feat: created DA solution for IBM catalog (#101)

Aayush-Abhyarthi · web-flow · commit 59a9e73c7400 · 2024-03-28T09:14:26.000Z
diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+offerings:
+  - name: deploy-arch-ibm-icd-elasticsearch
+    kind: solution
+    catalog_id: 7df1e4ca-d54c-4fd0-82ce-3d13247308cd
+    offering_id: 7ee5876d-6e30-49d1-be25-259a442085e8
+    variations:
+      - name: secure
+        mark_ready: true
+        install_type: fullstack
+        scc:
+          instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
+          region: us-south
diff --git a/.github/settings.yml b/.github/settings.yml
@@ -26,4 +26,4 @@ repository:
 
   # Uncomment this topics property
   # and add a comma-separated list of topics to set on the repo.
-  topics: core-team, terraform, ibm-cloud, terraform-module, ibm-database, icd-elasticsearch, elasticsearch, supported, graduated
+  topics: core-team, terraform, ibm-cloud, terraform-module, ibm-database, icd-elasticsearch, elasticsearch, supported, graduated, deployable-architecture
diff --git a/.releaserc b/.releaserc
@@ -10,6 +10,9 @@
     }],
     ["@semantic-release/exec", {
       "successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV"
+    }],
+    ["@semantic-release/exec",{
+      "publishCmd": "./ci/trigger-catalog-onboarding-pipeline.sh --version=v${nextRelease.version}"
     }]
   ]
 }
diff --git a/common-dev-assets b/common-dev-assets
@@ -1 +1 @@
-Subproject commit 8405107509b351b346887674d06ee37e98140493
+Subproject commit 465a57d227d66bf8c80e75ec934c91dd7dd3d2d8
diff --git a/ibm_catalog.json b/ibm_catalog.json
@@ -0,0 +1,92 @@
+{
+    "products": [
+      {
+        "name": "deploy-arch-ibm-icd-elasticsearch",
+        "label": "Databases for Elasticsearch",
+        "product_kind": "solution",
+        "tags": [
+          "ibm_created",
+          "target_terraform",
+          "terraform",
+          "databases",
+          "solution"
+        ],
+        "keywords": [
+          "elasticsearch",
+          "IaC",
+          "infrastructure as code",
+          "terraform",
+          "solution",
+          "elasticsearch secure",
+          "database",
+          "nosql"
+        ],
+        "short_description": "Creates and configures an instance of IBM Cloud Databases for Elasticsearch.",
+        "long_description": "This architecture supports creating and configuring an Elasticsearch instance with KMS encryption on IBM Cloud.",
+        "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/blob/main/README.md",
+        "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/main/images/elasticsearch_icon.svg",
+        "provider_name": "IBM",
+        "features": [
+          {
+            "title": "Creates an instance of Databases for Elasticsearch.",
+            "description": "Creates and configures an Elasticsearch instance on the IBM Cloud."
+          },
+          {
+            "title": "Supports KMS encryption",
+            "description": "Provides the KMS encryption feature."
+          },
+          {
+            "title": "Supports autoscaling",
+            "description": "Provides the autoscaling feature."
+          },
+          {
+            "title": "Attaches access tags",
+            "description": "Attaches access tags to the Elasticsearch instance."
+          }
+        ],
+        "flavors": [
+          {
+            "label": "Secure",
+            "name": "secure",
+            "install_type": "fullstack",
+            "working_directory": "solutions/secure",
+            "compliance": {
+              "authority": "scc-v3",
+              "profiles": [
+                {
+                  "profile_name": "IBM Cloud Framework for Financial Services",
+                  "profile_version": "1.5.0"
+                }
+              ]},
+            "iam_permissions": [
+              {
+                "role_crns": [
+                  "crn:v1:bluemix:public:iam::::serviceRole:Editor"
+                ],
+                "service_name": "databases-for-elasticsearch"
+              }
+            ],
+            "architecture": {
+              "descriptions": "This architecture creates an Elasticsearch instance on IBM Cloud with KMS encryption and supports autoscaling.",
+              "features": [
+                {
+                  "title": " Creates an Elasticsearch instance on IBM Cloud.",
+                  "description": "This architecture creates an Elasticsearch instance on IBM Cloud with KMS encryption, supports provisioning of a resource group and provides autoscaling feature."
