Skip to content

Commit 2232282

Browse files
Aashiq-JAashiq-J
authored
feat: add FSCloud profile submodule with example on how to use it (#85)
1 parent f2a6d44 commit 2232282

File tree

16 files changed

+607
-37
lines changed

16 files changed

+607
-37
lines changed

‎.secrets.baseline‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2023-12-11T13:50:58Z",
6+
"generated_at": "2024-01-19T08:57:22Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -82,7 +82,7 @@
8282
"hashed_secret": "33da8d0e8af2efc260f01d8e5edfcc5c5aba44ad",
8383
"is_secret": true,
8484
"is_verified": false,
85-
"line_number": 33,
85+
"line_number": 36,
8686
"type": "Secret Keyword",
8787
"verified_result": null
8888
}

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,12 @@
1010
<!-- BEGIN OVERVIEW HOOK -->
1111
## Overview
1212
* [terraform-ibm-icd-elasticsearch](#terraform-ibm-icd-elasticsearch)
13+
* [Submodules](./modules)
14+
* [fscloud](./modules/fscloud)
1315
* [Examples](./examples)
1416
* [Basic example](./examples/basic)
1517
* [Complete example with autoscaling, BYOK encryption, service credentials creation, index creation and updates to cluster-wide settings](./examples/complete)
18+
* [Financial Services Cloud profile example with autoscaling enabled](./examples/fscloud)
1619
* [Contributing](#contributing)
1720
<!-- END OVERVIEW HOOK -->
1821

‎cra-config.yaml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/complete" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "examples/fscloud" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
6-
# CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs.
7-
# TF_VAR_sample: "sample value"
8-
# TF_VAR_other: "another value"
9-
# SCC_INSTANCE_ID: "" # The SCC instance ID to use to download profile for CRA scan. If not provided, a default global value will be used.
10-
# SCC_REGION: "" # The IBM Cloud region that the SCC instance is in. If not provided, a default global value will be used.
11-
# PROFILE_ID: "" # The Profile ID input for CRA SCC scan. If not provided, a default global value will be used.
6+
PROFILE_ID: "0e6e7b5a-817d-4344-ab6f-e5d7a9c49520"
7+
CRA_ENVIRONMENT_VARIABLES:
8+
TF_VAR_existing_at_instance_crn: "crn:v1:bluemix:public:logdnaat:eu-de:a/abac0df06b644a9cabc6e44f55b3880e:b1ef3365-dfbf-4d8f-8ac8-75f4f84d6f4a::"
9+
TF_VAR_existing_kms_instance_guid: "e6dce284-e80f-46e1-a3c1-830f7adff7a9"
10+
TF_VAR_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533"

‎cra-tf-validate-ignore-rules.json‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
11
{
2-
"scc_rules": []
2+
"scc_rules": [
3+
{
4+
"scc_rule_id": "rule-216e2449-27d7-4afc-929a-b66e196a9cf9",
5+
"description": "Check whether Flow Logs for VPC are enabled",
6+
"ignore_reason": "This rule is not relevant to the module itself, just the VPC resource is used in the example that is scanned",
7+
"is_valid": false
8+
}
9+
]
310
}

‎examples/fscloud/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Financial Services Cloud profile example with autoscaling enabled
2+
3+
An end-to-end example that uses the [Profile for IBM Cloud Framework for Financial Services](https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/tree/main/modules/fscloud) to deploy an instance of IBM Cloud Databases for Elasticsearch.
4+
5+
The example uses the IBM Cloud Terraform provider to create the following infrastructure:
6+
7+
- A resource group, if one is not passed in.
8+
- An IAM authorization between all Elasticsearch database instances in the given resource group, and the Hyper Protect Crypto Services instance that is passed in.
9+
- An IBM Cloud Databases Elasticsearch database instance that is encrypted with the Hyper Protect Crypto Services root key that is passed in.
10+
- Autoscaling rules for the IBM Cloud Databases Elasticsearch database instance.
11+
- Service Credentials for the Elasticsearch database instance.
12+
- A sample virtual private cloud (VPC).
13+
- A context-based restriction (CBR) rule to only allow Elasticsearch to be accessible from within the VPC.
14+
15+
:exclamation: **Important:** In this example, only the IBM Cloud Databases for Elasticsearch instance complies with the IBM Cloud Framework for Financial Services. Other parts of the infrastructure do not necessarily comply.
16+
17+
## Before you begin
18+
19+
- You need a Hyper Protect Crypto Services instance and root key available in the region that you want to deploy your Elasticsearch database instance to.

