From 59d9a174c8c64abcb6a6c3a7bf2d3dc32179218c Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 11 Nov 2025 11:13:31 +0530 Subject: [PATCH 01/30] fix: update the default port to 443 --- solutions/fully-configurable/variables.tf | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 0359dd4..489f589 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -115,7 +115,7 @@ variable "application_loadbalancer_pool_algorithm" { variable "application_loadbalancer_pool_member_port" { type = number description = "The port where traffic is sent to the instance." - default = 80 + default = 443 } variable "application_loadbalancer_pool_health_delay" { @@ -151,7 +151,7 @@ variable "application_loadbalancer_pool_protocol" { variable "application_loadbalancer_listener_port" { type = number description = "The listener port for the Private Path network load balancer." - default = 80 + default = 443 } variable "application_loadbalancer_listener_protocol" { @@ -191,7 +191,7 @@ variable "network_loadbalancer_name" { variable "network_loadbalancer_listener_port" { type = number description = "The listener port for the Private Path network load balancer." - default = 80 + default = 443 } variable "network_loadbalancer_listener_accept_proxy_protocol" { @@ -239,13 +239,13 @@ variable "network_loadbalancer_pool_health_monitor_url" { variable "network_loadbalancer_pool_health_monitor_port" { type = number description = "The port on which the load balancer sends health check requests. By default, health checks are sent on the same port where traffic is sent to the instance." - default = 80 + default = 443 } variable "network_loadbalancer_pool_member_port" { type = number description = "The port where traffic is sent to the instance." - default = 80 + default = 443 } ############################################################################## From c28197f99cb905a51073863ee2a52a0bf6f62bb6 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 9 Dec 2025 12:18:45 +0530 Subject: [PATCH 02/30] SKIP UPGRADE TEST From 9efb2a0ec868f70de5794516ed8e5b04232b4416 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 9 Dec 2025 15:06:41 +0530 Subject: [PATCH 03/30] update variable description --- solutions/fully-configurable/variables.tf | 12 ++++++------ tests/pr_test.go | 2 ++ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 489f589..9e0e5a6 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -138,14 +138,14 @@ variable "application_loadbalancer_pool_health_timeout" { variable "application_loadbalancer_pool_health_type" { type = string - description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp` or `http`." - default = "http" + description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp`, `https` or `http`." + default = "https" } variable "application_loadbalancer_pool_protocol" { type = string description = "The protocol used to send traffic to instances in the pool. Supported values are `tcp`, `http`, `https` or `udp`." - default = "http" + default = "https" } variable "application_loadbalancer_listener_port" { @@ -156,13 +156,13 @@ variable "application_loadbalancer_listener_port" { variable "application_loadbalancer_listener_protocol" { type = string - description = "The protocol used to send traffic to instances in the pool. Supported values are `tcp`, `http`, `https` or `udp`." - default = "http" + description = "The listener protocol used by instances in the application loadbalancer pool. Supported values are `tcp`, `http`, `https` or `udp`." + default = "https" } variable "application_loadbalancer_listener_idle_timeout" { type = number - description = "The protocol used to send traffic to instances in the pool. Supported values are `tcp`, `http`, `https` or `udp`." + description = "The idle connection timeout of the listener in seconds." default = 50 } diff --git a/tests/pr_test.go b/tests/pr_test.go index 4de6ae7..b5ebb5e 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -111,6 +111,7 @@ func TestRunFullyConfigurableInSchematics(t *testing.T) { {Name: "existing_subnet_id", Value: terraform.Output(t, existingTerraformOptions, "existing_subnet_id"), DataType: "string"}, {Name: "private_path_service_endpoints", Value: []string{"vpc-pps.dev.internal"}, DataType: "list(string)"}, {Name: "application_loadbalancer_pool_member_ip_address", Value: []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, DataType: "list(string)"}, + {Name: "application_loadbalancer_listener_protocol", Value: "http", DataType: "string"}, } require.NoError(t, options.RunSchematicTest(), "This should not have errored") cleanupTerraform(t, existingTerraformOptions, prefix) @@ -140,6 +141,7 @@ func TestRunUpgradeFullyConfigurable(t *testing.T) { {Name: "existing_subnet_id", Value: terraform.Output(t, existingTerraformOptions, "existing_subnet_id"), DataType: "string"}, {Name: "private_path_service_endpoints", Value: []string{"vpc-pps.dev.internal"}, DataType: "list(string)"}, {Name: "application_loadbalancer_pool_member_ip_address", Value: []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, DataType: "list(string)"}, + {Name: "application_loadbalancer_listener_protocol", Value: "http", DataType: "string"}, } require.NoError(t, options.RunSchematicUpgradeTest(), "This should not have errored") From e311bf4b963cb21ff9a826fa628920e5c8fd7399 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Fri, 12 Dec 2025 18:30:03 +0530 Subject: [PATCH 04/30] add support for cert engine --- README.md | 2 +- ibm_catalog.json | 338 +++++++++++++++++++--- solutions/fully-configurable/main.tf | 79 ++++- solutions/fully-configurable/outputs.tf | 5 + solutions/fully-configurable/provider.tf | 8 + solutions/fully-configurable/variables.tf | 90 +++++- tests/pr_test.go | 229 ++++++++++----- tests/resources/main.tf | 51 +++- tests/resources/outputs.tf | 5 + tests/resources/provider.tf | 6 + tests/resources/variables.tf | 12 + 11 files changed, 693 insertions(+), 132 deletions(-) diff --git a/README.md b/README.md index 07dc843..c8cfbd2 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # VPC Private-path External Connectivity -[![Incubating (Not yet consumable)](https://img.shields.io/badge/status-Incubating%20(Not%20yet%20consumable)-red)](https://terraform-ibm-modules.github.io/documentation/#/badge-status) +[![Graduated (Supported)](https://img.shields.io/badge/Status-Graduated%20(Supported)-brightgreen)](https://terraform-ibm-modules.github.io/documentation/#/badge-status) [![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/sample-deployable-architectures?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/sample-deployable-architectures/releases/latest) [![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit) [![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/) diff --git a/ibm_catalog.json b/ibm_catalog.json index f9913bf..2f9bad6 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -149,6 +149,9 @@ "key": "ibmcloud_api_key" }, { + "key": "region", + "required": true, + "type": "string", "custom_config": { "config_constraints": { "generationType": "2" @@ -157,12 +160,48 @@ "original_grouping": "deployment", "type": "vpc_region" }, - "key": "region", - "required": true + "description": "Region in which all resources will be deployed. [Learn More](https://terraform-ibm-modules.github.io/documentation/#/region).", + "default_value": "us-south" }, { "key": "prefix", - "required": true + "required": true, + "default_value": "dev", + "random_string": { + "length": 4 + }, + "value_constraints": [ + { + "type": "regex", + "description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters.", + "value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$" + } + ] + }, + { + "key": "subnets", + "default_value": "{\n zone-1 = [\n {\n name = \"subnet-a\"\n cidr = \"10.10.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-2 = [\n {\n name = \"subnet-b\"\n cidr = \"10.20.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-3 = []\n }", + "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", + "required": false, + "virtual": true, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "type": "code_editor" + } + }, + { + "key": "network_acls", + "type": "list(object)", + "default_value": "[\n {\n name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-all-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 80\n port_max = 80\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-443-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-udp-80-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n udp = {\n port_min = 80\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-udp-all-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n udp = {\n port_min = 1\n port_max = 65535\n source_port_min = 1\n source_port_max = 65535\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]", + "description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).", + "required": false, + "virtual": true, + "custom_config": { + "type": "code_editor", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "enable_platform_metrics", @@ -197,12 +236,17 @@ "config_constraints": { "identifier": "rg_name" } - }, - "default_value": "Default", - "description": "The name of an existing resource group to provision the resources." + } }, { - "key": "existing_vpc_id" + "key": "existing_vpc_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_vpc_crn' is not valid.", + "value": "^crn:(.*:){3}is:(.*:){2}:vpc:[0-9a-z]{4}-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + } + ] }, { "key": "existing_subnet_id", @@ -282,7 +326,99 @@ "key": "network_loadbalancer_name" }, { - "key": "application_loadbalancer_listener_certificate_instance" + "key": "secrets_manager_service_plan", + "required": true, + "virtual": true, + "type": "string", + "options": [ + { + "displayname": "Standard", + "value": "standard" + }, + { + "displayname": "Trial", + "value": "trial" + } + ], + "default_value": "standard", + "description": "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)." + }, + { + "key": "application_loadbalancer_listener_certificate_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'application_loadbalancer_listener_certificate_crn' is not valid.", + "value": "^__NULL__$|^crn:(.*:){3}secrets-manager:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:secret:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$" + } + ] + }, + { + "key": "existing_secrets_manager_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.", + "value": "^crn:(.*:){3}secrets-manager:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] + }, + { + "key": "existing_secrets_manager_secret_group_id" + }, + { + "key": "private_cert_engine_config_root_ca_common_name" + }, + { + "key": "private_cert_engine_config_template_name" + }, + { + "key": "root_ca_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "root-ca", + "description": "The name of the Root Certificate Authority you want to create." + }, + { + "key": "root_ca_common_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "example-root.com", + "description": "The common name of the Root Certificate Authority you want to create." + }, + { + "key": "intermediate_ca_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "intermediate-ca", + "description": "The name of the Intermediate Certificate Authority you want to create." + }, + { + "key": "intermediate_ca_common_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "example-int.com", + "description": "The common name of the Intermediate Certificate Authority you want to create." + }, + { + "key": "certificate_template_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "template", + "description": "The name of the Certificate Template you want to create." + }, + { + "key": "template_max_ttl", + "type": "string", + "required": false, + "virtual": true, + "default_value": "8760h", + "description": "Max TTL for the certificate template you want to create." }, { "key": "application_loadbalancer_listener_idle_timeout" @@ -291,10 +427,34 @@ "key": "application_loadbalancer_listener_port" }, { - "key": "application_loadbalancer_listener_protocol" + "key": "application_loadbalancer_listener_protocol", + "options": [ + { + "displayname": "HTTPS", + "value": "https" + }, + { + "displayname": "TCP", + "value": "tcp" + }, + { + "displayname": "UDP", + "value": "udp" + } + ] }, { - "key": "application_loadbalancer_pool_algorithm" + "key": "application_loadbalancer_pool_algorithm", + "options": [ + { + "displayname": "Round Robin", + "value": "round_robin" + }, + { + "displayname": "Weighted Round Robin", + "value": "weighted_round_robin" + } + ] }, { "key": "application_loadbalancer_pool_health_delay" @@ -306,7 +466,17 @@ "key": "application_loadbalancer_pool_health_timeout" }, { - "key": "application_loadbalancer_pool_health_type" + "key": "application_loadbalancer_pool_health_type", + "options": [ + { + "displayname": "HTTPS", + "value": "https" + }, + { + "displayname": "TCP", + "value": "tcp" + } + ] }, { "key": "application_loadbalancer_pool_member_ip_address" @@ -315,7 +485,21 @@ "key": "application_loadbalancer_pool_member_port" }, { - "key": "application_loadbalancer_pool_protocol" + "key": "application_loadbalancer_pool_protocol", + "options": [ + { + "displayname": "HTTPS", + "value": "https" + }, + { + "displayname": "TCP", + "value": "tcp" + }, + { + "displayname": "UDP", + "value": "udp" + } + ] }, { "key": "application_loadbalancer_type", @@ -355,7 +539,17 @@ "key": "network_loadbalancer_pool_health_timeout" }, { - "key": "network_loadbalancer_pool_health_type" + "key": "network_loadbalancer_pool_health_type", + "options": [ + { + "displayname": "HTTPS", + "value": "https" + }, + { + "displayname": "TCP", + "value": "tcp" + } + ] }, { "key": "network_loadbalancer_pool_member_port" @@ -399,15 +593,16 @@ }, "dependencies": [ { - "name": "deploy-arch-ibm-account-infra-base", - "description": "Cloud automation for Account Configuration organizes your IBM Cloud account with a ready-made set of resource groups by default and when you enable the \"with Account Settings\" option, it also applies baseline security and governance settings. ", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "name": "deploy-arch-ibm-slz-vpc", + "description": "Configure the VPC and subnets required to deploy VPN Server.", + "id": "9fc0fa64-27af-4fed-9dce-47b3640ba739-global", + "version": "v8.8.3", "flavors": [ - "resource-group-only", - "resource-groups-with-account-settings" + "fully-configurable" ], - "default_flavor": "resource-group-only", - "id": "63641cec-6093-4b4f-b7b0-98d2f4185cd6-global", + "catalog_id": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc", + "optional": true, + "on_by_default": true, "input_mapping": [ { "dependency_input": "prefix", @@ -415,22 +610,49 @@ "reference_version": true }, { - "dependency_output": "workload_resource_group_name", - "version_input": "existing_resource_group_name" + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + }, + { + "dependency_output": "subnet_ids", + "version_input": "existing_subnet_ids" + }, + { + "dependency_output": "vpc_crn", + "version_input": "existing_vpc_crn" + }, + { + "dependency_input": "subnets", + "version_input": "subnets", + "reference_version": true + }, + { + "dependency_input": "network_acls", + "version_input": "network_acls", + "reference_version": true } - ], - "optional": true, - "on_by_default": false, - "version": "v3.0.7" + ] }, { - "name": "deploy-arch-ibm-vpc", - "description": "Configures the VPC network infrastructure required to deploy Private Path