diff --git a/README.md b/README.md index cc663d19..fe2618a5 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ External Secrets Operator synchronizes secrets in the Kubernetes cluster with se The module provides the following features: - Install and configure External Secrets Operator (ESO). -- Customise External Secret Operator deployment on specific cluster workers by configuration approriate NodeSelector and Tolerations in the ESO helm release [More details below](#customise-eso-deployment-on-specific-cluster-nodes) +- Customise External Secret Operator deployment on specific cluster workers by configuration appropriate NodeSelector and Tolerations in the ESO helm release [More details below](#customise-eso-deployment-on-specific-cluster-nodes) The submodules automate the configuration of an operator, providing the following features: - Deploy and configure [ClusterSecretStore](https://external-secrets.io/latest/api/clustersecretstore/) resources for cluster scope secrets store [eso-clusterstore](./eso-clusterstore/README.md) @@ -116,7 +116,6 @@ will make the External Secret Operator to run on clusters nodes labeled with `de The resulting helm release configuration, according to the `terraform plan` output would be like ```bash - (...) # module.external_secrets_operator.helm_release.external_secrets_operator[0] will be created + resource "helm_release" "external_secrets_operator" { @@ -520,18 +519,18 @@ You need the following permissions to run this module. | [eso\_cluster\_nodes\_configuration](#input\_eso\_cluster\_nodes\_configuration) | Configuration to use to customise ESO deployment on specific cluster nodes. Setting appropriate values will result in customising ESO helm release. Default value is null to keep ESO standard deployment. |
object({
nodeSelector = object({
label = string
value = string
})
tolerations = object({
key = string
operator = string
value = string
effect = string
})
})
| `null` | no | | [eso\_enroll\_in\_servicemesh](#input\_eso\_enroll\_in\_servicemesh) | Flag to enroll ESO into istio servicemesh | `bool` | `false` | no | | [eso\_image](#input\_eso\_image) | The External Secrets Operator image in the format of `[registry-url]/[namespace]/[image]`. | `string` | `"ghcr.io/external-secrets/external-secrets"` | no | -| [eso\_image\_version](#input\_eso\_image\_version) | The version or digest for the external secrets image to deploy. If changing the value, ensure it is compatible with the chart version set in eso\_chart\_version. | `string` | `"v0.19.2-ubi@sha256:b85e577e14c0a943e5eda57d631012d8fe7cea0e747069bfd9fdf3736cdad3ad"` | no | +| [eso\_image\_version](#input\_eso\_image\_version) | The version or digest for the external secrets image to deploy. If changing the value, ensure it is compatible with the chart version set in eso\_chart\_version. | `string` | `"v0.20.1-ubi@sha256:33dc5f563339e6332e1549c9e3c2b362d1e1b03acada1386a6f2c6f2d5af4a6e"` | no | | [eso\_namespace](#input\_eso\_namespace) | Namespace to create and be used to install ESO components including helm releases. | `string` | `null` | no | | [eso\_pod\_configuration](#input\_eso\_pod\_configuration) | Configuration to use to customise ESO deployment on specific pods. Setting appropriate values will result in customising ESO helm release. Default value is {} to keep ESO standard deployment. Ignore the key if not required. |
object({
annotations = optional(object({
# The annotations for external secret controller pods.
external_secrets = optional(map(string), {})
# The annotations for external secret cert controller pods.
external_secrets_cert_controller = optional(map(string), {})
# The annotations for external secret controller pods.
external_secrets_webhook = optional(map(string), {})
}), {})

labels = optional(object({
# The labels for external secret controller pods.
external_secrets = optional(map(string), {})
# The labels for external secret cert controller pods.
external_secrets_cert_controller = optional(map(string), {})
