Skip to content

Commit 11e46ab

Browse files
Khuzaima05Khuzaima-Shakeel
Khuzaima05
and
Khuzaima-Shakeel
authored
feat: improved user experience for validating input variable values <br> - updated required terraform to be >= 1.9.0 (#485)
* feat: updated code to use cross-object referencing for validations * resolve review comments * resolve review comments * resolve review comments * resolve review comments * updated PR after test-coverage * fix pipeline * made PR consistent * updated PR as per other ICDs --------- Co-authored-by: Khuzaima-Shakeel <[email protected]>
1 parent bf6068c commit 11e46ab

File tree

11 files changed

+89
-44
lines changed

11 files changed

+89
-44
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ You need the following permissions to run this module.
5555

5656
| Name | Version |
5757
|------|---------|
58-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
58+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
5959
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.70.0, < 2.0.0 |
6060
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |
6161

‎examples/backup-restore/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎examples/basic/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎examples/complete/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎examples/fscloud/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎main.tf‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,6 @@
22
# ICD MongoDB module
33
##############################################################################
44

5-
locals {
6-
# Validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
7-
# tflint-ignore: terraform_unused_declarations
8-
validate_kms_values = var.use_ibm_owned_encryption_key && (var.kms_key_crn != null || var.backup_encryption_key_crn != null) ? tobool("When passing values for 'kms_key_crn' or 'backup_encryption_key_crn', you must set 'use_ibm_owned_encryption_key' to false. Otherwise unset them to use default encryption.") : true
9-
# tflint-ignore: terraform_unused_declarations
10-
validate_kms_vars = !var.use_ibm_owned_encryption_key && var.kms_key_crn == null ? tobool("When setting 'use_ibm_owned_encryption_key' to false, a value must be passed for 'kms_key_crn'.") : true
11-
# tflint-ignore: terraform_unused_declarations
12-
validate_backup_key = !var.use_ibm_owned_encryption_key && var.backup_encryption_key_crn != null && (var.use_default_backup_encryption_key || var.use_same_kms_key_for_backups) ? tobool("When passing a value for 'backup_encryption_key_crn' you cannot set 'use_default_backup_encryption_key' to true or 'use_ibm_owned_encryption_key' to false.") : true
13-
# tflint-ignore: terraform_unused_declarations
14-
validate_backup_key_2 = !var.use_ibm_owned_encryption_key && var.backup_encryption_key_crn == null && !var.use_same_kms_key_for_backups ? tobool("When 'use_same_kms_key_for_backups' is set to false, a value needs to be passed for 'backup_encryption_key_crn'.") : true
15-
}
165

176
########################################################################################################################
187
# Locals

‎solutions/standard/main.tf‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,6 @@ module "resource_group" {
99
existing_resource_group_name = var.use_existing_resource_group == true ? var.resource_group_name : null
1010
}
1111

12-
#######################################################################################################################
13-
# KMS related variable validation
14-
# (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
15-
#
16-
# TODO: Replace with terraform cross variable validation: https://github.ibm.com/GoldenEye/issues/issues/10836
17-
#######################################################################################################################
18-
19-
locals {
20-
# tflint-ignore: terraform_unused_declarations
21-
validate_kms_1 = var.existing_mongodb_instance_crn != null ? true : var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn != null || var.existing_kms_key_crn != null || var.existing_backup_kms_key_crn != null) ? tobool("When setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn', the 'use_ibm_owned_encryption_key' input must be set to false.") : true
22-
# tflint-ignore: terraform_unused_declarations
23-
validate_kms_2 = var.existing_mongodb_instance_crn != null ? true : !var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn == null && var.existing_kms_key_crn == null) ? tobool("When 'use_ibm_owned_encryption_key' is false, a value is required for either 'existing_kms_instance_crn' (to create a new key), or 'existing_kms_key_crn' to use an existing key.") : true
24-
}
25-
2612

2713
#######################################################################################################################
2814
# KMS encryption key
@@ -259,10 +245,6 @@ module "mongodb_instance_crn_parser" {
259245
locals {
260246
existing_mongodb_guid = var.existing_mongodb_instance_crn != null ? module.mongodb_instance_crn_parser[0].service_instance : null
261247
existing_mongodb_region = var.existing_mongodb_instance_crn != null ? module.mongodb_instance_crn_parser[0].region : null
262-
263-
# Validate the region input matches region detected in existing instance CRN (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
264-
# tflint-ignore: terraform_unused_declarations
265-
validate_existing_instance_region = var.existing_mongodb_instance_crn != null && var.region != local.existing_mongodb_region ? tobool("The region detected in the 'existing_mongodb_instance_crn' value must match the value of the 'region' input variable when passing an existing instance.") : true
266248
}
267249

268250
# Do a data lookup on the resource GUID to get more info that is needed for the 'ibm_database' data lookup below
@@ -333,14 +315,6 @@ locals {
333315
#######################################################################################################################
334316

335317
locals {
336-
## Variable validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
337-
# tflint-ignore: terraform_unused_declarations
338-
validate_secret_manager_crn = length(local.service_credential_secrets) > 0 && var.existing_secrets_manager_instance_crn == null ? tobool("`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret.") : false
339-
# tflint-ignore: terraform_unused_declarations
340-
validate_secret_manager_sg = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secret_manager_secret_group == null ? tobool("`admin_pass_secret_manager_secret_group` is required when `existing_secrets_manager_instance_crn` is set.") : false
341-
# tflint-ignore: terraform_unused_declarations
342-
validate_secret_manager_sn = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secret_manager_secret_name == null ? tobool("`admin_pass_secret_manager_secret_name` is required when `existing_secrets_manager_instance_crn` is set.") : false
343-
344318
create_secret_manager_auth_policy = var.skip_mongodb_secret_manager_auth_policy || var.existing_secrets_manager_instance_crn == null ? 0 : 1
345319
}
346320

‎solutions/standard/variables.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ variable "region" {
3434
description = "The region where you want to deploy your instance."
3535
type = string
3636
default = "us-south"
37+
38+
validation {
39+
condition = var.existing_mongodb_instance_crn != null && var.region != local.existing_mongodb_region ? false : true
40+
error_message = "The region detected in the 'existing_mongodb_instance_crn' value must match the value of the 'region' input variable when passing an existing instance."
41+
}
3742
}
3843

3944
variable "mongodb_version" {
@@ -146,6 +151,29 @@ variable "use_ibm_owned_encryption_key" {
146151
type = bool
147152
description = "IBM Cloud Databases will secure your deployment's data at rest automatically with an encryption key that IBM hold. Alternatively, you may select your own Key Management System instance and encryption key (Key Protect or Hyper Protect Crypto Services) by setting this to false. If setting to false, a value must be passed for `existing_kms_instance_crn` to create a new key, or `existing_kms_key_crn` and/or `existing_backup_kms_key_crn` to use an existing key."
148153
default = false
154+
155+
validation {
156+
condition = (
157+
var.existing_mongodb_instance_crn != null ||
158+
!(var.use_ibm_owned_encryption_key && (
159+
var.existing_kms_instance_crn != null ||
160+
var.existing_kms_key_crn != null ||
161+
var.existing_backup_kms_key_crn != null
162+
))
163+
)
164+
error_message = "When setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn', the 'use_ibm_owned_encryption_key' input must be set to false."
165+
}
166+
167+
# this validation ensures key info is provided when IBM-owned key is disabled and no MongoDB instance is given
168+
validation {
169+
condition = !(
170+
var.existing_mongodb_instance_crn == null &&
171+
var.use_ibm_owned_encryption_key == false &&
172+
var.existing_kms_instance_crn == null &&
173+
var.existing_kms_key_crn == null
174+
)
175+
error_message = "When 'use_ibm_owned_encryption_key' is false, you must provide either 'existing_kms_instance_crn' (to create a new key) or 'existing_kms_key_crn' (to use an existing key)."
176+
}
149177
}
150178

