Skip to content

Commit 1214963

Browse files
arya-girish-karya-girish-k
authored
feat: Add UI regex validation to the DA (#470)
1 parent d340db9 commit 1214963

File tree

3 files changed

+178
-14
lines changed

3 files changed

+178
-14
lines changed

‎ibm_catalog.json‎

Lines changed: 96 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,14 @@
320320
"key": "admin_pass"
321321
},
322322
{
323-
"key": "existing_secrets_manager_instance_crn"
323+
"key": "existing_secrets_manager_instance_crn",
324+
"value_constraints": [
325+
{
326+
"type": "regex",
327+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
328+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
329+
}
330+
]
324331
},
325332
{
326333
"key": "existing_secrets_manager_endpoint_type",
@@ -364,10 +371,24 @@
364371
"key": "kms_encryption_enabled"
365372
},
366373
{
367-
"key": "existing_kms_instance_crn"
374+
"key": "existing_kms_instance_crn",
375+
"value_constraints": [
376+
{
377+
"type": "regex",
378+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
379+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
380+
}
381+
]
368382
},
369383
{
370-
"key": "existing_kms_key_crn"
384+
"key": "existing_kms_key_crn",
385+
"value_constraints": [
386+
{
387+
"type": "regex",
388+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
389+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
390+
}
391+
]
371392
},
372393
{
373394
"key": "kms_endpoint_type",
@@ -390,10 +411,24 @@
390411
"key": "key_name"
391412
},
392413
{
393-
"key": "backup_crn"
414+
"key": "backup_crn",
415+
"value_constraints": [
416+
{
417+
"type": "regex",
418+
"description": "The value provided for 'backup_crn' is not valid.",
419+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
420+
}
421+
]
394422
},
395423
{
396-
"key": "existing_backup_kms_key_crn"
424+
"key": "existing_backup_kms_key_crn",
425+
"value_constraints": [
426+
{
427+
"type": "regex",
428+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
429+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
430+
}
431+
]
397432
},
398433
{
399434
"key": "use_default_backup_encryption_key"
@@ -402,7 +437,14 @@
402437
"key": "skip_rabbitmq_kms_auth_policy"
403438
},
404439
{
405-
"key": "existing_rabbitmq_instance_crn"
440+
"key": "existing_rabbitmq_instance_crn",
441+
"value_constraints": [
442+
{
443+
"type": "regex",
444+
"description": "The value provided for 'existing_rabbitmq_instance_crn' is not valid.",
445+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
446+
}
447+
]
406448
},
407449
{
408450
"key": "cbr_rules",
@@ -653,7 +695,14 @@
653695
"key": "admin_pass"
654696
},
655697
{
656-
"key": "existing_secrets_manager_instance_crn"
698+
"key": "existing_secrets_manager_instance_crn",
699+
"value_constraints": [
700+
{
701+
"type": "regex",
702+
"description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.",
703+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
704+
}
705+
]
657706
},
658707
{
659708
"key": "skip_rabbitmq_secrets_manager_auth_policy"
@@ -681,10 +730,24 @@
681730
},
682731
{
683732
"key": "existing_kms_instance_crn",
684-
"required": true
733+
"required": true,
734+
"value_constraints": [
735+
{
736+
"type": "regex",
737+
"description": "The value provided for 'existing_kms_instance_crn' is not valid.",
738+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
739+
}
740+
]
685741
},
686742
{
687-
"key": "existing_kms_key_crn"
743+
"key": "existing_kms_key_crn",
744+
"value_constraints": [
745+
{
746+
"type": "regex",
747+
"description": "The value provided for 'existing_kms_key_crn' is not valid.",
748+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
749+
}
750+
]
688751
},
689752
{
690753
"key": "key_ring_name"
@@ -693,16 +756,37 @@
693756
"key": "key_name"
694757
},
695758
{
696-
"key": "backup_crn"
759+
"key": "backup_crn",
760+
"value_constraints": [
761+
{
762+
"type": "regex",
763+
"description": "The value provided for 'backup_crn' is not valid.",
764+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$"
765+
}
766+
]
697767
},
698768
{
699-
"key": "existing_backup_kms_key_crn"
769+
"key": "existing_backup_kms_key_crn",
770+
"value_constraints": [
771+
{
772+
"type": "regex",
773+
"description": "The value provided for 'existing_backup_kms_key_crn' is not valid.",
774+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
775+
}
776+
]
700777
},
701778
{
702779
"key": "skip_rabbitmq_kms_auth_policy"
703780
},
704781
{
705-
"key": "existing_rabbitmq_instance_crn"
782+
"key": "existing_rabbitmq_instance_crn",
783+
"value_constraints": [
784+
{
785+
"type": "regex",
786+
"description": "The value provided for 'existing_rabbitmq_instance_crn' is not valid.",
787+
"value": "^__NULL__$|^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$"
788+
}
789+
]
706790
},
707791
{
708792
"key": "cbr_rules",