# The labels for external secret controller pods.
external_secrets_webhook = optional(map(string), {})
}), {})
})
| `{}` | no | | [existing\_eso\_namespace](#input\_existing\_eso\_namespace) | Existing Namespace to be used to install ESO components including helm releases. | `string` | `null` | no | | [reloader\_chart\_location](#input\_reloader\_chart\_location) | The location of the Reloader Helm chart. | `string` | `"https://stakater.github.io/stakater-charts"` | no | -| [reloader\_chart\_version](#input\_reloader\_chart\_version) | The version of the Reloader Helm chart. Ensure that the chart version is compatible with the image version specified in reloader\_image\_version. | `string` | `"2.2.0"` | no | +| [reloader\_chart\_version](#input\_reloader\_chart\_version) | The version of the Reloader Helm chart. Ensure that the chart version is compatible with the image version specified in reloader\_image\_version. | `string` | `"2.2.3"` | no | | [reloader\_custom\_values](#input\_reloader\_custom\_values) | String containing custom values to be used for reloader helm chart. See https://github.com/stakater/Reloader/blob/master/deployments/kubernetes/chart/reloader/values.yaml | `string` | `null` | no | | [reloader\_deployed](#input\_reloader\_deployed) | Whether to deploy reloader or not https://github.com/stakater/Reloader | `bool` | `true` | no | | [reloader\_ignore\_configmaps](#input\_reloader\_ignore\_configmaps) | Whether to ignore configmap changes or not | `bool` | `false` | no | | [reloader\_ignore\_secrets](#input\_reloader\_ignore\_secrets) | Whether to ignore secret changes or not | `bool` | `false` | no | | [reloader\_image](#input\_reloader\_image) | The reloader image repository in the format of `[registry-url]/[namespace]/[image]`. | `string` | `"ghcr.io/stakater/reloader"` | no | -| [reloader\_image\_version](#input\_reloader\_image\_version) | The version or digest for the reloader image to deploy. If changing the value, ensure it is compatible with the chart version set in reloader\_chart\_version. | `string` | `"v1.4.6-ubi@sha256:98403ed026af2eac04796f8e3d99530ed7f251a5d40b50ac172a008933338d48"` | no | +| [reloader\_image\_version](#input\_reloader\_image\_version) | The version or digest for the reloader image to deploy. If changing the value, ensure it is compatible with the chart version set in reloader\_chart\_version. | `string` | `"v1.4.8-ubi@sha256:d87801fae5424f347d34b776ba25ea0c1ba80a8b50ba91ece0777206a47d91d3"` | no | | [reloader\_is\_argo\_rollouts](#input\_reloader\_is\_argo\_rollouts) | Enable Argo Rollouts | `bool` | `false` | no | | [reloader\_is\_openshift](#input\_reloader\_is\_openshift) | Enable OpenShift DeploymentConfigs | `bool` | `true` | no | | [reloader\_log\_format](#input\_reloader\_log\_format) | The log format to use for reloader. Possible values are `json` or `text`. Default value is `json` | `string` | `"text"` | no | diff --git a/examples/all-combined/clusterstore.tf b/examples/all-combined/clusterstore.tf index 795e59e6..8cb49760 100644 --- a/examples/all-combined/clusterstore.tf +++ b/examples/all-combined/clusterstore.tf @@ -39,7 +39,7 @@ locals { # Create username_password secret and store in secret manager module "sm_userpass_secret" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.secrets_manager_group.secret_group_id @@ -51,8 +51,8 @@ module "sm_userpass_secret" { #tfsec:ignore:general-secrets-no-plaintext-exposure secret_username = "artifactory-user" # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value secret_auto_rotation = false - secret_auto_rotation_interval = 0 - secret_auto_rotation_unit = null + secret_auto_rotation_interval = 1 + secret_auto_rotation_unit = "day" providers = { ibm = ibm.ibm-sm } diff --git a/examples/all-combined/main.tf b/examples/all-combined/main.tf index cbbc5537..fa5f5ca9 100644 --- a/examples/all-combined/main.tf +++ b/examples/all-combined/main.tf @@ -79,7 +79,7 @@ module "zone_subnet_addrs" { module "vpc" { source = "terraform-ibm-modules/vpc/ibm" - version = "1.5.1" + version = "1.5.2" vpc_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id locations = [] @@ -96,7 +96,7 @@ module "vpc" { module "subnet_prefix" { source = "terraform-ibm-modules/vpc/ibm//modules/vpc-address-prefix" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) name = "${var.prefix}-z-${local.subnet_prefix[count.index].label}-${split("-", local.subnet_prefix[count.index].zone)[2]}" location = local.subnet_prefix[count.index].zone @@ -108,7 +108,7 @@ module "subnet_prefix" { module "subnets" { depends_on = [module.subnet_prefix] source = "terraform-ibm-modules/vpc/ibm//modules/subnet" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) location = local.subnet_prefix[count.index].zone vpc_id = module.vpc.vpc.vpc_id @@ -120,7 +120,7 @@ module "subnets" { module "public_gateways" { source = "terraform-ibm-modules/vpc/ibm//modules/public-gateway" - version = "1.5.1" + version = "1.5.2" count = length(var.zones) vpc_id = module.vpc.vpc.vpc_id location = "${var.region}-${var.zones[count.index]}" @@ -130,7 +130,7 @@ module "public_gateways" { module "security_group" { source = "terraform-ibm-modules/vpc/ibm//modules/security-group" - version = "1.5.1" + version = "1.5.2" depends_on = [module.vpc] create_security_group = false resource_group_id = module.resource_group.resource_group_id @@ -176,7 +176,7 @@ locals { module "network_acl" { source = "terraform-ibm-modules/vpc/ibm//modules/network-acl" - version = "1.5.1" + version = "1.5.2" name = "${var.prefix}-vpc-acl" vpc_id = module.vpc.vpc.vpc_id resource_group_id = module.resource_group.resource_group_id @@ -186,7 +186,7 @@ module "network_acl" { # OCP CLUSTER creation module "ocp_base" { source = "terraform-ibm-modules/base-ocp-vpc/ibm" - version = "3.55.4" + version = "3.60.0" cluster_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id region = var.region @@ -231,7 +231,7 @@ data "ibm_cis" "cis_instance" { module "vpes" { source = "terraform-ibm-modules/vpe-gateway/ibm" - version = "4.7.5" + version = "4.7.7" count = var.service_endpoints == "private" ? 1 : 0 region = var.region prefix = "vpe" diff --git a/examples/all-combined/privatecertificate.tf b/examples/all-combined/privatecertificate.tf index 7bc971f4..f3fa9b32 100644 --- a/examples/all-combined/privatecertificate.tf +++ b/examples/all-combined/privatecertificate.tf @@ -13,7 +13,7 @@ locals { # private certificate engine module "secrets_manager_private_secret_engine" { source = "terraform-ibm-modules/secrets-manager-private-cert-engine/ibm" - version = "1.6.7" + version = "1.6.11" secrets_manager_guid = local.sm_guid region = local.sm_region root_ca_name = var.pvt_ca_name != null ? var.pvt_ca_name : "pvt-${var.prefix}-project-root-ca" @@ -30,7 +30,7 @@ module "secrets_manager_private_secret_engine" { module "secrets_manager_private_certificate" { depends_on = [module.secrets_manager_private_secret_engine] source = "terraform-ibm-modules/secrets-manager-private-cert/ibm" - version = "1.4.4" + version = "1.4.7" cert_name = "${var.prefix}-sm-private-cert" cert_description = "Private certificate for ${local.pvt_cert_common_name}" cert_secrets_group_id = module.secrets_manager_group.secret_group_id diff --git a/examples/all-combined/publiccertificate.tf b/examples/all-combined/publiccertificate.tf index 36435cc9..9b7cdba5 100644 --- a/examples/all-combined/publiccertificate.tf +++ b/examples/all-combined/publiccertificate.tf @@ -8,7 +8,7 @@ module "secrets_manager_public_cert_engine" { count = (var.acme_letsencrypt_private_key != null || (var.acme_letsencrypt_private_key_sm_id != null && var.acme_letsencrypt_private_key_secret_id != null && var.acme_letsencrypt_private_key_sm_region != null)) ? 1 : 0 source = "terraform-ibm-modules/secrets-manager-public-cert-engine/ibm" - version = "1.1.9" + version = "1.1.14" secrets_manager_guid = local.sm_guid region = local.sm_region internet_services_crn = data.ibm_cis.cis_instance.id diff --git a/examples/all-combined/secretsmanager.tf b/examples/all-combined/secretsmanager.tf index b58de8d3..0685bbb0 100644 --- a/examples/all-combined/secretsmanager.tf +++ b/examples/all-combined/secretsmanager.tf @@ -36,7 +36,7 @@ resource "ibm_resource_instance" "secrets_manager" { # create secrets group for secrets module "secrets_manager_group" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = "${var.prefix}-secret-group" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -49,7 +49,7 @@ module "secrets_manager_group" { # additional secrets manager secret group for service level secrets module "secrets_manager_group_acct" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid #tfsec:ignore:general-secrets-no-plaintext-exposure diff --git