feat: scc workload protection DA #181

jor2 · 2025-02-20T03:17:14Z

Description

Currently the SCC Workload Protection service is provisioned (optionally) as part of the SCC DA.

We want to split it into its own DA. The code should live in the module repo: https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection

After doing this, we should remove support for Workload Protections from the SCC DA, and instead leverage add-ons to make it an optional addon.
We might also want to consider moving the SCC DA code from terraform-ibm-scc-da into the terraform-ibm-scc and remove the scc-da specific repo.

Release required?

No release
Patch release (x.x.X)
Minor release (x.X.x)
Major release (X.x.x)

Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

If relevant, a test for the change is included or updated with this PR.
If relevant, documentation for the change is included or updated with this PR.

For mergers

Use a conventional commit message to set the release level. Follow the guidelines.
Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
Use the Squash and merge option.

jor2 · 2025-02-20T05:59:43Z

/run pipeline

ocofaigh

Can you add the ibm_catalog.json and .catalog-onboard-pipeline.yaml files please? Also I think we should name the variation Baseline instead of Standard as it looks like this is the naming convention we are going it. In parallel I am trying to get confirmation n that

solutions/standard/main.tf

solutions/standard/variables.tf

tests/pr_test.go

ocofaigh

A few more comments. Also when creating the ibm_catalog.json make sure to follow all the best practises we are rolling out as per https://github.ibm.com/GoldenEye/issues/issues/12542. There is a reference PR which you can copy the approach in (its still under review, but you can see the review comments)

solutions/standard/variables.tf

tests/pr_test.go

solutions/standard/README.md

ocofaigh

See latest comments.

ibm_catalog.json

solutions/standard/cbr-rules.md

solutions/standard/variables.tf

.catalog-onboard-pipeline.yaml

ibm_catalog.json

solutions/standard/variables.tf

ocofaigh

@jor2 still several things to address. See comments.
Also we should not be using display_name in the catalog json - please remove them.

In the diagram update Monitoring -> Existing Monitoring instance and on the arrow, put "metrics" on it

ocofaigh · 2025-03-13T14:09:55Z

tests/pr_test.go

-	options := setupOptions(t, "scc-wp-upg", advancedExampleDir)
+	var region = validRegions[rand.IntN(len(validRegions))]
+
+	options := testhelper.TestOptionsDefault(&testhelper.TestOptions{


Can we use the new schematics upgrade test instead? All DA tests should use schematics

tests/pr_test.go

ocofaigh · 2025-03-13T14:13:19Z

tests/pr_test.go

-const advancedExampleDir = "examples/advanced"
-const basicExampleDir = "examples/basic"
+const resourceGroup = "geretain-test-resources"
+const standardSolutionDir = "solutions/standard"


This should be solutions/fully-configurable

ocofaigh · 2025-03-13T14:15:33Z

tests/other_tests.go

+	assert.NotNil(t, output, "Expected some output")
+}
+
+func TestRunAdvancedUpgradeExample(t *testing.T) {


This should be a normal test - not upgrade test

ocofaigh · 2025-03-13T14:18:06Z

solutions/fully-configurable/variables.tf

+variable "scc_workload_protection_instance_name" {
+  description = "The name for the Workload Protection instance that is created by this solution. Must begin with a letter. Applies only if `provision_scc_workload_protection` is true. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
+  type        = string
+  default     = "workload_protection"


scc-workload-protection

ocofaigh · 2025-03-13T14:28:35Z

ibm_catalog.json

+        ],
+        "short_description": "Creates and configures IBM Security and Compliance Center resources",
+        "long_description": "This architecture supports creating and configuring IBM Security and Compliance Center resources.",
+        "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/blob/main/solutions/instances/README.md",


wrong directory

ocofaigh · 2025-03-13T14:28:47Z

ibm_catalog.json

+          "solution"
+        ],
+        "short_description": "Creates and configures IBM Security and Compliance Center resources",
+        "long_description": "This architecture supports creating and configuring IBM Security and Compliance Center resources.",


needs to be updated

ocofaigh · 2025-03-13T14:28:51Z

ibm_catalog.json

+          "terraform",
+          "solution"
+        ],
+        "short_description": "Creates and configures IBM Security and Compliance Center resources",


needs to be updated

ocofaigh · 2025-03-13T14:29:18Z

ibm_catalog.json

+{
+    "products": [
+      {
+        "name": "deploy-arch-ibm-workload-protection",


maybe go with deploy-arch-ibm-scc-workload-protection

ocofaigh · 2025-03-13T14:29:33Z

.catalog-onboard-pipeline.yaml

+---
+apiVersion: v1
+offerings:
+  - name: deploy-arch-ibm-workload-protection


maybe go with deploy-arch-ibm-scc-workload-protection

ocofaigh

Final few comments

ocofaigh · 2025-03-13T16:46:48Z

solutions/fully-configurable/variables.tf

+variable "region" {
+  type        = string
+  default     = "us-south"
+  description = "The region to provision Security and Compliance Center resources in."