+                }
+              ],
+              "diagrams": [
+                {
+                  "diagram": {
+                    "caption": "Elasticsearch instance on IBM Cloud",
+                    "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/main/reference-architecture/deployable-architecture-elasticsearch.svg",
+                    "type": "image/svg+xml"
+                  },
+                  "description": "This architecture supports creating and configuring an Elasticsearch instance with KMS encryption."
+                }
+              ]
+            }
+          }
+        ]
+      }
+    ]
+  }
diff --git a/images/elasticsearch_icon.svg b/images/elasticsearch_icon.svg
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg version="1.1" id="Padding" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 32 32" style="enable-background:new 0 0 32 32;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:url(#SVGID_1_);}
+</style>
+<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="0.9903" y1="30.4217" x2="30.1814" y2="1.2305">
+	<stop  offset="9.954491e-02" style="stop-color:#EE5396"/>
+	<stop  offset="0.8983" style="stop-color:#8A3FFC"/>
+</linearGradient>
+<path class="st0" d="M5.2,24V7.9h10.6v2.7H8.3v3.9H15v2.7H8.3v4.1h7.5V24H5.2z M22.8,24.3c-1.1,0-2.1-0.2-2.9-0.6s-1.5-0.9-2.1-1.6
+	l1.8-1.7c0.4,0.5,0.9,0.9,1.5,1.2c0.5,0.3,1.1,0.4,1.8,0.4s1.2-0.1,1.5-0.4s0.5-0.6,0.5-1s-0.1-0.6-0.3-0.8
+	c-0.2-0.2-0.6-0.3-1.1-0.4l-1.2-0.2c-1.3-0.2-2.3-0.5-3-1.1s-1-1.4-1-2.5c0-0.6,0.1-1.1,0.3-1.6c0.2-0.5,0.6-1,1-1.3
+	s0.8-0.5,1.3-0.7c0.6-0.2,1.2-0.3,1.9-0.3c0.6,0,1.1,0,1.6,0.1s0.8,0.2,1.2,0.4c0.4,0.2,0.7,0.4,1,0.6s0.6,0.5,0.9,0.8l-1.7,1.7
+	c-0.4-0.4-0.8-0.7-1.3-0.9s-1-0.4-1.6-0.4c-0.7,0-1.1,0.1-1.4,0.3s-0.4,0.5-0.4,0.9s0.1,0.7,0.4,0.9c0.2,0.2,0.6,0.3,1.2,0.4
+	c0.3,0.1,1.2,0.2,1.2,0.2c2.2,0.3,3.8,1.5,3.8,3.5c0,0.6,0,1.1-0.2,1.6c-0.3,0.5-0.5,1-0.9,1.3s-0.7,0.6-1.5,0.9
+	C24.2,24.3,23.5,24.3,22.8,24.3z"/>
+</svg>
diff --git a/modules/fscloud/README.md b/modules/fscloud/README.md
@@ -36,7 +36,7 @@ No resources.
 | <a name="input_backup_crn"></a> [backup\_crn](#input\_backup\_crn) | The CRN of a backup resource to restore from. The backup is created by a database deployment with the same service ID. The backup is loaded after provisioning and the new deployment starts up that uses that data. A backup CRN is in the format crn:v1:<…>:backup:. If omitted, the database is provisioned empty. | `string` | `null` | no |
 | <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of CBR rules to create | <pre>list(object({<br>    description = string<br>    account_id  = string<br>    rule_contexts = list(object({<br>      attributes = optional(list(object({<br>        name  = string<br>        value = string<br>    }))) }))<br>    enforcement_mode = string<br>  }))</pre> | `[]` | no |
 | <a name="input_elasticsearch_version"></a> [elasticsearch\_version](#input\_elasticsearch\_version) | Version of the Elasticsearch instance. If no value is passed, the current preferred version of IBM Cloud Databases is used. | `string` | `null` | no |
-| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Hyper Protect Crypto Services instance. | `string` | n/a | yes |
+| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Hyper Protect Crypto Services instance. It is only required while creating authorization policy. | `string` | `null` | no |
 | <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of the Hyper Protect Crypto Service (HPCS) to use for disk encryption. | `string` | n/a | yes |
 | <a name="input_member_cpu_count"></a> [member\_cpu\_count](#input\_member\_cpu\_count) | Allocated dedicated CPU per member. For shared CPU, set to 0. For more information, see https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-resources-scaling | `number` | `0` | no |
 | <a name="input_member_disk_mb"></a> [member\_disk\_mb](#input\_member\_disk\_mb) | Allocated disk per-member. For more information, see https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-resources-scaling | `number` | `5120` | no |
diff --git a/modules/fscloud/variables.tf b/modules/fscloud/variables.tf
@@ -114,8 +114,9 @@ variable "kms_key_crn" {
 }
 
 variable "existing_kms_instance_guid" {
-  description = "The GUID of the Hyper Protect Crypto Services instance."
+  description = "The GUID of the Hyper Protect Crypto Services instance. It is only required while creating authorization policy."
   type        = string
+  default     = null
 }
 
 variable "skip_iam_authorization_policy" {
diff --git a/reference-architecture/deployable-architecture-elasticsearch.svg b/reference-architecture/deployable-architecture-elasticsearch.svg
diff --git a/renovate.json b/renovate.json
@@ -1,4 +1,18 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"]
+  "extends": ["github>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"],
+  "packageRules": [
+    {
+      "description": "Allow the locked in provider version to be updated to the latest for deployable architectures",
+      "enabled": true,
+      "matchFileNames": ["solutions/**"],
+      "matchManagers": ["terraform"],
+      "matchDepTypes": ["required_provider"],
+      "rangeStrategy": "bump",
+      "semanticCommitType": "fix",
+      "group": true,
+      "groupName": "required_provider",
+      "commitMessageExtra": "to latest for the deployable architecture solution"
+    }
+  ]
 }
diff --git a/solutions/secure/README.md b/solutions/secure/README.md
@@ -0,0 +1,11 @@
+# IBM Cloud Databases for Elasticsearch
+
+This architecture creates an Elasticsearch instance on IBM Cloud and supports provisioning of the following resources:
+
+- A resource group, if one is not passed in.
+- An Elasticsearch instance on IBM Cloud with KMS encryption.
+- Autoscaling rules for the Elasticsearch instance, if provided.
+
+![fscloud-elastic-search](../../reference-architecture/deployable-architecture-elasticsearch.svg)
+
+This solution is not intended to be called by one or more other modules since it contains a provider configurations, meaning it is not compatible with the for_each, count, and depends_on arguments. For more information see ![Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers)
diff --git a/solutions/secure/catalogValidationValues.json.template b/solutions/secure/catalogValidationValues.json.template
@@ -0,0 +1,8 @@
+{
+  "ibmcloud_api_key": $VALIDATION_APIKEY,
+  "region": "us-south",
+  "tags": $TAGS,
+  "name": $PREFIX,
+  "resource_group_name": $PREFIX,
+  "existing_kms_instance_guid": $EXISTING_KMS_INSTANCE_GUID
+}
diff --git a/solutions/secure/main.tf b/solutions/secure/main.tf
@@ -0,0 +1,63 @@
+module "resource_group" {
+  source                       = "terraform-ibm-modules/resource-group/ibm"
+  version                      = "1.1.4"
+  resource_group_name          = var.existing_resource_group == false ? var.resource_group_name : null
+  existing_resource_group_name = var.existing_resource_group == true ? var.resource_group_name : null
+}
+
+# KMS root key for Elasticsearch
+module "kms" {
+  providers = {
+    ibm = ibm.kms
+  }
+  count                       = var.existing_kms_key_crn != null ? 0 : 1 # no need to create any KMS resources if passing an existing key
+  source                      = "terraform-ibm-modules/kms-all-inclusive/ibm"
+  version                     = "4.8.5"
+  create_key_protect_instance = false
+  region                      = var.kms_region
+  existing_kms_instance_guid  = var.existing_kms_instance_guid
+  key_ring_endpoint_type      = var.kms_endpoint_type
+  key_endpoint_type           = var.kms_endpoint_type
+  keys = [
+    {
+      key_ring_name         = var.elasticsearch_key_ring_name
+      existing_key_ring     = false
+      force_delete_key_ring = true
+      keys = [
+        {
+          key_name                 = var.elasticsearch_key_name
+          standard_key             = false
+          rotation_interval_month  = 3
+          dual_auth_delete_enabled = false
+          force_delete             = true
+        }
+      ]
+    }
+  ]
+}
+
+locals {
+  kms_key_crn = var.existing_kms_key_crn != null ? var.existing_kms_key_crn : module.kms[0].keys[format("%s.%s", var.elasticsearch_key_ring_name, var.elasticsearch_key_name)].crn
