Create Fully Configurable and Security Enforced DA #399

kierramarie · 2025-06-06T15:51:54Z

Description

Updated standard solution to fully-configurable and added security enforced da.

Release required?

No release
Patch release (x.x.X)
Minor release (x.X.x)
Major release (X.x.x)

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

If relevant, a test for the change is included or updated with this PR.
If relevant, documentation for the change is included or updated with this PR.

For mergers

Use a conventional commit message to set the release level. Follow the guidelines.
Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
Use the Squash and merge option.

kierramarie · 2025-06-06T15:53:03Z

I am unsure if the values in the .catalog-onboard-pipeline.yaml are correct.

kierramarie · 2025-06-06T15:53:16Z

/run pipeline

kierramarie · 2025-06-06T16:09:17Z

/run pipeline

kierramarie · 2025-06-06T17:25:52Z

/run pipeline

kierramarie · 2025-06-09T19:22:46Z

Only test that is failing is the upgrade test, which is expected.

kierramarie · 2025-06-27T15:14:02Z

/run pipeline

akocbek

Make sure that all changes that are for fully-configurable DA must be applied to security-enforced as well.

.catalog-onboard-pipeline.yaml

akocbek · 2025-06-27T15:48:22Z

cra-config.yaml

-      TF_VAR_resource_group_name: "geretain-test-redis"
+      TF_VAR_existing_resource_group_name: "geretain-test-rabbitmq"
      TF_VAR_provider_visibility: "public"
+      TF_VAR_use_ibm_owned_encryption_key: false


does fullly-configurable DA have use_ibm_owned_encryption_key input?
sync with Redis, pay attention to the order as well

akocbek · 2025-06-27T15:49:58Z

ibm_catalog.json

        "solution",
        "rabbitmq standard",
        "cache",
        "in memory"


remove rabbitmq standard" keywords

akocbek · 2025-06-27T15:51:12Z

ibm_catalog.json

      "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-rabbitmq/main/images/rabbitmq_icon.svg",
      "provider_name": "IBM",
      "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in the repository [https://github.com/terraform-ibm-modules/terraform-ibm-icd-rabbitmq/issues](https://github.com/terraform-ibm-modules/terraform-ibm-icd-rabbitmq/issues). Please note this product is not supported via the IBM Cloud Support Center.",
      "features": [


sync features with Redis. Check the order, add links to the features, etc.

akocbek · 2025-06-27T15:51:47Z

ibm_catalog.json

        {
-          "label": "Standard",
-          "name": "standard",
+          "label": "Fully Configurable",


should be "label": "Fully configurable",

akocbek · 2025-06-27T16:19:42Z

solutions/fully-configurable/variables.tf


 ##############################################################
 # Encryption
 ##############################################################


tags rename to resource_tags,sync with Redis

akocbek · 2025-06-27T16:20:12Z

solutions/fully-configurable/variables.tf

-    error_message = "When 'use_ibm_owned_encryption_key' is false, you must provide either 'existing_kms_instance_crn' (to create a new key) or 'existing_kms_key_crn' (to use an existing key)."
+    condition     = (var.existing_kms_instance_crn == null && var.existing_kms_key_crn == null && var.existing_backup_kms_key_crn == null) || var.kms_encryption_enabled
+    error_message = "When either 'existing_kms_instance_crn', 'existing_kms_key_crn' or 'existing_backup_kms_key_crn' is set then 'kms_encryption_enabled' must be set to true."
  }


existing_kms_instance_crn sync desc with Redis

akocbek · 2025-06-27T16:21:12Z

solutions/fully-configurable/variables.tf

      var.existing_secrets_manager_instance_crn != null
    )
    error_message = "`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret."
  }


existing_backup_kms_key_crn sync with Redis

akocbek · 2025-06-27T16:21:24Z

solutions/fully-configurable/variables.tf

    error_message = "`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret."
  }
 }



