feat: onboard "Existing VPC" VSI extension deployable architecture to IBM catalog (#610)

ocofaigh · web-flow · commit 7b7af928b0cf · 2023-12-12T18:05:31.000Z
diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml
@@ -10,14 +10,18 @@ offerings:
         mark_ready: false
         install_type: fullstack
         pre_validation: "tests/scripts/pre-validation-generate-ssh-key.sh ssh_key patterns/vsi-quickstart"
-        destroy_resources_on_failure: true
-        destroy_workspace_on_failure: false
       - name: standard
         mark_ready: false
         install_type: fullstack
         pre_validation: "tests/scripts/pre-validation-generate-ssh-key.sh ssh_public_key patterns/vsi"
-        destroy_resources_on_failure: true
-        destroy_workspace_on_failure: false
+        scc:
+          instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
+          region: us-south
+      - name: existing-vpc
+        mark_ready: false
+        install_type: extension
+        pre_validation: "tests/scripts/pre-validation-deploy-slz-vpc.sh"
+        post_validation: "tests/scripts/post-validation-destroy-slz-vpc.sh"
         scc:
           instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
           region: us-south
@@ -29,8 +33,6 @@ offerings:
       - name: standard
         mark_ready: false
         install_type: fullstack
-        destroy_resources_on_failure: true
-        destroy_workspace_on_failure: false
         scc:
           instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
           region: us-south
@@ -42,8 +44,6 @@ offerings:
       - name: standard
         mark_ready: false
         install_type: fullstack
-        destroy_resources_on_failure: true
-        destroy_workspace_on_failure: false
         scc:
           instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
           region: us-south
diff --git a/ibm_catalog.json b/ibm_catalog.json
diff --git a/patterns/vsi-extension/README.md b/patterns/vsi-extension/README.md
@@ -1,11 +1,11 @@
 # Add a VSI to a landing zone VPC
 
-This architecture creates virtual server instances (VSI) for VPC in some or all of the subnets of any existing landing zone VPC deployable architecture.
+This architecture creates virtual server instances (VSI) in some or all of the subnets of one VPC of an existing landing zone deployable architecture. To create VSIs in multiple VPCs, deploy the extension once for each VPC.
 
 ## Before you begin
 
 - You must have either the [VPC landing zone](https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-vpc-9fc0fa64-27af-4fed-9dce-47b3640ba739-global) or [Red Hat OpenShift Container Platform on VPC landing zone](https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-ocp-95fccffc-ae3b-42df-b6d9-80be5914d852-global) deployable architecture deployed.
-- The block storage to KMS auth policy must exist. This policy would have been created by one of the above deployable architectures if the `add_kms_block_storage_s2s` variable was set to `true`, which is default value.
-- You need the VPC ID, subnet names, and boot volume encryption key from your existing landing zone VPC deployable architecture. For information about finding these values, see [Adding a VSI to your VPC landing zone deployable architecture](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ext-with-vsi).
+- You need an authorization policy that grants access between block storage and the KMS. The policy exists if you set the `add_kms_block_storage_s2s` input variable to `true` (the default value) in your existing landing zone deployable architecture.
+- You need the VPC ID, subnet names, and boot volume encryption key from your existing landing zone deployable architecture. For information about finding these values, see [Adding a VSI to your VPC landing zone deployable architecture](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-ext-with-vsi).
 
 ![Architecture diagram for adding a VSI to your VPC landing zone deployable architecture](https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone/main/reference-architectures/vsi-extension.drawio.svg)
diff --git a/patterns/vsi-extension/catalogValidationValues.json.template b/patterns/vsi-extension/catalogValidationValues.json.template
@@ -0,0 +1,4 @@
+{
+  "ibmcloud_api_key": $VALIDATION_APIKEY,
+  "resource_tags": $TAGS
+}
diff --git a/patterns/vsi-extension/variables.tf b/patterns/vsi-extension/variables.tf
@@ -30,6 +30,7 @@ variable "existing_ssh_key_name" {
 variable "ssh_public_key" {
   description = "A public SSH key that does not exist in the region where you want to deploy the VSI. The key must be an RSA key with a key size of either 2048 bits or 4096 bits (recommended). [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys). To use an existing key, specify a value in the `existing_ssh_key_name` input instead."
   type        = string
+  default     = null
 
