SKIP UPGRADE TEST

Author: whoffler

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "go.sum|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2025-03-24T11:10:21Z",
+  "generated_at": "2025-05-02T09:58:59Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -104,6 +104,16 @@
         "type": "Secret Keyword",
         "verified_result": null
       }
+    ],
+    "tests/pr_test.go": [
+      {
+        "hashed_secret": "8c7c51db5075ebd0369c51e9f14737d9b4c1c21d",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 356,
+        "type": "Base64 High Entropy String",
+        "verified_result": null
+      }
     ]
   },
   "version": "0.13.1+ibm.62.dss",

cra-config.yaml

@@ -6,6 +6,7 @@ CRA_TARGETS:
     PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3"  # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
     CRA_ENVIRONMENT_VARIABLES:
       TF_VAR_prefix: "test"
+      TF_VAR_use_ibm_owned_encryption_key: false
       TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
       TF_VAR_existing_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533"
       TF_VAR_provider_visibility: "public"

ibm_catalog.json

@@ -96,6 +96,7 @@
             },
             {
               "key": "provider_visibility",
+              "hidden": true,
               "options": [
                 {
                   "displayname": "private",

solutions/fully-configurable/variables.tf

@@ -238,6 +238,13 @@ variable "use_ibm_owned_encryption_key" {
     )
     error_message = "When not using ibm owned encryption keys by setting variable 'use_ibm_owned_encryption_key' to false, 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn' must be set."
   }
+
+  validation {
+    condition = (
+      var.use_ibm_owned_encryption_key ? length(compact([var.existing_kms_instance_crn, var.existing_kms_key_crn, var.existing_backup_kms_key_crn])) == 0 : true
+    )
+    error_message = "When using ibm owned encryption keys by setting variable 'use_ibm_owned_encryption_key' to true, 'existing_kms_instance_crn', 'existing_kms_key_crn' and 'existing_backup_kms_key_crn' must not be set."
+  }
 }
 
 variable "existing_kms_instance_crn" {

tests/pr_test.go

@@ -96,6 +96,7 @@ func TestRunFullyConfigurableSolutionSchematics(t *testing.T) {
 	options.TerraformVars = []testschematic.TestSchematicTerraformVar{
 		{Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true},
 		{Name: "elasticsearch_access_tags", Value: permanentResources["accessTags"], DataType: "list(string)"},
+		{Name: "use_ibm_owned_encryption_key", Value: false, DataType: "bool"},
 		{Name: "existing_kms_instance_crn", Value: permanentResources["hpcs_south_crn"], DataType: "string"},
 		{Name: "kms_endpoint_type", Value: "private", DataType: "string"},
 		{Name: "existing_resource_group_name", Value: resourceGroup, DataType: "string"},
@@ -131,6 +132,7 @@ func TestRunFullyConfigurableUpgradeSolution(t *testing.T) {
 	options.TerraformVars = map[string]interface{}{
 		"prefix":                       options.Prefix,
 		"elasticsearch_access_tags":    permanentResources["accessTags"],
+		"use_ibm_owned_encryption_key": false,
 		"existing_kms_instance_crn":    permanentResources["hpcs_south_crn"],
 		"kms_endpoint_type":            "public",
 		"existing_resource_group_name": resourceGroup,
@@ -185,6 +187,7 @@ func TestRunSecurityEnforcedSolutionSchematics(t *testing.T) {
 
 	options.TerraformVars = []testschematic.TestSchematicTerraformVar{
 		{Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true},
+		{Name: "use_ibm_owned_encryption_key", Value: false, DataType: "bool"},
 		{Name: "elasticsearch_access_tags", Value: permanentResources["accessTags"], DataType: "list(string)"},
 		{Name: "existing_kms_instance_crn", Value: permanentResources["hpcs_south_crn"], DataType: "string"},
 		{Name: "existing_resource_group_name", Value: resourceGroup, DataType: "string"},
@@ -310,7 +313,7 @@ func TestPlanValidation(t *testing.T) {
 	options := testhelper.TestOptionsDefault(&testhelper.TestOptions{
 		Testing:       t,
 		TerraformDir:  fullyConfigurableSolutionTerraformDir,
-		Prefix:        "validate-plan",
+		Prefix:        "val-plan",
 		ResourceGroup: resourceGroup,
 		Region:        "us-south", // skip VPC region picker
 	})
@@ -319,36 +322,38 @@ func TestPlanValidation(t *testing.T) {
 	options.TerraformOptions.Logger = logger.Discard
 	options.TerraformOptions.Vars = map[string]interface{}{
 		"prefix":                       options.Prefix,
+		"existing_resource_group_name": resourceGroup,
 		"region":                       "us-south",
 		"elasticsearch_version":        "8.10",
 		"provider_visibility":          "public",
-		"existing_resource_group_name": options.Prefix,
 	}
 
 	// Test the DA when using Elser model
-	var standardSolutionWithElserModelVars = map[string]interface{}{
-		"existing_kms_instance_crn": permanentResources["hpcs_south_crn"],
-		"enable_elser_model":        true,
-		"plan":                      "platinum",
+	var fullyConfigurableSolutionWithElserModelVars = map[string]interface{}{
+		"use_ibm_owned_encryption_key": false,
+		"existing_kms_instance_crn":    permanentResources["hpcs_south_crn"],
+		"enable_elser_model":           true,
+		"plan":                         "platinum",
 	}
 
 	// Test the DA when using Kibana dashboard and existing KMS instance
-	var standardSolutionWithKibanaDashboardVars = map[string]interface{}{
-		"enable_kibana_dashboard":   true,
-		"existing_kms_instance_crn": permanentResources["hpcs_south_crn"],
-		"plan":                      "enterprise",
+	var fullyConfigurableSolutionWithKibanaDashboardVars = map[string]interface{}{
+		"enable_kibana_dashboard":      true,
+		"use_ibm_owned_encryption_key": false,
+		"existing_kms_instance_crn":    permanentResources["hpcs_south_crn"],
+		"plan":                         "enterprise",
 	}
 
 	// Test the DA when using IBM owned encryption key
-	var standardSolutionWithUseIbmOwnedEncKey = map[string]interface{}{
+	var fullyConfigurableSolutionWithUseIbmOwnedEncKey = map[string]interface{}{
 		"use_ibm_owned_encryption_key": true,
 	}
 
 	// Create a map of the variables
 	tfVarsMap := map[string]map[string]interface{}{
-		"standardSolutionWithElserModelVars":      standardSolutionWithElserModelVars,
-		"standardSolutionWithKibanaDashboardVars": standardSolutionWithKibanaDashboardVars,
-		"standardSolutionWithUseIbmOwnedEncKey":   standardSolutionWithUseIbmOwnedEncKey,
+		"fullyConfigurableSolutionWithElserModelVars":      fullyConfigurableSolutionWithElserModelVars,
+		"fullyConfigurableSolutionWithKibanaDashboardVars": fullyConfigurableSolutionWithKibanaDashboardVars,
+		"fullyConfigurableSolutionWithUseIbmOwnedEncKey":   fullyConfigurableSolutionWithUseIbmOwnedEncKey,
 	}
 
 	_, initErr := terraform.InitE(t, options.TerraformOptions)