Feat: Add Service to Service Authorisation DA #282

dishankkalra23 · 2025-10-08T09:14:46Z

Description

This PR adds Service to Service Authorisation DA in existing module

Issue

#281

Release required?

No release
Patch release (x.x.X)
Minor release (x.X.x)
Major release (X.x.x)

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

If relevant, a test for the change is included or updated with this PR.
If relevant, documentation for the change is included or updated with this PR.

For mergers

Use a conventional commit message to set the release level. Follow the guidelines.
Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
Use the Squash and merge option.

…sage

solutions/fully-configurable/main.tf

solutions/fully-configurable/catalogValidationValues.json.template

dishankkalra23 · 2025-10-15T17:30:18Z

/run pipeline

…leDAInSchematics

dishankkalra23 · 2025-10-15T19:08:07Z

/run pipeline

toddgiguere · 2025-10-16T17:51:47Z

Upgrade test failed which is expected, this PR is already a known breaking change. Due to the renaming of the terraform resources from an indexed count (integer) to a map key (string), it is causing upgrade test to destroy and recreate all policies:

module.service_auth_cbr_rules.ibm_iam_authorization_policy.auth_policies[0] will be destroyed
module.service_auth_cbr_rules.ibm_iam_authorization_policy.auth_policies[1] will be destroyed

module.service_auth_cbr_rules.ibm_iam_authorization_policy.auth_policies["test-policy-1"] will be created
module.service_auth_cbr_rules.ibm_iam_authorization_policy.auth_policies["test-policy-2"] will be created

We will skip upgrade test from this point on.

this change has a known breaking change, skipping any upgrade tests SKIP UPGRADE TEST

toddgiguere · 2025-10-16T17:54:42Z

/run pipeline

toddgiguere · 2025-10-16T21:46:12Z

/run pipeline

ocofaigh

You need to onboard this to the catalog pipeline..

Add a file called .catalog-onboard-pipeline.yaml The catalog ID is 7df1e4ca-d54c-4fd0-82ce-3d13247308cd and the offering ID is 51b92aab-bbf2-489e-b462-bf7bd547961b (see other DA repos for examples of this file)
Update the .releaserc to trigger the pipeline for every new release generated. Add this line -> https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/d11524626244fea3be600a526fa109783c4b88c5/.releaserc#L14-L16

variables.tf

README.md

tests/pr_test.go

solutions/fully-configurable/variables.tf

ocofaigh · 2025-10-17T08:01:19Z

solutions/fully-configurable/variables.tf

+variable "prefix" {
+  type        = string
+  nullable    = true
+  description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-cbr. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)."


please follow the guidance here for prefix input

Updated var.prefix

@ocofaigh Regarding the prefix variable, it is safe to remove prefix from the DA as it is not used in the creation of the auth policy. It was only referenced in cbr_rules here which we have already disabled by default here.

ocofaigh · 2025-10-17T08:06:05Z

ibm_catalog.json

+            },
+            {
+              "key": "service_map",
+              "required": true


please use the HCL editor for this

@ocofaigh what's the type for hcl editor? is it "code_editor"?

ibm_catalog.json

ocofaigh · 2025-10-17T08:08:11Z

examples/basic/variables.tf

  default     = null
 }
+
+variable "enable_cbr" {


No need to expose this in the example as a variable. Just set it to false in the main.tf of the example. We don't want examples to become flexible solutions

examples/complete/variables.tf

solutions/fully-configurable/catalogValidationValues.json.template

Co-authored-by: Conall Ó Cofaigh <[email protected]>

dishankkalra23 · 2025-10-17T14:15:17Z

/run pipeline

dishankkalra23 · 2025-10-17T16:41:07Z

/run pipeline

ocofaigh · 2025-10-17T16:45:28Z

solutions/fully-configurable/variables.tf

+##############################################################################
+
+variable "service_map" {
+  description = "Map of unique service pairs and their authorization config."


This is a complex object - consumers of the DA will not know the required format. A helper markdown doc is required that this description should link to. For example -> https://github.com/terraform-ibm-modules/terraform-ibm-kms-all-inclusive/blob/main/solutions/fully-configurable/DA-keys.md

Can we get an initial release of the DA and later I can add the helper doc after coming from leave next week?

ocofaigh

Left another comment - please stop triggering pipeline until it has been approved

dishankkalra23 · 2025-10-17T17:22:07Z

/run pipeline

dishankkalra23 · 2025-10-17T17:22:40Z

Left another comment - please stop triggering pipeline until it has been approved

Just saw the comment after triggering it.