use_default_backup_encryption_key sync with redis

akocbek · 2025-06-27T16:21:54Z

solutions/fully-configurable/variables.tf

    error_message = "`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret."
  }
 }



add empty line before variable "provider_visibility". sync with redis

akocbek · 2025-06-30T08:41:16Z

CRA scanning failed with

Error: Invalid value for variable
│ 
│   on variables.tf line 160:
│  160: variable "kms_encryption_enabled" {
│     ├────────────────
│     │ var.existing_backup_kms_key_crn is null
│     │ var.existing_kms_instance_crn is "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
│     │ var.existing_kms_key_crn is "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:1368d2eb-3ed0-4a8b-b09c-2155895f01ea"
│     │ var.kms_encryption_enabled is false
│ 
│ When either 'existing_kms_instance_crn', 'existing_kms_key_crn' or
│ 'existing_backup_kms_key_crn' is set then 'kms_encryption_enabled' must be
│ set to true.

kms_encryption_enabled must be added to CRA

shemau · 2025-06-30T09:45:32Z

tests/pr_test.go

+		TerraformDir:       fullyConfigurableSolutionTerraformDir,
 		BestRegionYAMLPath: regionSelectionPath,
-		Prefix:             "rabbitmq-st-da-upg",
+		Prefix:             "rmq-da-upg",


This is still too long. Limit is 16 and the test infrastructure adds 7, so limit is 9 characters.

shemau · 2025-06-30T10:01:05Z

solutions/security-enforced/catalogValidationValues.json.template

+  "ibmcloud_api_key": $VALIDATION_APIKEY,
+  "region": "us-south",
+  "tags": $TAGS,
+  "name": $PREFIX,


existing_resource_group_name is a required property. It should be included here for the catalog pipeline.

kierramarie · 2025-06-30T13:52:49Z

/run pipeline

akocbek

about the diagrams:

Please use the latest stencil version. For example, the latest stencil gives you a dotted box for resource group.

resource group has dots, but its not the right box, should be red colored with icon, also other icons are different

also check how the KMS encryption is added in other DAs. For an example the redis

akocbek · 2025-06-30T15:00:59Z

ibm_catalog.json

              ],
              "service_name": "Resource group only",
              "notes": "Viewer access is required in the resource group you want to provision in."
            },


for Resource group only iam permission, role_crn should have one indent less

check security-enforced as well

akocbek · 2025-06-30T15:01:04Z

ibm_catalog.json

          "title": "KMS encryption",
-          "description": "Provides KMS encryption for the data that you store in the database."
+          "description": "Provides [KMS encryption](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-key-protect&interface=ui) for the data that you store in the database, enhancing data security."
+


remove extra line

akocbek · 2025-06-30T15:03:39Z

ibm_catalog.json

            {
              "key": "existing_rabbitmq_instance_crn"
            }
          ]


move "key": "cbr_rules" after existing_rabbitmq_instance_crn. following the rule that inputs that are not in redis, should be placed at the end

check security-enforced as well

akocbek · 2025-06-30T15:04:17Z

ibm_catalog.json

-              "service_name": "kms"
+              "service_name": "hs-crypto",
+              "notes": "[Optional] Editor access is required to create keys in HPCS. It is only required when using HPCS for encryption."
            }


existing_resource_group_name -> delete required
check security-enforced as well

akocbek · 2025-06-30T15:15:09Z

solutions/fully-configurable/variables.tf

  type        = number
  description = "The number of members that are allocated. [Learn more](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-resources-scaling)."
-  default     = 3
+  default     = 2


pipeline failed, it looks it has to be 3 after all. let's update it everywhere back to 3.

…m-icd-rabbitmq into ks-da

kierramarie · 2025-06-30T16:27:48Z

/run pipeline

akocbek · 2025-06-30T16:42:23Z

ibm_catalog.json

+              "key": "cbr_rules"
            }
          ]
        }


diagrams not the same in light and dark mode (do we need that extra arrow?). Also name the key, probably would be rabbitmq-key?