151179
variable "existing_kms_instance_crn" {
@@ -312,6 +340,14 @@ variable "service_credential_secrets" {
312340
])
313341
error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles"
314342
}
343+
344+
validation {
345+
condition = (
346+
length(var.service_credential_secrets) == 0 ||
347+
var.existing_secrets_manager_instance_crn != null
348+
)
349+
error_message = "`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret."
350+
}
315351
}
316352

317353
variable "skip_mongodb_secret_manager_auth_policy" {
@@ -324,6 +360,14 @@ variable "admin_pass_secret_manager_secret_group" {
324360
type = string
325361
description = "The name of a new or existing secrets manager secret group for admin password. To use existing secret group, `use_existing_admin_pass_secrets_manager_secret_group` must be set to `true`. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
326362
default = "mongodb-secrets"
363+
364+
validation {
365+
condition = (
366+
var.existing_secrets_manager_instance_crn == null ||
367+
var.admin_pass_secret_manager_secret_group != null
368+
)
369+
error_message = "`admin_pass_secret_manager_secret_group` is required when `existing_secrets_manager_instance_crn` is set."
370+
}
327371
}
328372

329373
variable "use_existing_admin_pass_secret_manager_secret_group" {
@@ -336,4 +380,11 @@ variable "admin_pass_secret_manager_secret_name" {
336380
type = string
337381
description = "The name of a new mongodb administrator secret. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
338382
default = "mongodb-admin-password"
383+
validation {
384+
condition = (
385+
var.existing_secrets_manager_instance_crn == null ||
386+
var.admin_pass_secret_manager_secret_name != null
387+
)
388+
error_message = "`admin_pass_secret_manager_secret_name` is required when `existing_secrets_manager_instance_crn` is set."
389+
}
339390
}

‎solutions/standard/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
# Lock DA into an exact provider version - renovate automation will keep it updated
44
required_providers {
55
ibm = {

‎variables.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,37 @@ variable "use_ibm_owned_encryption_key" {
186186
type = bool
187187
description = "IBM Cloud Databases will secure your deployment's data at rest automatically with an encryption key that IBM hold. Alternatively, you may select your own Key Management System instance and encryption key (Key Protect or Hyper Protect Crypto Services) by setting this to false. If setting to false, a value must be passed for the `kms_key_crn` input."
188188
default = true
189+
190+
validation {
191+
condition = !(
192+
var.use_ibm_owned_encryption_key == true &&
193+
(var.kms_key_crn != null || var.backup_encryption_key_crn != null)
194+
)
195+
error_message = "When 'use_ibm_owned_encryption_key' is true, 'kms_key_crn' and 'backup_encryption_key_crn' must both be null."
196+
}
197+
198+
validation {
199+
condition = var.use_ibm_owned_encryption_key || var.kms_key_crn != null
200+
error_message = "When setting 'use_ibm_owned_encryption_key' to false, a value must be passed for 'kms_key_crn'."
201+
}
202+
203+
validation {
204+
condition = (
205+
var.use_ibm_owned_encryption_key ||
206+
var.backup_encryption_key_crn == null ||
207+
(!var.use_default_backup_encryption_key && !var.use_same_kms_key_for_backups)
208+
)
209+
error_message = "When passing a value for 'backup_encryption_key_crn' you cannot set 'use_default_backup_encryption_key' to true or 'use_ibm_owned_encryption_key' to false."
210+
}
211+
212+
validation {
213+
condition = (
214+
var.use_ibm_owned_encryption_key ||
215+
var.backup_encryption_key_crn != null ||
216+
var.use_same_kms_key_for_backups
217+
)
218+
error_message = "When 'use_same_kms_key_for_backups' is set to false, a value needs to be passed for 'backup_encryption_key_crn'."
219+
}
189220
}
190221

191222
variable "use_default_backup_encryption_key" {

0 commit comments

Comments
 (0)