Skip to content

Commit f895078

Browse files
whofflerwhoffler
committed
fully-configurble + security-enforced DAs
1 parent 3482d57 commit f895078

21 files changed

+640
-139
lines changed

‎.catalog-onboard-pipeline.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ offerings:
66
catalog_id: 7df1e4ca-d54c-4fd0-82ce-3d13247308cd
77
offering_id: 0298facd-3e69-43fa-87c0-4d3d0b3c887e
88
variations:
9-
- name: standard
9+
- name: fully-configurable
1010
mark_ready: true
1111
install_type: fullstack
1212
scc:

‎.secrets.baseline‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2024-07-25T15:38:43Z",
6+
"generated_at": "2025-05-12T14:07:27Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -87,7 +87,7 @@
8787
"verified_result": null
8888
}
8989
],
90-
"solutions/standard/DA-types.md": [
90+
"solutions/fully-configurable/DA-types.md": [
9191
{
9292
"hashed_secret": "44cdfc3615970ada14420caaaa5c5745fca06002",
9393
"is_secret": false,

‎cra-config.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "solutions/standard"
4+
- CRA_TARGET: "solutions/fully-configurable"
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"
66
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
77
CRA_ENVIRONMENT_VARIABLES:
8+
TF_VAR_kms_encryption_enabled: true
9+
TF_VAR_use_ibm_owned_encryption_key: false
810
TF_VAR_existing_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533"
9-
TF_VAR_prefix: "test-postgres-standard"
10-
TF_VAR_resource_group_name: "test"
11+
TF_VAR_prefix: "test-postgres-fc"
12+
TF_VAR_existing_resource_group_name: "geretain-test-postgres"
1113
TF_VAR_provider_visibility: "public"

‎ibm_catalog.json‎

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
"relational"
2424
],
2525
"short_description": "Creates and configures an instance of IBM Cloud Databases for PostgreSQL.",
26-
"long_description": "This architecture supports creating and configuring an instance of Databases for PostgreSQL with KMS encryption.",
26+
"long_description": "This architecture supports creating and configuring an instance of [Databases for PostgreSQL](https://www.ibm.com/products/databases-for-postgresql), with optional KMS encryption. This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
2727
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-icd-postgresql/blob/main/README.md",
2828
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-postgresql/main/images/postgresql.svg",
2929
"provider_name": "IBM",
@@ -47,10 +47,10 @@
4747
],
4848
"flavors": [
4949
{
50-
"label": "Standard",
51-
"name": "standard",
50+
"label": "Fully configurable",
51+
"name": "fully-configurable",
5252
"install_type": "fullstack",
53-
"working_directory": "solutions/standard",
53+
"working_directory": "solutions/fully-configurable",
5454
"compliance": {
5555
"authority": "scc-v3",
5656
"profiles": [
@@ -122,18 +122,21 @@
122122
]
123123
},
124124
{
125-
"key": "use_existing_resource_group"
126-
},
127-
{
128-
"key": "resource_group_name"
125+
"key": "existing_resource_group_name",
126+
"required": true,
127+
"custom_config": {
128+
"type": "resource_group",
129+
"grouping": "deployment",
130+
"original_grouping": "deployment",
131+
"config_constraints": {
132+
"identifier": "rg_name"
133+
}
134+
}
129135
},
130136
{
131137
"key": "prefix",
132138
"required": true
133139
},
134-
{
135-
"key": "name"
136-
},
137140
{
138141
"key": "region",
139142
"required": true,
@@ -190,7 +193,10 @@
190193
]
191194
},
192195
{
193-
"key": "pg_version",
196+
"key": "postgresql_name"
197+
},
198+
{
199+
"key": "postgresql_version",
194200
"required": false,
195201
"default_value": "__NULL__",
196202
"options": [
@@ -248,10 +254,13 @@
248254
"key": "users"
249255
},
250256
{
251-
"key": "resource_tags"
257+
"key": "postgresql_resource_tags"
258+
},
259+
{
260+
"key": "postgresql_access_tags"
252261
},
253262
{
254-
"key": "access_tags"
263+
"key": "kms_encryption_enabled"
255264
},
256265
{
257266
"key": "use_ibm_owned_encryption_key"
@@ -260,8 +269,7 @@
260269
"key": "ibmcloud_kms_api_key"
261270
},
262271
{
263-
"key": "existing_kms_instance_crn",
264-
"required": true
272+
"key": "existing_kms_instance_crn"
265273
},
266274
{
267275
"key": "existing_kms_key_crn"
@@ -280,7 +288,7 @@
280288
]
281289
},
282290
{
283-
"key": "skip_pg_kms_auth_policy"
291+
"key": "skip_postgresql_kms_auth_policy"
284292
},
285293
{
286294
"key": "key_ring_name"
@@ -305,6 +313,9 @@
305313
},
306314
{
307315
"key": "existing_postgresql_instance_crn"
316+
},
317+
{
318+
"key": "service_endpoints"
308319
}
309320
]
310321
}

‎solutions/standard/DA-types.md‎ renamed to ‎solutions/fully-configurable/DA-types.md‎

File renamed without changes.

‎solutions/fully-configurable/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# IBM Cloud Databases for PostgreSQL (Fully Configurable)
2+
3+
## Prerequisites
4+
- An existing resource group
5+
6+
This architecture creates an instance of IBM Cloud Databases for PostgreSQL and supports provisioning of the following resources:
7+
8+
- A KMS root key, if one is not passed in.
9+
- An IBM Cloud Databases for PostgreSQL instance with KMS encryption.
10+
- Autoscaling rules for the database instance, if provided.
11+
12+
![fscloud-postgresql](../../reference-architecture/deployable-architecture-postgresql.svg)
13+
14+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/fully-configurable/catalogValidationValues.json.template‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY,
3+
"region": "us-south",
4+
"postgresql_resource_tags": $TAGS,
5+
"postgresql_name": $PREFIX,
6+
"existing_resource_group_name": $PREFIX,
7+
"kms_encryption_enabled": true,
8+
"use_ibm_owned_encryption_key": false,
9+
"existing_kms_instance_crn": $HPCS_US_SOUTH_CRN
10+
}

‎solutions/standard/main.tf‎ renamed to ‎solutions/fully-configurable/main.tf‎

Lines changed: 10 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,7 @@
55
module "resource_group" {
66
source = "terraform-ibm-modules/resource-group/ibm"
77
version = "1.2.0"
8-
resource_group_name = var.use_existing_resource_group == false ? ((var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.resource_group_name}" : var.resource_group_name) : null
9-
existing_resource_group_name = var.use_existing_resource_group == true ? var.resource_group_name : null
10-
}
11-
12-
#######################################################################################################################
13-
# KMS related variable validation
14-
# (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
15-
#
16-
# TODO: Replace with terraform cross variable validation: https://github.ibm.com/GoldenEye/issues/issues/10836
17-
#######################################################################################################################
18-
19-
locals {
20-
# tflint-ignore: terraform_unused_declarations
21-
validate_kms_1 = var.existing_postgresql_instance_crn != null ? true : var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn != null || var.existing_kms_key_crn != null || var.existing_backup_kms_key_crn != null) ? tobool("When setting values for 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn', the 'use_ibm_owned_encryption_key' input must be set to false.") : true
22-
# tflint-ignore: terraform_unused_declarations
23-
validate_kms_2 = var.existing_postgresql_instance_crn != null ? true : !var.use_ibm_owned_encryption_key && (var.existing_kms_instance_crn == null && var.existing_kms_key_crn == null) ? tobool("When 'use_ibm_owned_encryption_key' is false, a value is required for either 'existing_kms_instance_crn' (to create a new key), or 'existing_kms_key_crn' to use an existing key.") : true
8+
existing_resource_group_name = var.existing_resource_group_name
249
}
2510

2611
#######################################################################################################################
@@ -99,8 +84,8 @@ data "ibm_iam_account_settings" "iam_account_settings" {
9984