Ah that arrow was an accident. I've removed it.

kierramarie · 2025-06-30T16:54:06Z

/run pipeline

kierramarie · 2025-06-30T17:31:15Z

/run pipeline

kierramarie · 2025-06-30T18:00:58Z

Only upgrade test is failing now.

akocbek · 2025-06-30T18:02:24Z

@kierramarie upgrade test failed because

 TestRunFullyConfigurableUpgradeSolution 2025-06-30T17:37:52Z retry.go:99: Returning due to fatal error: FatalError{Underlying: error while running command: chdir /tmp/terraform-base-rmq-upg-3pt1095509553/solutions/fully-configurable

this is expected, since main branch doesn't have solutions/fully-configurable yet. It is fine to skip the upgrade test

kierramarie · 2025-06-30T18:12:45Z

/run pipeline

All review issues resolved

terraform-ibm-modules-ops · 2025-06-30T20:08:29Z

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

GitHub release
v2.0.0

Your semantic-release bot 📦🚀

kierramarie added 2 commits June 3, 2025 13:58

feat: fully configurable da

e681f74

feat: security enforced da

721c822

kierramarie requested review from iamar7 and shemau as code owners June 6, 2025 15:51

fix: update cra-config

209aafc

fix: update vars for fully config schematics test

887c750

kierramarie added 3 commits June 26, 2025 14:50

Merge branch 'main' into ks-da

213d67b

refactor: sync with redis

ae12f6d

fix: enhanced ux

959e735

akocbek requested changes Jun 27, 2025

View reviewed changes

shemau previously requested changes Jun 30, 2025

View reviewed changes

kierramarie added 2 commits June 30, 2025 09:51

fix: missed things when syncing with redis

9555205

Merge branch 'main' into ks-da

8d0cc00

kierramarie requested review from akocbek and shemau June 30, 2025 13:52

akocbek requested changes Jun 30, 2025

View reviewed changes

kierramarie added 2 commits June 30, 2025 12:26

fix: a few more changes

45012ba

Merge branch 'ks-da' of github.com:terraform-ibm-modules/terraform-ib…

2a3cbe6

…m-icd-rabbitmq into ks-da

kierramarie requested a review from akocbek June 30, 2025 16:27

akocbek requested changes Jun 30, 2025

View reviewed changes

fix: diagram

28fb5ef

kierramarie requested a review from akocbek June 30, 2025 16:54

test: fix kms vars in test

c8d694a

SKIP UPGRADE TEST

427f49f

akocbek approved these changes Jun 30, 2025

View reviewed changes

akocbek removed request for iamar7 and shemau June 30, 2025 19:10

toddgiguere merged commit a04664d into main Jun 30, 2025
2 checks passed

toddgiguere deleted the ks-da branch June 30, 2025 20:07

terraform-ibm-modules-ops added the released label Jun 30, 2025

Create Fully Configurable and Security Enforced DA #399

Create Fully Configurable and Security Enforced DA #399

Uh oh!

Conversation

kierramarie commented Jun 6, 2025 • edited by shemau Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Release required?

Release notes content

Run the pipeline

Checklist for reviewers

For mergers

Uh oh!

kierramarie commented Jun 6, 2025

Uh oh!

kierramarie commented Jun 6, 2025

Uh oh!

kierramarie commented Jun 6, 2025

Uh oh!

kierramarie commented Jun 6, 2025

Uh oh!

kierramarie commented Jun 9, 2025

Uh oh!

kierramarie commented Jun 27, 2025

Uh oh!

akocbek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akocbek commented Jun 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kierramarie commented Jun 30, 2025

Uh oh!

akocbek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kierramarie commented Jun 30, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kierramarie commented Jun 30, 2025

Uh oh!

kierramarie commented Jun 6, 2025 •

edited by shemau

Loading