Test

.catalog-onboard-pipeline.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+offerings:
+  - name: deploy-arch-ibm-ocp-vpc
+    kind: solution
+    catalog_id: f64499c8-eb50-4985-bf91-29f9e605a433
+    offering_id: 1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8
+    variations:
+      - name: fully-configurable
+        mark_ready: true
+        install_type: fullstack
+        pre_validation: "tests/scripts/pre-validation-deploy-cos-instance-and-vpc.sh"
+        post_validation: "tests/scripts/post-validation-destroy-cos-instance-and-vpc.sh"
+        scc:
+          instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
+          region: us-south
+          scope_resource_group_var_name: existing_resource_group_name
+      - name: quickstart
+        mark_ready: true
+        install_type: fullstack

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Primary owner should be listed first in list of global owners, follwed by any secondary owners
+*       @toddgiguere @Aashiq-J

.github/settings.yml

@@ -19,6 +19,6 @@ repository:
   # The description is displayed under the repository name on the
   # organization page and in the 'About' section of the repository.
 
-  description: "Provision an IBM Cloud Red Hat OpenShift cluster on VPC Gen2"
+  description: "Provisions a Red Hat OpenShift VPC cluster on IBM Cloud"
 
-  topics: core-team, terraform, ibm-cloud, terraform-module, openshift-cluster, vpc-cluster, ocp
+  topics: core-team, terraform, ibm-cloud, terraform-module, openshift-cluster, vpc-cluster, ocp, supported, graduated

.github/workflows/ci.yml

@@ -7,9 +7,8 @@ on:
       - created
 jobs:
   call-terraform-ci-pipeline:
-    uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-terraform-module-ci-v2.yml@v1.16.0
+    uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-terraform-module-ci-v2.yml@v1.22.5
     secrets: inherit
     with:
       craSCCv2: true
-      craTarget: "examples/standard"
-      craRuleIgnoreFile: "cra-tf-validate-ignore-rules.json"
+      craConfigYamlFile: "cra-config.yaml"

.github/workflows/release.yml

@@ -8,5 +8,5 @@ on:
 
 jobs:
   call-terraform-release-pipeline:
-    uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-release.yml@v1.16.0
+    uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-release.yml@v1.22.5
     secrets: inherit

.releaserc

@@ -1,15 +1,29 @@
 {
   "tagFormat": "v${version}",
-  "branches": ["main"],
+  "branches": [
+    "main"
+  ],
   "plugins": [
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
     "@semantic-release/github",
-    ["@semantic-release/git", {
-      "assets": "false"
-    }],
-    ["@semantic-release/exec", {
-      "successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV"
-    }]
+    [
+      "@semantic-release/git",
+      {
+        "assets": "false"
+      }
+    ],
+    [
+      "@semantic-release/exec",
+      {
+        "successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV"
+      }
+    ],
+    [
+      "@semantic-release/exec",
+      {
+        "publishCmd": "./ci/trigger-catalog-onboarding-pipeline.sh --version=v${nextRelease.version}"
+      }
+    ]
   ]
 }

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "go.sum|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2023-06-09T23:33:34Z",
+  "generated_at": "2025-07-31T06:11:34Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -76,8 +76,19 @@
       "name": "TwilioKeyDetector"
     }
   ],
-  "results": {},
-  "version": "0.13.1+ibm.61.dss",
+  "results": {
+    "tests/pr_test.go": [
+      {
+        "hashed_secret": "8196b86ede820e665b2b8af9c648f4996be99838",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 89,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ]
+  },
+  "version": "0.13.1+ibm.62.dss",
   "word_list": {
     "file": null,
     "hash": null

cra-config.yaml

@@ -0,0 +1,8 @@
+version: "v1"
+CRA_TARGETS:
+  - CRA_TARGET: "examples/advanced"
+    CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"
+    PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
+    CRA_ENVIRONMENT_VARIABLES:  # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs.
+      TF_VAR_region: "us-south"
+      TF_VAR_prefix: "base-ocp-adv"

cra-tf-validate-ignore-rules.json

@@ -1,11 +1,10 @@
 {
     "scc_rules": [
-
         {
-            "scc_rule_id": "rule-ded212fe-7def-44ce-9480-0487067b64c4",
-            "description:": "Check whether Kubernetes Service is accessible only by using private endpoints",
-            "ignore_reason": "This is a valid issue - tracking in https://github.ibm.com/GoldenEye/issues/issues/174",
-            "is_valid": true
+            "scc_rule_id": "rule-64c0bea0-8760-4a6b-a56c-ee375a48961e",
+            "description": "Check whether Virtual Private Cloud (VPC) has no public gateways attached",
+            "ignore_reason": "This rule is not relevant to the module itself, just the VPC resource that is used in the example that is scanned",
+            "is_valid": false
         }
     ]
 }

examples/add_rules_to_sg/README.md

@@ -1,3 +1,12 @@
-# Add Rules to Security Groups Example
+# Cluster security group rules example
 
-This example will add security rules to the `kube-<vpcid>` and `kube-<clusterId>` security groups
+This example will add security rules to the `kube-<vpcid>` and `kube-<clusterId>` security groups.
+
+The following resources are provisioned by this example:
+
+- A new resource group, if an existing one is not passed in.
+- A VPC with subnets in a single zone and public gw attached.
+- Security rules to the `kube-<vpcid>` and `kube-<clusterId>` security groups.
+- A basic single zone OCP VPC cluster.
+
+You may also be interested in the [example](../custom_sg) that attaches separate security groups to worker nodes, as opposed to adding rules to existing IBM managed security groups.

examples/add_rules_to_sg/catalogValidationValues.json.template

@@ -0,0 +1,6 @@
+{
+  "ibmcloud_api_key": $VALIDATION_APIKEY,
+  "region": "au-syd",
+  "resource_tags": $TAGS,
+  "prefix": $PREFIX
+}