Skip to content

Commit 1182990

Browse files
AchimHaaser1stafaniasajusurajsbharadwaj
authored
feat: enable monitoring solution (#961)
BREAKING CHANGE: recreate intel VSI due to VNI change and security group reorg Co-authored-by: stafaniasaju <[email protected]> Co-authored-by: surajsbharadwaj <[email protected]> Co-authored-by: surajsbharadwaj <[email protected]>
1 parent 18bf9d5 commit 1182990

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+865
-468
lines changed

‎.secrets.baseline‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2024-10-31T13:54:05Z",
6+
"generated_at": "2024-11-26T11:58:55Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -82,23 +82,23 @@
8282
"hashed_secret": "91199272d5d6a574a51722ca6f3d1148edb1a0e7",
8383
"is_secret": false,
8484
"is_verified": false,
85-
"line_number": 43,
85+
"line_number": 46,
8686
"type": "Secret Keyword",
8787
"verified_result": null
8888
},
8989
{
9090
"hashed_secret": "a67ef662b9a11a96b15936764d77e118c9f155dd",
9191
"is_secret": false,
9292
"is_verified": false,
93-
"line_number": 56,
93+
"line_number": 59,
9494
"type": "Secret Keyword",
9595
"verified_result": null
9696
},
9797
{
9898
"hashed_secret": "6aa42ddb8d86de967d322e6fdde293bf1344c852",
9999
"is_secret": false,
100100
"is_verified": false,
101-
"line_number": 71,
101+
"line_number": 74,
102102
"type": "Secret Keyword",
103103
"verified_result": null
104104
}

‎cra-config.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
version: "v1"
22
CRA_TARGETS:
33
- CRA_TARGET: "solutions/standard"
4-
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
4+
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"
66
CRA_ENVIRONMENT_VARIABLES:
77
TF_VAR_prefix: "cra-infra"
88
TF_VAR_powervs_zone: "syd05"
99
TF_VAR_powervs_resource_group_name: "Default"
1010
TF_VAR_external_access_ip: "0.0.0.0/0"
11-
TF_VAR_ssh_public_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDb8qoH4U47+79ssT6FdsOIxxZY8/oxWc66WPwqHfpjCgDRP3Rc1uq2YEKIRJba2DzNFnf+byinH0O9hwjKZ/3l7HxNtvQZXdCnT79TOT/wGbcHBV8ZUTBkUOx67ryS0F5bKDdMDWdsWkMXkRb8AAsJWLAeuFsfMYQjMBLmvrMsRRB6GG+97jF18ghqHjuBTX1FNF9fcytEaz7WfP8KrgSYRcQOauIVlMJyOmh3gZl84u14SXwQKhQrdvqt47ZErKH+fbsgxfOvvmYgr5RktKjbmi+lyBkxRM7//BaKcPw5saThf1MiEesJxIqyL16DW9LXdWei74xHNuF65K03y975Qr9CtPkr1rGgxwU2ksqLy1NN5TnF4erd1VSuLZ5BLov7JRJ2K17ttt0agp9VmkjRFIivOek=
11+
TF_VAR_ssh_public_key:
12+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDb8qoH4U47+79ssT6FdsOIxxZY8/oxWc66WPwqHfpjCgDRP3Rc1uq2YEKIRJba2DzNFnf+byinH0O9hwjKZ/3l7HxNtvQZXdCnT79TOT/wGbcHBV8ZUTBkUOx67ryS0F5bKDdMDWdsWkMXkRb8AAsJWLAeuFsfMYQjMBLmvrMsRRB6GG+97jF18ghqHjuBTX1FNF9fcytEaz7WfP8KrgSYRcQOauIVlMJyOmh3gZl84u14SXwQKhQrdvqt47ZErKH+fbsgxfOvvmYgr5RktKjbmi+lyBkxRM7//BaKcPw5saThf1MiEesJxIqyL16DW9LXdWei74xHNuF65K03y975Qr9CtPkr1rGgxwU2ksqLy1NN5TnF4erd1VSuLZ5BLov7JRJ2K17ttt0agp9VmkjRFIivOek=
1213
some-user@testing-box"
1314
TF_VAR_ssh_private_key: "some_key"
15+
TF_VAR_enable_monitoring: true

