From c218a03bced0e62aba38f290fd4059c4d24efd3c Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 17 Apr 2025 12:40:26 +0530 Subject: [PATCH 01/16] fix: updated vpc catalog and reference architecture --- ibm_catalog.json | 62 +++++++++---------- .../deployable-architecture-vpc.drawio.svg | 4 ++ .../deployable-architecture-vpc.svg | 4 -- solutions/fully-configurable/README.md | 2 +- solutions/fully-configurable/variables.tf | 16 +++++ 5 files changed, 52 insertions(+), 36 deletions(-) create mode 100644 reference-architecture/deployable-architecture-vpc.drawio.svg delete mode 100644 reference-architecture/deployable-architecture-vpc.svg diff --git a/ibm_catalog.json b/ibm_catalog.json index 968db5f8..db1ef3d7 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -21,50 +21,50 @@ "solution" ], "short_description": "Automates VPC deployment on IBM Cloud, offering full configurability and flexibility for diverse workloads.", - "long_description": "The VPC deployable architecture deploys a Virtual Private Cloud (VPC) infrastructure without any compute resources, such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. This is an experimental tile and not suitable for production workloads. Stay here if you want to try an experimental version with the [Optional and swappable components](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-choose-plan-process#optional-swappable) capability.", + "long_description": "The VPC deployable architecture deploys a Virtual Private Cloud (VPC) infrastructure without any compute resources, such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. This is an experimental tile and not suitable for production workloads. Stay here if you want to try an experimental version with the [Optional and swappable components](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-choose-plan-process#optional-swappable) capability. This can also be used as a base for other Deployable Architectures (such as the OpenShift DA).", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", "features": [ { - "title": "VPC on IBM Cloud", - "description": "Creates and configures a VPC network on IBM Cloud." + "title": "VPC", + "description": "Creates and configures a Virtual Private Cloud (VPC) network on IBM Cloud, providing an isolated and secure environment for your cloud resources. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=terraform)" }, { "title": "Subnets", - "description": "Creates and configures subnets for VPC." + "description": "Creates and configures subnets for the VPC, enabling resource segmentation across availability zones. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)." }, { "title": "Network ACLs", - "description": "Creates and configures network ACLs." + "description": "Creates and configures network ACLs to control inbound and outbound traffic at the subnet level. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)." }, { "title": "Public gateways", - "description": "Create and configure public gateways." + "description": "Creates and configures public gateways to enable internet access for resources within the VPC. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)." }, { "title": "VPN gateways", - "description": "Create and configure VPN gateways." + "description": "Creates and configures VPN gateways to securely connect your on-premises network to IBM Cloud. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)." }, { "title": "VPE gateways", - "description": "Create and configure VPE gateways." + "description": "Creates and configures VPE (Virtual Private Endpoint) gateways for secure, private access to IBM Cloud services. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" }, { "title": "Security groups", - "description": "Create and configure security group rules." + "description": "Creates and configures security group rules to control traffic at the instance level within the VPC. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" }, { "title": "VPC flow logs", - "description": "VPC flow logs can be enabled." + "description": "Enables VPC flow logs to capture and monitor network traffic for analysis and auditing purposes. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" }, { "title": "Address Prefixes", - "description": "Creates and configures address prefixes." + "description": "Creates and configures address prefixes to define IP address ranges for subnets within the VPC." }, { "title": "Routing Table and routes", - "description": "Creates and configures routing table and customized routes." + "description": "Creates and configures routing tables and custom routes to control how network traffic is forwarded within the Virtual Private Cloud (VPC). For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" }, { "title": "Object Storage bucket for VPC flow logs", @@ -158,11 +158,11 @@ "diagrams": [ { "diagram": { - "caption": "Architecture for provisioning and configuring fully configurable Virtual Private Cloud..", + "caption": "Architecture for provisioning and configuring fully configurable Virtual Private Cloud topology", "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, - "description": "This architecture supports provisioning and configuring fully configurable Virtual Private Cloud." + "description": "This architecture supports provisioning and configuring a fully customizable Virtual Private Cloud (VPC) environment. It includes the creation of a VPC along with foundational infrastructure such as a Cloud Object Storage (COS) bucket to store flow logs, and a Key Management Services (KMS) key ring and key when an existing key is not provided. The architecture configures key network components for the VPC including subnets, network ACLs, security group rules, address prefixes, routing tables and routes, public gateway, VPN gateway, and Virtual Private Endpoints (VPEs). Flow logs are also enabled for monitoring network traffic. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." } ] }, @@ -222,23 +222,6 @@ } } }, - { - "key": "provider_visibility", - "options": [ - { - "displayname": "private", - "value": "private" - }, - { - "displayname": "public", - "value": "public" - }, - { - "displayname": "public-and-private", - "value": "public-and-private" - } - ] - }, { "key": "vpc_name", "required": true @@ -445,6 +428,23 @@ }, { "key": "flow_logs_cos_bucket_enable_permanent_retention" + }, + { + "key": "provider_visibility", + "options": [ + { + "displayname": "private", + "value": "private" + }, + { + "displayname": "public", + "value": "public" + }, + { + "displayname": "public-and-private", + "value": "public-and-private" + } + ] } ], "dependencies": [ diff --git a/reference-architecture/deployable-architecture-vpc.drawio.svg b/reference-architecture/deployable-architecture-vpc.drawio.svg new file mode 100644 index 00000000..92c52fe8 --- /dev/null +++ b/reference-architecture/deployable-architecture-vpc.drawio.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-vpc.svg b/reference-architecture/deployable-architecture-vpc.svg deleted file mode 100644 index 4de4ed1c..00000000 --- a/reference-architecture/deployable-architecture-vpc.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage Instance
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional) \ No newline at end of file diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index 6ae38f05..dfeb7399 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -102,7 +102,7 @@ This solution supports provisioning and configuring the following infrastructure | [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#security-group-rules-). | 
list(
    object({
      name      = string
      direction = string
      remote    = optional(string)
      tcp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      udp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      icmp = optional(
        object({
          type = optional(number)
          code = optional(number)
        })
      )
    })
  )
| `[]` | no | | [skip\_cos\_kms\_iam\_auth\_policy](#input\_skip\_cos\_kms\_iam\_auth\_policy) | To skip creating an IAM authorization policy that allows Cloud Object Storage(COS) to access KMS key. | `bool` | `false` | no | | [skip\_vpc\_cos\_iam\_auth\_policy](#input\_skip\_vpc\_cos\_iam\_auth\_policy) | To skip creating an IAM authorization policy that allows the VPC to access the Cloud Object Storage, set this variable to `true`. Required only if `enable_vpc_flow_logs` is set to true. | `bool` | `false` | no | -| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-). | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ]
}
| no | +| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-). | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "name": "subnet-b",
      "public_gateway": false
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "name": "subnet-c",
      "public_gateway": false
    }
  ]
}
| no | | [vpc\_name](#input\_vpc\_name) | Name of the VPC. If a prefix input variable is specified, the prefix is added to the name in the `-` format. | `string` | `"vpc"` | no | | [vpe\_gateway\_cloud\_service\_by\_crn](#input\_vpe\_gateway\_cloud\_service\_by\_crn) | The list of cloud service CRNs used to create endpoint gateways. Use this list to identify services that are not supported by service name in the `cloud_services` variable. For a list of supported services, see [VPE-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services). If `service_name` is not specified, the CRN is used to find the name. If `vpe_name` is not specified in the list, VPE names are created in the format `--`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#vpe-gateway-cloud-service-by-crn-). | 
set(
    object({
      crn                          = string
      vpe_name                     = optional(string) # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.