+}
+
+module "elasticsearch" {
+  source                        = "../../modules/fscloud"
+  resource_group_id             = module.resource_group.resource_group_id
+  name                          = var.name
+  region                        = var.region
+  plan                          = var.plan
+  skip_iam_authorization_policy = var.skip_iam_authorization_policy
+  elasticsearch_version         = var.elasticsearch_version
+  existing_kms_instance_guid    = var.existing_kms_instance_guid
+  kms_key_crn                   = local.kms_key_crn
+  access_tags                   = var.access_tags
+  tags                          = var.tags
+  members                       = var.members
+  member_memory_mb              = var.member_memory_mb
+  admin_pass                    = var.admin_pass
+  users                         = var.users
+  member_disk_mb                = var.member_disk_mb
+  member_cpu_count              = var.member_cpu_count
+  auto_scaling                  = var.auto_scaling
+  service_credential_names      = var.service_credential_names
+}
diff --git a/solutions/secure/outputs.tf b/solutions/secure/outputs.tf
@@ -0,0 +1,50 @@
+##############################################################################
+# Outputs
+##############################################################################
+
+output "id" {
+  description = "Elasticsearch instance id"
+  value       = module.elasticsearch.id
+}
+
+output "guid" {
+  description = "Elasticsearch instance guid"
+  value       = module.elasticsearch.guid
+}
+
+output "version" {
+  description = "Elasticsearch instance version"
+  value       = module.elasticsearch.version
+}
+
+output "crn" {
+  description = "Elasticsearch instance crn"
+  value       = module.elasticsearch.crn
+}
+
+output "cbr_rule_ids" {
+  description = "CBR rule ids created to restrict Elasticsearch"
+  value       = module.elasticsearch.cbr_rule_ids
+}
+
+output "service_credentials_json" {
+  description = "Service credentials json map"
+  value       = module.elasticsearch.service_credentials_json
+  sensitive   = true
+}
+
+output "service_credentials_object" {
+  description = "Service credentials object"
+  value       = module.elasticsearch.service_credentials_object
+  sensitive   = true
+}
+
+output "hostname" {
+  description = "Elasticsearch instance hostname"
+  value       = module.elasticsearch.hostname
+}
+
+output "port" {
+  description = "Elasticsearch instance port"
+  value       = module.elasticsearch.port
+}
diff --git a/solutions/secure/provider.tf b/solutions/secure/provider.tf
@@ -0,0 +1,6 @@
+provider "ibm" {
+  alias            = "kms"
+  ibmcloud_api_key = var.ibmcloud_api_key
+  region           = var.region
+  ibmcloud_timeout = 60
+}
diff --git a/solutions/secure/variables.tf b/solutions/secure/variables.tf
diff --git a/solutions/secure/version.tf b/solutions/secure/version.tf
diff --git a/tests/pr_test.go b/tests/pr_test.go

Original file line number	Diff line number	Diff line change
`@@ -10,6 +10,9 @@`
`10`	`10`	`}],`
`11`	`11`	`["@semantic-release/exec", {`
`12`	`12`	`"successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV"`
	`13`	`+ }],`
	`14`	`+ ["@semantic-release/exec",{`
	`15`	`+ "publishCmd": "./ci/trigger-catalog-onboarding-pipeline.sh --version=v${nextRelease.version}"`
`13`	`16`	`}]`
`14`	`17`	`]`
`15`	`18`	`}`
Original file line number	Diff line number	Diff line change
`@@ -114,8 +114,9 @@ variable "kms_key_crn" {`
`114`	`114`	`}`
`115`	`115`
`116`	`116`	`variable "existing_kms_instance_guid" {`
`117`		`- description = "The GUID of the Hyper Protect Crypto Services instance."`
	`117`	`+ description = "The GUID of the Hyper Protect Crypto Services instance. It is only required while creating authorization policy."`
`118`	`118`	`type = string`
	`119`	`+ default = null`
`119`	`120`	`}`
`120`	`121`
`121`	`122`	`variable "skip_iam_authorization_policy" {`