Skip to content

Commit b8c7613

Browse files
arya-girish-kArya Girish Kshemau
authored
feat: Add UI regex validation to the DA (#654)
* feat: Add UI regex validation * fix: updated CRN pattern * removed common dev assets changes * update CRN pattern for existing mongodb instance crn --------- Co-authored-by: Arya Girish K <[email protected]> Co-authored-by: shemau <[email protected]>
1 parent cdbd98b commit b8c7613

File tree

3 files changed

+178
-14
lines changed

3 files changed

+178
-14
lines changed

‎ibm_catalog.json‎

Lines changed: 96 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,14 @@
313313
"key": "admin_pass"
314314
},
315315
{
316-
"key": "existing_secrets_manager_instance_crn"
316+
"key": "existing_secrets_manager_instance_crn",
317+
"value_constraints": [
318+
{
319+
"type": "regex",
320+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
321+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
322+
}
323+
]
317324
},
318325
{
319326
"key": "existing_secrets_manager_endpoint_type",
@@ -357,10 +364,24 @@
357364
"key": "kms_encryption_enabled"
358365
},
359366
{
360-
"key": "existing_kms_instance_crn"
367+
"key": "existing_kms_instance_crn",
368+
"value_constraints": [
369+
{
370+
"type": "regex",
371+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
372+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
373+
}
374+
]
361375
},
362376
{
363-
"key": "existing_kms_key_crn"
377+
"key": "existing_kms_key_crn",
378+
"value_constraints": [
379+
{
380+
"type": "regex",
381+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
382+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
383+
}
384+
]
364385
},
365386
{
366387
"key": "kms_endpoint_type",
@@ -383,10 +404,24 @@
383404
"key": "key_name"
384405
},
385406
{
386-
"key": "backup_crn"
407+
"key": "backup_crn",
408+
"value_constraints": [
409+
{
410+
"type": "regex",
411+
"description": "The value provided for 'backup_crn' is not valid.",
412+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
413+
}
414+
]
387415
},
388416
{
389-
"key": "existing_backup_kms_key_crn"
417+
"key": "existing_backup_kms_key_crn",
418+
"value_constraints": [
419+
{
420+
"type": "regex",
421+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
422+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
423+
}
424+
]
390425
},
391426
{
392427
"key": "use_default_backup_encryption_key"
@@ -395,7 +430,14 @@
395430
"key": "skip_mongodb_kms_auth_policy"
396431
},
397432
{
398-
"key": "existing_mongodb_instance_crn"
433+
"key": "existing_mongodb_instance_crn",
434+
"value_constraints": [
435+
{
436+
"type": "regex",
437+
"description": "The value provided for 'existing_mongodb_instance_crn' is not valid.",
438+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
439+
}
440+
]
399441
}
400442
],
401443
"terraform_version": "1.12.2",
@@ -632,7 +674,14 @@
632674
"key": "admin_pass"
633675
},
634676
{
635-
"key": "existing_secrets_manager_instance_crn"
677+
"key": "existing_secrets_manager_instance_crn",
678+
"value_constraints": [
679+
{
680+
"type": "regex",
681+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
682+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
683+
}
684+
]
636685
},
637686
{
638687
"key": "skip_mongodb_secrets_manager_auth_policy"
@@ -660,10 +709,24 @@
660709
},
661710
{
662711
"key": "existing_kms_instance_crn",
663-
"required": true
712+
"required": true,
713+
"value_constraints": [
714+
{
715+
"type": "regex",
716+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
717+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
718+
}
719+
]
664720
},
665721
{
666-
"key": "existing_kms_key_crn"
722+
"key": "existing_kms_key_crn",
723+
"value_constraints": [
724+
{
725+
"type": "regex",
726+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
727+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
728+
}
729+
]
667730
},
668731
{
669732
"key": "key_ring_name"
@@ -672,16 +735,37 @@
672735
"key": "key_name"
673736
},
674737
{
675-
"key": "backup_crn"
738+
"key": "backup_crn",
739+
"value_constraints": [
740+
{
741+
"type": "regex",
742+
"description": "The value provided for 'backup_crn' is not valid.",
743+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
744+
}
745+
]
676746
},
677747
{
678-
"key": "existing_backup_kms_key_crn"
748+
"key": "existing_backup_kms_key_crn",
749+
"value_constraints": [
750+
{
751+
"type": "regex",
752+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
753+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
754+
}
755+
]
679756
},
680757
{
681758
"key": "skip_mongodb_kms_auth_policy"
682759
},
683760
{
684-
"key": "existing_mongodb_instance_crn"
761+
"key": "existing_mongodb_instance_crn",
762+
"value_constraints": [
763+
{
764+
"type": "regex",
765+
"description": "The value provided for 'existing_mongodb_instance_crn' is not valid.",
766+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
767+
}
768+
]
685769
}
686770
],
687771
"terraform_version": "1.12.2",

‎solutions/fully-configurable/variables.tf‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,14 @@ variable "existing_mongodb_instance_crn" {
6262
type = string
6363
default = null
6464
description = "The CRN of an existing Databases for MongoDB instance. If no value is specified, a new instance is created."
65+
66+
validation {
67+
condition = anytrue([
68+
var.existing_mongodb_instance_crn == null,
69+
can(regex("^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_mongodb_instance_crn))
70+
])
71+
error_message = "The value provided for 'existing_mongodb_instance_crn' is not valid."
72+
}
6573
}
6674

6775
variable "mongodb_version" {
@@ -220,12 +228,28 @@ variable "existing_kms_instance_crn" {
220228
type = string
221229
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
222230
default = null
231+
232+
validation {
233+
condition = anytrue([
234+
var.existing_kms_instance_crn == null,
235+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
236+
])
237+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
238+
}
223239
}
224240

225241
variable "existing_kms_key_crn" {
226242
type = string
227243
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
228244
default = null
245+
246+
validation {
247+
condition = anytrue([
248+
var.existing_kms_key_crn == null,
249+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
250+
])
251+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
252+
}
229253
}
230254

231255
variable "kms_endpoint_type" {
@@ -268,6 +292,14 @@ variable "existing_backup_kms_key_crn" {
268292
type = string
269293
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
270294
default = null
295+
296+
validation {
297+
condition = anytrue([
298+
var.existing_backup_kms_key_crn == null,
299+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
300+
])
301+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
302+
}
271303
}
272304

273305
variable "use_default_backup_encryption_key" {
@@ -284,7 +316,7 @@ variable "backup_crn" {
284316
validation {
285317
condition = anytrue([
286318
var.backup_crn == null,
287-
can(regex("^crn:.*:backup:", var.backup_crn))
319+
can(regex("^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
288320
])
289321
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
290322
}
@@ -361,6 +393,14 @@ variable "existing_secrets_manager_instance_crn" {
361393
type = string
362394
default = null
363395
description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for MongoDB instance."
396+
397+
validation {
398+
condition = anytrue([
399+
var.existing_secrets_manager_instance_crn == null,
400+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
401+
])
402+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
403+
}
364404
}
365405

366406
variable "existing_secrets_manager_endpoint_type" {

‎solutions/security-enforced/variables.tf‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ variable "existing_mongodb_instance_crn" {
5757
type = string
5858
default = null
5959
description = "The CRN of an existing Databases for MongoDB instance. If no value is specified, a new instance is created."
60+
61+
validation {
62+
condition = anytrue([
63+
var.existing_mongodb_instance_crn == null,
64+
can(regex("^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_mongodb_instance_crn))
65+
])
66+
error_message = "The value provided for 'existing_mongodb_instance_crn' is not valid."
67+
}
6068
}
6169

6270
variable "mongodb_version" {
@@ -175,6 +183,14 @@ variable "existing_kms_instance_crn" {
175183
type = string
176184
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
177185
default = null
186+
187+
validation {
188+
condition = anytrue([
189+
var.existing_kms_instance_crn == null,
190+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
191+
])
192+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
193+
}
178194
}
179195

180196
variable "existing_kms_key_crn" {
@@ -189,6 +205,14 @@ variable "existing_kms_key_crn" {
189205
)
190206
error_message = "Either existing_kms_key_crn or existing_kms_instance_crn must be set, but not both."
191207
}
208+
209+
validation {
210+
condition = anytrue([
211+
var.existing_kms_key_crn == null,
212+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
213+
])
214+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
215+
}
192216
}
193217

194218
variable "skip_mongodb_kms_auth_policy" {
@@ -220,6 +244,14 @@ variable "existing_backup_kms_key_crn" {
220244
type = string
221245
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input."
222246
default = null
247+
248+
validation {
249+
condition = anytrue([
250+
var.existing_backup_kms_key_crn == null,
251+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
252+
])
253+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
254+
}
223255
}
224256

225257
variable "backup_crn" {
@@ -230,7 +262,7 @@ variable "backup_crn" {
230262
validation {
231263
condition = anytrue([
232264
var.backup_crn == null,
233-
can(regex("^crn:.*:backup:", var.backup_crn))
265+
can(regex("^crn:v\\d:(.*:){2}databases-for-mongodb:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
234266
])
235267
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
236268
}
@@ -296,6 +328,14 @@ variable "existing_secrets_manager_instance_crn" {
296328
type = string
297329
default = null
298330
description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for MongoDB instance."
331+
332+
validation {
333+
condition = anytrue([
334+
var.existing_secrets_manager_instance_crn == null,
335+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
336+
])
337+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
338+
}
299339
}
300340

301341
variable "service_credential_secrets" {

0 commit comments

Comments
 (0)