      service_name                 = optional(string) # Name of the service used to compute the name of the VPE. If not specified, the service name will be obtained from the crn.
      allow_dns_resolution_binding = optional(bool, true)
    })
  )
| `[]` | no | | [vpe\_gateway\_cloud\_services](#input\_vpe\_gateway\_cloud\_services) | The list of cloud services used to create endpoint gateways. If `vpe_name` is not specified in the list, VPE names are created in the format `--`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#vpe-gateway-cloud-services-). | 
set(object({
    service_name                 = string
    vpe_name                     = optional(string), # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.
    allow_dns_resolution_binding = optional(bool, false)
  }))
| `[]` | no | diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index bef9415d..a9fbd706 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -108,6 +108,22 @@ variable "subnets" { no_addr_prefix = false } ] + zone-2 = [ + { + name = "subnet-b" + cidr = "10.20.10.0/24" + public_gateway = false + acl_name = "vpc-acl" + } + ], + zone-3 = [ + { + name = "subnet-c" + cidr = "10.30.10.0/24" + public_gateway = false + acl_name = "vpc-acl" + } + ] } validation { From 545d7ee31e2f9cec9af0195074d0cc676e965418 Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 24 Apr 2025 14:43:53 +0530 Subject: [PATCH 02/16] update catalog --- ibm_catalog.json | 98 ++++++++++++++++++++++++------------------------ 1 file changed, 48 insertions(+), 50 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index db1ef3d7..c56fe2fb 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -21,59 +21,57 @@ "solution" ], "short_description": "Automates VPC deployment on IBM Cloud, offering full configurability and flexibility for diverse workloads.", - "long_description": "The VPC deployable architecture deploys a Virtual Private Cloud (VPC) infrastructure without any compute resources, such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. This is an experimental tile and not suitable for production workloads. Stay here if you want to try an experimental version with the [Optional and swappable components](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-choose-plan-process#optional-swappable) capability. This can also be used as a base for other Deployable Architectures (such as the OpenShift DA).", + "long_description": "The VPC deployable architecture sets up a foundational IBM Cloud® Virtual Private Cloud (VPC) environment without including any compute resources such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. Designed for experimental use, this architecture is not intended for production workloads. It enables users to explore the Optional and swappable components capability, allowing for flexible customization of the infrastructure stack. IBM Cloud VPC provides a high-performance, secure, and scalable Infrastructure-as-a-Service (IaaS) platform that can be managed via UI, CLI, or API. While this tile does not provision compute services by default, it lays the groundwork for adding Virtual Servers for VPC and other advanced resources later. It’s ideal for users who want to test configurations, plan modular deployments, or understand VPC setups before scaling to production. For more information and tutorials, refer to the IBM Cloud VPC [information](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=terraform).", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", "features": [ - { - "title": "VPC", - "description": "Creates and configures a Virtual Private Cloud (VPC) network on IBM Cloud, providing an isolated and secure environment for your cloud resources. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=terraform)" - }, - { - "title": "Subnets", - "description": "Creates and configures subnets for the VPC, enabling resource segmentation across availability zones. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)." - }, - { - "title": "Network ACLs", - "description": "Creates and configures network ACLs to control inbound and outbound traffic at the subnet level. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)." - }, - { - "title": "Public gateways", - "description": "Creates and configures public gateways to enable internet access for resources within the VPC. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)." - }, - { - "title": "VPN gateways", - "description": "Creates and configures VPN gateways to securely connect your on-premises network to IBM Cloud. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)." - }, - { - "title": "VPE gateways", - "description": "Creates and configures VPE (Virtual Private Endpoint) gateways for secure, private access to IBM Cloud services. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" - }, - { - "title": "Security groups", - "description": "Creates and configures security group rules to control traffic at the instance level within the VPC. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" - }, - { - "title": "VPC flow logs", - "description": "Enables VPC flow logs to capture and monitor network traffic for analysis and auditing purposes. For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" - }, - { - "title": "Address Prefixes", - "description": "Creates and configures address prefixes to define IP address ranges for subnets within the VPC." - }, - { - "title": "Routing Table and routes", - "description": "Creates and configures routing tables and custom routes to control how network traffic is forwarded within the Virtual Private Cloud (VPC). For more [information](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" - }, - { - "title": "Object Storage bucket for VPC flow logs", - "description": "Creates and configures an Object Storage bucket required for VPC flow logs." - }, - { - "title": "KMS encryption", - "description": "Supports creating a new key, or using an existing one to encrypt the COS flow log bucket." - } + [ + { + "title": "Subnets", + "description": "Subnets divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)" + }, + { + "title": "Network ACLs", + "description": "Network Access Control Lists (ACLs) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)" + }, + { + "title": "Public gateways", + "description": "Public gateways provide internet access to your VPC resources, acting as a bridge between private network components and the public internet. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)" + }, + { + "title": "VPN gateways", + "description": "VPN gateways enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)" + }, + { + "title": "VPE gateways", + "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" + }, + { + "title": "Security groups", + "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" + }, + { + "title": "VPC flow logs", + "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" + }, + { + "title": "Address Prefixes", + "description": "Address prefixes define the IP address ranges used by your subnets, helping with IP management and planning in your VPC." + }, + { + "title": "Routing Table and routes", + "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" + }, + { + "title": "Object Storage bucket for flow logs", + "description": "Stores the network traffic data captured by VPC flow logs, enabling analysis and long-term storage." + }, + { + "title": "KMS encryption", + "description": "Uses a Key Management Service (KMS) key—either new or existing—to encrypt the Object Storage bucket where flow logs are stored, enhancing data security." + } + ] ], "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues). Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ @@ -158,7 +156,7 @@ "diagrams": [ { "diagram": { - "caption": "Architecture for provisioning and configuring fully configurable Virtual Private Cloud topology", + "caption": "Virtual Private Cloud topology", "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, From de0c2969b2b1fc449d8f04dbe0f009f79fa14bd7 Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 24 Apr 2025 14:53:14 +0530 Subject: [PATCH 03/16] update catalog --- ...rawio.svg => deployable-architecture-vpc.svg} | 0 solutions/fully-configurable/README.md | 2 +- solutions/fully-configurable/variables.tf | 16 ---------------- 3 files changed, 1 insertion(+), 17 deletions(-) rename reference-architecture/{deployable-architecture-vpc.drawio.svg => deployable-architecture-vpc.svg} (100%) diff --git a/reference-architecture/deployable-architecture-vpc.drawio.svg b/reference-architecture/deployable-architecture-vpc.svg similarity index 100% rename from reference-architecture/deployable-architecture-vpc.drawio.svg rename to reference-architecture/deployable-architecture-vpc.svg diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index dfeb7399..6ae38f05 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -102,7 +102,7 @@ This solution supports provisioning and configuring the following infrastructure | [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty). [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#security-group-rules-). | 
list(
    object({
      name      = string
      direction = string
      remote    = optional(string)
      tcp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      udp = optional(
        object({
          port_max = optional(number)
          port_min = optional(number)
        })
      )
      icmp = optional(
        object({
          type = optional(number)
          code = optional(number)
        })
      )
    })
  )
| `[]` | no | | [skip\_cos\_kms\_iam\_auth\_policy](#input\_skip\_cos\_kms\_iam\_auth\_policy) | To skip creating an IAM authorization policy that allows Cloud Object Storage(COS) to access KMS key. | `bool` | `false` | no | | [skip\_vpc\_cos\_iam\_auth\_policy](#input\_skip\_vpc\_cos\_iam\_auth\_policy) | To skip creating an IAM authorization policy that allows the VPC to access the Cloud Object Storage, set this variable to `true`. Required only if `enable_vpc_flow_logs` is set to true. | `bool` | `false` | no | -| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-). | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ],
  "zone-2": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.20.10.0/24",
      "name": "subnet-b",
      "public_gateway": false
    }
  ],
  "zone-3": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.30.10.0/24",
      "name": "subnet-c",
      "public_gateway": false
    }
  ]
}
| no | +| [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-). | 
object({
    zone-1 = list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    }))
    zone-2 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
    zone-3 = optional(list(object({
      name           = string
      cidr           = string
      public_gateway = optional(bool)
      acl_name       = string
      no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true
      subnet_tags    = optional(list(string), [])
    })))
  })
| 
{
  "zone-1": [
    {
      "acl_name": "vpc-acl",
      "cidr": "10.10.10.0/24",
      "name": "subnet-a",
      "no_addr_prefix": false,
      "public_gateway": true
    }
  ]
}
| no | | [vpc\_name](#input\_vpc\_name) | Name of the VPC. If a prefix input variable is specified, the prefix is added to the name in the `-` format. | `string` | `"vpc"` | no | | [vpe\_gateway\_cloud\_service\_by\_crn](#input\_vpe\_gateway\_cloud\_service\_by\_crn) | The list of cloud service CRNs used to create endpoint gateways. Use this list to identify services that are not supported by service name in the `cloud_services` variable. For a list of supported services, see [VPE-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services). If `service_name` is not specified, the CRN is used to find the name. If `vpe_name` is not specified in the list, VPE names are created in the format `--`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#vpe-gateway-cloud-service-by-crn-). | 
set(
    object({
      crn                          = string
      vpe_name                     = optional(string) # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.
      service_name                 = optional(string) # Name of the service used to compute the name of the VPE. If not specified, the service name will be obtained from the crn.
      allow_dns_resolution_binding = optional(bool, true)
    })
  )
| `[]` | no | | [vpe\_gateway\_cloud\_services](#input\_vpe\_gateway\_cloud\_services) | The list of cloud services used to create endpoint gateways. If `vpe_name` is not specified in the list, VPE names are created in the format `--`. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#vpe-gateway-cloud-services-). | 
set(object({
    service_name                 = string
    vpe_name                     = optional(string), # Full control on the VPE name. If not specified, the VPE name will be computed based on prefix, vpc name and service name.