service.", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "name": "deploy-arch-secrets-manager-private-cert", + "description": "Configures secrets manager instance, private certificate engine and VPN server certificate. Client certificate will not get created and will have to be created manually.", + "id": "422283a7-9cb2-4149-8093-a36a799e1d27-global", + "version": "v1.7.4", "flavors": [ "fully-configurable" ], - "id": "2af61763-f8ef-4527-a815-b92166f29bc8-global", + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "ignore_auto_referencing": [ + "*" + ], "input_mapping": [ { "dependency_input": "prefix", @@ -438,33 +660,63 @@ "reference_version": true }, { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", + "dependency_output": "secrets_manager_crn", + "version_input": "existing_secrets_manager_instance_crn" + }, + { + "dependency_input": "prefix", + "version_input": "prefix", "reference_version": true }, { - "dependency_input": "region", + "dependency_input": "secrets_manager_region", "version_input": "region", "reference_version": true }, { - "dependency_output": "vpc_id", - "version_input": "existing_vpc_id" + "dependency_input": "secrets_manager_service_plan", + "version_input": "secrets_manager_service_plan", + "reference_version": true + }, + { + "dependency_input": "root_ca_name", + "version_input": "root_ca_name", + "reference_version": true }, { - "dependency_input": "enable_platform_metrics", - "version_input": "enable_platform_metrics", + "dependency_input": "root_ca_common_name", + "version_input": "root_ca_common_name", "reference_version": true }, { - "dependency_input": "logs_routing_tenant_regions", - "version_input": "logs_routing_tenant_regions", + "dependency_input": "intermediate_ca_name", + "version_input": "intermediate_ca_name", "reference_version": true + }, + { + "dependency_input": "intermediate_ca_common_name", + "version_input": "intermediate_ca_common_name", + "reference_version": true + }, + { + "dependency_input": "certificate_template_name", + "version_input": "certificate_template_name", + "reference_version": true + }, + { + "dependency_input": "template_max_ttl", + "version_input": "template_max_ttl", + "reference_version": true + }, + { + "version_input": "enable_certificate_auth", + "value": false + }, + { + "dependency_output": "secret_crn", + "version_input": "application_loadbalancer_listener_certificate_crn" } - ], - "optional": true, - "on_by_default": true, - "version": "v7.24.0" + ] } ], "dependency_version_2": true, diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf index 84f553c..960797f 100644 --- a/solutions/fully-configurable/main.tf +++ b/solutions/fully-configurable/main.tf @@ -8,27 +8,90 @@ module "resource_group" { existing_resource_group_name = var.existing_resource_group_name } +######################################################################################################################## +# Secrets Manager resources +######################################################################################################################## +locals { + secrets_manager_cert_crn = var.application_loadbalancer_listener_certificate_crn != null ? var.application_loadbalancer_listener_certificate_crn : module.secrets_manager_private_certificate[0].secret_crn + secrets_manager_secret_group_id = var.application_loadbalancer_listener_certificate_crn != null ? null : var.existing_secrets_manager_secret_group_id != null ? var.existing_secrets_manager_secret_group_id : module.secrets_manager_secret_group[0].secret_group_id +} +module "existing_sm_crn_parser" { + source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser" + version = "1.2.0" + crn = var.existing_secrets_manager_instance_crn +} + +module "application_loadbalancer_listener_certificate_crn_parser" { + count = var.application_loadbalancer_listener_certificate_crn != null ? 1 : 0 + source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser" + version = "1.2.0" + crn = var.application_loadbalancer_listener_certificate_crn +} + +# Create a secret group to place the certificate if provisioning a new certificate +module "secrets_manager_secret_group" { + count = var.application_loadbalancer_listener_certificate_crn == null && var.existing_secrets_manager_secret_group_id == null ? 1 : 0 + source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" + version = "1.3.15" + region = module.existing_sm_crn_parser.region + secrets_manager_guid = module.existing_sm_crn_parser.service_instance + secret_group_name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-cert-secret-group" : "cert-secret-group" + secret_group_description = "secret group used for private certificates" + providers = { + ibm = ibm.ibm-sm + } +} + +# Create private certificate to use for VPN server +module "secrets_manager_private_certificate" { + count = var.application_loadbalancer_listener_certificate_crn == null ? 