‎ibm_catalog.json‎

Lines changed: 64 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -216,30 +216,34 @@
216216
"key": "powervs_image_names",
217217
"required": true
218218
},
219+
{
220+
"key": "enable_monitoring",
221+
"required": true
222+
},
219223
{
220224
"key": "powervs_custom_images",
221225
"custom_config": {
222-
"grouping": "deployment",
223-
"original_grouping": "deployment",
224-
"type": "json_editor"
226+
"grouping": "deployment",
227+
"original_grouping": "deployment",
228+
"type": "json_editor"
225229
}
226230
},
227231
{
228232
"key": "powervs_custom_image_cos_configuration",
229233
"custom_config": {
230-
"grouping": "deployment",
231-
"original_grouping": "deployment",
232-
"type": "json_editor"
234+
"grouping": "deployment",
235+
"original_grouping": "deployment",
236+
"type": "json_editor"
233237
}
234238
},
235239
{
236240
"key": "powervs_custom_image_cos_service_credentials",
237241
"type": "multiline_secure_value",
238242
"display_name": "Multiline secure value",
239243
"custom_config": {
240-
"grouping": "deployment",
241-
"original_grouping": "deployment",
242-
"type": "multiline_secure_value"
244+
"grouping": "deployment",
245+
"original_grouping": "deployment",
246+
"type": "multiline_secure_value"
243247
}
244248
},
245249
{
@@ -272,6 +276,9 @@
272276
{
273277
"key": "tags"
274278
},
279+
{
280+
"key": "existing_monitoring_instance_crn"
281+
},
275282
{
276283
"key": "sm_service_plan"
277284
},
@@ -406,6 +413,9 @@
406413
{
407414
"key": "powervs_images"
408415
},
416+
{
417+
"key": "monitoring_instance"
418+
},
409419
{
410420
"key": "schematics_workspace_id"
411421
}
@@ -480,36 +490,32 @@
480490
"description": "No"
481491
},
482492
{
483-
"title": "Number of VPCs",
484-
"description": "1"
485-
},
486-
{
487-
"title": "Number of Intel VSIs",
493+
"title": "Number of Intel Virtual Server Instance",
488494
"description": "2"
489495
},
490496
{
491-
"title": "Separate VPC for management",
492-
"description": "Yes"
497+
"title": "Number of VPCs",
498+
"description": "1"
493499
},
494500
{
495-
"title": "Separate VPC for Network Services",
496-
"description": "Yes"
501+
"title": "Number of Power Virtual Server Workspace",
502+
"description": "1"
497503
},
498504
{
499505
"title": "Increases security with Key Management",
500506
"description": "Yes"
501507
},
502-
{
503-
"title": "Power Virtual Server Workspace",
504-
"description": "PowerVS Workspace with all required components"
505-
},
506508
{
507509
"title": "Internet proxy on VPC",
508510
"description": "Proxy service to reach public internet from PowerVS Workspace"
509511
},
510512
{
511513
"title": "Additional management configurations on VPC",
512514
"description": "NFS as service, NTP forwarder, and DNS forwarder reachable from PowerVS Workspace"
515+
},
516+
{
517+
"title": "Monitoring Instance and Monitoring Intel VSI Host",
518+
"description": "Optional"
513519
}
514520
],
515521
"diagrams": [
@@ -570,6 +576,10 @@
570576
"displayname": "London 06 (lon06)",
571577
"value": "lon06"
572578
},
579+
{
580+
"displayname": "Madrid 02 (mad02)",
581+
"value": "mad02"
582+
},
573583
{
574584
"displayname": "Osaka 21 (osa21)",
575585
"value": "osa21"
@@ -750,6 +760,10 @@
750760
"type": "resource_group"
751761
}
752762
},
763+
{
764+
"key": "enable_monitoring",
765+