    allow_dns_resolution_binding = optional(bool, false)
  }))
| `[]` | no | diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index a9fbd706..bef9415d 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -108,22 +108,6 @@ variable "subnets" { no_addr_prefix = false } ] - zone-2 = [ - { - name = "subnet-b" - cidr = "10.20.10.0/24" - public_gateway = false - acl_name = "vpc-acl" - } - ], - zone-3 = [ - { - name = "subnet-c" - cidr = "10.30.10.0/24" - public_gateway = false - acl_name = "vpc-acl" - } - ] } validation { From 636948a402e976c00dd00e4bdd1f2d245cc9e354 Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 24 Apr 2025 14:57:40 +0530 Subject: [PATCH 04/16] update catalog --- ibm_catalog.json | 90 +++++++++++++++++++++++------------------------- 1 file changed, 44 insertions(+), 46 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index c56fe2fb..a1aaca1b 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -26,52 +26,50 @@ "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", "features": [ - [ - { - "title": "Subnets", - "description": "Subnets divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)" - }, - { - "title": "Network ACLs", - "description": "Network Access Control Lists (ACLs) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)" - }, - { - "title": "Public gateways", - "description": "Public gateways provide internet access to your VPC resources, acting as a bridge between private network components and the public internet. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)" - }, - { - "title": "VPN gateways", - "description": "VPN gateways enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)" - }, - { - "title": "VPE gateways", - "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" - }, - { - "title": "Security groups", - "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" - }, - { - "title": "VPC flow logs", - "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" - }, - { - "title": "Address Prefixes", - "description": "Address prefixes define the IP address ranges used by your subnets, helping with IP management and planning in your VPC." - }, - { - "title": "Routing Table and routes", - "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" - }, - { - "title": "Object Storage bucket for flow logs", - "description": "Stores the network traffic data captured by VPC flow logs, enabling analysis and long-term storage." - }, - { - "title": "KMS encryption", - "description": "Uses a Key Management Service (KMS) key—either new or existing—to encrypt the Object Storage bucket where flow logs are stored, enhancing data security." - } - ] + { + "title": "Subnets", + "description": "Subnets divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)" + }, + { + "title": "Network ACLs", + "description": "Network Access Control Lists (ACLs) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)" + }, + { + "title": "Public gateways", + "description": "Public gateways provide internet access to your VPC resources, acting as a bridge between private network components and the public internet. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)" + }, + { + "title": "VPN gateways", + "description": "VPN gateways enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)" + }, + { + "title": "VPE gateways", + "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" + }, + { + "title": "Security groups", + "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" + }, + { + "title": "VPC flow logs", + "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" + }, + { + "title": "Address Prefixes", + "description": "Address prefixes define the IP address ranges used by your subnets, helping with IP management and planning in your VPC." + }, + { + "title": "Routing Table and routes", + "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" + }, + { + "title": "Object Storage bucket for flow logs", + "description": "Stores the network traffic data captured by VPC flow logs, enabling analysis and long-term storage." + }, + { + "title": "KMS encryption", + "description": "Uses a Key Management Service (KMS) key—either new or existing—to encrypt the Object Storage bucket where flow logs are stored, enhancing data security." + } ], "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues). Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ From 500571b10165dba1e7113832c4fbca841c438b1d Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 24 Apr 2025 15:12:33 +0530 Subject: [PATCH 05/16] fix arch --- .../deployable-architecture-vpc-selected.drawio.svg | 4 ++++ reference-architecture/deployable-architecture-vpc.drawio.svg | 4 ++++ 2 files changed, 8 insertions(+) create mode 100644 reference-architecture/deployable-architecture-vpc-selected.drawio.svg create mode 100644 reference-architecture/deployable-architecture-vpc.drawio.svg diff --git a/reference-architecture/deployable-architecture-vpc-selected.drawio.svg b/reference-architecture/deployable-architecture-vpc-selected.drawio.svg new file mode 100644 index 00000000..4e91fc01 --- /dev/null +++ b/reference-architecture/deployable-architecture-vpc-selected.drawio.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-vpc.drawio.svg b/reference-architecture/deployable-architecture-vpc.drawio.svg new file mode 100644 index 00000000..af0317bd --- /dev/null +++ b/reference-architecture/deployable-architecture-vpc.drawio.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file From 3c7257a50691dcf6a3ed62505ef4d34493bbdd5e Mon Sep 17 00:00:00 2001 From: Khuzaima-Shakeel Date: Thu, 24 Apr 2025 15:18:51 +0530 Subject: [PATCH 06/16] fix arch --- ibm_catalog.json | 2 +- .../deployable-architecture-vpc-selected.drawio.svg | 4 ---- reference-architecture/deployable-architecture-vpc.drawio.svg | 4 ---- reference-architecture/deployable-architecture-vpc.svg | 2 +- 4 files changed, 2 insertions(+), 10 deletions(-) delete mode 100644 reference-architecture/deployable-architecture-vpc-selected.drawio.svg delete mode 100644 reference-architecture/deployable-architecture-vpc.drawio.svg diff --git a/ibm_catalog.json b/ibm_catalog.json index a1aaca1b..250691e1 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -155,7 +155,7 @@ { "diagram": { "caption": "Virtual Private Cloud topology", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/reference-architecture/deployable-architecture-vpc.svg", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issue_13328/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, "description": "This architecture supports provisioning and configuring a fully customizable Virtual Private Cloud (VPC) environment. It includes the creation of a VPC along with foundational infrastructure such as a Cloud Object Storage (COS) bucket to store flow logs, and a Key Management Services (KMS) key ring and key when an existing key is not provided. The architecture configures key network components for the VPC including subnets, network ACLs, security group rules, address prefixes, routing tables and routes, public gateway, VPN gateway, and Virtual Private Endpoints (VPEs). Flow logs are also enabled for monitoring network traffic. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." diff --git a/reference-architecture/deployable-architecture-vpc-selected.drawio.svg b/reference-architecture/deployable-architecture-vpc-selected.drawio.svg deleted file mode 100644 index 4e91fc01..00000000 --- a/reference-architecture/deployable-architecture-vpc-selected.drawio.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-vpc.drawio.svg b/reference-architecture/deployable-architecture-vpc.drawio.svg deleted file mode 100644 index af0317bd..00000000 --- a/reference-architecture/deployable-architecture-vpc.drawio.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-vpc.svg b/reference-architecture/deployable-architecture-vpc.svg index 92c52fe8..4e91fc01 100644 --- a/reference-architecture/deployable-architecture-vpc.svg +++ b/reference-architecture/deployable-architecture-vpc.svg @@ -1,4 +1,4 @@ -
