Skip to content

Commit 41f7bd0

Browse files
arya-girish-kArya Girish Kshemau
authored
feat: Add UI regex validation to the DA (#547)
* feat: Add UI regex validation * feat: Added validation for kibana_image_digest * fix: Updated validation in variable.tf * fix: Updated CRN pattern * fix: bump test wrapper for resource group fix * fix : updated CRN pattern * fix : updated CRN pattern * update branch * removed common dev assets changes * updated variable descritption --------- Co-authored-by: Arya Girish K <[email protected]> Co-authored-by: shemau <[email protected]>
1 parent f186d81 commit 41f7bd0

File tree

3 files changed

+197
-16
lines changed

3 files changed

+197
-16
lines changed

‎ibm_catalog.json‎

Lines changed: 112 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,14 @@
331331
"key": "admin_pass"
332332
},
333333
{
334-
"key": "existing_secrets_manager_instance_crn"
334+
"key": "existing_secrets_manager_instance_crn",
335+
"value_constraints": [
336+
{
337+
"type": "regex",
338+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
339+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
340+
}
341+
]
335342
},
336343
{
337344
"key": "existing_secrets_manager_endpoint_type",
@@ -375,10 +382,24 @@
375382
"key": "kms_encryption_enabled"
376383
},
377384
{
378-
"key": "existing_kms_instance_crn"
385+
"key": "existing_kms_instance_crn",
386+
"value_constraints": [
387+
{
388+
"type": "regex",
389+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
390+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
391+
}
392+
]
379393
},
380394
{
381-
"key": "existing_kms_key_crn"
395+
"key": "existing_kms_key_crn",
396+
"value_constraints": [
397+
{
398+
"type": "regex",
399+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
400+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
401+
}
402+
]
382403
},
383404
{
384405
"key": "kms_endpoint_type",
@@ -401,10 +422,24 @@
401422
"key": "key_name"
402423
},
403424
{
404-
"key": "backup_crn"
425+
"key": "backup_crn",
426+
"value_constraints": [
427+
{
428+
"type": "regex",
429+
"description": "The value provided for 'backup_crn' is not valid.",
430+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
431+
}
432+
]
405433
},
406434
{
407-
"key": "existing_backup_kms_key_crn"
435+
"key": "existing_backup_kms_key_crn",
436+
"value_constraints": [
437+
{
438+
"type": "regex",
439+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
440+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
441+
}
442+
]
408443
},
409444
{
410445
"key": "use_default_backup_encryption_key"
@@ -413,7 +448,14 @@
413448
"key": "skip_elasticsearch_kms_auth_policy"
414449
},
415450
{
416-
"key": "existing_elasticsearch_instance_crn"
451+
"key": "existing_elasticsearch_instance_crn",
452+
"value_constraints": [
453+
{
454+
"type": "regex",
455+
"description": "The value provided for 'existing_elasticsearch_instance_crn' is not valid.",
456+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
457+
}
458+
]
417459
},
418460
{
419461
"key": "enable_elser_model"
@@ -454,7 +496,14 @@
454496
"key": "kibana_registry_namespace_image"
455497
},
456498
{
457-
"key": "kibana_image_digest"
499+
"key": "kibana_image_digest",
500+
"value_constraints": [
501+
{
502+
"type": "regex",
503+
"description": "The value provided for 'kibana_image_digest' is not valid.",
504+
"value": "^__NULL__$|^sha256:"
505+
}
506+
]
458507
},
459508
{
460509
"key": "kibana_image_port"
@@ -758,7 +807,14 @@
758807
"key": "admin_pass"
759808
},
760809
{
761-
"key": "existing_secrets_manager_instance_crn"
810+
"key": "existing_secrets_manager_instance_crn",
811+
"value_constraints": [
812+
{
813+
"type": "regex",
814+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
815+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
816+
}
817+
]
762818
},
763819
{
764820
"key": "skip_elasticsearch_to_secrets_manager_auth_policy"
@@ -786,10 +842,24 @@
786842
},
787843
{
788844
"key": "existing_kms_instance_crn",
789-
"required": true
845+
"required": true,
846+
"value_constraints": [
847+
{
848+
"type": "regex",
849+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
850+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
851+
}
852+
]
790853
},
791854
{
792-
"key": "existing_kms_key_crn"
855+
"key": "existing_kms_key_crn",
856+
"value_constraints": [
857+
{
858+
"type": "regex",
859+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
860+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
861+
}
862+
]
793863
},
794864
{
795865
"key": "key_ring_name"
@@ -798,16 +868,37 @@
798868
"key": "key_name"
799869
},
800870
{
801-
"key": "backup_crn"
871+
"key": "backup_crn",
872+
"value_constraints": [
873+
{
874+
"type": "regex",
875+
"description": "The value provided for 'backup_crn' is not valid.",
876+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
877+
}
878+
]
802879
},
803880
{
804-
"key": "existing_backup_kms_key_crn"
881+
"key": "existing_backup_kms_key_crn",
882+
"value_constraints": [
883+
{
884+
"type": "regex",
885+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
886+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
887+
}
888+
]
805889
},
806890
{
807891
"key": "skip_elasticsearch_kms_auth_policy"
808892
},
809893
{
810-
"key": "existing_elasticsearch_instance_crn"
894+
"key": "existing_elasticsearch_instance_crn",
895+
"value_constraints": [
896+
{
897+
"type": "regex",
898+
"description": "The value provided for 'existing_elasticsearch_instance_crn' is not valid.",
899+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
900+
}
901+
]
811902
},
812903
{
813904
"key": "enable_elser_model"
@@ -845,7 +936,14 @@
845936
"key": "kibana_registry_namespace_image"
846937
},
847938
{
848-
"key": "kibana_image_digest"
939+
"key": "kibana_image_digest",
940+
"value_constraints": [
941+
{
942+
"type": "regex",
943+
"description": "The value provided for 'kibana_image_digest' must start with 'sha256:'.",
944+
"value": "^__NULL__$|^sha256:"
945+
}
946+
]
849947
},
850948
{
851949
"key": "kibana_image_port"