1 : 0 + source = "terraform-ibm-modules/secrets-manager-private-cert/ibm" + version = "1.7.0" + cert_name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-cts-vpn-private-cert" : "cts-vpn-private-cert" + cert_description = "private certificate for client to site VPN connection" + cert_template = var.private_cert_engine_config_template_name + cert_secrets_group_id = local.secrets_manager_secret_group_id + cert_common_name = var.private_cert_engine_config_root_ca_common_name + secrets_manager_guid = module.existing_sm_crn_parser.service_instance + secrets_manager_region = module.existing_sm_crn_parser.region + providers = { + ibm = ibm.ibm-sm + } +} + +######################################################################################################################## +# Application Load balancer resources +######################################################################################################################## + +module "existing_vpc_crn_parser" { + count = var.existing_vpc_crn != null ? 1 : 0 + source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser" + version = "1.2.0" + crn = var.existing_vpc_crn +} + locals { prefix = var.prefix != null ? trimspace(var.prefix) != "" ? "${var.prefix}-" : "" : "" network_loadbalancer_name = "${local.prefix}${var.network_loadbalancer_name}" private_path_name = "${local.prefix}${var.private_path_name}" subnet_id = var.existing_subnet_id != null ? var.existing_subnet_id : data.ibm_is_vpc.vpc[0].subnets[0].id + existing_vpc_id = var.existing_vpc_crn != null ? module.existing_vpc_crn_parser[0].resource : null } data "ibm_is_vpc" "vpc" { - count = var.existing_vpc_id != null && var.existing_subnet_id == null ? 1 : 0 - identifier = var.existing_vpc_id + count = var.existing_vpc_crn != null && var.existing_subnet_id == null ? 1 : 0 + identifier = local.existing_vpc_id } resource "ibm_is_lb" "alb" { - name = "${local.prefix}-alb" + name = "${local.prefix}alb" resource_group = module.resource_group.resource_group_id subnets = [local.subnet_id] type = var.application_loadbalancer_type } resource "ibm_is_lb_pool" "alb_backend_pool" { - name = "${local.prefix}-alb-pool" + name = "${local.prefix}alb-pool" lb = ibm_is_lb.alb.id algorithm = var.application_loadbalancer_pool_algorithm protocol = var.application_loadbalancer_pool_protocol @@ -51,13 +114,17 @@ resource "ibm_is_lb_listener" "alb_frontend_listener" { port = var.application_loadbalancer_listener_port protocol = var.application_loadbalancer_listener_protocol idle_connection_timeout = var.application_loadbalancer_listener_idle_timeout - certificate_instance = var.application_loadbalancer_listener_certificate_instance + certificate_instance = local.secrets_manager_cert_crn default_pool = ibm_is_lb_pool.alb_backend_pool.pool_id } +######################################################################################################################## +# Private path resources +######################################################################################################################## + module "private_path" { source = "terraform-ibm-modules/vpc-private-path/ibm" - version = "1.3.2" + version = "1.5.0" resource_group_id = module.resource_group.resource_group_id subnet_id = local.subnet_id tags = var.private_path_tags diff --git a/solutions/fully-configurable/outputs.tf b/solutions/fully-configurable/outputs.tf index d4550c7..efbfebe 100644 --- a/solutions/fully-configurable/outputs.tf +++ b/solutions/fully-configurable/outputs.tf @@ -38,6 +38,11 @@ output "alb_listener_id" { value = ibm_is_lb_listener.alb_frontend_listener.id } +output "alb_listener_certificate_secret_id" { + description = "ID of the client to site vpn server certificate secret stored in Secrets Manager" + value = var.application_loadbalancer_listener_certificate_crn == null ? module.secrets_manager_private_certificate[0].secret_id : module.application_loadbalancer_listener_certificate_crn_parser[0].service_instance +} + ## Private Path output "nlb_crn" { description = "The CRN for this load balancer." diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf index 17cfc77..fa3d678 100644 --- a/solutions/fully-configurable/provider.tf +++ b/solutions/fully-configurable/provider.tf @@ -8,3 +8,11 @@ provider "ibm" { visibility = var.provider_visibility private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null } + +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + region = module.existing_sm_crn_parser.region + alias = "ibm-sm" + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null +} diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 9e0e5a6..a5cf36f 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -10,8 +10,8 @@ variable "ibmcloud_api_key" { variable "existing_resource_group_name" { type = string - description = "The name of an existing resource group to provision the resources. If not provided the default resource group will be used." - default = null + description = "The name of an existing resource group to provision the resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-rgs&interface=ui#create_rgs) about how to create a resource group." + default = "Default" } variable "region" { @@ -34,7 +34,7 @@ variable "provider_visibility" { variable "prefix" { type = string nullable = true - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-0205-pp. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + description = "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To skip using a prefix, set this value to null or an empty string. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { # - null and empty string is allowed @@ -74,13 +74,13 @@ variable "private_path_access_tags" { # VPC Variables ############################################################################## -variable "existing_vpc_id" { - description = "The ID of an existing VPC. If the user provides only the `existing_vpc_id`, the Private Path service will be provisioned in the first subnet." +variable "existing_vpc_crn" { type = string + description = "CRN of the existing VPC in which the VPN infrastructure will be created. If the user provides only the `existing_vpc_crn`, the Private Path service will be provisioned in the first subnet." default = null validation { - condition = var.existing_vpc_id == null && var.existing_subnet_id == null ? false : true - error_message = "A value for either `existing_vpc_id` or `existing_subnet_id` should be passed." + condition = var.existing_vpc_crn == null && var.existing_subnet_id == null ? false : true + error_message = "A value for either `existing_vpc_crn` or `existing_subnet_id` should be passed." } } @@ -104,12 +104,21 @@ variable "application_loadbalancer_type" { type = string default = "private" description = "The type of the application load balancer. Supported values are `private`, `public`." + validation { + condition = contains(["private", "public"], var.application_loadbalancer_type) + error_message = "Invalid type of application load balancer. Allowed values are 'private', 'public'." + } } variable "application_loadbalancer_pool_algorithm" { type = string description = "The load-balancing algorithm for Private Path network load balancer pool members. Supported values are `round_robin` or `weighted_round_robin`." default = "round_robin" + + validation { + condition = contains(["round_robin", "weighted_round_robin"], var.application_loadbalancer_pool_algorithm) + error_message = "Invalid load-balancing algorithm. Allowed values are 'round_robin', 'weighted_round_robin'." + } } variable "application_loadbalancer_pool_member_port" { @@ -138,14 +147,22 @@ variable "application_loadbalancer_pool_health_timeout" { variable "application_loadbalancer_pool_health_type" { type = string - description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp`, `https` or `http`." + description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp`, `https`." default = "https" + validation { + condition = contains(["tcp", "https"], var.application_loadbalancer_pool_health_type) + error_message = "Invalid protocol for health check. Allowed values are 'tcp', 'https'." + } } variable "application_loadbalancer_pool_protocol" { type = string - description = "The protocol used to send traffic to instances in the pool. Supported values are `tcp`, `http`, `https` or `udp`." + description = "The protocol used to send traffic to instances in the pool. Supported values are `tcp`, `https` or `udp`." default = "https" + validation { + condition = contains(["tcp", "https", "udp"], var.application_loadbalancer_pool_protocol) + error_message = "Invalid protocol for loadbalancer pool. Allowed values are 'tcp', 'https' or 'udp'." + } } variable "application_loadbalancer_listener_port" { @@ -156,8 +173,12 @@ variable "application_loadbalancer_listener_port" { variable "application_loadbalancer_listener_protocol" { type = string - description = "The listener protocol used by instances in the application loadbalancer pool. Supported values are `tcp`, `http`, `https` or `udp`." + description = "The listener protocol used by instances in the application loadbalancer pool. Supported values are `tcp`, `https` or `udp`." default = "https" + validation { + condition = contains(["tcp", "https", "udp"], var.application_loadbalancer_listener_protocol) + error_message = "Invalid listener protocol for application loadbalancer. Allowed values are 'tcp', 'https' or 'udp'." + } } variable "application_loadbalancer_listener_idle_timeout" { @@ -166,17 +187,48 @@ variable "application_loadbalancer_listener_idle_timeout" { default = 50 } -variable "application_loadbalancer_listener_certificate_instance" { +variable "application_loadbalancer_listener_certificate_crn" { type = string - description = "The CRN of the certificate in your secret manager, it is applicable(mandatory) only to https protocol." + description = "The CRN of existing secrets manager private certificate to use to create application loadbalancer listener. If the value is null, then new private certificate is created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificates&interface=ui)" default = null validation { - condition = var.application_loadbalancer_listener_protocol == "https" ? var.application_loadbalancer_listener_certificate_instance != null ? true : false : true - error_message = "A value must be set for `application_loadbalancer_listener_certificate_instance` when `application_loadbalancer_listener_protocol` is set to `https`." + condition = var.application_loadbalancer_listener_certificate_crn == null ? var.private_cert_engine_config_template_name != null && var.private_cert_engine_config_root_ca_common_name != null : true + error_message = "Set 