Skip to content

Commit 0f69518

Browse files
ocofaighocofaigh
authored
feat: merge in SCC workload protection features and enable them by default<br>- NOTE: Input cloud_monitoring_instance_region has been renamed to instance_region (#143)
1 parent f381ab9 commit 0f69518

27 files changed

+1148
-538
lines changed

‎.secrets.baseline‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2025-03-24T23:50:51Z",
6+
"generated_at": "2025-07-14T16:52:00Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -76,7 +76,18 @@
7676
"name": "TwilioKeyDetector"
7777
}
7878
],
79-
"results": {},
79+
"results": {
80+
"README.md": [
81+
{
82+
"hashed_secret": "3f0155e75563ab3adc0505000a86da5baa207d1f",
83+
"is_secret": false,
84+
"is_verified": false,
85+
"line_number": 49,
86+
"type": "Secret Keyword",
87+
"verified_result": null
88+
}
89+
]
90+
},
8091
"version": "0.13.1+ibm.62.dss",
8192
"word_list": {
8293
"file": null,

‎README.md‎

Lines changed: 75 additions & 58 deletions
Large diffs are not rendered by default.

‎examples/obs-agent-iks/README.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1-
# Monitoring agent on Kubernetes using CSE ingress endpoint with an apikey
1+
# Deploy agent in IKS cluster
22

3-
An example that shows how to deploy a Monitoring agent in a Kubernetes cluster to send Logs directly to IBM a Cloud Monitoring instance.
3+
An example that shows how to deploy the agent in an IKS cluster.
4+
5+
The following resources are provisioned:
46

5-
The example provisions the following resources:
67
- A new resource group, if an existing one is not passed in.
78
- A basic VPC (if `is_vpc_cluster` is true).
89
- A Kubernetes cluster.
9-
- An IBM Cloud Monitoring instance
10-
- Monitoring agent
10+
- An IBM Cloud Monitoring instance.
11+
- An SCC Workload Protection instance.
12+
- The Monitoring and Workload Protection agent.

‎examples/obs-agent-iks/main.tf‎

Lines changed: 99 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -10,71 +10,89 @@ module "resource_group" {
1010
existing_resource_group_name = var.resource_group
1111
}
1212

13-
########################################################################################################################
14-
# VPC + Subnet + Public Gateway
15-
#
16-
# NOTE: This is a very simple VPC with single subnet in a single zone with a public gateway enabled, that will allow
17-
# all traffic ingress/egress by default.
18-
# For production use cases this would need to be enhanced by adding more subnets and zones for resiliency, and
19-
# ACLs/Security Groups for network security.
20-
########################################################################################################################
21-
22-
resource "ibm_is_vpc" "vpc" {
23-
name = "${var.prefix}-vpc"
24-
resource_group = module.resource_group.resource_group_id
25-
address_prefix_management = "auto"
26-
tags = var.resource_tags
13+
##############################################################################
14+
# Create VPC and IKS Cluster
15+
##############################################################################
16+
17+
resource "ibm_is_vpc" "example_vpc" {
18+
count = var.is_vpc_cluster ? 1 : 0
19+
name = "${var.prefix}-vpc"
20+
resource_group = module.resource_group.resource_group_id
21+
tags = var.resource_tags
2722
}
2823

29-
resource "ibm_is_subnet" "subnet_zone_1" {
30-
name = "${var.prefix}-subnet-1"
31-
vpc = ibm_is_vpc.vpc.id
32-
resource_group = module.resource_group.resource_group_id
24+
resource "ibm_is_subnet" "testacc_subnet" {
25+
count = var.is_vpc_cluster ? 1 : 0
26+
name = "${var.prefix}-subnet"
27+
vpc = ibm_is_vpc.example_vpc[0].id
3328
zone = "${var.region}-1"
3429
total_ipv4_address_count = 256
30+
resource_group = module.resource_group.resource_group_id
3531
}
3632

37-
########################################################################################################################
38-
# OCP VPC cluster (single zone)
39-
########################################################################################################################
40-
33+
# Lookup the current default kube version
34+
data "ibm_container_cluster_versions" "cluster_versions" {}
4135
locals {
42-
cluster_vpc_subnets = {
43-
default = [
44-
{
45-
id = ibm_is_subnet.subnet_zone_1.id
46-
cidr_block = ibm_is_subnet.subnet_zone_1.ipv4_cidr_block
47-
zone = ibm_is_subnet.subnet_zone_1.zone
48-
}
49-
]
50-
}
36+
default_version = data.ibm_container_cluster_versions.cluster_versions.default_kube_version
37+
}
5138

