feat: gpg

solutions/banking/main.tf

@@ -46,6 +46,15 @@ module "secrets_manager_secret_ibm_iam" {
   endpoint_type           = var.secrets_manager_endpoint_type
 }
 
+# generate signing key if it is not provided.
+module "gpg_signing_key" {
+  count = var.signing_key == null ? 1 : 0
+
+  source    = "git::[email protected]:terraform-ibm-modules/terraform-ibm-devsecops-infrastructure.git//gpg-key?ref=v1.3.0"
+  gpg_name  = var.gpg_name
+  gpg_email = var.gpg_email
+}
+
 # secrets manager secrets - IBM signing key
 module "secrets_manager_secret_signing_key" {
   providers = {
@@ -59,7 +68,7 @@ module "secrets_manager_secret_signing_key" {
   secret_name             = "signing-key"
   secret_description      = "IBM Signing GPG key"
   secret_type             = "arbitrary" #checkov:skip=CKV_SECRET_6
-  secret_payload_password = var.signing_key
+  secret_payload_password = var.signing_key == null ? module.gpg_signing_key[0].gpg_key : var.signing_key
   endpoint_type           = var.secrets_manager_endpoint_type
 }
 

solutions/banking/variables.tf

@@ -96,11 +96,23 @@ variable "watson_machine_learning_instance_resource_name" {
 }
 
 variable "signing_key" {
-  description = "Signing GPG key."
+  description = "Signing GPG key. If it is not provided by the user, then automation will create one."
   type        = string
   sensitive   = true
 }
 
+variable "gpg_name" {
+  type        = string
+  description = "The name to be associated with the GPG key."
+  default     = "IBMer"
+}
+
+variable "gpg_email" {
+  type        = string
+  description = "The email address associated with the GPG key."
+  default     = "[email protected]"
+}
+
 variable "create_secrets" {
   description = "Create Secrets in the existing Secrets Manager instance."
   type        = bool