Skip to content

Commit 3f8cac9

Browse files
whofflerwhoffler
committed
rebase on Redis
1 parent 78aaa94 commit 3f8cac9

File tree

3 files changed

+44
-35
lines changed

3 files changed

+44
-35
lines changed

‎ibm_catalog.json‎

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,10 @@
6666
"iam_permissions": [
6767
{
6868
"role_crns": [
69-
"crn:v1:bluemix:public:iam::::role:Administrator"
69+
"crn:v1:bluemix:public:iam::::role:Viewer"
7070
],
71-
"service_name": "all-account-management-services"
71+
"service_name": "Resource group only",
72+
"notes": "Viewer access is required in the resource group you want to provision in."
7273
},
7374
{
7475
"role_crns": [
@@ -78,7 +79,6 @@
7879
},
7980
{
8081
"role_crns": [
81-
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
8282
"crn:v1:bluemix:public:iam::::role:Editor"
8383
],
8484
"service_name": "kms",
@@ -134,7 +134,7 @@
134134
},
135135
{
136136
"key": "existing_resource_group_name",
137-
"required": true,
137+
"display_name": "resource_group",
138138
"custom_config": {
139139
"type": "resource_group",
140140
"grouping": "deployment",
@@ -145,8 +145,7 @@
145145
}
146146
},
147147
{
148-
"key": "prefix",
149-
"required": true
148+
"key": "prefix"
150149
},
151150
{
152151
"key": "region",
@@ -381,29 +380,36 @@
381380
"iam_permissions": [
382381
{
383382
"role_crns": [
384-
"crn:v1:bluemix:public:iam::::role:Administrator"
383+
"crn:v1:bluemix:public:iam::::role:Viewer"
385384
],
386-
"service_name": "all-account-management-services"
385+
"service_name": "Resource group only",
386+
"notes": "Viewer access is required in the resource group you want to provision in."
387387
},
388388
{
389389
"role_crns": [
390390
"crn:v1:bluemix:public:iam::::role:Editor"
391391
],
392392
"service_name": "databases-for-postgresql"
393393
},
394+
{
395+
"role_crns": [
396+
"crn:v1:bluemix:public:iam::::role:Editor"
397+
],
398+
"service_name": "kms",
399+
"notes": "[Optional] Editor access is required to create keys. It is required only if KMS encryption is enabled."
400+
},
394401
{
395402
"role_crns": [
396-
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
397403
"crn:v1:bluemix:public:iam::::role:Editor"
398404
],
399-
"service_name": "kms"
405+
"service_name": "hs-crypto",
406+
"notes": "[Optional] Editor access is required to create keys in HPCS. It is only required when using HPCS for encryption."
400407
}
401408
],
402409
"architecture": {
403-
"descriptions": "This architecture creates an instance of IBM Cloud Databases for PostgreSQL instance with KMS encryption. Supports autoscaling.",
404410
"features": [
405411
{
406-
"title": " Creates an instance of Databases for PostgreSQL",
412+
"title": " ",
407413
"description": "This architecture creates an instance of IBM Cloud Databases for PostgreSQL with KMS encryption. It accepts or creates a resource group, and provides autoscaling rules."
408414
}
409415
],
@@ -424,7 +430,7 @@
424430
},
425431
{
426432
"key": "existing_resource_group_name",
427-
"required": true,
433+
"display_name": "resource_group",
428434
"custom_config": {
429435
"type": "resource_group",
430436
"grouping": "deployment",
@@ -435,8 +441,7 @@
435441
}
436442
},
437443
{
438-
"key": "prefix",
439-
"required": true
444+
"key": "prefix"
440445
},
441446
{
442447
"key": "region",
@@ -591,7 +596,8 @@
591596
"key": "ibmcloud_kms_api_key"
592597
},
593598
{
594-
"key": "existing_kms_instance_crn"
599+
"key": "existing_kms_instance_crn",
600+
"required": true
595601
},
596602
{
597603
"key": "existing_kms_key_crn"

‎solutions/fully-configurable/variables.tf‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -198,27 +198,22 @@ variable "postgresql_access_tags" {
198198