a/examples/all-combined/secretstore.tf b/examples/all-combined/secretstore.tf index 3c16d26a..71c0ee96 100644 --- a/examples/all-combined/secretstore.tf +++ b/examples/all-combined/secretstore.tf @@ -50,7 +50,7 @@ locals { # create the arbitrary secret and store in secret manager module "sm_arbitrary_imagepull_secret" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.secrets_manager_group.secret_group_id diff --git a/examples/all-combined/tpauth_cluster_sstore.tf b/examples/all-combined/tpauth_cluster_sstore.tf index 832afbc9..5bbcbd41 100644 --- a/examples/all-combined/tpauth_cluster_sstore.tf +++ b/examples/all-combined/tpauth_cluster_sstore.tf @@ -7,7 +7,7 @@ # creating a secrets group for clustersecretstore with trustedprofile auth module "tp_clusterstore_secrets_manager_group" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = "${var.prefix}-cpstore-tp-secret-group" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -53,7 +53,7 @@ module "eso_clusterstore_tpauth" { # arbitrary secret to be synched through the clustersecretstore with TP authentication module "sm_cstore_arbitrary_secret_tp" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.tp_clusterstore_secrets_manager_group.secret_group_id diff --git a/examples/all-combined/tpauth_namespaced_sstore.tf b/examples/all-combined/tpauth_namespaced_sstore.tf index a70abf01..19e3a23c 100644 --- a/examples/all-combined/tpauth_namespaced_sstore.tf +++ b/examples/all-combined/tpauth_namespaced_sstore.tf @@ -40,7 +40,7 @@ module "eso_tp_namespace_secretstores" { # creating a secrets group for each namespace to be used for namespaced secretstores with trustedprofile auth module "tp_secrets_manager_groups" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" count = length(var.es_namespaces_tp) region = local.sm_region secrets_manager_guid = local.sm_guid @@ -67,7 +67,7 @@ module "external_secrets_trusted_profiles" { module "sm_arbitrary_secrets_tp" { count = length(var.es_namespaces_tp) source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.tp_secrets_manager_groups[count.index].secret_group_id @@ -140,7 +140,7 @@ module "eso_tp_namespace_secretstore_multisg" { # creating two secrets groups for a single namespace to test trusted profile policy on multiple secrets groups module "tp_secrets_manager_group_multi_1" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = "${var.prefix}-tp-secret-group-multisg-1" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -152,7 +152,7 @@ module "tp_secrets_manager_group_multi_1" { module "tp_secrets_manager_group_multi_2" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = "${var.prefix}-tp-secret-group-multisg-21" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -165,7 +165,7 @@ module "tp_secrets_manager_group_multi_2" { # arbitrary secret for secrets group 1 module "sm_arbitrary_secret_tp_multisg_1" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.tp_secrets_manager_group_multi_1.secret_group_id @@ -182,7 +182,7 @@ module "sm_arbitrary_secret_tp_multisg_1" { # arbitrary secret for secrets group 2 module "sm_arbitrary_secret_tp_multisg_2" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.tp_secrets_manager_group_multi_2.secret_group_id @@ -285,7 +285,7 @@ module "eso_tp_namespace_secretstore_nosecgroup" { # creating secrets group for a single namespace to test trusted profile policy without any secret group in the TP policy module "tp_secrets_manager_group_not_for_policy" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = "${var.prefix}-tp-secret-group-not-for-policy" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -298,7 +298,7 @@ module "tp_secrets_manager_group_not_for_policy" { # arbitrary secret to use with external secret with auth using TP and policy not restricted to secrets group module "sm_arbitrary_secret_tp_nosecgroup" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.tp_secrets_manager_group_not_for_policy.secret_group_id diff --git a/examples/basic/main.tf b/examples/basic/main.tf index 0d863367..37c62828 100644 --- a/examples/basic/main.tf +++ b/examples/basic/main.tf @@ -91,7 +91,7 @@ module "zone_subnet_addrs" { module "vpc" { source = "terraform-ibm-modules/vpc/ibm" - version = "1.5.1" + version = "1.5.2" vpc_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id locations = [] @@ -108,7 +108,7 @@ module "vpc" { module "subnet_prefix" { source = "terraform-ibm-modules/vpc/ibm//modules/vpc-address-prefix" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) name = "${var.prefix}-z-${local.subnet_prefix[count.index].label}-${split("-", local.subnet_prefix[count.index].zone)[2]}" location = local.subnet_prefix[count.index].zone @@ -120,7 +120,7 @@ module "subnet_prefix" { module "subnets" { depends_on = [module.subnet_prefix] source = "terraform-ibm-modules/vpc/ibm//modules/subnet" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) location = local.subnet_prefix[count.index].zone vpc_id = module.vpc.vpc.vpc_id @@ -132,7 +132,7 @@ module "subnets" { module "public_gateways" { source = "terraform-ibm-modules/vpc/ibm//modules/public-gateway" - version = "1.5.1" + version = "1.5.2" count = length(var.zones) vpc_id = module.vpc.vpc.vpc_id location = "${var.region}-${var.zones[count.index]}" @@ -142,7 +142,7 @@ module "public_gateways" { module "security_group" { source = "terraform-ibm-modules/vpc/ibm//modules/security-group" - version = "1.5.1" + version = "1.5.2" depends_on = [module.vpc] create_security_group = false resource_group_id = module.resource_group.resource_group_id @@ -188,7 +188,7 @@ locals { module "network_acl" { source = "terraform-ibm-modules/vpc/ibm//modules/network-acl" - version = "1.5.1" + version = "1.5.2" name = "${var.prefix}-vpc-acl" vpc_id = module.vpc.vpc.vpc_id resource_group_id = module.resource_group.resource_group_id @@ -198,7 +198,7 @@ module "network_acl" { # OCP CLUSTER creation module "ocp_base" { source = "terraform-ibm-modules/base-ocp-vpc/ibm" - version = "3.55.4" + version = "3.60.0" cluster_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id region = var.region @@ -267,7 +267,7 @@ resource "ibm_resource_instance" "secrets_manager" { # Additional Secrets-Manager Secret-Group for SERVICE level secrets module "secrets_manager_group_acct" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid #tfsec:ignore:general-secrets-no-plaintext-exposure @@ -370,7 +370,7 @@ locals { # Create username_password secret and store in secret manager module "sm_userpass_secret" { source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.secrets_manager_group_acct.secret_group_id @@ -382,8 +382,8 @@ module "sm_userpass_secret" { #tfsec:ignore:general-secrets-no-plaintext-exposure secret_username = "artifactory-user" # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value secret_auto_rotation = false - secret_auto_rotation_interval = 0 - secret_auto_rotation_unit = null + secret_auto_rotation_interval = 1 + secret_auto_rotation_unit = "day" providers = { ibm = ibm.ibm-sm } diff --git a/examples/basic/version.tf b/examples/basic/version.tf index 0d085ccc..f3de3ba8 100644 --- a/examples/basic/version.tf +++ b/examples/basic/version.tf @@ -15,7 +15,7 @@ terraform { } ibm = { source = "IBM-Cloud/ibm" - version = "= 1.79.0" + version = "= 1.79.2" } null = { source = "hashicorp/null" diff --git a/examples/trusted-profiles-authentication/main.tf b/examples/trusted-profiles-authentication/main.tf index 3c60bbe3..5a570f11 100644 --- a/examples/trusted-profiles-authentication/main.tf +++ b/examples/trusted-profiles-authentication/main.tf @@ -41,7 +41,7 @@ resource "ibm_resource_instance" "secrets_manager" { module "secrets_manager_groups" { source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" count = length(kubernetes_namespace.examples) region = local.sm_region secrets_manager_guid = local.sm_guid @@ -71,7 +71,7 @@ resource "kubernetes_namespace" "examples" { module "sm_arbitrary_secrets" { count = length(kubernetes_namespace.examples) source = "terraform-ibm-modules/secrets-manager-secret/ibm" - version = "1.7.0" + version = "1.9.0" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_id = module.secrets_manager_groups[count.index].secret_group_id @@ -166,7 +166,7 @@ module "external_secrets" { module "vpes" { source = "terraform-ibm-modules/vpe-gateway/ibm" - version = "4.7.5" + version = "4.7.7" count = var.service_endpoints == "private" ? 1 : 0 region = var.region prefix = "vpe" diff --git a/solutions/fully-configurable/DA-details.md b/solutions/fully-configurable/DA-details.md index 2c4cf667..f0ac3016 100644 --- a/solutions/fully-configurable/DA-details.md +++ b/solutions/fully-configurable/DA-details.md @@ -6,7 +6,7 @@ External Secrets Operator synchronizes secrets in the Kubernetes cluster with se The architecture provides the following features: - Install and configure External Secrets Operator (ESO). -- Customise External Secret Operator deployment on specific cluster workers by configuration approriate NodeSelector and Tolerations in the ESO helm release [More details below](#customise-eso-deployment-on-specific-cluster-nodes) +- Customise External Secret Operator deployment on specific cluster workers by configuration appropriate NodeSelector and Tolerations in the ESO helm release [More details below](#customise-eso-deployment-on-specific-cluster-nodes) - Deploy and configure [ClusterSecretStore](https://external-secrets.io/latest/api/clustersecretstore/) resources for cluster scope secrets store - Deploy and configure [SecretStore](https://external-secrets.io/latest/api/secretstore/) resources for namespace scope secrets store - Leverage on two authentication methods to be configured on the single stores instances: diff --git a/solutions/fully-configurable/example-secrets-configuration.md b/solutions/fully-configurable/example-secrets-configuration.md index 1f8e337c..f4958b6b 100644 --- a/solutions/fully-configurable/example-secrets-configuration.md +++ b/solutions/fully-configurable/example-secrets-configuration.md @@ -29,8 +29,8 @@ module "sm_userpass_secret" { #tfsec:ignore:general-secrets-no-plaintext-exposure secret_username = "artifactory-user" # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value secret_auto_rotation = false - secret_auto_rotation_interval = 0 - secret_auto_rotation_unit = null + secret_auto_rotation_interval = 1 + secret_auto_rotation_unit = "day" providers = { ibm = ibm.ibm-sm } diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf index 28cdfafa..0012682a 100644 --- a/solutions/fully-configurable/main.tf +++ b/solutions/fully-configurable/main.tf @@ -107,7 +107,7 @@ module "cluster_secrets_stores_service_secrets_groups" { for idx, element in local.cluster_secrets_stores_service_secrets_groups_list : element.key => element }) source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = each.value.name # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -167,7 +167,7 @@ module "cluster_secrets_stores_account_secrets_groups" { } if(cluster_secrets_store.existing_account_secrets_group_id == null || cluster_secrets_store.existing_account_secrets_group_id == "") && cluster_secrets_store.account_secrets_group_name != null }) source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = each.value.name # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -366,7 +366,7 @@ module "secrets_stores_service_secrets_groups" { for idx, element in local.secrets_stores_service_secrets_groups_list : element.key => element }) source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = each.value.name # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value @@ -426,7 +426,7 @@ module "secrets_stores_account_secrets_groups" { } if(secrets_store.existing_account_secrets_group_id == null || secrets_store.existing_account_secrets_group_id == "") && secrets_store.account_secrets_group_name != null }) source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" - version = "1.3.13" + version = "1.3.15" region = local.sm_region secrets_manager_guid = local.sm_guid secret_group_name = each.value.name # checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index ed6b44ae..1c37ac4c 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -146,7 +146,7 @@ variable "eso_image" { variable "eso_image_version" { type = string description = "The version or digest for the external secrets image to deploy. If changing the value, ensure it is compatible with the chart version set in eso_chart_version." - default = "v0.19.2-ubi@sha256:b85e577e14c0a943e5eda57d631012d8fe7cea0e747069bfd9fdf3736cdad3ad" # datasource: ghcr.io/external-secrets/external-secrets + default = "v0.20.1-ubi@sha256:33dc5f563339e6332e1549c9e3c2b362d1e1b03acada1386a6f2c6f2d5af4a6e" # datasource: ghcr.io/external-secrets/external-secrets nullable = false validation { condition = can(regex("(^v\\d+\\.\\d+.\\d+(\\-\\w+)?