terraform-ibm-modules-ops · 2025-10-17T17:55:36Z

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

GitHub release
v2.0.0

Your semantic-release bot 📦🚀

Dishank-Kalra1 added 2 commits October 8, 2025 14:36

feat: add s2s auth DA

cbbbb7a

fix: pre-commit failures

9eb5137

dishankkalra23 mentioned this pull request Oct 8, 2025

Create s2s authorisation DA #281

Closed

test: add TestFullyConfigurableDAInSchematics

b1cc05b

dishankkalra23 marked this pull request as ready for review October 9, 2025 02:34

dishankkalra23 requested review from MatthewLemmond and toddgiguere as code owners October 9, 2025 02:34

Dishank-Kalra1 and others added 4 commits October 9, 2025 08:31

fix: pre-commit failure

104e274

add support for cross account s2s auth and update count to for_each u…

b68dd16

…sage

update: add index for creating same policy

ff242cc

update: service_map_by_key

6fc2145

dishankkalra23 self-assigned this Oct 13, 2025

dishankkalra23 added the ready-for-review PR is ready for review label Oct 13, 2025

dishankkalra23 added 2 commits October 13, 2025 23:55

fix: pre-commit failure

5e329dd

update: service_map schema and disable the CBR in DA

b69e12e

toddgiguere requested changes Oct 14, 2025

View reviewed changes

solutions/fully-configurable/main.tf Outdated Show resolved Hide resolved

solutions/fully-configurable/catalogValidationValues.json.template Outdated Show resolved Hide resolved

dishankkalra23 added 3 commits October 15, 2025 21:30

fix: rename module and fix output value

22e617c

update: service_map schema

5eed8cc

test: update TestFullyConfigurableDAInSchematics

41efd60

update: catalogValidationValues.json.template and TestFullyConfigurab…

af7401f

…leDAInSchematics

dishankkalra23 added 3 commits October 16, 2025 20:03

update: s2s auth reference architecture

b9d5531

update: s2s image

a6922c9

fix: add url in catalog.json

ca6f527

chore: skipping upgrade tests

cfe6746

this change has a known breaking change, skipping any upgrade tests SKIP UPGRADE TEST

docs: add major version migration notes

70e35f8

toddgiguere previously approved these changes Oct 16, 2025

View reviewed changes

ocofaigh requested changes Oct 17, 2025

View reviewed changes

Update ibm_catalog.json

59e2646

Co-authored-by: Conall Ó Cofaigh <[email protected]>

dishankkalra23 dismissed toddgiguere’s stale review via 59e2646 October 17, 2025 08:27

dishankkalra23 added 10 commits October 17, 2025 18:27

update: add .catalog-onboard-pipeline.yaml and update .releaserc

b9f5eb1

update: description of var.enable_cbr

64bcf23

add: new file to add migration notes

5145c49

test: add TestRunUpgradeFullyConfigurableDAInSchematics

bec1e4b

fix: remove var.region from DA

5d7046d

update: var.prefix

208b579

upadte: ibm_catalog.json

b406fb8

update: ibm_catalog.json

900edf9

update: enforce CBR in examples - basic and complete

93820c1

fix: update service_map catalogValidationValues

66fc870

fix: resolve review comments

a0c2096

ocofaigh reviewed Oct 17, 2025

View reviewed changes

ocofaigh requested changes Oct 17, 2025

View reviewed changes

test: remove prefix variable

c114d07

ocofaigh approved these changes Oct 17, 2025

View reviewed changes

ocofaigh merged commit 0daf93b into main Oct 17, 2025
2 checks passed

ocofaigh deleted the issue-281 branch October 17, 2025 17:54

terraform-ibm-modules-ops added the released label Oct 17, 2025

ocofaigh mentioned this pull request Oct 17, 2025

s2s auth DA required helper doc for complex input #283

Open

Uh oh!

Feat: Add Service to Service Authorisation DA #282

Feat: Add Service to Service Authorisation DA #282

Uh oh!

Conversation

dishankkalra23 commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Release required?

Release notes content

Run the pipeline

Checklist for reviewers

For mergers

Uh oh!

Uh oh!

Uh oh!

dishankkalra23 commented Oct 15, 2025

Uh oh!

dishankkalra23 commented Oct 15, 2025

Uh oh!

toddgiguere commented Oct 16, 2025

Uh oh!

toddgiguere commented Oct 16, 2025

Uh oh!

toddgiguere commented Oct 16, 2025

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dishankkalra23 commented Oct 17, 2025

Uh oh!

dishankkalra23 commented Oct 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

dishankkalra23 commented Oct 17, 2025

Uh oh!

dishankkalra23 commented Oct 17, 2025

Uh oh!

Uh oh!

terraform-ibm-modules-ops commented Oct 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dishankkalra23 commented Oct 8, 2025 •

edited

Loading