199199
variable "kms_encryption_enabled" {
200200
type = bool
201-
description = "Set to true to enable KMS Encryption using customer managed keys. When set to true, a value must be passed for either 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn'."
201+
description = "Set to true to enable KMS encryption using customer-managed keys. When enabled, you must provide a value for at least one of the following: existing_kms_instance_crn, existing_kms_key_crn, or existing_backup_kms_key_crn. If set to false, IBM-owned encryption is used (i.e., encryption keys managed and held by IBM)."
202202
default = false
203203

204204
validation {
205-
condition = (
206-
!var.kms_encryption_enabled ||
205+
condition = (!var.kms_encryption_enabled ||
207206
var.existing_postgresql_instance_crn != null ||
208-
(
209-
var.existing_kms_instance_crn != null ||
210-
var.existing_kms_key_crn != null ||
211-
var.existing_backup_kms_key_crn != null
212-
)
207+
var.existing_kms_instance_crn != null ||
208+
var.existing_kms_key_crn != null ||
209+
var.existing_backup_kms_key_crn != null
213210
)
214-
error_message = "When 'kms_encryption_enabled' is true and setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn'."
211+
error_message = "When 'kms_encryption_enabled' is true, you must provide either 'existing_backup_kms_key_crn', 'existing_kms_instance_crn' (to create a new key) or 'existing_kms_key_crn' (to use an existing key)."
215212
}
216213

217214
validation {
218-
condition = (
219-
!var.kms_encryption_enabled ? length(compact([var.existing_kms_instance_crn, var.existing_kms_key_crn, var.existing_backup_kms_key_crn])) == 0 : true
220-
)
221-
error_message = "When using ibm owned encryption keys by setting input 'kms_encryption_enabled' to false, 'existing_kms_instance_crn', 'existing_kms_key_crn' and 'existing_backup_kms_key_crn' should not be set."
215+
condition = (var.existing_kms_instance_crn == null && var.existing_kms_key_crn == null && var.existing_backup_kms_key_crn == null) || var.kms_encryption_enabled
216+
error_message = "When either 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn' is set then 'kms_encryption_enabled' must be set to true."
222217
}
223218
}
224219

@@ -230,13 +225,13 @@ variable "existing_kms_instance_crn" {
230225

231226
variable "existing_kms_key_crn" {
232227
type = string
233-
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. Applies only if `kms_encryption_enabled` is true. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
228+
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
234229
default = null
235230
}
236231

237232
variable "kms_endpoint_type" {
238233
type = string
239-
description = "The type of endpoint to use for communicating with the Key Protect or Hyper Protect Crypto Services instance. Possible values: `public`, `private`."
234+
description = "The type of endpoint to use for communicating with the Key Protect or Hyper Protect Crypto Services instance. Possible values: `public`, `private`. Applies only if `existing_kms_key_crn` is not specified."
240235
default = "private"
241236
validation {
242237
condition = can(regex("public|private", var.kms_endpoint_type))

‎solutions/security-enforced/variables.tf‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -181,14 +181,23 @@ variable "postgresql_access_tags" {
181181

182182
variable "existing_kms_instance_crn" {
183183
type = string
184-
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. Applies only if `use_ibm_owned_encryption_key` is false. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
184+
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
185185
default = null
186186
}
187187

188188
variable "existing_kms_key_crn" {
189189
type = string
190-
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. Applies only if `use_ibm_owned_encryption_key` is false. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
190+
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
191191
default = null
192+
193+
194+
validation {
195+
condition = (
196+
(var.existing_kms_key_crn != null && var.existing_kms_instance_crn == null) ||
197+
(var.existing_kms_key_crn == null && var.existing_kms_instance_crn != null)
198+
)
199+
error_message = "Either existing_kms_key_crn or existing_kms_instance_crn must be set, but not both."
200+
}
192201
}
193202

194203
variable "skip_postgresql_kms_auth_policy" {
@@ -218,7 +227,7 @@ variable "key_name" {
218227

219228
variable "existing_backup_kms_key_crn" {
220229
type = string
221-
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. Applies only if `use_ibm_owned_encryption_key` is false. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
230+
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input."
222231
default = null
223232
}
224233

@@ -228,7 +237,6 @@ variable "backup_crn" {
228237
default = null
229238
}
230239

231-
232240
##############################################################
233241
# Auto Scaling
234242
##############################################################

0 commit comments

Comments
 (0)