10085
locals {
10186
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
102-
create_cross_account_kms_auth_policy = var.existing_postgresql_instance_crn == null && !var.skip_pg_kms_auth_policy && var.ibmcloud_kms_api_key != null && !var.use_ibm_owned_encryption_key
103-
create_cross_account_backup_kms_auth_policy = var.existing_postgresql_instance_crn == null && !var.skip_pg_kms_auth_policy && var.ibmcloud_kms_api_key != null && !var.use_ibm_owned_encryption_key && var.existing_backup_kms_key_crn != null
87+
create_cross_account_kms_auth_policy = var.existing_postgresql_instance_crn == null && !var.skip_postgresql_kms_auth_policy && var.ibmcloud_kms_api_key != null && !var.use_ibm_owned_encryption_key
88+
create_cross_account_backup_kms_auth_policy = var.existing_postgresql_instance_crn == null && !var.skip_postgresql_kms_auth_policy && var.ibmcloud_kms_api_key != null && !var.use_ibm_owned_encryption_key && var.existing_backup_kms_key_crn != null
10489

10590
# If KMS encryption enabled (and existing ES instance is not being passed), parse details from the existing key if being passed, otherwise get it from the key that the DA creates
10691
kms_account_id = var.existing_postgresql_instance_crn != null || var.use_ibm_owned_encryption_key ? null : var.existing_kms_key_crn != null ? module.kms_key_crn_parser[0].account_id : module.kms_instance_crn_parser[0].account_id
@@ -287,21 +272,21 @@ data "ibm_database_connection" "existing_connection" {
287272
# Create new instance
288273
module "postgresql_db" {
289274
count = var.existing_postgresql_instance_crn != null ? 0 : 1
290-
source = "../../modules/fscloud"
275+
source = "../../"
291276
depends_on = [time_sleep.wait_for_authorization_policy, time_sleep.wait_for_backup_kms_authorization_policy]
292277
resource_group_id = module.resource_group.resource_group_id
293-
name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.name}" : var.name
278+
name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.postgresql_name}" : var.postgresql_name
294279
region = var.region
295280
remote_leader_crn = var.remote_leader_crn
296-
skip_iam_authorization_policy = var.skip_pg_kms_auth_policy
297-
pg_version = var.pg_version
281+
skip_iam_authorization_policy = var.skip_postgresql_kms_auth_policy
282+
pg_version = var.postgresql_version
298283
use_ibm_owned_encryption_key = var.use_ibm_owned_encryption_key
299284
kms_key_crn = local.kms_key_crn
300285
backup_encryption_key_crn = local.backup_kms_key_crn
301286
use_same_kms_key_for_backups = local.use_same_kms_key_for_backups
302287
use_default_backup_encryption_key = var.use_default_backup_encryption_key
303-
access_tags = var.access_tags
304-
tags = var.resource_tags
288+
access_tags = var.postgresql_access_tags
289+
tags = var.postgresql_resource_tags
305290
# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6141
306291
admin_pass = var.remote_leader_crn == null ? local.admin_pass : null
307292
users = var.users
@@ -314,6 +299,7 @@ module "postgresql_db" {
314299
configuration = var.configuration
315300
service_credential_names = var.service_credential_names
316301
backup_crn = var.backup_crn
302+
service_endpoints = var.service_endpoints
317303
}
318304

319305
locals {

‎solutions/standard/moved.tf‎ renamed to ‎solutions/fully-configurable/moved.tf‎

File renamed without changes.

‎solutions/standard/outputs.tf‎ renamed to ‎solutions/fully-configurable/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ output "service_credentials_json" {
3030

3131
output "service_credentials_object" {
3232
description = "Service credentials object"
33-
value = var.existing_postgresql_instance_crn != null ? null : module.postgresql_db[0].service_credentials_json
33+
value = var.existing_postgresql_instance_crn != null ? null : module.postgresql_db[0].service_credentials_object
3434
sensitive = true
3535
}
3636

0 commit comments

Comments
 (0)