Skip to content

Commit a3ff2d3

Browse files
ocofaighocofaigh
authored
fix: cleanup DA inputs (#332)
1 parent 8eb9543 commit a3ff2d3

File tree

6 files changed

+62
-52
lines changed

6 files changed

+62
-52
lines changed

‎cra-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ CRA_TARGETS:
1010
TF_VAR_existing_resource_group_name: "geretain-test-secrets-manager"
1111
TF_VAR_provider_visibility: "public"
1212
TF_VAR_prefix: "test"
13+
TF_VAR_service_plan: "trial"

‎ibm_catalog.json‎

Lines changed: 47 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -121,19 +121,16 @@
121121
"required": true
122122
},
123123
{
124-
"key": "provider_visibility",
124+
"key": "service_plan",
125+
"required": true,
125126
"options": [
126127
{
127-
"displayname": "private",
128-
"value": "private"
129-
},
130-
{
131-
"displayname": "public",
132-
"value": "public"
128+
"displayname": "Standard",
129+
"value": "standard"
133130
},
134131
{
135-
"displayname": "public-and-private",
136-
"value": "public-and-private"
132+
"displayname": "Trial",
133+
"value": "trial"
137134
}
138135
]
139136
},
@@ -150,13 +147,29 @@
150147
}
151148
},
152149
{
153-
"key": "secrets_manager_instance_name"
150+
"key": "provider_visibility",
151+
"hidden": true,
152+
"options": [
153+
{
154+
"displayname": "private",
155+
"value": "private"
156+
},
157+
{
158+
"displayname": "public",
159+
"value": "public"
160+
},
161+
{
162+
"displayname": "public-and-private",
163+
"value": "public-and-private"
164+
}
165+
]
154166
},
155167
{
156-
"key": "existing_secrets_manager_crn"
168+
"key": "secrets_manager_instance_name"
157169
},
158170
{
159171
"key": "secrets_manager_endpoint_type",
172+
"hidden": true,
160173
"options": [
161174
{
162175
"displayname": "public",
@@ -178,19 +191,6 @@
178191
}
179192
}
180193
},
181-
{
182-
"key": "service_plan",
183-
"options": [
184-
{
185-
"displayname": "Standard",
186-
"value": "standard"
187-
},
188-
{
189-
"displayname": "Trial",
190-
"value": "trial"
191-
}
192-
]
193-
},
194194
{
195195
"key": "skip_sm_ce_iam_authorization_policy"
196196
},
@@ -211,8 +211,7 @@
211211
"key": "kms_encryption_enabled"
212212
},
213213
{
214-
"key": "existing_kms_instance_crn",
215-
"required": true
214+
"key": "existing_kms_instance_crn"
216215
},
217216
{
218217
"key": "existing_secrets_manager_kms_key_crn"
@@ -262,6 +261,9 @@
262261
},
263262
{
264263
"key": "secret_groups"
264+
},
265+
{
266+
"key": "existing_secrets_manager_crn"
265267
}
266268
],
267269
"architecture": {
@@ -285,11 +287,11 @@
285287
},
286288
{
287289
"title": "Enforced private-only endpoint communication",
288-
"description": "Yes"
290+
"description": "No"
289291
},
290292
{
291293
"title": "Enforced KMS encryption",
292-
"description": "Yes"
294+
"description": "No"
293295
},
294296
{
295297
"title": "KMS instance creation",
@@ -392,16 +394,27 @@
392394
"key": "prefix",
393395
"required": true
394396
},
397+
{
398+
"key": "service_plan",
399+
"required": true,
400+
"options": [
401+
{
402+
"displayname": "Standard",
403+
"value": "standard"
404+
},
405+
{
406+
"displayname": "Trial",
407+
"value": "trial"
408+
}
409+
]
410+
},
395411
{
396412
"key": "existing_kms_instance_crn",
397413
"required": true
398414
},
399415
{
400416
"key": "secrets_manager_instance_name"
401417
},
402-
{
403-
"key": "existing_secrets_manager_crn"
404-
},
405418
{
406419
"key": "secrets_manager_resource_tags",
407420
"custom_config": {
@@ -412,19 +425,6 @@
412425
}
413426
}
414427
},
415-
{
416-
"key": "service_plan",
417-
"options": [
418-
{
419-
"displayname": "Standard",
420-
"value": "standard"
421-
},
422-
{
423-
"displayname": "Trial",
424-
"value": "trial"
425-
}
426-
]
427-
},
428428
{
429429
"key": "skip_sm_ce_iam_authorization_policy"
430430
},
@@ -475,6 +475,9 @@
475475
},
476476
{
477477
"key": "secret_groups"
478+
},
479+
{
480+
"key": "existing_secrets_manager_crn"
478481
}
479482
],
480483
"architecture": {