‎solutions/fully-configurable/variables.tf‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,14 @@ variable "existing_elasticsearch_instance_crn" {
6262
type = string
6363
default = null
6464
description = "The CRN of an existing Databases for Elasticsearch instance. If no value is specified, a new instance is created."
65+
66+
validation {
67+
condition = anytrue([
68+
var.existing_elasticsearch_instance_crn == null,
69+
can(regex("^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_elasticsearch_instance_crn))
70+
])
71+
error_message = "The value provided for 'existing_elasticsearch_instance_crn' is not valid."
72+
}
6573
}
6674

6775
variable "elasticsearch_version" {
@@ -229,12 +237,30 @@ variable "existing_kms_instance_crn" {
229237
type = string
230238
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
231239
default = null
240+
241+
validation {
242+
condition = anytrue([
243+
var.existing_kms_instance_crn == null,
244+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
245+
])
246+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
247+
}
248+
232249
}
233250

234251
variable "existing_kms_key_crn" {
235252
type = string
236253
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
237254
default = null
255+
256+
validation {
257+
condition = anytrue([
258+
var.existing_kms_key_crn == null,
259+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
260+
])
261+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
262+
}
263+
238264
}
239265

240266
variable "kms_endpoint_type" {
@@ -277,6 +303,15 @@ variable "existing_backup_kms_key_crn" {
277303
type = string
278304
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. Applies only if `kms_encryption_enabled` is true. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `kms_encryption_enabled` to false to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
279305
default = null
306+
307+
validation {
308+
condition = anytrue([
309+
var.existing_backup_kms_key_crn == null,
310+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
311+
])
312+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
313+
}
314+
280315
}
281316

282317
variable "use_default_backup_encryption_key" {
@@ -293,7 +328,7 @@ variable "backup_crn" {
293328
validation {
294329
condition = anytrue([
295330
var.backup_crn == null,
296-
can(regex("^crn:.*:backup:", var.backup_crn))
331+
can(regex("^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
297332
])
298333
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
299334
}
@@ -370,6 +405,14 @@ variable "existing_secrets_manager_instance_crn" {
370405
type = string
371406
default = null
372407
description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for Elasticsearch instance."
408+
409+
validation {
410+
condition = anytrue([
411+
var.existing_secrets_manager_instance_crn == null,
412+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
413+
])
414+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
415+
}
373416
}
374417

375418
variable "existing_secrets_manager_endpoint_type" {

‎solutions/security-enforced/variables.tf‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ variable "existing_elasticsearch_instance_crn" {
5757
type = string
5858
default = null
5959
description = "The CRN of an existing Databases for Elasticsearch instance. If no value is specified, a new instance is created."
60+
61+
validation {
62+
condition = anytrue([
63+
var.existing_elasticsearch_instance_crn == null,
64+
can(regex("^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_elasticsearch_instance_crn))
65+
])
66+
error_message = "The value provided for 'existing_elasticsearch_instance_crn' is not valid."
67+
}
6068
}
6169

6270
variable "elasticsearch_version" {
@@ -186,6 +194,14 @@ variable "existing_kms_instance_crn" {
186194
type = string
187195
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
188196
default = null
197+
198+
validation {
199+
condition = anytrue([
200+
var.existing_kms_instance_crn == null,
201+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
202+
])
203+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
204+
}
189205
}
190206

191207
variable "existing_kms_key_crn" {
@@ -200,6 +216,14 @@ variable "existing_kms_key_crn" {
200216
)
201217
error_message = "Either existing_kms_key_crn or existing_kms_instance_crn must be set, but not both."
202218
}
219+
220+
validation {
221+
condition = anytrue([
222+
var.existing_kms_key_crn == null,
223+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
224+
])
225+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
226+
}
203227
}
204228

205229
variable "skip_elasticsearch_kms_auth_policy" {
@@ -231,6 +255,14 @@ variable "existing_backup_kms_key_crn" {
231255
type = string
232256
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input."
233257
default = null
258+
259+
validation {
260+
condition = anytrue([
261+
var.existing_backup_kms_key_crn == null,
262+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
263+
])
264+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
265+
}
234266
}
235267

236268
variable "backup_crn" {
@@ -241,7 +273,7 @@ variable "backup_crn" {
241273
validation {
242274
condition = anytrue([
243275
var.backup_crn == null,
244-
can(regex("^crn:.*:backup:", var.backup_crn))
276+
can(regex("^crn:v\\d:(.*:){2}databases-for-elasticsearch:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
245277
])
246278
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
247279
}
@@ -307,6 +339,14 @@ variable "existing_secrets_manager_instance_crn" {
307339
type = string
308340
default = null
309341
description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for Elasticsearch instance."
342+
343+
validation {
344+
condition = anytrue([
345+
var.existing_secrets_manager_instance_crn == null,
346+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
347+
])
348+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
349+
}
310350
}
311351

312352
variable "service_credential_secrets" {

0 commit comments

Comments
 (0)