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file +
ACL
locked
IBM Cloud
Region
Resource Group
Existing KMS
Key Ring
Root KeyFlow logs Bucket
Cloud Object Storage 
VPC
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 2
VPN Gateway (Optional)
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 1
VPN Gateway (Optional)
ACL
locked
Subnet
Public Gateway (Optional)Virtual Private Endpoints(Optional)
Zone 3
VPN Gateway (Optional) \ No newline at end of file From bf01b9f30a08576fadd2000e626ed36ba21db608 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Tue, 29 Apr 2025 17:59:32 +0530 Subject: [PATCH 07/16] update code --- ibm_catalog.json | 80 ++++++++---------------------------------------- 1 file changed, 12 insertions(+), 68 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 250691e1..511b2133 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -21,38 +21,38 @@ "solution" ], "short_description": "Automates VPC deployment on IBM Cloud, offering full configurability and flexibility for diverse workloads.", - "long_description": "The VPC deployable architecture sets up a foundational IBM Cloud® Virtual Private Cloud (VPC) environment without including any compute resources such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. Designed for experimental use, this architecture is not intended for production workloads. It enables users to explore the Optional and swappable components capability, allowing for flexible customization of the infrastructure stack. IBM Cloud VPC provides a high-performance, secure, and scalable Infrastructure-as-a-Service (IaaS) platform that can be managed via UI, CLI, or API. While this tile does not provision compute services by default, it lays the groundwork for adding Virtual Servers for VPC and other advanced resources later. It’s ideal for users who want to test configurations, plan modular deployments, or understand VPC setups before scaling to production. For more information and tutorials, refer to the IBM Cloud VPC [information](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=terraform).", + "long_description": "The VPC deployable architecture sets up a foundational IBM Cloud® [Virtual Private Cloud (VPC)](https://www.ibm.com/cloud/vpc) environment without including any compute resources such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. IBM Cloud VPC provides a high-performance, secure, and scalable Infrastructure-as-a-Service (IaaS) platform that can be managed via UI, CLI, or API. While this tile does not provision compute services by default, it lays the groundwork for adding Virtual Servers for VPC and other advanced resources later.", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", "features": [ { "title": "Subnets", - "description": "Subnets divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc)" + "description": "[Subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc) divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication." }, { "title": "Network ACLs", - "description": "Network Access Control Lists (ACLs) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls)" + "description": "[Network Access Control Lists (ACLs)](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security." }, { "title": "Public gateways", - "description": "Public gateways provide internet access to your VPC resources, acting as a bridge between private network components and the public internet. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways)" + "description": "[Public gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways) provide internet access to your VPC resources, acting as a bridge between private network components and the public internet." }, { "title": "VPN gateways", - "description": "VPN gateways enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)" + "description": "[VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview) enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups." }, { "title": "VPE gateways", - "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)" + "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)." }, { "title": "Security groups", - "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)" + "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)." }, { "title": "VPC flow logs", - "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)" + "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. Refer [this](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) to get more information." }, { "title": "Address Prefixes", @@ -60,7 +60,7 @@ }, { "title": "Routing Table and routes", - "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)" + "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)." }, { "title": "Object Storage bucket for flow logs", @@ -91,64 +91,8 @@ "descriptions": "This architecture supports provisioning and configuring fully configurable Virtual Private Cloud.", "features": [ { - "title": "Create VPC", - "description": "Yes" - }, - { - "title": "Use existing VPC instance", - "description": "No" - }, - { - "title": "New resource group creation", - "description": "No" - }, - { - "title": "Create public gateways", - "description": "Yes" - }, - { - "title": "Create subnets", - "description": "Yes" - }, - { - "title": "Create network ACLs", - "description": "Yes" - }, - { - "title": "Create VPN gateways", - "description": "Yes" - }, - { - "title": "Create VPE gateways", - "description": "Yes" - }, - { - "title": "Create security groups rules", - "description": "Yes" - }, - { - "title": "Configure VPC flow logs", - "description": "Yes" - }, - { - "title": "Create COS instance", - "description": "No" - }, - { - "title": "Enforced KMS encryption", - "description": "No" - }, - { - "title": "Use existing KMS key", - "description": "Yes" - }, - { - "title": "KMS key ring and key creation", - "description": "Yes" - }, - { - "title": "Create custom routes", - "description": "Yes" + "title": "Fully Configurable", + "description": "Enables you to customize every aspect of the solution." } ], "diagrams": [ @@ -158,7 +102,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issue_13328/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, - "description": "This architecture supports provisioning and configuring a fully customizable Virtual Private Cloud (VPC) environment. It includes the creation of a VPC along with foundational infrastructure such as a Cloud Object Storage (COS) bucket to store flow logs, and a Key Management Services (KMS) key ring and key when an existing key is not provided. The architecture configures key network components for the VPC including subnets, network ACLs, security group rules, address prefixes, routing tables and routes, public gateway, VPN gateway, and Virtual Private Endpoints (VPEs). Flow logs are also enabled for monitoring network traffic. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." + "description": "This architecture supports provisioning and configuring a fully configurable Virtual Private Cloud (VPC) environment. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. Flow logs can also be enabled for monitoring network traffic.
It supports the creation of:
- a Cloud Object Storage (COS) bucket to store flow logs
- a Key Management Services (KMS) key rings and keys when an existing key is provided.