(\\@sha256\\:\\w+){0,1})$", var.eso_image_version)) @@ -288,7 +288,7 @@ variable "reloader_image" { variable "reloader_image_version" { type = string description = "The version or digest for the reloader image to deploy. If changing the value, ensure it is compatible with the chart version set in reloader_chart_version." - default = "v1.4.6-ubi@sha256:98403ed026af2eac04796f8e3d99530ed7f251a5d40b50ac172a008933338d48" # datasource: ghcr.io/stakater/reloader + default = "v1.4.8-ubi@sha256:d87801fae5424f347d34b776ba25ea0c1ba80a8b50ba91ece0777206a47d91d3" # datasource: ghcr.io/stakater/reloader nullable = false validation { condition = can(regex("(^v\\d+\\.\\d+.\\d+(\\-\\w+)?(\\@sha256\\:\\w+){0,1})$", var.reloader_image_version)) @@ -306,7 +306,7 @@ variable "reloader_chart_location" { variable "reloader_chart_version" { type = string description = "The version of the Reloader Helm chart. Ensure that the chart version is compatible with the image version specified in reloader_image_version." - default = "2.2.0" # registryUrl: stakater.github.io/stakater-charts + default = "2.2.3" # registryUrl: stakater.github.io/stakater-charts nullable = false } diff --git a/solutions/fully-configurable/version.tf b/solutions/fully-configurable/version.tf index 78896629..af2336d2 100644 --- a/solutions/fully-configurable/version.tf +++ b/solutions/fully-configurable/version.tf @@ -11,7 +11,7 @@ terraform { } ibm = { source = "IBM-Cloud/ibm" - version = "1.81.1" + version = "1.82.1" } } } diff --git a/tests/existing-resources/main.tf b/tests/existing-resources/main.tf index 8b902e19..96a5616d 100644 --- a/tests/existing-resources/main.tf +++ b/tests/existing-resources/main.tf @@ -77,7 +77,7 @@ module "zone_subnet_addrs" { module "vpc" { source = "terraform-ibm-modules/vpc/ibm" - version = "1.5.1" + version = "1.5.2" vpc_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id locations = [] @@ -94,7 +94,7 @@ module "vpc" { module "subnet_prefix" { source = "terraform-ibm-modules/vpc/ibm//modules/vpc-address-prefix" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) name = "${var.prefix}-z-${local.subnet_prefix[count.index].label}-${split("-", local.subnet_prefix[count.index].zone)[2]}" location = local.subnet_prefix[count.index].zone @@ -106,7 +106,7 @@ module "subnet_prefix" { module "subnets" { depends_on = [module.subnet_prefix] source = "terraform-ibm-modules/vpc/ibm//modules/subnet" - version = "1.5.1" + version = "1.5.2" count = length(local.subnet_prefix) location = local.subnet_prefix[count.index].zone vpc_id = module.vpc.vpc.vpc_id @@ -118,7 +118,7 @@ module "subnets" { module "public_gateways" { source = "terraform-ibm-modules/vpc/ibm//modules/public-gateway" - version = "1.5.1" + version = "1.5.2" count = length(var.zones) vpc_id = module.vpc.vpc.vpc_id location = "${var.region}-${var.zones[count.index]}" @@ -128,7 +128,7 @@ module "public_gateways" { module "security_group" { source = "terraform-ibm-modules/vpc/ibm//modules/security-group" - version = "1.5.1" + version = "1.5.2" depends_on = [module.vpc] create_security_group = false resource_group_id = module.resource_group.resource_group_id @@ -174,7 +174,7 @@ locals { module "network_acl" { source = "terraform-ibm-modules/vpc/ibm//modules/network-acl" - version = "1.5.1" + version = "1.5.2" name = "${var.prefix}-vpc-acl" vpc_id = module.vpc.vpc.vpc_id resource_group_id = module.resource_group.resource_group_id @@ -184,7 +184,7 @@ module "network_acl" { # OCP CLUSTER creation module "ocp_base" { source = "terraform-ibm-modules/base-ocp-vpc/ibm" - version = "3.55.4" + version = "3.60.0" cluster_name = "${var.prefix}-vpc" resource_group_id = module.resource_group.resource_group_id region = var.region diff --git a/tests/go.mod b/tests/go.mod index 61e1628a..296db52b 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -2,12 +2,12 @@ module github.com/terraform-ibm-modules/terraform-ibm-external-secrets-operator go 1.24.0 -toolchain go1.25.0 +toolchain go1.25.1 require ( github.com/gruntwork-io/terratest v0.50.0 - github.com/stretchr/testify v1.10.0 - github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.59.0 + github.com/stretchr/testify v1.11.1 + github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.6 gopkg.in/yaml.v3 v3.0.1 k8s.io/apimachinery v0.33.4 ) @@ -19,7 +19,7 @@ require ( github.com/IBM-Cloud/power-go-client v1.12.0 // indirect github.com/IBM/cloud-databases-go-sdk v0.8.0 // indirect github.com/IBM/go-sdk-core/v5 v5.21.0 // indirect - github.com/IBM/platform-services-go-sdk v0.85.1 // indirect + github.com/IBM/platform-services-go-sdk v0.86.1 // indirect github.com/IBM/project-go-sdk v0.3.6 // indirect github.com/IBM/schematics-go-sdk