:51:48Z

@ocofaigh ,
kube-audit submodule can be used independently of the root module, thats why we have the install-binaries script in that submodule as well.

…form-ibm-base-ocp-vpc into install-deps

scripts/install-binaries.sh

ocofaigh

@Aashiq-J We should not have to duplicate the script in the submodule. Can't we find syntax to reference it from the same location? Worst case, we could use a symlink, but I'm hoping we can use ../.. to maybe find it?

modules/kube-audit/scripts/install-binaries.sh

README.md

modules/kube-audit/scripts/install-binaries.sh

Aashiq-J · 2025-12-01T15:35:08Z

@ocofaigh , ../.. usually gives an error in waypoint, that was why I was avoiding it. I'm just running a quick test to see if ../.. will work in waypoint.

ocofaigh · 2025-12-01T16:52:34Z

Can we look more into why this doesn't work? Perhaps set it up locally so we can play with it?

Aashiq-J · 2025-12-02T09:34:55Z

/run pipeline

Aashiq-J · 2025-12-02T11:51:54Z

         2025/12/02 11:04:44 Terraform apply | Error: local-exec provisioner error
         2025/12/02 11:04:44 Terraform apply | 
         2025/12/02 11:04:44 Terraform apply |   with module.kube_audit[0].null_resource.set_audit_webhook,
         2025/12/02 11:04:44 Terraform apply |   on ../../modules/kube-audit/main.tf line 122, in resource "null_resource" "set_audit_webhook":
         2025/12/02 11:04:44 Terraform apply |  122:   provisioner "local-exec" {
         2025/12/02 11:04:44 Terraform apply | 
         2025/12/02 11:04:44 Terraform apply | Error running command '../../modules/kube-audit/scripts/set_webhook.sh jp-osa
         2025/12/02 11:04:44 Terraform apply | true default d4nbekfo0gsdui1npgu0 bcf50e9435d0407ca539741836c70bbb default
         2025/12/02 11:04:44 Terraform apply | /tmp': exit status 1. Output: hostname: armada-api-b848b867d-5jxqm
         2025/12/02 11:04:44 Terraform apply | x-region: jp-osa
         2025/12/02 11:04:44 Terraform apply | x-request-id: f2b4b0cb-f855-4d74-877c-0856e3f10940
         2025/12/02 11:04:44 Terraform apply | date: Tue, 02 Dec 2025 11:02:10 GMT
         2025/12/02 11:04:44 Terraform apply | content-length: 321
         2025/12/02 11:04:44 Terraform apply | cache-control: no-cache, no-store
         2025/12/02 11:04:44 Terraform apply | content-security-policy: default-src 'none'; script-src 'self'
         2025/12/02 11:04:44 Terraform apply | 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:;
         2025/12/02 11:04:44 Terraform apply | style-src 'self' 'unsafe-inline'; font-src 'self'
         2025/12/02 11:04:44 Terraform apply | expires: 0
         2025/12/02 11:04:44 Terraform apply | pragma: no-cache
         2025/12/02 11:04:44 Terraform apply | strict-transport-security: max-age=31536000; includeSubDomains
         2025/12/02 11:04:44 Terraform apply | x-content-type-options: nosniff
         2025/12/02 11:04:44 Terraform apply | x-frame-options: DENY
         2025/12/02 11:04:44 Terraform apply | x-permitted-cross-domain-policies: master-only
         2025/12/02 11:04:44 Terraform apply | x-xss-protection: 1; mode=block
         2025/12/02 11:04:44 Terraform apply | 
         2025/12/02 11:04:44 Terraform apply | {"incidentID":"f2b4b0cb-f855-ad74-877c-0856e3f10940","code":"A0003","description":"Your
         2025/12/02 11:04:44 Terraform apply | IAM token could not be verified. Run ibmcloud iam oauth-tokens to retrieve
         2025/12/02 11:04:44 Terraform apply | your access tokens, and use the IAM token for the Authorization
         2025/12/02 11:04:44 Terraform apply | header.","type":"Authentication","recoveryCLI":"Run 'ibmcloud login' to log
         2025/12/02 11:04:44 Terraform apply | in to IBM Cloud."}
         2025/12/02 11:04:44 Terraform apply | Sleeping for 30 secs..
         2025/12/02 11:04:44 Terraform apply | Webhook status: ERROR::
         2025/12/02 11:04:44 Terraform apply | v1/clusters/d4nbekfo0gsdui1npgu0/apiserverconfigs/auditwebhook FAILED
         2025/12/02 11:04:44 Terraform apply | HTTP/2 401 
         2025/12/02 11:04:44 Terraform apply | content-type: application/json; charset=utf-8
         2025/12/02 11:04:44 Terraform apply | x-carrier: prod-osa21-carrier100
         2025/12/02 11:04:44 Terraform apply | x-correlation-id: 13b1ba94-be58-43fa-bc35-c1d9dbef7ba2
         2025/12/02 11:04:44 Terraform apply | x-hostname: armada-api-b848b867d-v2wj7
         2025/12/02 11:04:44 Terraform apply | x-region: jp-osa
         2025/12/02 11:04:44 Terraform apply | x-request-id: 1a17f220-dc9d-45be-84bb-e6c301987757
         2025/12/02 11:04:44 Terraform apply | date: Tue, 02 Dec 2025 11:02:40 GMT
         2025/12/02 11:04:44 Terraform apply | content-length: 321

Still facing issues with the kube-audit script which required token, will revert the change for now and need to debug that issue further.