‎solutions/fully-configurable/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ This solution supports the following:
7272
| <a name="input_secrets_manager_endpoint_type"></a> [secrets\_manager\_endpoint\_type](#input\_secrets\_manager\_endpoint\_type) | The type of endpoint (public or private) to connect to the Secrets Manager API. The Terraform provider uses this endpoint type to interact with the Secrets Manager API and configure Event Notifications. | `string` | `"private"` | no |
7373
| <a name="input_secrets_manager_instance_name"></a> [secrets\_manager\_instance\_name](#input\_secrets\_manager\_instance\_name) | The name to give the Secrets Manager instance provisioned by this solution. If a prefix input variable is specified, it is added to the value in the `<prefix>-value` format. Applies only if `existing_secrets_manager_crn` is not provided. | `string` | `"secrets-manager"` | no |
7474
| <a name="input_secrets_manager_resource_tags"></a> [secrets\_manager\_resource\_tags](#input\_secrets\_manager\_resource\_tags) | The list of resource tags you want to associate with your Secrets Manager instance. Applies only if `existing_secrets_manager_crn` is not provided. | `list(any)` | `[]` | no |
75-
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. | `string` | `"standard"` | no |
75+
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard). | `string` | n/a | yes |
7676
| <a name="input_skip_event_notifications_iam_authorization_policy"></a> [skip\_event\_notifications\_iam\_authorization\_policy](#input\_skip\_event\_notifications\_iam\_authorization\_policy) | If set to true, this skips the creation of a service to service authorization from Secrets Manager to Event Notifications. If false, the service to service authorization is created. | `bool` | `false` | no |
7777
| <a name="input_skip_sm_ce_iam_authorization_policy"></a> [skip\_sm\_ce\_iam\_authorization\_policy](#input\_skip\_sm\_ce\_iam\_authorization\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service. | `bool` | `false` | no |
7878
| <a name="input_skip_sm_kms_iam_authorization_policy"></a> [skip\_sm\_kms\_iam\_authorization\_policy](#input\_skip\_sm\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no |

‎solutions/fully-configurable/variables.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,14 @@ variable "existing_secrets_manager_crn" {
6565

6666
variable "service_plan" {
6767
type = string
68-
description = "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`."
69-
default = "standard"
68+
description = "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)."
7069
validation {
7170
condition = contains(["standard", "trial"], var.service_plan)
72-
error_message = "Only \"standard\" and \"trial\" are allowed values for secrets_manager_service_plan.Applies only if not providing a value for the `existing_secrets_manager_crn` input."
71+
error_message = "Only 'standard' and 'trial' are allowed values for 'service_plan'. Applies only if not providing a value for the 'existing_secrets_manager_crn' input."
72+
}
73+
validation {
74+
condition = var.existing_secrets_manager_crn == null ? var.service_plan != null : true
75+
error_message = "A value for 'service_plan' is required if not providing a value for 'existing_secrets_manager_crn'"
7376
}
7477
}
7578

‎solutions/security-enforced/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ No resources.
4646
| <a name="input_secrets_manager_cbr_rules"></a> [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
4747
| <a name="input_secrets_manager_instance_name"></a> [secrets\_manager\_instance\_name](#input\_secrets\_manager\_instance\_name) | The name to give the Secrets Manager instance provisioned by this solution. If a prefix input variable is specified, it is added to the value in the `<prefix>-value` format. Applies only if `existing_secrets_manager_crn` is not provided. | `string` | `"secrets-manager"` | no |
4848
| <a name="input_secrets_manager_resource_tags"></a> [secrets\_manager\_resource\_tags](#input\_secrets\_manager\_resource\_tags) | The list of resource tags you want to associate with your Secrets Manager instance. Applies only if `existing_secrets_manager_crn` is not provided. | `list(any)` | `[]` | no |
49-
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. | `string` | `"standard"` | no |
49+
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard). | `string` | n/a | yes |
5050
| <a name="input_skip_event_notifications_iam_authorization_policy"></a> [skip\_event\_notifications\_iam\_authorization\_policy](#input\_skip\_event\_notifications\_iam\_authorization\_policy) | If set to true, this skips the creation of a service to service authorization from Secrets Manager to Event Notifications. If false, the service to service authorization is created. | `bool` | `false` | no |
5151
| <a name="input_skip_sm_ce_iam_authorization_policy"></a> [skip\_sm\_ce\_iam\_authorization\_policy](#input\_skip\_sm\_ce\_iam\_authorization\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service. | `bool` | `false` | no |
5252
| <a name="input_skip_sm_kms_iam_authorization_policy"></a> [skip\_sm\_kms\_iam\_authorization\_policy](#input\_skip\_sm\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no |

‎solutions/security-enforced/variables.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,14 @@ variable "existing_secrets_manager_crn" {
5454

5555
variable "service_plan" {
5656
type = string
57-
description = "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`."
58-
default = "standard"
57+
description = "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)."
5958
validation {
6059
condition = contains(["standard", "trial"], var.service_plan)
61-
error_message = "Only \"standard\" and \"trial\" are allowed values for secrets_manager_service_plan.Applies only if not providing a value for the `existing_secrets_manager_crn` input."
60+
error_message = "Only 'standard' and 'trial' are allowed values for 'service_plan'. Applies only if not providing a value for the 'existing_secrets_manager_crn' input."
61+
}
62+
validation {
63+
condition = var.existing_secrets_manager_crn == null ? var.service_plan != null : true
64+
error_message = "A value for 'service_plan' is required if not providing a value for 'existing_secrets_manager_crn'"
6265
}
6366
}
6467

0 commit comments

Comments
 (0)