52-
worker_pools = [
53-
{
54-
subnet_prefix = "default"
55-
pool_name = "default" # ibm_container_vpc_cluster automatically names default pool "default" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
56-
machine_type = "bx2.4x16"
57-
operating_system = "REDHAT_8_64"
58-
workers_per_zone = 2 # minimum of 2 is allowed when using single zone
59-
}
60-
]
39+
resource "ibm_container_vpc_cluster" "cluster" {
40+
count = var.is_vpc_cluster ? 1 : 0
41+
name = var.prefix
42+
vpc_id = ibm_is_vpc.example_vpc[0].id
43+
kube_version = local.default_version
44+
flavor = "bx2.4x16"
45+
worker_count = "2"
46+
force_delete_storage = true
47+
wait_till = "IngressReady"
48+
zones {
49+
subnet_id = ibm_is_subnet.testacc_subnet[0].id
50+
name = "${var.region}-1"
51+
}
52+
resource_group_id = module.resource_group.resource_group_id
53+
tags = var.resource_tags
6154
}
6255

63-
module "ocp_base" {
64-
source = "terraform-ibm-modules/base-ocp-vpc/ibm"
65-
version = "3.52.0"
56+
resource "ibm_container_cluster" "cluster" {
57+
#checkov:skip=CKV2_IBM_7:Public endpoint is required for testing purposes
58+
count = var.is_vpc_cluster ? 0 : 1
59+
name = var.prefix
60+
datacenter = var.datacenter
61+
default_pool_size = 2
62+
hardware = "shared"
63+
kube_version = local.default_version
64+
force_delete_storage = true
65+
machine_type = "b3c.4x16"
66+
public_vlan_id = ibm_network_vlan.public_vlan[0].id
67+
private_vlan_id = ibm_network_vlan.private_vlan[0].id
68+
wait_till = "Normal"
6669
resource_group_id = module.resource_group.resource_group_id
67-
region = var.region
6870
tags = var.resource_tags
69-
cluster_name = var.prefix
70-
force_delete_storage = true
71-
vpc_id = ibm_is_vpc.vpc.id
72-
vpc_subnets = local.cluster_vpc_subnets
73-
worker_pools = local.worker_pools
71+
72+
timeouts {
73+
delete = "2h"
74+
create = "3h"
75+
}
76+
}
77+
78+
locals {
79+
cluster_name_id = var.is_vpc_cluster ? ibm_container_vpc_cluster.cluster[0].id : ibm_container_cluster.cluster[0].id
80+
}
81+
82+
resource "ibm_network_vlan" "public_vlan" {
83+
count = var.is_vpc_cluster ? 0 : 1
84+
datacenter = var.datacenter
85+
type = "PUBLIC"
86+
}
87+
88+
resource "ibm_network_vlan" "private_vlan" {
89+
count = var.is_vpc_cluster ? 0 : 1
90+
datacenter = var.datacenter
91+
type = "PRIVATE"
7492
}
7593

7694
data "ibm_container_cluster_config" "cluster_config" {
77-
cluster_name_id = module.ocp_base.cluster_id
95+
cluster_name_id = local.cluster_name_id
7896
resource_group_id = module.resource_group.resource_group_id
7997
}
8098

@@ -85,30 +103,46 @@ resource "time_sleep" "wait_operators" {
85103
}
86104

87105
##############################################################################
88-
# Monitoring Instance
106+
# Monitoring instance
89107
##############################################################################
90108

91109
module "cloud_monitoring" {
92-
source = "terraform-ibm-modules/observability-instances/ibm//modules/cloud_monitoring"
93-
version = "3.5.3"
94-
instance_name = "${var.prefix}-cloud-monitoring"
95-
resource_group_id = module.resource_group.resource_group_id
96-
region = var.region
97-
plan = "graduated-tier"
98-
enable_platform_metrics = var.enable_platform_metrics
110+
source = "terraform-ibm-modules/cloud-monitoring/ibm"
111+
version = "1.3.0"
112+
instance_name = "${var.prefix}-cloud-monitoring"
113+
resource_group_id = module.resource_group.resource_group_id
114+
resource_tags = var.resource_tags
115+
region = var.region
116+
plan = "graduated-tier"
117+
}
118+
119+
##############################################################################
120+
# SCC Workload Protection instance
121+
##############################################################################
122+
123+
module "scc_wp" {
124+
source = "terraform-ibm-modules/scc-workload-protection/ibm"
125+
version = "1.10.3"
126+
name = "${var.prefix}-scc-wp"
127+
resource_group_id = module.resource_group.resource_group_id
128+
region = var.region
129+
resource_tags = var.resource_tags
130+
cloud_monitoring_instance_crn = module.cloud_monitoring.crn
131+
cspm_enabled = false
99132
}
100133

101134
##############################################################################
102135
# Monitoring Agents
103136
##############################################################################
104137