Issue: https://github.ibm.com/GoldenEye/issues/issues/16988

Aashiq-J · 2025-12-02T11:57:06Z

/run pipeline

ocofaigh · 2025-12-02T12:53:43Z

@Aashiq-J can you please create an issue to investigate with the goal of adding back the provider data lookup to generate the access token?

Aashiq-J · 2025-12-02T14:02:36Z

/run pipeline

Aashiq-J · 2025-12-03T04:49:09Z

/run pipeline

Aashiq-J · 2025-12-03T05:02:05Z

/run pipeline

ocofaigh · 2025-12-03T08:27:11Z

@Aashiq-J can you please leave comments on why tests are failing as they fail so we know what kind of issues are tests are hitting

Aashiq-J · 2025-12-03T08:29:20Z

/run pipeline

Aashiq-J · 2025-12-03T08:31:37Z

last test failed due to this:


2025/12/03 04:58:11 Failed to execute script: exit status 1
Stderr: Looking up resource group ID for name: geretain-test-base-ocp-vpc
Found resource group ID: ed293fd4909f4bc69b1e85324b8c39db
FAIL	command-line-arguments	48.415s
FAIL
make: *** [Makefile:120: run-tests] Error 1

Not related to the code change.

terraform-ibm-modules-ops · 2025-12-03T12:19:25Z

🎉 This PR is included in version 3.74.0 🎉

The release is available on:

GitHub release
v3.74.0

Your semantic-release bot 📦🚀

feat: add support for install deps

e881082

Aashiq-J requested a review from vkuma17 as a code owner November 14, 2025 09:20

Aashiq-J and others added 4 commits November 14, 2025 14:54

test

9e40a6f

add variables

733a0a7

Merge branch 'main' of https://github.com/terraform-ibm-modules/terra…

647d147

…form-ibm-base-ocp-vpc into install-deps

Merge branch 'main' into install-deps

ce8cf9e

update test

c94e876

Aashiq-J and others added 2 commits November 24, 2025 09:49

Merge branch 'main' into install-deps

b0c4803

fix test

c8f9b34

udpate submodule

6d4f942

update readme

ba81ae2

update test

612138b

update script

9b40676

update test

bb310b0

ocofaigh reviewed Nov 26, 2025

View reviewed changes

ocofaigh requested changes Nov 26, 2025

View reviewed changes

Aashiq-J added 2 commits November 26, 2025 19:16

review changes

f577343

fix

febc4c3

Merge branch 'main' of https://github.com/terraform-ibm-modules/terra…

05221ac

…form-ibm-base-ocp-vpc into install-deps

SKIP UPGRADE TEST

9617423

ocofaigh reviewed Dec 1, 2025

View reviewed changes

scripts/install-binaries.sh Outdated Show resolved Hide resolved

Aashiq-J added 2 commits December 1, 2025 20:39

review change

16cd543

update path

55efa37

ocofaigh requested changes Dec 1, 2025

View reviewed changes

modules/kube-audit/scripts/install-binaries.sh Outdated Show resolved Hide resolved

README.md Show resolved Hide resolved

modules/kube-audit/scripts/install-binaries.sh Outdated Show resolved Hide resolved

test kube-audit

d8ad15a

Aashiq-J added 2 commits December 1, 2025 22:24

test path kube-audit

5cf6740

move script

c04417a

ocofaigh previously approved these changes Dec 2, 2025

View reviewed changes

revert kube-audit changes

5cca92d

Aashiq-J dismissed ocofaigh’s stale review via 5cca92d December 2, 2025 11:51

remove data block

02912da

Merge branch 'main' into install-deps

546c18a

ocofaigh approved these changes Dec 3, 2025

View reviewed changes

ocofaigh merged commit 7a7aad3 into main Dec 3, 2025
2 checks passed

ocofaigh deleted the install-deps branch December 3, 2025 12:18

terraform-ibm-modules-ops added the released label Dec 3, 2025

feat: add support for install deps #867

feat: add support for install deps #867

Uh oh!

Conversation

Aashiq-J commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Release required?

Release notes content

Run the pipeline

Checklist for reviewers

For mergers

Uh oh!

Aashiq-J commented Nov 18, 2025

Uh oh!

Aashiq-J commented Nov 18, 2025

Uh oh!

Aashiq-J commented Nov 24, 2025

Uh oh!

Aashiq-J commented Nov 24, 2025

Uh oh!

Aashiq-J commented Nov 24, 2025

Uh oh!

Aashiq-J commented Nov 24, 2025

Uh oh!

Aashiq-J commented Nov 25, 2025

Uh oh!

Aashiq-J commented Nov 25, 2025

Uh oh!

Aashiq-J commented Nov 25, 2025

Uh oh!

Aashiq-J commented Nov 26, 2025

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aashiq-J commented Nov 26, 2025

Uh oh!

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aashiq-J commented Dec 1, 2025

Uh oh!

ocofaigh commented Dec 1, 2025

Uh oh!

Aashiq-J commented Dec 2, 2025

Uh oh!

Aashiq-J commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Aashiq-J commented Dec 2, 2025

Uh oh!

Aashiq-J commented Nov 14, 2025 •

edited

Loading

Aashiq-J commented Dec 2, 2025 •

edited

Loading

ocofaigh commented Dec 2, 2025 •

edited

Loading