"required": true
766+
},
753767
{
754768
"key": "custom_profile_instance_boot_image",
755769
"type": "string",
@@ -862,6 +876,9 @@
862876
{
863877
"key": "tags"
864878
},
879+
{
880+
"key": "existing_monitoring_instance_crn"
881+
},
865882
{
866883
"key": "external_access_ip",
867884
"default_value": "0.0.0.0/0"
@@ -1012,6 +1029,9 @@
10121029
{
10131030
"key": "powervs_storage_configuration"
10141031
},
1032+
{
1033+
"key": "monitoring_instance"
1034+
},
10151035
{
10161036
"key": "schematics_workspace_id"
10171037
}
@@ -1086,36 +1106,32 @@
10861106
"description": "Yes, 1 instance"
10871107
},
10881108
{
1089-
"title": "Number of VPCs",
1090-
"description": "1"
1091-
},
1092-
{
1093-
"title": "Number of Intel VSIs",
1109+
"title": "Number of Intel Virtual Server Instance",
10941110
"description": "2"
10951111
},
10961112
{
1097-
"title": "Separate VPC for management",
1098-
"description": "Yes"
1113+
"title": "Number of VPCs",
1114+
"description": "1"
10991115
},
11001116
{
1101-
"title": "Separate VPC for Network Services",
1102-
"description": "Yes"
1117+
"title": "Number of Power Virtual Server Workspace",
1118+
"description": "1"
11031119
},
11041120
{
11051121
"title": "Increases security with Key Management",
11061122
"description": "Yes"
11071123
},
1108-
{
1109-
"title": "Power Virtual Server Workspace",
1110-
"description": "PowerVS Workspace with all required components"
1111-
},
11121124
{
11131125
"title": "Internet proxy on VPC",
11141126
"description": "Proxy service to reach public internet from PowerVS Workspace"
11151127
},
11161128
{
11171129
"title": "Additional management configurations on VPC",
1118-
"description": "NFS server, NTP forwarder, and DNS forwarder reachable from PowerVS Workspace"
1130+
"description": "NFS as service, NTP forwarder, and DNS forwarder reachable from PowerVS Workspace"
1131+
},
1132+
{
1133+
"title": "Monitoring Instance and Monitoring Intel VSI Host",
1134+
"description": "Optional"
11191135
}
11201136
],
11211137
"diagrams": [
@@ -1604,27 +1620,27 @@
16041620
{
16051621
"key": "powervs_custom_images",
16061622
"custom_config": {
1607-
"grouping": "deployment",
1608-
"original_grouping": "deployment",
1609-
"type": "json_editor"
1623+
"grouping": "deployment",
1624+
"original_grouping": "deployment",
1625+
"type": "json_editor"
16101626
}
16111627
},
16121628
{
16131629
"key": "powervs_custom_image_cos_configuration",
16141630
"custom_config": {
1615-
"grouping": "deployment",
1616-
"original_grouping": "deployment",
1617-
"type": "json_editor"
1631+
"grouping": "deployment",
1632+
"original_grouping": "deployment",
1633+
"type": "json_editor"
16181634
}
16191635
},
16201636
{
16211637
"key": "powervs_custom_image_cos_service_credentials",
16221638
"type": "multiline_secure_value",
16231639
"display_name": "Multiline secure value",
16241640
"custom_config": {
1625-
"grouping": "deployment",
1626-
"original_grouping": "deployment",
1627-
"type": "multiline_secure_value"
1641+
"grouping": "deployment",
1642+
"original_grouping": "deployment",
1643+
"type": "multiline_secure_value"
16281644
}
16291645
},
16301646
{
@@ -1701,6 +1717,9 @@
17011717
{
17021718
"key": "powervs_images"
17031719
},
1720+
{
1721+
"key": "monitoring_instance"
1722+
},
17041723
{
17051724
"key": "schematics_workspace_id"
17061725
}

‎modules/powervs-vpc-landing-zone/README.md‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@
44

55
This module provisions the following resources in IBM Cloud:
66
- A **VPC Infrastructure** with the following components:
7-
- One VSI for one management (jump/bastion) VSI,
7+
- One VSI for management (jump/bastion) VSI,
88
- One VSI for network-services configured as squid proxy, NTP and DNS servers(using Ansible Galaxy collection roles [ibm.power_linux_sap collection](https://galaxy.ansible.com/ui/repo/published/ibm/power_linux_sap/). This VSI also acts as central ansible execution node.
9+
- Optional VSI for Monitoring host
910
- Optional [Client to site VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview)
1011
- Optional [File storage share](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create&interface=ui)
1112
- Optional [Application load balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers&interface=ui)
@@ -16,7 +17,9 @@ This module provisions the following resources in IBM Cloud:
1617
- Activity tracker
1718
- Optional Secrets Manager Instance Instance with private certificate.
1819

20+
1921
- A local or global **transit gateway**
22+
- An optional IBM Cloud Monitoring Instance
2023

2124
- A **Power Virtual Server** workspace with the following network topology:
2225
- Creates two private networks: a management network and a backup network.
@@ -73,6 +76,8 @@ module "powervs-vpc-landing-zone" {
7376
existing_sm_instance_region = var.existing_sm_instance_region #(optional. default check vars)
7477
certificate_template_name = var.certificate_template_name #(optional. default check vars)
7578
network_services_vsi_profile = var.network_services_vsi_profile #(optional. default check vars)
79+
enable_monitoring = var.enable_monitoring #(optional. default true)
80+
existing_monitoring_instance_crn = var.existing_monitoring_instance_crn #(optional. default null)
7681
}
7782
```
7883

@@ -101,9 +106,10 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr
101106

102107
| Name | Source | Version |
103108
|------|--------|---------|
104-
| <a name="module_client_to_site_vpn"></a> [client\_to\_site\_vpn](#module\_client\_to\_site\_vpn) | terraform-ibm-modules/client-to-site-vpn/ibm | 1.7.23 |
109+
| <a name="module_client_to_site_vpn"></a> [client\_to\_site\_vpn](#module\_client\_to\_site\_vpn) | terraform-ibm-modules/client-to-site-vpn/ibm | 1.7.24 |
110+
| <a name="module_configure_monitoring_host"></a> [configure\_monitoring\_host](#module\_configure\_monitoring\_host) | ./submodules/ansible | n/a |
105111
| <a name="module_configure_network_services"></a> [configure\_network\_services](#module\_configure\_network\_services) | ./submodules/ansible | n/a |
106-
| <a name="module_landing_zone"></a> [landing\_zone](#module\_landing\_zone) | terraform-ibm-modules/landing-zone/ibm//patterns//vsi//module | 6.2.2 |
112+
| <a name="module_landing_zone"></a> [landing\_zone](#module\_landing\_zone) | terraform-ibm-modules/landing-zone/ibm//patterns//vsi//module | 6.4.0 |
107113
| <a name="module_powervs_workspace"></a> [powervs\_workspace](#module\_powervs\_workspace) | terraform-ibm-modules/powervs-workspace/ibm | 2.2.0 |
108114
| <a name="module_private_secret_engine"></a> [private\_secret\_engine](#module\_private\_secret\_engine) | terraform-ibm-modules/secrets-manager-private-cert-engine/ibm | 1.3.4 |
109115
| <a name="module_secrets_manager_group"></a> [secrets\_manager\_group](#module\_secrets\_manager\_group) | terraform-ibm-modules/secrets-manager-secret-group/ibm | 1.2.2 |
@@ -116,6 +122,7 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr
116122
|------|------|
117123
| [ibm_is_vpc_address_prefix.vpn_address_prefix](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpc_address_prefix) | resource |
118124
| [ibm_is_vpc_routing_table.transit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpc_routing_table) | resource |
125+
| [ibm_resource_instance.monitoring_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_instance) | resource |
119126
| [ibm_resource_instance.secrets_manager](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_instance) | resource |
120127

121128
### Inputs
@@ -128,6 +135,8 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr
128135