105138
module "monitoring_agents" {
106-
source = "../.."
107-
depends_on = [time_sleep.wait_operators]
108-
cluster_id = module.ocp_base.cluster_id
139+
source = "../.."
140+
# remove the above line and uncomment the below 2 lines to consume the module from the registry
141+
# source = "terraform-ibm-modules/monitoring-agent/ibm"
142+
# version = "X.Y.Z" # Replace "X.Y.Z" with a release version to lock into a specific release
143+
cluster_id = local.cluster_name_id
109144
cluster_resource_group_id = module.resource_group.resource_group_id
110-
# # Monitoring agent
111-
access_key = module.cloud_monitoring.access_key
112-
cloud_monitoring_instance_region = var.region
113-
enable_universal_ebpf = true
145+
is_vpc_cluster = var.is_vpc_cluster
146+
access_key = module.cloud_monitoring.access_key
147+
instance_region = var.region
114148
}

‎examples/obs-agent-iks/provider.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,13 @@ provider "kubernetes" {
1616
token = data.ibm_container_cluster_config.cluster_config.token
1717
cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config.ca_certificate
1818
}
19+
20+
data "ibm_iam_auth_token" "auth_token" {}
21+
22+
provider "restapi" {
23+
uri = "https://resource-controller.cloud.ibm.com"
24+
headers = {
25+
Authorization = data.ibm_iam_auth_token.auth_token.iam_access_token
26+
}
27+
write_returns_object = true
28+
}

‎examples/obs-agent-iks/variables.tf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,14 @@ variable "region" {
2828
default = "au-syd"
2929
}
3030

31-
variable "enable_platform_metrics" {
31+
variable "is_vpc_cluster" {
3232
type = bool
33-
description = "Enable platform metrics"
34-
default = false
33+
description = "Specify true if the target cluster for the observability agents is a VPC cluster, false if it is classic cluster."
34+
default = true
35+
}
36+
37+
variable "datacenter" {
38+
type = string
39+
description = "If creating a classic cluster, the data center where the cluster is created"
40+
default = "syd01"
3541
}

‎examples/obs-agent-iks/version.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
required_providers {
77
ibm = {
88
source = "ibm-cloud/ibm"
9-
version = "1.79.0"
9+
version = "1.79.2"
1010
}
1111
helm = {
1212
source = "hashicorp/helm"
@@ -22,5 +22,10 @@ terraform {
2222
source = "hashicorp/time"
2323
version = ">= 0.9.1"
2424
}
25+
# The restapi provider is not actually required by the module itself, just this example, so OK to use ">=" here instead of locking into a version
26+
restapi = {
27+
source = "Mastercard/restapi"
28+
version = ">= 2.0.1"
29+
}
2530
}
2631
}

‎examples/obs-agent-ocp/.secrets.baseline‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"exclude": {
3+
"files": "^.secrets.baseline$",
4+
"lines": null
5+
},
6+
"generated_at": "2025-07-14T16:51:43Z",
7+
"plugins_used": [
8+
{
9+
"name": "AWSKeyDetector"
10+
},
11+
{
12+
"name": "ArtifactoryDetector"
13+
},
14+
{
15+
"name": "AzureStorageKeyDetector"
16+
},
17+
{
18+
"base64_limit": 4.5,
19+
"name": "Base64HighEntropyString"
20+
},
21+
{
22+
"name": "BasicAuthDetector"
23+
},
24+
{
25+
"name": "BoxDetector"
26+
},
27+
{
28+
"name": "CloudantDetector"
29+
},
30+
{
31+
"ghe_instance": "github.ibm.com",
32+
"name": "GheDetector"
33+
},
34+
{
35+
"name": "GitHubTokenDetector"
36+
},
37+
{
38+
"hex_limit": 3,
39+
"name": "HexHighEntropyString"
40+
},
41+
{
42+
"name": "IbmCloudIamDetector"
43+
},
44+
{
45+
"name": "IbmCosHmacDetector"
46+
},
47+
{
48+
"name": "JwtTokenDetector"
49+
},
50+
{
51+
"keyword_exclude": null,
52+
"name": "KeywordDetector"
53+
},
54+
{
55+
"name": "MailchimpDetector"
56+
},
57+
{
58+
"name": "NpmDetector"
59+
},
60+
{
61+
"name": "PrivateKeyDetector"
62+
},
63+
{
64+
"name": "SlackDetector"
65+
},
66+
{
67+
"name": "SoftlayerDetector"
68+
},
69+
{
70+
"name": "SquareOAuthDetector"
71+
},
72+
{
73+
"name": "StripeDetector"
74+
},
75+
{
76+
"name": "TwilioKeyDetector"
77+
}
78+
],
79+
"results": {},
80+
"version": "0.13.1+ibm.62.dss",
81+
"word_list": {
82+
"file": null,
83+
"hash": null
84+
}
85+
}

0 commit comments

Comments
 (0)