Skip to content

Commit 2392f0d

Browse files
whofflerwhoffler
committed
update
1 parent daf3778 commit 2392f0d

File tree

16 files changed

+157
-175
lines changed

16 files changed

+157
-175
lines changed

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ You need the following permissions to run this module.
5656
| Name | Version |
5757
|------|---------|
5858
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
59-
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.79.2, < 2.0.0 |
59+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.79.2, <2.0.0 |
6060
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1, < 1.0.0 |
6161

6262
### Modules
@@ -75,7 +75,7 @@ You need the following permissions to run this module.
7575
| [ibm_iam_authorization_policy.backup_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
7676
| [ibm_iam_authorization_policy.kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
7777
| [ibm_resource_key.service_credentials](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_key) | resource |
78-
| [ibm_resource_tag.mongodb_tag](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_tag) | resource |
78+
| [ibm_resource_tag.access_tag](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_tag) | resource |
7979
| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
8080
| [time_sleep.wait_for_backup_kms_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
8181
| [ibm_database_connection.database_connection](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/database_connection) | data source |
@@ -89,7 +89,7 @@ You need the following permissions to run this module.
8989
| <a name="input_auto_scaling"></a> [auto\_scaling](#input\_auto\_scaling) | Optional rules to allow the database to increase resources in response to usage. Only a single autoscaling block is allowed. Make sure you understand the effects of autoscaling, especially for production environments. See https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-autoscaling&interface=cli#autoscaling-considerations in the IBM Cloud Docs. | <pre>object({<br/> disk = object({<br/> capacity_enabled = optional(bool, false)<br/> free_space_less_than_percent = optional(number, 10)<br/> io_above_percent = optional(number, 90)<br/> io_enabled = optional(bool, false)<br/> io_over_period = optional(string, "15m")<br/> rate_increase_percent = optional(number, 10)<br/> rate_limit_mb_per_member = optional(number, 3670016)<br/> rate_period_seconds = optional(number, 900)<br/> rate_units = optional(string, "mb")<br/> })<br/> memory = object({<br/> io_above_percent = optional(number, 90)<br/> io_enabled = optional(bool, false)<br/> io_over_period = optional(string, "15m")<br/> rate_increase_percent = optional(number, 10)<br/> rate_limit_mb_per_member = optional(number, 114688)<br/> rate_period_seconds = optional(number, 900)<br/> rate_units = optional(string, "mb")<br/> })<br/> })</pre> | `null` | no |
9090
| <a name="input_backup_crn"></a> [backup\_crn](#input\_backup\_crn) | The CRN of a backup resource to restore from. The backup is created by a database deployment with the same service ID. The backup is loaded after provisioning and the new deployment starts up that uses that data. A backup CRN is in the format crn:v1:<…>:backup:. If omitted, the database is provisioned empty. | `string` | `null` | no |
9191
| <a name="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn) | The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. Applies only if `use_ibm_owned_encryption_key` is false and `use_same_kms_key_for_backups` is false. If no value is passed, and `use_same_kms_key_for_backups` is true, the value of `kms_key_crn` is used. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups). | `string` | `null` | no |
92-
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of context-based restrictions rules to create. | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })))<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
92+
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of CBR rules to create | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })))<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
9393
| <a name="input_cpu_count"></a> [cpu\_count](#input\_cpu\_count) | Allocated dedicated CPU per member. For shared CPU, set to 0. [Learn more](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-pricing#mongodb-scale-member) | `number` | `0` | no |
9494
| <a name="input_disk_mb"></a> [disk\_mb](#input\_disk\_mb) | The disk that is allocated per member. [Learn more](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-pricing#mongodb-scale-member) | `number` | `10240` | no |
9595
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. Applies only if `use_ibm_owned_encryption_key` is false. By default this key is used for both deployment data and backups, but this behaviour can be altered using the `use_same_kms_key_for_backups` and `backup_encryption_key_crn` inputs. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups). | `string` | `null` | no |
@@ -102,9 +102,9 @@ You need the following permissions to run this module.
102102
| <a name="input_region"></a> [region](#input\_region) | The region where you want to deploy your instance. | `string` | `"us-south"` | no |
103103
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the MongoDB instance will be created. | `string` | n/a | yes |
104104
| <a name="input_service_credential_names"></a> [service\_credential\_names](#input\_service\_credential\_names) | Map of name, role for service credentials that you want to create for the database | `map(string)` | `{}` | no |
105-
| <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | The type of endpoint of the database instance. Possible values: `public`, `private`, `public-and-private`. | `string` | `"public"` | no |
105+
| <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | Specify whether you want to enable the public, private, or both service endpoints. Supported values are 'public', 'private', or 'public-and-private'. | `string` | `"private"` | no |
106106
| <a name="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Set to true to skip the creation of IAM authorization policies that permits all Databases for MongoDB instances in the given resource group 'Reader' access to the Key Protect or Hyper Protect Crypto Services key that was provided in the `kms_key_crn` and `backup_encryption_key_crn` inputs. This policy is required in order to enable KMS encryption, so only skip creation if there is one already present in your account. No policy is created if `use_ibm_owned_encryption_key` is true. | `bool` | `false` | no |
107-
| <a name="input_tags"></a> [tags](#input\_tags) | Optional list of tags to be added to the MongoDB instance. | `list(any)` | `[]` | no |
107+
| <a name="input_tags"></a> [tags](#input\_tags) | Optional list of tags to be added to the MongoDB instance. | `list(string)` | `[]` | no |
108108
| <a name="input_use_default_backup_encryption_key"></a> [use\_default\_backup\_encryption\_key](#input\_use\_default\_backup\_encryption\_key) | When `use_ibm_owned_encryption_key` is set to false, backups will be encrypted with either the key specified in `kms_key_crn`, or in `backup_encryption_key_crn` if a value is passed. If you do not want to use your own key for backups encryption, you can set this to `true` to use the IBM Cloud Databases default encryption for backups. Alternatively set `use_ibm_owned_encryption_key` to true to use the default encryption for both backups and deployment data. | `bool` | `false` | no |
109109
| <a name="input_use_ibm_owned_encryption_key"></a> [use\_ibm\_owned\_encryption\_key](#input\_use\_ibm\_owned\_encryption\_key) | IBM Cloud Databases will secure your deployment's data at rest automatically with an encryption key that IBM hold. Alternatively, you may select your own Key Management System instance and encryption key (Key Protect or Hyper Protect Crypto Services) by setting this to false. If setting to false, a value must be passed for the `kms_key_crn` input. | `bool` | `true` | no |
110110
| <a name="input_use_same_kms_key_for_backups"></a> [use\_same\_kms\_key\_for\_backups](#input\_use\_same\_kms\_key\_for\_backups) | Set this to false if you wan't to use a different key that you own to encrypt backups. When set to false, a value is required for the `backup_encryption_key_crn` input. Alternatiely set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Applies only if `use_ibm_owned_encryption_key` is false. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups). | `bool` | `true` | no |

‎cra-config.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,8 @@ CRA_TARGETS:
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"
66
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
77
CRA_ENVIRONMENT_VARIABLES:
8-
TF_VAR_prefix: "test"
8+
TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
99
TF_VAR_existing_resource_group_name: "geretain-test-redis"
1010
TF_VAR_kms_encryption_enabled: true
11-
TF_VAR_use_ibm_owned_encryption_key: false
12-
TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
1311
TF_VAR_provider_visibility: "public"
12+
TF_VAR_prefix: "test"

‎ibm_catalog.json‎

Lines changed: 33 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -74,21 +74,21 @@
7474
"role_crns": [
7575
"crn:v1:bluemix:public:iam::::role:Editor"
7676
],
77-
"service_name": "databases-for-elasticsearch"
77+
"service_name": "databases-for-mongodb"
7878
},
7979
{
8080
"role_crns": [
8181
"crn:v1:bluemix:public:iam::::role:Editor"
8282
],
8383
"service_name": "kms",
84-
"notes": "[Optional] Editor access is required to create keys. It is required only if KMS encryption is enabled."
84+
"notes": "[Optional] Editor access is required to create keys. It is only required when using Key Protect for encryption."
8585
},
8686
{
8787
"role_crns": [
8888
"crn:v1:bluemix:public:iam::::role:Editor"
8989
],
9090
"service_name": "hs-crypto",
91-
"notes": "[Optional] Editor access is required to create keys in HPCS. It is required only if KMS encryption is enabled."
91+
"notes": "[Optional] Editor access is required to create keys in HPCS. It is only required when using HPCS for encryption."
9292
}
9393
],
9494
"architecture": {
@@ -113,9 +113,27 @@
113113
{
114114
"key": "ibmcloud_api_key"
115115
},
116+
{
117+
"key": "provider_visibility",
118+
"hidden": true,
119+
"options": [
120+
{
121+
"displayname": "private",
122+
"value": "private"
123+
},
124+
{
125+
"displayname": "public",
126+
"value": "public"
127+
},
128+
{
129+
"displayname": "public-and-private",
130+
"value": "public-and-private"
131+
}
132+
]
133+
},
116134
{
117135
"key": "existing_resource_group_name",
118-
"required": true,
136+
"display_name": "resource_group",
119137
"custom_config": {
120138
"type": "resource_group",
121139
"grouping": "deployment",
@@ -125,6 +143,9 @@
125143
}
126144
}
127145
},
146+
{
147+
"key": "prefix"
148+
},
128149
{
129150
"key": "region",
130151
"required": true,
@@ -179,24 +200,6 @@
179200
}
180201
]
181202
},
182-
{
183-
"key": "provider_visibility",
184-
"hidden": true,
185-
"options": [
186-
{
187-
"displayname": "private",
188-
"value": "private"
189-
},
190-
{
191-
"displayname": "public",
192-
"value": "public"
193-
},
194-
{
195-
"displayname": "public-and-private",
196-
"value": "public-and-private"
197-
}
198-
]
199-
},
200203
{
201204
"key": "mongodb_version",
202205
"required": false,
@@ -216,17 +219,14 @@
216219
}
217220
]
218221
},
219-
{
220-
"key": "prefix"
221-
},
222222
{
223223
"key": "plan"
224224
},
225225
{
226226
"key": "name"
227227
},
228228
{
229-
"key": "mongodb_resource_tags",
229+
"key": "resource_tags",
230230
"type": "array",
231231
"custom_config": {
232232
"grouping": "deployment",
@@ -237,7 +237,7 @@
237237
}
238238
},
239239
{
240-
"key": "mongodb_access_tags",
240+
"key": "access_tags",
241241
"type": "array",
242242
"custom_config": {
243243
"grouping": "deployment",
@@ -385,7 +385,7 @@
385385
]
386386
},
387387
{
388-
"label": "Security Enforced",
388+
"label": "Security-enforced",
389389
"name": "security-enforced",
390390
"index": 2,
391391
"install_type": "fullstack",
@@ -462,10 +462,12 @@
462462
}
463463
}
464464
},
465+
{
466+
"key": "prefix"
467+
},
465468
{
466469
"key": "region",
467470
"required": true,
468-
"default_value": "us-south",
469471
"options": [
470472
{
471473
"displayname": "Chennai (che01)",
@@ -517,9 +519,6 @@
517519
}
518520
]
519521
},
520-
{
521-
"key": "prefix"
522-
},
523522
{
524523
"key": "plan"
525524
},
@@ -546,7 +545,7 @@
546545
"key": "name"
547546
},
548547
{
549-
"key": "mongodb_resource_tags",
548+
"key": "resource_tags",
550549
"type": "array",
551550
"custom_config": {
552551
"grouping": "deployment",
@@ -557,7 +556,7 @@
557556
}
558557
},
559558
{
560-
"key": "mongodb_access_tags",
559+
"key": "access_tags",
561560
"type": "array",
562561
"custom_config": {
563562
"grouping": "deployment",

‎main.tf‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
1-
##############################################################################
2-
# ICD MongoDB module
3-
##############################################################################
4-
5-
61
########################################################################################################################
72
# Locals
83
########################################################################################################################
94

105
locals {
6+
# If no value passed for 'backup_encryption_key_crn' use the value of 'kms_key_crn' and perform validation of 'kms_key_crn' to check if region is supported by backup encryption key.
7+
118
# If 'use_ibm_owned_encryption_key' is true or 'use_default_backup_encryption_key' is true, default to null.
129
# If no value is passed for 'backup_encryption_key_crn', then default to use 'kms_key_crn'.
1310
backup_encryption_key_crn = var.use_ibm_owned_encryption_key || var.use_default_backup_encryption_key ? null : (var.backup_encryption_key_crn != null ? var.backup_encryption_key_crn : var.kms_key_crn)
@@ -163,8 +160,8 @@ resource "time_sleep" "wait_for_backup_kms_authorization_policy" {
163160
resource "ibm_database" "mongodb" {
164161
depends_on = [time_sleep.wait_for_authorization_policy, time_sleep.wait_for_backup_kms_authorization_policy]
165162
name = var.name
166-
location = var.region
167163
plan = var.plan
164+
location = var.region
168165
service = "databases-for-mongodb"
169166
version = var.mongodb_version
170167
resource_group_id = var.resource_group_id
@@ -291,7 +288,7 @@ resource "ibm_database" "mongodb" {
291288
}
292289
}
293290

294-
resource "ibm_resource_tag" "mongodb_tag" {
291+
resource "ibm_resource_tag" "access_tag" {
295292
count = length(var.access_tags) == 0 ? 0 : 1
296293
resource_id = ibm_database.mongodb.resource_crn
297294
tags = var.access_tags

‎outputs.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,21 @@ output "id" {
77
value = ibm_database.mongodb.id
88
}
99

10-
output "guid" {
11-
description = "MongoDB instance guid"
12-
value = ibm_database.mongodb.guid
13-
}
14-
1510
output "version" {
1611
description = "MongoDB instance version"
1712
value = ibm_database.mongodb.version
1813
}
1914

15+
output "guid" {
16+
description = "MongoDB instance guid"
17+
value = ibm_database.mongodb.guid
18+
}
19+
2020
output "crn" {
2121
description = "MongoDB instance crn"
2222
value = ibm_database.mongodb.resource_crn
2323
}
2424

25-
output "cbr_rule_ids" {
26-
description = "CBR rule ids created to restrict MongoDB"
27-
value = module.cbr_rule[*].rule_id
28-
}
29-
3025
output "service_credentials_json" {
3126
description = "Service credentials json map"
3227
value = local.service_credentials_json
@@ -39,6 +34,11 @@ output "service_credentials_object" {
3934
sensitive = true
4035
}
4136

37+
output "cbr_rule_ids" {
38+
description = "CBR rule ids created to restrict MongoDB"
39+
value = module.cbr_rule[*].rule_id
40+
}
41+
4242
output "adminuser" {
4343
description = "Database admin user name"
4444
value = ibm_database.mongodb.adminuser

0 commit comments

Comments
 (0)