@jor2 still needs to be addressed

solutions/fully-configurable/README.md

ocofaigh · 2025-03-13T16:48:07Z

solutions/fully-configurable/README.md

+
+This solution supports provisioning and configuring the following infrastructure:
+
+- A resource group, if one is not passed in.


It does not create a new RG

ocofaigh · 2025-03-13T16:49:52Z

ibm_catalog.json

+        "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/issues](https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/issues). Please note this product is not supported via the IBM Cloud Support Center.",
+        "flavors": [
+          {
+            "label": "Fully Configurable",


Fully configurable

ocofaigh · 2025-03-13T16:50:19Z

.catalog-onboard-pipeline.yaml

+offerings:
+  - name: deploy-arch-ibm-scc-workload-protection
+    kind: solution
+    catalog_id: _


7df1e4ca-d54c-4fd0-82ce-3d13247308cd

ocofaigh · 2025-03-13T16:50:27Z

.catalog-onboard-pipeline.yaml

+  - name: deploy-arch-ibm-scc-workload-protection
+    kind: solution
+    catalog_id: _
+    offering_id: _


4322cf44-2289-49aa-a719-dd79e39b14dc

ocofaigh · 2025-03-13T16:51:11Z

tests/pr_test.go

-const advancedExampleDir = "examples/advanced"
-const basicExampleDir = "examples/basic"
+const resourceGroup = "geretain-test-resources"
+const standardSolutionDir = "solutions/fully-configurable"


standardSolutionDir -> fullyConfigurableDADir

ocofaigh · 2025-03-14T11:51:41Z

/run pipeline

terraform-ibm-modules-ops · 2025-03-14T12:09:41Z

🎉 This PR is included in version 1.5.0 🎉

The release is available on:

GitHub release
v1.5.0

Your semantic-release bot 📦🚀

jor2 self-assigned this Feb 20, 2025

jor2 requested review from akocbek and shemau as code owners February 20, 2025 03:17

feat: scc workload protection DA

78012df

jor2 force-pushed the wp-da branch from 77a6150 to 78012df Compare February 20, 2025 05:58

SKIP UPGRADE TESTS

bd68d59

ocofaigh requested changes Feb 20, 2025

View reviewed changes

solutions/standard/variables.tf Show resolved Hide resolved

tests/pr_test.go Outdated Show resolved Hide resolved

solutions/standard/README.md Outdated Show resolved Hide resolved

Jordan-Williams2 added 6 commits February 21, 2025 12:51

feat: review feedback

dc9d051

feat: review feedback

e217ab8

fix: merge

76770f2

fix: merge

21b1495

fix: merge

07d6527

fix: merge

285d9bc

ocofaigh requested changes Feb 24, 2025

View reviewed changes

.catalog-onboard-pipeline.yaml Outdated Show resolved Hide resolved

.catalog-onboard-pipeline.yaml Outdated Show resolved Hide resolved

ocofaigh reviewed Mar 5, 2025

View reviewed changes

ibm_catalog.json Outdated Show resolved Hide resolved

ocofaigh reviewed Mar 5, 2025

View reviewed changes

solutions/standard/variables.tf Outdated Show resolved Hide resolved

jor2 and others added 3 commits March 6, 2025 13:39

Merge branch 'main' into wp-da

86e0d37

fix: address feedback

215881d

Merge branch 'main' into wp-da

3c19ff4

ocofaigh requested changes Mar 13, 2025

View reviewed changes

Jordan-Williams2 added 2 commits March 13, 2025 15:37

fix: address feedback

58bdd70

fix: address feedback

5ba2b6f

ocofaigh requested changes Mar 13, 2025

View reviewed changes

fix: address feedback

392aebb

ocofaigh mentioned this pull request Mar 14, 2025

Add SCC DA (Fully configurable + Security-enforced variations) terraform-ibm-modules/terraform-ibm-scc#249

Merged

6 tasks

ocofaigh approved these changes Mar 14, 2025

View reviewed changes

ocofaigh merged commit 0c11711 into main Mar 14, 2025
2 checks passed

ocofaigh deleted the wp-da branch March 14, 2025 12:09

terraform-ibm-modules-ops added the released label Mar 14, 2025


		This solution supports provisioning and configuring the following infrastructure:

		- A resource group, if one is not passed in.

feat: scc workload protection DA #181

feat: scc workload protection DA #181

Uh oh!

Conversation

jor2 commented Feb 20, 2025

Description

Release required?

Release notes content

Run the pipeline

Checklist for reviewers

For mergers

Uh oh!

jor2 commented Feb 20, 2025

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ocofaigh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment