Skip to content

Commit 89e9961

Browse files
Aditya-ranjan-16Ak-skyaatreyee2506lethal007
authored
feat: improved user experience for validating input variable values <br> - updated required terraform to be >= 1.9.0 (#212)
* add: cross object referencing * add: validation in main module * fix * fix * fix * fix: corrected logic * fix: added existing_kms_instance_crn in cra config * fix * fix: making validation consistent with other ICDS * fix * test * fix * fix * fix: Making Consistent with Redis --------- Co-authored-by: Akash Kumar <[email protected]> Co-authored-by: Aatreyee Mukherjee <[email protected]> Co-authored-by: lethal007 <[email protected]>
1 parent 57f2357 commit 89e9961

File tree

13 files changed

+92
-46
lines changed

13 files changed

+92
-46
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ To attach access management tags to resources in this module, you need the follo
8484

8585
| Name | Version |
8686
|------|---------|
87-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
87+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
8888
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.70.0, < 2.0.0 |
8989
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1 |
9090

‎examples/backup/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎examples/basic/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Pin to the lowest provider version of the range defined in the main module's version.tf to ensure lowest version still works
55
ibm = {

‎examples/complete/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎examples/fscloud/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# Use latest version of provider in non-basic examples to verify latest version works with module
55
ibm = {

‎main.tf‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,6 @@
33
##############################################################################
44

55
locals {
6-
# Validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
7-
# tflint-ignore: terraform_unused_declarations
8-
validate_kms_values = var.use_ibm_owned_encryption_key && (var.kms_key_crn != null || var.backup_encryption_key_crn != null) ? tobool("When passing values for 'kms_key_crn' or 'backup_encryption_key_crn', you must set 'use_ibm_owned_encryption_key' to false. Otherwise unset them to use default encryption.") : true
9-
# tflint-ignore: terraform_unused_declarations
10-
validate_kms_vars = !var.use_ibm_owned_encryption_key && var.kms_key_crn == null ? tobool("When setting 'use_ibm_owned_encryption_key' to false, a value must be passed for 'kms_key_crn'.") : true
11-
# tflint-ignore: terraform_unused_declarations
12-
validate_backup_key = !var.use_ibm_owned_encryption_key && var.backup_encryption_key_crn != null && (var.use_default_backup_encryption_key || var.use_same_kms_key_for_backups) ? tobool("When passing a value for 'backup_encryption_key_crn' you cannot set 'use_default_backup_encryption_key' to true or 'use_ibm_owned_encryption_key' to false.") : true
13-
# tflint-ignore: terraform_unused_declarations
14-
validate_backup_key_2 = !var.use_ibm_owned_encryption_key && var.backup_encryption_key_crn == null && !var.use_same_kms_key_for_backups ? tobool("When 'use_same_kms_key_for_backups' is set to false, a value needs to be passed for 'backup_encryption_key_crn'.") : true
15-
16-
# If no value passed for 'backup_encryption_key_crn' use the value of 'kms_key_crn' and perform validation of 'kms_key_crn' to check if region is supported by backup encryption key.
17-
186
# If 'use_ibm_owned_encryption_key' is true or 'use_default_backup_encryption_key' is true, default to null.
197
# If no value is passed for 'backup_encryption_key_crn', then default to use 'kms_key_crn'.
208
backup_encryption_key_crn = var.use_ibm_owned_encryption_key || var.use_default_backup_encryption_key ? null : (var.backup_encryption_key_crn != null ? var.backup_encryption_key_crn : var.kms_key_crn)

‎modules/fscloud/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ The IBM Cloud Framework for Financial Services mandates the application of an in
1313

1414
| Name | Version |
1515
|------|---------|
16-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
16+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
1717
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.70.0 |
1818

1919
### Modules

‎modules/fscloud/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
terraform {
2-
required_version = ">= 1.3.0"
2+
required_version = ">= 1.9.0"
33
required_providers {
44
# The below tflint-ignore is required because although the below provider is not directly required by this submodule,
55
# it is required by consuming modules, and if not set here, the top level module calling this module will not be

‎solutions/standard/main.tf‎

Lines changed: 0 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,6 @@ module "resource_group" {
99
existing_resource_group_name = var.use_existing_resource_group == true ? var.resource_group_name : null
1010
}
1111

12-
#######################################################################################################################
13-
# KMS related variable validation
14-
# (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
15-
#
16-
# TODO: Replace with terraform cross variable validation: https://github.ibm.com/GoldenEye/issues/issues/10836
17-
#######################################################################################################################
18-
19-
locals {
20-
# tflint-ignore: terraform_unused_declarations
21-
validate_kms_1 = var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn != null || var.existing_kms_key_crn != null || var.existing_backup_kms_key_crn != null) ? tobool("When setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn', the 'use_ibm_owned_encryption_key' input must be set to false.") : true
22-
# tflint-ignore: terraform_unused_declarations
23-
validate_kms_2 = !var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn == null && var.existing_kms_key_crn == null) ? tobool("When 'use_ibm_owned_encryption_key' is false, a value is required for either 'existing_kms_instance_crn' (to create a new key), or 'existing_kms_key_crn' to use an existing key.") : true
24-
}
25-
2612
#######################################################################################################################
2713
# KMS encryption key
2814
#######################################################################################################################
@@ -254,10 +240,6 @@ module "mysql_instance_crn_parser" {
254240
locals {
255241
existing_mysql_guid = var.existing_mysql_instance_crn != null ? module.mysql_instance_crn_parser[0].service_instance : null
256242
existing_mysql_region = var.existing_mysql_instance_crn != null ? module.mysql_instance_crn_parser[0].region : null
257-
258-
# Validate the region input matches region detected in existing instance CRN (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
259-
# tflint-ignore: terraform_unused_declarations
260-
validate_existing_instance_region = var.existing_mysql_instance_crn != null && var.region != local.existing_mysql_region ? tobool("The region detected in the 'existing_mysql_instance_crn' value must match the value of the 'region' input variable when passing an existing instance.") : true
261243
}
262244

263245
# Do a data lookup on the resource GUID to get more info that is needed for the 'ibm_database' data lookup below
@@ -332,13 +314,6 @@ locals {
332314

333315
locals {
334316
## Variable validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
335-
# tflint-ignore: terraform_unused_declarations
336-
validate_sm_crn = length(local.service_credential_secrets) > 0 && var.existing_secrets_manager_instance_crn == null ? tobool("`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret.") : false
337-
# tflint-ignore: terraform_unused_declarations
338-
validate_sm_sg = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secret_manager_secret_group == null ? tobool("`admin_pass_secret_manager_secret_group` is required when `existing_secrets_manager_instance_crn` is set.") : false
339-
# tflint-ignore: terraform_unused_declarations
340-
validate_sm_sn = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secret_manager_secret_name == null ? tobool("`admin_pass_secret_manager_secret_name` is required when `existing_secrets_manager_instance_crn` is set.") : false
341-
342317
create_sm_auth_policy = var.skip_mysql_sm_auth_policy || var.existing_secrets_manager_instance_crn == null ? 0 : 1
343318
}
344319

‎solutions/standard/variables.tf‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,17 @@ variable "region" {
3434
description = "The region where you want to deploy your instance."
3535
type = string
3636
default = "us-south"
37+
validation {
38+
condition = var.existing_mysql_instance_crn != null && var.region != local.existing_mysql_region ? false : true
39+
error_message = "The region detected in the 'existing_mysql_instance_crn' value must match the value of the 'region' input variable when passing an existing instance."
40+
}
3741
}
3842

3943
variable "existing_mysql_instance_crn" {
4044
type = string
4145
default = null
4246
description = "The CRN of an existing Databases for MySql instance. If no value is specified, a new instance is created."
47+
4348
}
4449

4550
variable "remote_leader_crn" {
@@ -173,6 +178,28 @@ variable "use_ibm_owned_encryption_key" {
173178
type = bool
174179
description = "IBM Cloud Databases will secure your deployment's data at rest automatically with an encryption key that IBM hold. Alternatively, you may select your own Key Management System instance and encryption key (Key Protect or Hyper Protect Crypto Services) by setting this to false. If setting to false, a value must be passed for `existing_kms_instance_crn` to create a new key, or `existing_kms_key_crn` and/or `existing_backup_kms_key_crn` to use an existing key."
175180
default = false
181+
validation {
182+
condition = (
183+
var.existing_mysql_instance_crn != null ||
184+
!(var.use_ibm_owned_encryption_key && (
185+
var.existing_kms_instance_crn != null ||
186+
var.existing_kms_key_crn != null ||
187+
var.existing_backup_kms_key_crn != null
188+
))
189+
)
190+
error_message = "When setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn', the 'use_ibm_owned_encryption_key' input must be set to false."
191+
}
192+
193+
# this validation ensures key info is provided when IBM-owned key is disabled and no Redis instance is given
194+
validation {
195+
condition = !(
196+
var.existing_mysql_instance_crn == null &&
197+
var.use_ibm_owned_encryption_key == false &&
198+
var.existing_kms_instance_crn == null &&
199+
var.existing_kms_key_crn == null
200+
)
201+
error_message = "When 'use_ibm_owned_encryption_key' is false, you must provide either 'existing_kms_instance_crn' (to create a new key) or 'existing_kms_key_crn' (to use an existing key)."
202+
}
176203
}
177204

178205
variable "existing_kms_instance_crn" {
@@ -297,6 +324,7 @@ variable "existing_secrets_manager_instance_crn" {
297324
type = string
298325
default = null
299326
description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for MySQL instance."
327+
300328
}
301329

302330
variable "existing_secrets_manager_endpoint_type" {
@@ -339,6 +367,13 @@ variable "service_credential_secrets" {
339367
])
340368
error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles"
341369
}
370+
validation {
371+
condition = (
372+
length(var.service_credential_secrets) == 0 ||
373+
var.existing_secrets_manager_instance_crn != null
374+
)
375+
error_message = "`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret."
376+
}
342377
}
343378

344379
variable "skip_mysql_sm_auth_policy" {
@@ -351,16 +386,33 @@ variable "admin_pass_secret_manager_secret_group" {
351386
type = string
352387
description = "The name of a new or existing secrets manager secret group for admin password. To use existing secret group, `use_existing_admin_pass_secret_manager_secret_group` must be set to `true`. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
353388
default = "mysql-secrets"
389+
390+
validation {
391+
condition = (
392+
var.existing_secrets_manager_instance_crn == null ||
393+
var.admin_pass_secret_manager_secret_group != null
394+
)
395+
error_message = "`admin_pass_secret_manager_secret_group` is required when `existing_secrets_manager_instance_crn` is set."
396+
}
354397
}
355398

356399
variable "use_existing_admin_pass_secret_manager_secret_group" {
357400
type = bool
358401
description = "Whether to use an existing secrets manager secret group for admin password."
359402
default = false
403+
360404
}
361405

362406
variable "admin_pass_secret_manager_secret_name" {
363407
type = string
364408
description = "The name of a new redis administrator secret. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
365409
default = "mysql-admin-password"
410+
411+
validation {
412+
condition = (
413+
var.existing_secrets_manager_instance_crn == null ||
414+
var.admin_pass_secret_manager_secret_name != null
415+
)
416+
error_message = "`admin_pass_secret_manager_secret_name` is required when `existing_secrets_manager_instance_crn` is set."
417+
}
366418
}

0 commit comments

Comments
 (0)