This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." } ] }, From 0f381632f3eaa64e01780571430fca0f6b3f9e85 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Tue, 6 May 2025 10:18:58 +0530 Subject: [PATCH 08/16] updated overview and features --- ibm_catalog.json | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 511b2133..8884fe6c 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -21,57 +21,57 @@ "solution" ], "short_description": "Automates VPC deployment on IBM Cloud, offering full configurability and flexibility for diverse workloads.", - "long_description": "The VPC deployable architecture sets up a foundational IBM Cloud® [Virtual Private Cloud (VPC)](https://www.ibm.com/cloud/vpc) environment without including any compute resources such as Virtual Server Instances (VSI) or Red Hat OpenShift clusters. IBM Cloud VPC provides a high-performance, secure, and scalable Infrastructure-as-a-Service (IaaS) platform that can be managed via UI, CLI, or API. While this tile does not provision compute services by default, it lays the groundwork for adding Virtual Servers for VPC and other advanced resources later.", + "long_description": "The Cloud automation for VPC sets up a foundational IBM Cloud® [Virtual Private Cloud (VPC)](https://www.ibm.com/cloud/vpc) environment. It lays the groundwork for adding Virtual Servers Instances (VSI) or Red Hat OpenShift clusters and other advanced resources. This can be used as a base deployable architecture for many others deployable architectures like [Cloud automation for Red Hat OpenShift Container Platform on VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global), [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global), [Cloud automation for Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vsi-vpc-28e2b12c-858f-4ae8-8717-60db8cec2e6e-global].", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", "features": [ { "title": "Subnets", - "description": "[Subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc) divide your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication." + "description": "Create [subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc) in three zones that divides your VPC into smaller, isolated networks across different availability zones. This helps you organize resources, improve availability, and control internal communication." }, { "title": "Network ACLs", - "description": "[Network Access Control Lists (ACLs)](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls) define rules to allow or deny traffic to and from your subnets, providing an extra layer of network security." + "description": "Define rules for [Network Access Control Lists (ACLs)](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls) to allow or deny traffic to and from your subnets, providing an extra layer of network security." }, { "title": "Public gateways", - "description": "[Public gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways) provide internet access to your VPC resources, acting as a bridge between private network components and the public internet." + "description": "Configures [public gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-public-gateways) to provide internet access to your VPC resources, acting as a bridge between private network components and the public internet." }, { "title": "VPN gateways", - "description": "[VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview) enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups." + "description": "Create and configures [VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview) to enable secure, encrypted connections between your on-premises environment and IBM Cloud, ideal for hybrid cloud setups." }, { "title": "VPE gateways", - "description": "Virtual Private Endpoints (VPEs) allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)." + "description": "Creates Virtual Private Endpoints (VPEs) gateways to allow private access to IBM Cloud services from within your VPC, avoiding public internet traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)." }, { "title": "Security groups", - "description": "Security groups function like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)." - }, - { - "title": "VPC flow logs", - "description": "VPC flow logs capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting. Refer [this](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) to get more information." + "description": "Has the ability to configure security groups that works like virtual firewalls for your instances, defining rules that control allowed inbound and outbound traffic. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups)." }, { "title": "Address Prefixes", - "description": "Address prefixes define the IP address ranges used by your subnets, helping with IP management and planning in your VPC." + "description": "Attaches address prefixes to define the IP address ranges used by your subnets, helping with IP management and planning in your VPC." }, { "title": "Routing Table and routes", - "description": "Routing tables and custom routes determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)." + "description": "Creates routing tables and custom routes to determine how traffic is directed within your VPC and to external networks. [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table&interface=ui)." + }, + { + "title": "VPC flow logs", + "description": "Creates and configures [VPC flow logs]((https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs)) capture data about traffic moving through your network, helping with monitoring, auditing, and troubleshooting." }, { "title": "Object Storage bucket for flow logs", - "description": "Stores the network traffic data captured by VPC flow logs, enabling analysis and long-term storage." + "description": "Creates and configures the Object storage bucket to store the network traffic data captured by VPC flow logs, enabling analysis and long-term storage." }, { "title": "KMS encryption", - "description": "Uses a Key Management Service (KMS) key—either new or existing—to encrypt the Object Storage bucket where flow logs are stored, enhancing data security." + "description": "Supports Key Management Service (KMS) encryption for the Object Storage bucket where flow logs are stored, enhancing data security." } ], - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues). Please note this product is not supported via the IBM Cloud Support Center.", + "support_details": "This product is in the community registry, as such support is handled through the originated repository. If you experience issues, kindly open an issue [here](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issues). Please note that this product is not currently supported through the IBM Cloud Support Center.", "flavors": [ { "label": "Fully configurable", From 260ffcd5f9001c1a4c5c5e600298fa141eee5fc7 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Tue, 6 May 2025 13:59:15 +0530 Subject: [PATCH 09/16] update code --- ibm_catalog.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 8884fe6c..72356800 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -91,8 +91,11 @@ "descriptions": "This architecture supports provisioning and configuring fully configurable Virtual Private Cloud.", "features": [ { - "title": "Fully Configurable", - "description": "Enables you to customize every aspect of the solution." + "title": "Default configuration", + "description": "Default configuration includes:✅
