Skip to content

Commit 6f61a7e

Browse files
arya-girish-kArya Girish K
arya-girish-k
and
Arya Girish K
authored
feat: improved user experience for validating input variable values <br> - updated required terraform to be >= 1.9.0 (#59)
* refactor: cross object reference for input variable validation * Modified validation * fix: Resolved conflicts and updated validation * fix :Update description --------- Co-authored-by: Arya Girish K <[email protected]>
1 parent c21918b commit 6f61a7e

File tree

26 files changed

+85
-155
lines changed

26 files changed

+85
-155
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -494,7 +494,7 @@ module "es_kubernetes_secret" {
494494
495495
| Name | Version |
496496
|------|---------|
497-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
497+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
498498
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.11.0, < 3.0.0 |
499499
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.16.1, < 3.0.0 |
500500

‎examples/all-combined/importedcertificate.tf‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,6 @@
22
# imported certificate for secrets manager
33
##################################################################
44

5-
locals {
6-
7-
# validation for secrets manager region to be set for existing secrets manager instance
8-
validate_imported_sm_region_cnd = var.imported_certificate_sm_id != null && var.imported_certificate_sm_region == null
9-
validate_imported_sm_region_msg = "imported_certificate_sm_region must also be set when value given for imported_certificate_sm_id"
10-
# tflint-ignore: terraform_unused_declarations
11-
validate_imported_sm_region_chk = regex(
12-
"^${local.validate_imported_sm_region_msg}$",
13-
(!local.validate_imported_sm_region_cnd
14-
? local.validate_imported_sm_region_msg
15-
: ""))
16-
17-
validate_imported_sm_cnd = (var.imported_certificate_public_secret_id != null && var.imported_certificate_private_secret_id != null) && var.imported_certificate_sm_id == null
18-
validate_imported_sm_msg = "If imported_certificate_public_secret_id and imported_certificate_private_secret_id to create an imported certificate also imported_certificate_sm_id must be set"
19-
# tflint-ignore: terraform_unused_declarations
20-
validate_imported_sm_chk = regex(
21-
"^${local.validate_imported_sm_msg}$",
22-
(!local.validate_imported_sm_cnd
23-
? local.validate_imported_sm_msg
24-
: ""))
25-
}
26-
275
# loading from Secrets Manager the three components (private key, intermediate and public cert) composing the imported certificate
286
data "ibm_sm_arbitrary_secret" "imported_certificate_intermediate" {
297
count = var.imported_certificate_intermediate_secret_id != null ? 1 : 0

‎examples/all-combined/secretsmanager.tf‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,6 @@
33
##############################################################################
44

55
locals {
6-
7-
# validation for secrets manager region to be set for existing secrets manager instance
8-
validate_sm_region_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_region == null
9-
validate_sm_region_msg = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
10-
# tflint-ignore: terraform_unused_declarations
11-
validate_sm_region_chk = regex(
12-
"^${local.validate_sm_region_msg}$",
13-
(!local.validate_sm_region_cnd
14-
? local.validate_sm_region_msg
15-
: ""))
16-
17-
# validation for secrets manager crn to be set for existing secrets manager instance if using private service endpoints
18-
validate_sm_crn_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_crn == null && var.service_endpoints == "private"
19-
validate_sm_crn_msg = "existing_sm_instance_crn must also be set when value given for existing_sm_instance_guid if service_endpoints is private."
20-
# tflint-ignore: terraform_unused_declarations
21-
validate_sm_crn_chk = regex(
22-
"^${local.validate_sm_crn_msg}$",
23-
(!local.validate_sm_crn_cnd
24-
? local.validate_sm_crn_msg
25-
: ""))
26-
276
# setting the secrets manager resource id to use
287
sm_guid = var.existing_sm_instance_guid == null ? ibm_resource_instance.secrets_manager[0].guid : var.existing_sm_instance_guid
298

‎examples/all-combined/variables.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,14 @@ variable "existing_sm_instance_guid" {
207207
type = string
208208
description = "Existing Secrets Manager GUID. If not provided a new instance will be provisioned"
209209
default = null
210+
validation {
211+
condition = var.existing_sm_instance_guid != null ? var.existing_sm_instance_region != null : true
212+
error_message = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
213+
}
214+
validation {
215+
condition = var.existing_sm_instance_guid != null && var.service_endpoints == "private" ? var.existing_sm_instance_crn != null : true
216+
error_message = "existing_sm_instance_crn must also be set when value given for existing_sm_instance_guid if service_endpoints is private."
217+
}
210218
}
211219