‎examples/fscloud/main.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
4+
5+
module "resource_group" {
6+
source = "terraform-ibm-modules/resource-group/ibm"
7+
version = "1.1.4"
8+
# if an existing resource group is not set (null) create a new one using prefix
9+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
10+
existing_resource_group_name = var.resource_group
11+
}
12+
13+
##############################################################################
14+
# Get Cloud Account ID
15+
##############################################################################
16+
17+
data "ibm_iam_account_settings" "iam_account_settings" {
18+
}
19+
20+
##############################################################################
21+
# VPC
22+
##############################################################################
23+
resource "ibm_is_vpc" "example_vpc" {
24+
name = "${var.prefix}-vpc"
25+
resource_group = module.resource_group.resource_group_id
26+
tags = var.resource_tags
27+
}
28+
29+
resource "ibm_is_subnet" "testacc_subnet" {
30+
name = "${var.prefix}-subnet"
31+
vpc = ibm_is_vpc.example_vpc.id
32+
zone = "${var.region}-1"
33+
total_ipv4_address_count = 256
34+
resource_group = module.resource_group.resource_group_id
35+
}
36+
37+
##############################################################################
38+
# Create CBR Zone
39+
##############################################################################
40+
module "cbr_zone" {
41+
source = "terraform-ibm-modules/cbr/ibm//modules/cbr-zone-module"
42+
version = "1.17.1"
43+
name = "${var.prefix}-VPC-network-zone"
44+
zone_description = "CBR Network zone containing VPC"
45+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
46+
addresses = [{
47+
type = "vpc", # to bind a specific vpc to the zone
48+
value = ibm_is_vpc.example_vpc.crn,
49+
}]
50+
}
51+
52+
##############################################################################
53+
# ICD elasticsearch database
54+
##############################################################################
55+
56+
module "elasticsearch" {
57+
source = "../../modules/fscloud"
58+
resource_group_id = module.resource_group.resource_group_id
59+
name = "${var.prefix}-elasticsearch"
60+
region = var.region
61+
tags = var.resource_tags
62+
access_tags = var.access_tags
63+
kms_key_crn = var.kms_key_crn
64+
existing_kms_instance_guid = var.existing_kms_instance_guid
65+
elasticsearch_version = var.elasticsearch_version
66+
service_credential_names = var.service_credential_names
67+
auto_scaling = var.auto_scaling
68+
cbr_rules = [
69+
{
70+
description = "${var.prefix}-elasticsearch access only from vpc"
71+
enforcement_mode = "enabled"
72+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
73+
rule_contexts = [{
74+
attributes = [
75+
{
76+
"name" : "endpointType",
77+
"value" : "private"
78+
},
79+
{
80+
name = "networkZoneId"
81+
value = module.cbr_zone.zone_id
82+
}]
83+
}]
84+
}
85+
]
86+
}

‎examples/fscloud/outputs.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
output "id" {
5+
description = "Elasticsearch instance id"
6+
value = module.elasticsearch.id
7+
}
8+
9+
output "guid" {
10+
description = "Elasticsearch instance guid"
11+
value = module.elasticsearch.guid
12+
}
13+
14+
output "version" {
15+
description = "Elasticsearch instance version"
16+
value = module.elasticsearch.version
17+
}
18+
19+
output "hostname" {
20+
description = "Database hostname. Only contains value when var.service_credential_names or var.users are set."
21+
value = module.elasticsearch.hostname
22+
}
23+
24+
output "port" {
25+
description = "Database port. Only contains value when var.service_credential_names or var.users are set."
26+
value = module.elasticsearch.port
27+
}

‎examples/fscloud/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎examples/fscloud/variables.tf‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
variable "ibmcloud_api_key" {
2+
type = string
3+
description = "The IBM Cloud API Key"
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
type = string
9+
description = "Region to provision all resources created by this example"
10+
default = "us-south"
11+
}
12+
13+
variable "prefix" {
14+
type = string
15+
description = "Prefix to append to all resources created by this example"
16+
default = "fs-cloud"
17+
}
18+
19+
variable "resource_group" {
20+
type = string
21+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
22+
default = null
23+
}
24+
25+
variable "resource_tags" {
26+
type = list(string)
27+
description = "Optional list of tags to be added to created resources"
28+
default = []
29+
}
30+
31+
variable "access_tags" {
32+
type = list(string)
33+
description = "A list of access tags to apply to the Elasticsearch instance created by the module, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial for more details"
34+
default = []
35+
}
36+
37+
variable "existing_kms_instance_guid" {
38+
description = "The GUID of the Hyper Protect Crypto service in which the key specified in var.kms_key_crn is coming from"
39+
type = string
40+
}
41+
42+
variable "kms_key_crn" {
43+
type = string
44+
description = "The root key CRN of a Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=ui for more information on integrating HPCS with Elasticsearch instance."
45+
}
46+
47+
variable "elasticsearch_version" {
48+
type = string
49+
description = "Version of the Elasticsearch instance. If no value is passed, the current preferred version of IBM Cloud Databases is used."
50+
default = null
51+
}
52+
53+
variable "service_credential_names" {
54+
description = "Map of name, role for service credentials that you want to create for the database"
55+
type = map(string)
56+
default = {
57+
"elasticsearch_admin" : "Administrator",
58+
"elasticsearch_operator" : "Operator",
59+
"elasticsearch_viewer" : "Viewer",
60+
"elasticsearch_editor" : "Editor",
61+
}
62+
}
63+
64+
variable "auto_scaling" {
65+
type = object({
66+
disk = object({
67+
capacity_enabled = optional(bool)
68+
free_space_less_than_percent = optional(number)
69+
io_above_percent = optional(number)
70+
io_enabled = optional(bool)
71+
io_over_period = optional(string)
72+
rate_increase_percent = optional(number)
73+
rate_limit_mb_per_member = optional(number)
74+
rate_period_seconds = optional(number)
75+
rate_units = optional(string)
76+
})
77+
memory = object({
78+
io_above_percent = optional(number)
79+
io_enabled = optional(bool)
80+
io_over_period = optional(string)
81+
rate_increase_percent = optional(number)
82+
rate_limit_mb_per_member = optional(number)
83+
rate_period_seconds = optional(number)
84+
rate_units = optional(string)
85+
})
86+
})
87+
description = "Optional rules to allow the database to increase resources in response to usage. Only a single autoscaling block is allowed. Make sure you understand the effects of autoscaling, especially for production environments. See https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-autoscaling&interface=cli#autoscaling-considerations in the IBM Cloud Docs."
88+
default = {
89+
disk = {
90+
capacity_enabled : true,
91+
io_enabled : true
92+
}
93+
memory = {
94+
io_enabled : true,
95+
}
96+
}
97+
}

‎examples/fscloud/version.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3.0, <1.6.0"
3+
required_providers {
4+
# Use latest version of provider in non-basic examples to verify latest version works with module
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = ">= 1.56.1"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)