   validation {
     error_message = "The public SSH key must be a valid SSH RSA public key."
diff --git a/tests/resources/slz-vpc/README.md b/tests/resources/slz-vpc/README.md
@@ -0,0 +1 @@
+The terraform code in this directory is used by the existing VPC VSI DA extension for catalog validation.
diff --git a/tests/resources/slz-vpc/main.tf b/tests/resources/slz-vpc/main.tf
@@ -0,0 +1,12 @@
+##############################################################################
+# SLZ VPC
+##############################################################################
+
+module "landing_zone" {
+  source                 = "../../../patterns/vpc/module"
+  region                 = var.region
+  prefix                 = var.prefix
+  tags                   = var.resource_tags
+  enable_transit_gateway = false
+  add_atracker_route     = false
+}
diff --git a/tests/resources/slz-vpc/outputs.tf b/tests/resources/slz-vpc/outputs.tf
@@ -0,0 +1,35 @@
+##############################################################################
+# Outputs
+##############################################################################
+
+output "prefix" {
+  value       = var.prefix
+  description = "Prefix"
+}
+
+output "management_vpc_id" {
+  value = lookup(
+    [for vpc in module.landing_zone.vpc_data : vpc if vpc.vpc_name == "${var.prefix}-management-vpc"][0],
+    "vpc_id",
+  "")
+  description = "Management VPC ID"
+}
+
+output "workload_vpc_id" {
+  value = lookup(
+    [for vpc in module.landing_zone.vpc_data : vpc if vpc.vpc_name == "${var.prefix}-workload-vpc"][0],
+    "vpc_id",
+  "")
+  description = "Workload VPC ID"
+}
+
+# Parse the VSI KMS Key CRN
+locals {
+  vsi_key_map = lookup(module.landing_zone.key_map, "${var.prefix}-vsi-volume-key", "")
+  vsi_key_crn = lookup(local.vsi_key_map, "crn", "")
+}
+
+output "vsi_kms_key_crn" {
+  value       = local.vsi_key_crn
+  description = "VSI KMS Key CRN"
+}
diff --git a/tests/resources/slz-vpc/provider.tf b/tests/resources/slz-vpc/provider.tf
@@ -0,0 +1,4 @@
+provider "ibm" {
+  ibmcloud_api_key = var.ibmcloud_api_key
+  region           = var.region
+}
diff --git a/tests/resources/slz-vpc/variables.tf b/tests/resources/slz-vpc/variables.tf
@@ -0,0 +1,23 @@
+variable "ibmcloud_api_key" {
+  type        = string
+  description = "The IBM Cloud API Key"
+  sensitive   = true
+}
+
+variable "region" {
+  type        = string
+  description = "Region to provision all resources created by this example"
+  default     = "us-south"
+}
+
+variable "prefix" {
+  type        = string
+  description = "Prefix to append to all resources created by this example"
+  default     = "slz-vpc"
+}
+
+variable "resource_tags" {
+  type        = list(string)
+  description = "Optional list of tags to be added to created resources"
+  default     = []
+}
diff --git a/tests/resources/slz-vpc/version.tf b/tests/resources/slz-vpc/version.tf
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.0.0, <1.6.0"
+  required_providers {
+    ibm = {
+      source  = "ibm-cloud/ibm"
+      version = ">= 1.49.0, < 2.0.0"
+    }
+  }
+}
diff --git a/tests/scripts/post-validation-destroy-slz-vpc.sh b/tests/scripts/post-validation-destroy-slz-vpc.sh
@@ -0,0 +1,19 @@
+#! /bin/bash
+
+########################################################################################################################
+## This script is used by the catalog pipeline to destroy the SLZ VPC, which was provisioned as a prerequisite        ##
+## for the existing VPC VSI extension DA                                                                              ##
+########################################################################################################################
+
+set -e
+