v0.4.0 // indirect github.com/IBM/vpc-go-sdk v1.0.2 // indirect @@ -161,7 +161,7 @@ require ( golang.org/x/mod v0.26.0 // indirect golang.org/x/net v0.42.0 // indirect golang.org/x/oauth2 v0.24.0 // indirect - golang.org/x/sync v0.16.0 // indirect + golang.org/x/sync v0.17.0 // indirect golang.org/x/sys v0.35.0 // indirect golang.org/x/term v0.34.0 // indirect golang.org/x/text v0.28.0 // indirect diff --git a/tests/go.sum b/tests/go.sum index e2158364..08a6af68 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -13,8 +13,8 @@ github.com/IBM/cloud-databases-go-sdk v0.8.0/go.mod h1:JYucI1PdwqbAd8XGdDAchxzxR github.com/IBM/go-sdk-core/v5 v5.9.2/go.mod h1:YlOwV9LeuclmT/qi/LAK2AsobbAP42veV0j68/rlZsE= github.com/IBM/go-sdk-core/v5 v5.21.0 h1:DUnYhvC4SoC8T84rx5omnhY3+xcQg/Whyoa3mDPIMkk= github.com/IBM/go-sdk-core/v5 v5.21.0/go.mod h1:Q3BYO6iDA2zweQPDGbNTtqft5tDcEpm6RTuqMlPcvbw= -github.com/IBM/platform-services-go-sdk v0.85.1 h1:lrBEeGaIajhSPMB6cPVAx53XTtVGrKOeA36gIXh2FYI= -github.com/IBM/platform-services-go-sdk v0.85.1/go.mod h1:aGD045m6I8pfcB77wft8w2cHqWOJjcM3YSSV55BX0Js= +github.com/IBM/platform-services-go-sdk v0.86.1 h1:ngBpaXvUF3gmLvbU1Z4lX1wowOSYgGoKBEBaR/urt30= +github.com/IBM/platform-services-go-sdk v0.86.1/go.mod h1:aGD045m6I8pfcB77wft8w2cHqWOJjcM3YSSV55BX0Js= github.com/IBM/project-go-sdk v0.3.6 h1:DRiANKnAePevFsIKSvR89SUaMa2xsd7YKK71Ka1eqKI= github.com/IBM/project-go-sdk v0.3.6/go.mod h1:FOJM9ihQV3EEAY6YigcWiTNfVCThtdY8bLC/nhQHFvo= github.com/IBM/schematics-go-sdk v0.4.0 h1:x01f/tPquYJYLQzJLGuxWfCbV/EdSMXRikOceNy/JLM= @@ -451,10 +451,10 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.59.0 h1:h+CvNQyeiieMXBSNESrHNVPJXj388T+sa4paV48nfl8= -github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.59.0/go.mod h1:6Wz8vnBelmRZxD5qjm5K4MpvPPWpoCWRPzG76j0B36g= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.6 h1:Tr7AlrQ+s1Nc9VOwB+It8sItnDOXhfXTxKqI2KtdyFA= +github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.6/go.mod h1:YBrRYc+5y5Pr9CXmY35lOqTQdlIjA4x4+3iVObXGOCE= github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tmccombs/hcl2json v0.6.4 h1:/FWnzS9JCuyZ4MNwrG4vMrFrzRgsWEOVi+1AyYUVLGw= github.com/tmccombs/hcl2json v0.6.4/go.mod h1:+ppKlIW3H5nsAsZddXPy2iMyvld3SHxyjswOZhavRDk= @@ -564,8 +564,8 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= -golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= +golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= diff --git a/variables.tf b/variables.tf index 76da6562..894fac13 100644 --- a/variables.tf +++ b/variables.tf @@ -77,7 +77,7 @@ variable "eso_image" { variable "eso_image_version" { type = string description = "The version or digest for the external secrets image to deploy. If changing the value, ensure it is compatible with the chart version set in eso_chart_version." - default = "v0.19.2-ubi@sha256:b85e577e14c0a943e5eda57d631012d8fe7cea0e747069bfd9fdf3736cdad3ad" # datasource: ghcr.io/external-secrets/external-secrets + default = "v0.20.1-ubi@sha256:33dc5f563339e6332e1549c9e3c2b362d1e1b03acada1386a6f2c6f2d5af4a6e" # datasource: ghcr.io/external-secrets/external-secrets nullable = false validation { condition = can(regex("(^v\\d+\\.\\d+.\\d+(\\-\\w+)?(\\@sha256\\:\\w+){0,1})$", var.eso_image_version)) @@ -204,7 +204,7 @@ variable "reloader_image" { variable "reloader_image_version" { type = string description = "The version or digest for the reloader image to deploy. If changing the value, ensure it is compatible with the chart version set in reloader_chart_version." - default = "v1.4.6-ubi@sha256:98403ed026af2eac04796f8e3d99530ed7f251a5d40b50ac172a008933338d48" # datasource: ghcr.io/stakater/reloader + default = "v1.4.8-ubi@sha256:d87801fae5424f347d34b776ba25ea0c1ba80a8b50ba91ece0777206a47d91d3" # datasource: ghcr.io/stakater/reloader nullable = false validation { condition = can(regex("(^v\\d+\\.\\d+.\\d+(\\-\\w+)?(\\@sha256\\:\\w+){0,1})$", var.reloader_image_version)) @@ -222,6 +222,6 @@ variable "reloader_chart_location" { variable "reloader_chart_version" { type = string description = "The version of the Reloader Helm chart. Ensure that the chart version is compatible with the image version specified in reloader_image_version." - default = "2.2.0" # registryUrl: stakater.github.io/stakater-charts + default = "2.2.3" # registryUrl: stakater.github.io/stakater-charts nullable = false }