‎solutions/fully-configurable/variables.tf‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,14 @@ variable "existing_rabbitmq_instance_crn" {
6262
type = string
6363
default = null
6464
description = "The CRN of an existing Messages for RabbitMQ instance. If no value is specified, a new instance is created."
65+
66+
validation {
67+
condition = anytrue([
68+
var.existing_rabbitmq_instance_crn == null,
69+
can(regex("^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_rabbitmq_instance_crn))
70+
])
71+
error_message = "The value provided for 'existing_rabbitmq_instance_crn' is not valid."
72+
}
6573
}
6674

6775
variable "rabbitmq_version" {
@@ -214,12 +222,28 @@ variable "existing_kms_instance_crn" {
214222
type = string
215223
description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
216224
default = null
225+
226+
validation {
227+
condition = anytrue([
228+
var.existing_kms_instance_crn == null,
229+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
230+
])
231+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
232+
}
217233
}
218234

219235
variable "existing_kms_key_crn" {
220236
type = string
221237
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
222238
default = null
239+
240+
validation {
241+
condition = anytrue([
242+
var.existing_kms_key_crn == null,
243+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
244+
])
245+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
246+
}
223247
}
224248

225249
variable "kms_endpoint_type" {
@@ -262,6 +286,14 @@ variable "existing_backup_kms_key_crn" {
262286
type = string
263287
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. Applies only if `use_ibm_owned_encryption_key` is false. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
264288
default = null
289+
290+
validation {
291+
condition = anytrue([
292+
var.existing_backup_kms_key_crn == null,
293+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
294+
])
295+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
296+
}
265297
}
266298

267299
variable "use_default_backup_encryption_key" {
@@ -278,7 +310,7 @@ variable "backup_crn" {
278310
validation {
279311
condition = anytrue([
280312
var.backup_crn == null,
281-
can(regex("^crn:.*:backup:", var.backup_crn))
313+
can(regex("^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
282314
])
283315
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
284316
}
@@ -355,6 +387,14 @@ variable "existing_secrets_manager_instance_crn" {
355387
type = string
356388
default = null
357389
description = "The CRN of existing secrets manager to use to create service credential secrets for Messages for RabbitMQ instance."
390+
391+
validation {
392+
condition = anytrue([
393+
var.existing_secrets_manager_instance_crn == null,
394+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
395+
])
396+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
397+
}
358398
}
359399

360400
variable "existing_secrets_manager_endpoint_type" {

‎solutions/security-enforced/variables.tf‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ variable "existing_rabbitmq_instance_crn" {
5757
type = string
5858
default = null
5959
description = "The CRN of an existing Messages for RabbitMQ instance. If no value is specified, a new instance is created."
60+
61+
validation {
62+
condition = anytrue([
63+
var.existing_rabbitmq_instance_crn == null,
64+
can(regex("^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_rabbitmq_instance_crn))
65+
])
66+
error_message = "The value provided for 'existing_rabbitmq_instance_crn' is not valid."
67+
}
6068
}
6169

6270
variable "rabbitmq_version" {
@@ -176,12 +184,28 @@ variable "existing_kms_instance_crn" {
176184
condition = anytrue([var.existing_kms_instance_crn == null, var.existing_kms_key_crn == null])
177185
error_message = "Either an existing_kms_instance_crn or an existing_kms_key_crn needs to be provided."
178186
}
187+
188+
validation {
189+
condition = anytrue([
190+
var.existing_kms_instance_crn == null,
191+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn))
192+
])
193+
error_message = "The value provided for 'existing_kms_instance_crn' is not valid."
194+
}
179195
}
180196

181197
variable "existing_kms_key_crn" {
182198
type = string
183199
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
184200
default = null
201+
202+
validation {
203+
condition = anytrue([
204+
var.existing_kms_key_crn == null,
205+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn))
206+
])
207+
error_message = "The value provided for 'existing_kms_key_crn’ is not valid."
208+
}
185209
}
186210

187211
variable "skip_rabbitmq_kms_auth_policy" {
@@ -213,6 +237,14 @@ variable "existing_backup_kms_key_crn" {
213237
type = string
214238
description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. Applies only if `use_ibm_owned_encryption_key` is false. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)."
215239
default = null
240+
241+
validation {
242+
condition = anytrue([
243+
var.existing_backup_kms_key_crn == null,
244+
can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn))
245+
])
246+
error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid."
247+
}
216248
}
217249

218250
variable "backup_crn" {
@@ -223,7 +255,7 @@ variable "backup_crn" {
223255
validation {
224256
condition = anytrue([
225257
var.backup_crn == null,
226-
can(regex("^crn:.*:backup:", var.backup_crn))
258+
can(regex("^crn:v\\d:(.*:){2}messages-for-rabbitmq:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn))
227259
])
228260
error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'"
229261
}
@@ -289,6 +321,14 @@ variable "existing_secrets_manager_instance_crn" {
289321
type = string
290322
default = null
291323
description = "The CRN of existing secrets manager to use to create service credential secrets for Messages for RabbitMQ instance."
324+
325+
validation {
326+
condition = anytrue([
327+
var.existing_secrets_manager_instance_crn == null,
328+
can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn))
329+
])
330+
error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid."
331+
}
292332
}
293333

294334
variable "service_credential_secrets" {

0 commit comments

Comments
 (0)