212220
variable "existing_sm_instance_crn" {
@@ -287,6 +295,14 @@ variable "imported_certificate_sm_id" {
287295
type = string
288296
default = null
289297
description = "Secrets Manager instance id where the components for the intermediate certificate are stored"
298+
validation {
299+
condition = var.imported_certificate_sm_id != null ? var.imported_certificate_sm_region != null : true
300+
error_message = "imported_certificate_sm_region must also be set when value given for imported_certificate_sm_id"
301+
}
302+
validation {
303+
condition = (var.imported_certificate_public_secret_id != null && var.imported_certificate_private_secret_id != null) && var.imported_certificate_sm_id == null ? false : true
304+
error_message = "If imported_certificate_public_secret_id and imported_certificate_private_secret_id to create an imported certificate also imported_certificate_sm_id must be set"
305+
}
290306
}
291307

292308
variable "imported_certificate_sm_region" {

‎examples/all-combined/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.1.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
kubernetes = {
55
source = "hashicorp/kubernetes"

‎examples/basic/main.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,6 @@
44

55
locals {
66

7-
# general
8-
validate_sm_region_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_region == null
9-
validate_sm_region_msg = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
10-
# tflint-ignore: terraform_unused_declarations
11-
validate_sm_region_chk = regex(
12-
"^${local.validate_sm_region_msg}$",
13-
(!local.validate_sm_region_cnd
14-
? local.validate_sm_region_msg
15-
: ""))
16-
177
sm_guid = var.existing_sm_instance_guid == null ? ibm_resource_instance.secrets_manager[0].guid : var.existing_sm_instance_guid
188

199

‎examples/basic/variables.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,10 @@ variable "existing_sm_instance_guid" {
5151
type = string
5252
description = "Existing Secrets Manager GUID. If not provided a new instance will be provisioned"
5353
default = null
54+
validation {
55+
condition = var.existing_sm_instance_guid != null ? var.existing_sm_instance_region != null : true
56+
error_message = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
57+
}
5458
}
5559

5660
variable "existing_sm_instance_region" {

‎examples/basic/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.0.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
kubernetes = {
55
source = "hashicorp/kubernetes"

‎examples/trusted-profiles-authentication/main.tf‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,6 @@ locals {
1313
secret_group_name = "${var.prefix}-sm-secret-group" #checkov:skip=CKV_SECRET_6
1414
es_kubernetes_namespaces = ["${var.prefix}-tp-test-1", "${var.prefix}-tp-test-2"] # namespace to create the externalsecrets resources for secrets sync
1515

16-
validate_sm_region_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_region == null
17-
validate_sm_region_msg = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
18-
# tflint-ignore: terraform_unused_declarations
19-
validate_sm_region_chk = regex(
20-
"^${local.validate_sm_region_msg}$",
21-
(!local.validate_sm_region_cnd
22-
? local.validate_sm_region_msg
23-
: ""))
24-
25-
# validation for secrets manager crn to be set for existing secrets manager instance if using private service endpoints
26-
validate_sm_crn_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_crn == null && var.service_endpoints == "private"
27-
validate_sm_crn_msg = "existing_sm_instance_crn must also be set when value given for existing_sm_instance_guid if service_endpoints is private."
28-
# tflint-ignore: terraform_unused_declarations
29-
validate_sm_crn_chk = regex(
30-
"^${local.validate_sm_crn_msg}$",
31-
(!local.validate_sm_crn_cnd
32-
? local.validate_sm_crn_msg
33-
: ""))
34-
3516
sm_guid = var.existing_sm_instance_guid == null ? ibm_resource_instance.secrets_manager[0].guid : var.existing_sm_instance_guid
3617
# if service_endpoints is not private the crn for SM is not needed because of VPE creation is not needed
3718
sm_crn = var.existing_sm_instance_crn == null ? (var.service_endpoints == "private" ? ibm_resource_instance.secrets_manager[0].crn : "") : var.existing_sm_instance_crn

‎examples/trusted-profiles-authentication/variables.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,14 @@ variable "existing_sm_instance_guid" {
3838
type = string
3939
description = "Existing Secrets Manager GUID. If not provided a new instance will be provisioned"
4040
default = null
41+
validation {
42+
condition = var.existing_sm_instance_guid != null ? var.existing_sm_instance_region != null : true
43+
error_message = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
44+
}
45+
validation {
46+
condition = var.existing_sm_instance_guid != null && var.service_endpoints == "private" ? var.existing_sm_instance_crn != null : true
47+
error_message = "existing_sm_instance_crn must also be set when value given for existing_sm_instance_guid if service_endpoints is private."
48+
}
4149
}
4250

4351
variable "existing_sm_instance_crn" {

0 commit comments

Comments
 (0)