- creates subnets in three zones
- configures ACLs in such a way that traffic is allowed through port 443, 80 and 22
- " + }, + { + "description": "VPC Flow logs is not enabled by default.", } ], "diagrams": [ From cd166bb9cf28c15ddfc7e4d38bb964d478fd4448 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Tue, 6 May 2025 14:19:48 +0530 Subject: [PATCH 10/16] fix code --- ibm_catalog.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 72356800..bc72d102 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -95,7 +95,8 @@ "description": "Default configuration includes:✅
- creates subnets in three zones
- configures ACLs in such a way that traffic is allowed through port 443, 80 and 22
- " }, { - "description": "VPC Flow logs is not enabled by default.", + "title": "Optional config", + "description": "VPC Flow logs is not enabled by default." } ], "diagrams": [ From e4fac04b1e2eb9a05e9679e9664f56fa722067c3 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Wed, 7 May 2025 18:22:42 +0530 Subject: [PATCH 11/16] prefix doc --- solutions/fully-configurable/DA-prefix.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 solutions/fully-configurable/DA-prefix.md diff --git a/solutions/fully-configurable/DA-prefix.md b/solutions/fully-configurable/DA-prefix.md new file mode 100644 index 00000000..1491dd13 --- /dev/null +++ b/solutions/fully-configurable/DA-prefix.md @@ -0,0 +1,19 @@ +## Prefix in Deployable Architecture + +The deployable architecture includes a `prefix` input variable, which is used to prepend a specified string to all resources created by the solution. This helps distinguish and easily locate the resources. If you prefer not to use a prefix, you can set the value to `null` or an empty string. + +- Rules: + - must begin with a lowercase letter + - may contain only lowercase letters, digits, and hyphens '-' + - must not end with a hyphen('-') + - can not contain consecutive hyphens ('--') + - maximum length allowed is of 16 characters + +### Example + +- Prefix can be something like `dev`, `test`, `prod` to help identify the resources across different environments. + +- It can include the region name to help identify resources based on their region. Examples are `dev-eu-gb`, `dev-us-south`. + + + From 6c64fe859987cd4dd7f01e32cbeafc79fe887c26 Mon Sep 17 00:00:00 2001 From: Vincent Burckhardt Date: Thu, 8 May 2025 11:34:29 +0100 Subject: [PATCH 12/16] Update DA-prefix.md --- solutions/fully-configurable/DA-prefix.md | 41 +++++++++++++++++------ 1 file changed, 30 insertions(+), 11 deletions(-) diff --git a/solutions/fully-configurable/DA-prefix.md b/solutions/fully-configurable/DA-prefix.md index 1491dd13..822c7d13 100644 --- a/solutions/fully-configurable/DA-prefix.md +++ b/solutions/fully-configurable/DA-prefix.md @@ -1,19 +1,38 @@ -## Prefix in Deployable Architecture +# Prefix in Deployable Architecture -The deployable architecture includes a `prefix` input variable, which is used to prepend a specified string to all resources created by the solution. This helps distinguish and easily locate the resources. If you prefer not to use a prefix, you can set the value to `null` or an empty string. +The **`prefix`** input variable allows you to prepend a custom string to the names of all resources created by this automation. This is especially useful for: -- Rules: - - must begin with a lowercase letter - - may contain only lowercase letters, digits, and hyphens '-' - - must not end with a hyphen('-') - - can not contain consecutive hyphens ('--') - - maximum length allowed is of 16 characters +- **Avoiding naming collisions** when deploying the same solution multiple times within the same account. +- **Creating identical infrastructure** across multiple regions or environments. +- **Improving resource traceability** by embedding environment or region identifiers into resource names. -### Example +If you do not wish to use a prefix, you may set the value to `null` or an empty string (`""`). -- Prefix can be something like `dev`, `test`, `prod` to help identify the resources across different environments. +**Important**: The automation automatically inserts a hyphen between the prefix and the resource name. Therefore, you do not need to include a hyphen in the prefix yourself. -- It can include the region name to help identify resources based on their region. Examples are `dev-eu-gb`, `dev-us-south`. +### Examples +Here are some common patterns for using the prefix: +- **Environment-based**: + - `dev`, `test`, `prod` +- **Environment + Region**: + - `dev-eu-gb`, `prod-us-south`, `test-jp-tok` +- **Project-specific**: + - `webapp-dev`, `ml-prod`, `iot-test` +- **Team or department identifiers**: + - `fin-dev`, `hr-prod`, `eng-test` +- **Date or version-based** (for temporary or experimental deployments): + - `exp-202505`, `v2-dev` +These conventions help ensure that resources are clearly grouped and easily identifiable, especially in shared or multi-tenant accounts. + +### Naming Rules + +To ensure compatibility and consistency, the prefix must follow these rules: + +- Must begin with a **lowercase letter** +- May contain only **lowercase letters**, **digits**, and **hyphens (`-`)** +- Must **not end** with a hyphen (`-`) +- Must **not contain consecutive hyphens** (`--`) +- Maximum length: **16 characters** From 6e38d558807b143ed5032c1c069280af1af72cae Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Wed, 14 May 2025 19:09:17 +0530 Subject: [PATCH 13/16] update desc --- ibm_catalog.json | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index bc72d102..af840d0f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -92,11 +92,7 @@ "features": [ { "title": "Default configuration", - "description": "Default configuration includes:✅
- creates subnets in three zones
- configures ACLs in such a way that traffic is allowed through port 443, 80 and 22
- " - }, - { - "title": "Optional config", - "description": "VPC Flow logs is not enabled by default." + "description": "Creates subnets in three zones and configures ACLs in such a way that traffic is allowed through port 443, 80 and 22." } ], "diagrams": [ @@ -106,7 +102,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issue_13328/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, - "description": "This architecture supports provisioning and configuring a fully configurable Virtual Private Cloud (VPC) environment. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. Flow logs can also be enabled for monitoring network traffic.
It supports the creation of:
- a Cloud Object Storage (COS) bucket to store flow logs
- a Key Management Services (KMS) key rings and keys when an existing key is provided.

This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." + "description": "This architecture supports provisioning and configuring a Virtual Private Cloud(VPC) environment. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. The default configuration deploys VPC with three zones subnets and the pre-defined ACLs. The additional features can be enabled on providing the appropriate input values.

The VPC Flow Logs can be enabled to monitor the traffic and analyse. If you enable Flow Logs then this solution creates:
- a Cloud Object Storage(COS) instance using the optional Cloud Object Storage deployable architecture, if any existing instance is not provided.
- the required COS buckets.
- the KMS keys if KMS encryption enabled bucket is required. It can use the existing KMS instance or can create new using the optional KMS deployable architecture.

