Skip to content

Commit 05642b0

Browse files
authored
feat: added support to pass an external account ID for cluster and worker boot volumes if KMS encryption key comes from another account (#664)
1 parent c8f2a71 commit 05642b0

File tree

2 files changed

+18
-6
lines changed

2 files changed

+18
-6
lines changed

README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -890,6 +890,7 @@ module "cluster_pattern" {
890890
| [time_sleep.wait_30_seconds](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
891891
| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
892892
| [ibm_container_cluster_versions.cluster_versions](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/container_cluster_versions) | data source |
893+
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/iam_account_settings) | data source |
893894
| [ibm_is_image.image](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_image) | data source |
894895
| [ibm_resource_group.resource_groups](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/resource_group) | data source |
895896
| [ibm_resource_instance.appid](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/resource_instance) | data source |

cluster.tf

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,14 @@ data "ibm_container_cluster_versions" "cluster_versions" {}
66

77
##############################################################################
88

9+
##############################################################################
10+
# Get account id
11+
##############################################################################
12+
13+
data "ibm_iam_account_settings" "iam_account_settings" {}
14+
15+
##############################################################################
16+
917

1018
##############################################################################
1119
# Cluster Locals
@@ -53,8 +61,9 @@ resource "ibm_container_vpc_cluster" "cluster" {
5361
cos_instance_crn = each.value.cos_instance_crn
5462
pod_subnet = each.value.pod_subnet
5563
service_subnet = each.value.service_subnet
56-
crk = each.value.boot_volume_crk_name == null ? null : module.key_management.key_map[each.value.boot_volume_crk_name].key_id
57-
kms_instance_id = each.value.boot_volume_crk_name == null ? null : module.key_management.key_management_guid
64+
crk = each.value.boot_volume_crk_name == null ? null : regex("key:(.*)", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
65+
kms_instance_id = each.value.boot_volume_crk_name == null ? null : regex(".*:(.*):key:.*", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
66+
kms_account_id = each.value.boot_volume_crk_name == null ? null : regex("a/([a-f0-9]{32})", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0] == data.ibm_iam_account_settings.iam_account_settings.account_id ? null : regex("a/([a-f0-9]{32})", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
5867
lifecycle {
5968
ignore_changes = [kube_version]
6069
}
@@ -70,9 +79,10 @@ resource "ibm_container_vpc_cluster" "cluster" {
7079
dynamic "kms_config" {
7180
for_each = each.value.kms_config == null ? [] : [each.value.kms_config]
7281
content {
73-
crk_id = module.key_management.key_map[kms_config.value.crk_name].key_id
74-
instance_id = module.key_management.key_management_guid
82+
crk_id = regex("key:(.*)", module.key_management.key_map[kms_config.value.crk_name].crn)[0]
83+
instance_id = regex(".*:(.*):key:.*", module.key_management.key_map[kms_config.value.crk_name].crn)[0]
7584
private_endpoint = kms_config.value.private_endpoint
85+
account_id = regex("a/([a-f0-9]{32})", module.key_management.key_map[kms_config.value.crk_name].crn)[0] == data.ibm_iam_account_settings.iam_account_settings.account_id ? null : regex("a/([a-f0-9]{32})", module.key_management.key_map[kms_config.value.crk_name].crn)[0]
7686
}
7787
}
7888

@@ -108,8 +118,9 @@ resource "ibm_container_vpc_worker_pool" "pool" {
108118
worker_pool_name = each.value.name
109119
flavor = each.value.flavor
110120
worker_count = each.value.workers_per_subnet
111-
crk = each.value.boot_volume_crk_name == null ? null : module.key_management.key_map[each.value.boot_volume_crk_name].key_id
112-
kms_instance_id = each.value.boot_volume_crk_name == null ? null : module.key_management.key_management_guid
121+
crk = each.value.boot_volume_crk_name == null ? null : regex("key:(.*)", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
122+
kms_instance_id = each.value.boot_volume_crk_name == null ? null : regex(".*:(.*):key:.*", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
123+
kms_account_id = each.value.boot_volume_crk_name == null ? null : regex("a/([a-f0-9]{32})", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0] == data.ibm_iam_account_settings.iam_account_settings.account_id ? null : regex("a/([a-f0-9]{32})", module.key_management.key_map[each.value.boot_volume_crk_name].crn)[0]
113124

114125
dynamic "zones" {
115126
for_each = each.value.subnets

0 commit comments

Comments
 (0)