| <a name="input_configure_nfs_server"></a> [configure\_nfs\_server](#input\_configure\_nfs\_server) | Specify if NFS server will be configured. This will allow you easily to share files between PowerVS instances (e.g., SAP installation files). [File storage share and mount target](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create&interface=ui) in VPC will be created.. If yes, ensure 'nfs\_server\_config' optional variable is set properly below. Default value is '200GB' which will be mounted on specified directory in network-service vsi. | `bool` | `false` | no |
129136
| <a name="input_configure_ntp_forwarder"></a> [configure\_ntp\_forwarder](#input\_configure\_ntp\_forwarder) | Specify if NTP forwarder will be configured. This will allow you to synchronize time between IBM PowerVS instances. NTP forwarder will be installed on the network-services vsi. | `bool` | `false` | no |
130137
| <a name="input_dns_forwarder_config"></a> [dns\_forwarder\_config](#input\_dns\_forwarder\_config) | Configuration for the DNS forwarder to a DNS service that is not reachable directly from PowerVS. | <pre>object({<br/> dns_servers = string<br/> })</pre> | <pre>{<br/> "dns_servers": "161.26.0.7; 161.26.0.8; 9.9.9.9;"<br/>}</pre> | no |
138+
| <a name="input_enable_monitoring"></a> [enable\_monitoring](#input\_enable\_monitoring) | Specify whether Monitoring will be enabled. This includes the creation of an IBM Cloud Monitoring Instance and an Intel Monitoring Instance to host the services. If you already have an existing monitoring instance then specify in optional parameter 'existing\_monitoring\_instance\_crn'. | `bool` | `true` | no |
139+
| <a name="input_existing_monitoring_instance_crn"></a> [existing\_monitoring\_instance\_crn](#input\_existing\_monitoring\_instance\_crn) | Existing CRN of IBM Cloud Monitoring Instance. If value is null, then an IBM Cloud Monitoring Instance will not be created but an intel VSI instance will be created if 'enable\_monitoring' is true. | `string` | `null` | no |
131140
| <a name="input_existing_sm_instance_guid"></a> [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | An existing Secrets Manager GUID. The existing Secret Manager instance must have private certificate engine configured. If not provided an new instance will be provisioned. | `string` | `null` | no |
132141
| <a name="input_existing_sm_instance_region"></a> [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Required if value is passed into `var.existing_sm_instance_guid`. | `string` | `null` | no |
133142
| <a name="input_external_access_ip"></a> [external\_access\_ip](#input\_external\_access\_ip) | Specify the source IP address or CIDR for login through SSH to the environment after deployment. Access to the environment will be allowed only from this IP address. Can be set to 'null' if you choose to use client to site vpn. | `string` | n/a | yes |
@@ -155,6 +164,7 @@ Creates VPC Landing Zone | Performs VPC VSI OS Config | Creates PowerVS Infrastr
155164
| <a name="output_access_host_or_ip"></a> [access\_host\_or\_ip](#output\_access\_host\_or\_ip) | Access host(jump/bastion) for created PowerVS infrastructure. |
156165
| <a name="output_ansible_host_or_ip"></a> [ansible\_host\_or\_ip](#output\_ansible\_host\_or\_ip) | Central Ansible node private IP address. |
157166
| <a name="output_dns_host_or_ip"></a> [dns\_host\_or\_ip](#output\_dns\_host\_or\_ip) | DNS forwarder host for created PowerVS infrastructure. |
167+
| <a name="output_monitoring_instance"></a> [monitoring\_instance](#output\_monitoring\_instance) | Details of the IBM Cloud Monitoring Instance: CRN, location, guid |
158168
| <a name="output_network_services_config"></a> [network\_services\_config](#output\_network\_services\_config) | Complete configuration of network management services. |
159169
| <a name="output_nfs_host_or_ip_path"></a> [nfs\_host\_or\_ip\_path](#output\_nfs\_host\_or\_ip\_path) | NFS host for created PowerVS infrastructure. |
160170
| <a name="output_ntp_host_or_ip"></a> [ntp\_host\_or\_ip](#output\_ntp\_host\_or\_ip) | NTP host for created PowerVS infrastructure. |

‎modules/powervs-vpc-landing-zone/client2sitevpn.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ module "secrets_manager_private_certificate" {
122122
# Create client to site VPN Server
123123
module "client_to_site_vpn" {
124124
source = "terraform-ibm-modules/client-to-site-vpn/ibm"
125-
version = "1.7.23"
125+
version = "1.7.24"
126126
providers = { ibm = ibm.ibm-is }
127127
count = var.client_to_site_vpn.enable ? 1 : 0
128128

0 commit comments

Comments
 (0)