This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." } ] }, From 0ed9271522d31184bf8ef46815bfbd3d6b966b00 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Wed, 14 May 2025 19:17:57 +0530 Subject: [PATCH 14/16] fix typo --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 20b77643..7a38aab4 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -21,7 +21,7 @@ "solution" ], "short_description": "Automates VPC deployment on IBM Cloud, offering full configurability and flexibility for diverse workloads.", - "long_description": "The Cloud automation for VPC sets up a foundational IBM Cloud® [Virtual Private Cloud (VPC)](https://www.ibm.com/cloud/vpc) environment. It lays the groundwork for adding Virtual Servers Instances (VSI) or Red Hat OpenShift clusters and other advanced resources. This can be used as a base deployable architecture for many others deployable architectures like [Cloud automation for Red Hat OpenShift Container Platform on VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global), [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global), [Cloud automation for Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vsi-vpc-28e2b12c-858f-4ae8-8717-60db8cec2e6e-global].", + "long_description": "The Cloud automation for VPC sets up a foundational IBM Cloud® [Virtual Private Cloud (VPC)](https://www.ibm.com/cloud/vpc) environment. It lays the groundwork for adding Virtual Servers Instances (VSI) or Red Hat OpenShift clusters and other advanced resources. This can be used as a base deployable architecture for many others deployable architectures like [Cloud automation for Red Hat OpenShift Container Platform on VPC](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-vpc-1728a4fd-f561-4cf9-82ef-2b1eeb5da1a8-global), [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global), [Cloud automation for Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-vsi-vpc-28e2b12c-858f-4ae8-8717-60db8cec2e6e-global).
", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/images/vpc_icon.svg", "provider_name": "IBM", From 5d1daa22169e122c25a5eff5fd599984a233a3c8 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Fri, 30 May 2025 08:16:54 +0530 Subject: [PATCH 15/16] update architecture description --- ibm_catalog.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 7a38aab4..401329e3 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -91,7 +91,7 @@ "features": [ { "title": "Default configuration", - "description": "Creates subnets in three zones and configures ACLs in such a way that traffic is allowed through port 443, 80 and 22." + "description": "Creates VPC with subnets in three zones and configures ACLs. The pre-defined ACLs allows traffic through 443, 80 and 22 ports. A public gateway is attached with one of the subnet." } ], "diagrams": [ @@ -101,7 +101,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/issue_13328/reference-architecture/deployable-architecture-vpc.svg", "type": "image/svg+xml" }, - "description": "This architecture supports provisioning and configuring a Virtual Private Cloud(VPC) environment. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements. The default configuration deploys VPC with three zones subnets and the pre-defined ACLs. The additional features can be enabled on providing the appropriate input values.

The VPC Flow Logs can be enabled to monitor the traffic and analyse. If you enable Flow Logs then this solution creates:
- a Cloud Object Storage(COS) instance using the optional Cloud Object Storage deployable architecture, if any existing instance is not provided.
- the required COS buckets.
- the KMS keys if KMS encryption enabled bucket is required. It can use the existing KMS instance or can create new using the optional KMS deployable architecture.

This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." + "description": "This architecture supports provisioning and configuring a Virtual Private Cloud(VPC) environment. While the diagram illustrates a three-zone deployment, the VPC can also be provisioned in a single-zone or two-zone configuration, depending on your availability requirements.
The default configuration deploys VPC with three zones subnets, configures the pre-defined ACLs and attaches a public gateway. The additional functionalities like VPN gateway, VPE gateway, Flow logs, security groups etc. can be configured on providing the appropriate input values.

The VPC Flow Logs is used to monitor the traffic and analyse. To enable the VPC Flow Logs, this solution manages the following tasks automatically:
- provisions a Cloud Object Storage(COS) instance using the Cloud Object Storage deployable architecture. Alternatively, you can provide an existing COS instance details if any.
- creates a COS bucket to store flow logs in the provisioned COS instance or in the existing instance.
- supports creation of keys for a Key Management Service(KMS) if KMS encryption enabled bucket is enabled for more security instead of default encryption. You can use the existing KMS instance or can create a new Key Protect instance using the KMS deployable architecture.

This modular design provides flexibility and can serve as a secure baseline for deploying compute workloads." } ] }, From f76f9afb5f2149c69dfc01a72bee518052d2f520 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Fri, 30 May 2025 08:18:57 +0530 Subject: [PATCH 16/16] delete prefix.md --- solutions/fully-configurable/DA-prefix.md | 38 ----------------------- 1 file changed, 38 deletions(-) delete mode 100644 solutions/fully-configurable/DA-prefix.md diff --git a/solutions/fully-configurable/DA-prefix.md b/solutions/fully-configurable/DA-prefix.md deleted file mode 100644 index 822c7d13..00000000 --- a/solutions/fully-configurable/DA-prefix.md +++ /dev/null @@ -1,38 +0,0 @@ -# Prefix in Deployable Architecture - -The **`prefix`** input variable allows you to prepend a custom string to the names of all resources created by this automation. This is especially useful for: - -- **Avoiding naming collisions** when deploying the same solution multiple times within the same account. -- **Creating identical infrastructure** across multiple regions or environments. -- **Improving resource traceability** by embedding environment or region identifiers into resource names. - -If you do not wish to use a prefix, you may set the value to `null` or an empty string (`""`). - -**Important**: The automation automatically inserts a hyphen between the prefix and the resource name. Therefore, you do not need to include a hyphen in the prefix yourself. - -### Examples - -Here are some common patterns for using the prefix: - -- **Environment-based**: - - `dev`, `test`, `prod` -- **Environment + Region**: - - `dev-eu-gb`, `prod-us-south`, `test-jp-tok` -- **Project-specific**: - - `webapp-dev`, `ml-prod`, `iot-test` -- **Team or department identifiers**: - - `fin-dev`, `hr-prod`, `eng-test` -- **Date or version-based** (for temporary or experimental deployments): - - `exp-202505`, `v2-dev` - -These conventions help ensure that resources are clearly grouped and easily identifiable, especially in shared or multi-tenant accounts. - -### Naming Rules - -To ensure compatibility and consistency, the prefix must follow these rules: - -- Must begin with a **lowercase letter** -- May contain only **lowercase letters**, **digits**, and **hyphens (`-`)** -- Must **not end** with a hyphen (`-`) -- Must **not contain consecutive hyphens** (`--`) -- Maximum length: **16 characters**