+TERRAFORM_SOURCE_DIR="tests/resources/slz-vpc"
+TF_VARS_FILE="terraform.tfvars"
+
+(
+  cd ${TERRAFORM_SOURCE_DIR}
+  echo "Destroying prerequisite SLZ VPC .."
+  terraform destroy -input=false -auto-approve -var-file=${TF_VARS_FILE} || exit 1
+
+  echo "Post-validation complete successfully"
+)
diff --git a/tests/scripts/pre-validation-deploy-slz-vpc.sh b/tests/scripts/pre-validation-deploy-slz-vpc.sh
@@ -0,0 +1,64 @@
+#! /bin/bash
+
+########################################################################################################################
+## This script is used by the catalog pipeline to deploy SLZ VPC, which is a prerequisite for the existing VPC VSI DA ##
+## extension                                                                                                          ##
+########################################################################################################################
+
+set -e
+
+DA_DIR="patterns/vsi-extension"
+TERRAFORM_SOURCE_DIR="tests/resources/slz-vpc"
+JSON_FILE="${DA_DIR}/catalogValidationValues.json"
+REGION="au-syd"
+TF_VARS_FILE="terraform.tfvars"
+
+(
+  cwd=$(pwd)
+  cd ${TERRAFORM_SOURCE_DIR}
+  echo "Provisioning prerequisite SLZ VPC .."
+  terraform init || exit 1
+  # $VALIDATION_APIKEY is available in the catalog runtime
+  {
+    echo "ibmcloud_api_key=\"${VALIDATION_APIKEY}\""
+    echo "prefix=\"slz-$(openssl rand -hex 2)\""
+    echo "region=\"${REGION}\""
+  } >> ${TF_VARS_FILE}
+  terraform apply -input=false -auto-approve -var-file=${TF_VARS_FILE} || exit 1
+
+  # Generate SSH keys and place in temp directory
+  temp_dir=$(mktemp -d)
+  ssh-keygen -f "${temp_dir}/id_rsa" -t rsa -N '' <<<y
+
+  # Extract public key value and delete temp directory
+  ssh_public_key=$(cat "${temp_dir}/id_rsa.pub")
+  rm -rf "${temp_dir}"
+
+  # append prefix, vpc_id, boot_volume_encryption_key, region and ssh_public_key to json
+  prefix_var_name="prefix"
+  prefix_value=$(terraform output -state=terraform.tfstate -raw prefix)
+  vpc_id_var_name="vpc_id"
+  vpc_id_value=$(terraform output -state=terraform.tfstate -raw management_vpc_id)
+  kms_key_var_name="boot_volume_encryption_key"
+  kms_key_value=$(terraform output -state=terraform.tfstate -raw vsi_kms_key_crn)
+  region_var_name="region"
+  region_value="${REGION}"
+  ssh_public_key_var_name="ssh_public_key"
+  ssh_public_key_value="${ssh_public_key}"
+  echo "Appending '${prefix_var_name}', '${vpc_id_var_name}', '${kms_key_var_name}', '${region_var_name}' and '${ssh_public_key_var_name}' input variable values to ${JSON_FILE}.."
+
+  cd "${cwd}"
+  jq -r --arg prefix_var_name "${prefix_var_name}" \
+        --arg prefix_value "${prefix_value}" \
+        --arg vpc_id_var_name "${vpc_id_var_name}" \
+        --arg vpc_id_value "${vpc_id_value}" \
+        --arg kms_key_var_name "${kms_key_var_name}" \
+        --arg kms_key_value "${kms_key_value}" \
+        --arg region_var_name "${region_var_name}" \
+        --arg region_value "${region_value}" \
+        --arg ssh_public_key_var_name "${ssh_public_key_var_name}" \
+        --arg ssh_public_key_value "${ssh_public_key_value}" \
+        '. + {($prefix_var_name): $prefix_value, ($vpc_id_var_name): $vpc_id_value, ($kms_key_var_name): $kms_key_value, ($region_var_name): $region_value, ($ssh_public_key_var_name): $ssh_public_key_value}' "${JSON_FILE}" > tmpfile && mv tmpfile "${JSON_FILE}" || exit 1
+
+  echo "Pre-validation complete successfully"
+)

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +{
 +  "ibmcloud_api_key": $VALIDATION_APIKEY,
 +  "resource_tags": $TAGS
 +}
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+The terraform code in this directory is used by the existing VPC VSI DA extension for catalog validation.`