'private_cert_engine_config_root_ca_common_name' and 'private_cert_engine_config_template_name' input variables if a 'application_loadbalancer_listener_certificate_crn' input variable is not set" } + + validation { + condition = var.application_loadbalancer_listener_certificate_crn != null ? var.private_cert_engine_config_template_name == null && var.private_cert_engine_config_root_ca_common_name == null : true + error_message = "'private_cert_engine_config_root_ca_common_name' and 'private_cert_engine_config_template_name' input variables can not be set if a 'application_loadbalancer_listener_certificate_crn' input variable is already set" + } +} + +############################################################################## +# Secrets Manager resources +############################################################################## + +variable "existing_secrets_manager_instance_crn" { + type = string + description = "The CRN of existing secrets manager where the certificate to use for the VPN is stored or where the new private certificate will be created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)" +} + +variable "existing_secrets_manager_secret_group_id" { + type = string + description = "The ID of existing secrets manager secret group used for new created certificate. If the value is null, then new secrets manager secret group is created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&interface=ui)" + default = null +} + +variable "private_cert_engine_config_root_ca_common_name" { + type = string + description = "A fully qualified domain name or host domain name for the certificate to be created. Only used when `application_loadbalancer_listener_certificate_crn` input variable is `null`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)" + default = null } +variable "private_cert_engine_config_template_name" { + type = string + description = "The name of the Certificate Template to create for a private certificate secret engine. When `application_loadbalancer_listener_certificate_crn` input variable is `null`, then it has to be the existing template name that exists in the private cert engine. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)" + default = null +} ############################################################################## # NLB Variables @@ -226,8 +278,12 @@ variable "network_loadbalancer_pool_health_timeout" { variable "network_loadbalancer_pool_health_type" { type = string - description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp` or `http`." + description = "The protocol used to send health check messages to instances in the pool. Supported values are `tcp` or `https`." default = "tcp" + validation { + condition = contains(["tcp", "https"], var.network_loadbalancer_pool_health_type) + error_message = "Invalid network loadbalancer health type. Allowed values are 'tcp', 'https'." + } } variable "network_loadbalancer_pool_health_monitor_url" { @@ -256,6 +312,10 @@ variable "private_path_default_access_policy" { type = string description = "The policy to use for bindings from accounts without an explicit account policy. The default policy is set to Review all requests. Supported options are `permit`, `deny`, or `review`." default = "review" + validation { + condition = contains(["review", "permit", "deny"], var.private_path_default_access_policy) + error_message = "Invalid network loadbalancer health type. Allowed values are 'review', 'permit' or 'deny'." + } } variable "private_path_service_endpoints" { diff --git a/tests/pr_test.go b/tests/pr_test.go index b5ebb5e..8627c88 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -15,12 +15,13 @@ import ( "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/common" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testschematic" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/cloudinfo" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testhelper" ) -const fullyConfigurableTerraformDir = "solutions/fully-configurable" +const fullyConfigurableSolutionDir = "solutions/fully-configurable" // Define a struct with fields that match the structure of the YAML data const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml" @@ -44,25 +45,30 @@ func TestMain(m *testing.M) { os.Exit(m.Run()) } -func validateEnvVariable(t *testing.T, varName string) string { - val, present := os.LookupEnv(varName) - require.True(t, present, "%s environment variable not set", varName) - require.NotEqual(t, "", val, "%s environment variable is empty", varName) - return val -} +func setupFullyConfigurableOptions(t *testing.T, prefix string) (*testschematic.TestSchematicOptions, *terraform.Options) { + + // ------------------------------------------------------------------------------------------------------ + // Create SLZ VPC, resource group first + // ------------------------------------------------------------------------------------------------------ + realTerraformDir := "./resources" + tempTerraformDir, _ := files.CopyTerraformFolderToTemp(realTerraformDir, fmt.Sprintf(prefix+"-%s", strings.ToLower(random.UniqueId()))) -func setupTerraform(t *testing.T, prefix, realTerraformDir string) *terraform.Options { - tempTerraformDir, err := files.CopyTerraformFolderToTemp(realTerraformDir, prefix) - require.NoError(t, err, "Failed to create temporary Terraform folder") - apiKey := validateEnvVariable(t, "TF_VAR_ibmcloud_api_key") // pragma: allowlist secret - region, err := testhelper.GetBestVpcRegion(apiKey, "../common-dev-assets/common-go-assets/cloudinfo-region-vpc-gen2-prefs.yaml", "eu-de") - require.NoError(t, err, "Failed to get best VPC region") + // Verify ibmcloud_api_key variable is set + checkVariable := "TF_VAR_ibmcloud_api_key" + val, present := os.LookupEnv(checkVariable) + require.True(t, present, checkVariable+" environment variable not set") + require.NotEqual(t, "", val, checkVariable+" environment variable is empty") + // Programmatically determine region to use based on availability + region, _ := testhelper.GetBestVpcRegion(val, "../common-dev-assets/common-go-assets/cloudinfo-region-vpc-gen2-prefs.yaml", "eu-de") + + logger.Log(t, "Tempdir: ", tempTerraformDir) existingTerraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{ TerraformDir: tempTerraformDir, Vars: map[string]interface{}{ - "prefix": prefix, - "region": region, + "prefix": prefix, + "region": region, + "resource_tags": []string{"test-schematic"}, }, // Set Upgrade to true to ensure latest version of providers and modules are used by terratest. // This is the same as setting the -upgrade=true flag with terraform. @@ -70,39 +76,27 @@ func setupTerraform(t *testing.T, prefix, realTerraformDir string) *terraform.Op }) terraform.WorkspaceSelectOrNew(t, existingTerraformOptions, prefix) - _, err = terraform.InitAndApplyE(t, existingTerraformOptions) - require.NoError(t, err, "Init and Apply of temp existing resource failed") - - return existingTerraformOptions -} + _, existErr := terraform.InitAndApplyE(t, existingTerraformOptions) -func cleanupTerraform(t *testing.T, options *terraform.Options, prefix string) { - if t.Failed() && strings.ToLower(os.Getenv("DO_NOT_DESTROY_ON_FAILURE")) == "true" { - fmt.Println("Terratest failed. Debug the test and delete resources manually.") - return + if existErr != nil { + assert.True(t, existErr == nil, "Init and Apply of temp resources (SLZ VPC and Secrets Manager) failed") + return nil, nil } - logger.Log(t, "START: Destroy (existing resources)") - terraform.Destroy(t, options) - terraform.WorkspaceDelete(t, options, prefix) - logger.Log(t, "END: Destroy (existing resources)") -} - -func TestRunFullyConfigurableInSchematics(t *testing.T) { - t.Parallel() - - // Provision resources first - prefix := fmt.Sprintf("ce-pp-%s", strings.ToLower(random.UniqueId())) - existingTerraformOptions := setupTerraform(t, prefix, "./resources") options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ - Testing: t, - Prefix: "ce-pp", - TarIncludePatterns: []string{"*.tf", fullyConfigurableTerraformDir + "/*.*", "scripts/*.sh"}, - TemplateFolder: fullyConfigurableTerraformDir, - Tags: []string{"test-schematic"}, - DeleteWorkspaceOnFail: false, + Testing: t, + Prefix: prefix, + TarIncludePatterns: []string{ + fullyConfigurableSolutionDir + "/*.*", + "*.tf", + }, + ResourceGroup: terraform.Output(t, existingTerraformOptions, "resource_group_name"), + TemplateFolder: fullyConfigurableSolutionDir, + Tags: []string{"test-schematic"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 60, + Region: region, }) - options.TerraformVars = []testschematic.TestSchematicTerraformVar{ {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, {Name: "prefix", Value: prefix, DataType: "string"}, @@ -111,10 +105,36 @@ func TestRunFullyConfigurableInSchematics(t *testing.T) { {Name: "existing_subnet_id", Value: terraform.Output(t, existingTerraformOptions, "existing_subnet_id"), DataType: "string"}, {Name: "private_path_service_endpoints", Value: []string{"vpc-pps.dev.internal"}, DataType: "list(string)"}, {Name: "application_loadbalancer_pool_member_ip_address", Value: []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, DataType: "list(string)"}, - {Name: "application_loadbalancer_listener_protocol", Value: "http", DataType: "string"}, + {Name: "private_cert_engine_config_root_ca_common_name", Value: fmt.Sprintf("%s%s", options.Prefix, ".com"), DataType: "string"}, + {Name: "private_cert_engine_config_template_name", Value: permanentResources["privateCertTemplateName"], DataType: "string"}, + {Name: "existing_secrets_manager_instance_crn", Value: permanentResources["secretsManagerCRN"], DataType: "string"}, + } + + return options, existingTerraformOptions +} + +func TestRunFullyConfigurableInSchematics(t *testing.T) { + t.Parallel() + prefix := fmt.Sprintf("ce-pp-%s", strings.ToLower(random.UniqueId())) + options, existingTerraformOptions := setupFullyConfigurableOptions(t, prefix) + if options == nil || existingTerraformOptions == nil { + t.Fatal("Failed to create agent schematic options (prerequisite Terraform deployment failed)") + } + + err := options.RunSchematicTest() + assert.Nil(t, err, "This should not have errored") + + // Check if "DO_NOT_DESTROY_ON_FAILURE" is set + envVal, _ := os.LookupEnv("DO_NOT_DESTROY_ON_FAILURE") + // Destroy the temporary existing resources if required + if t.Failed() && strings.ToLower(envVal) == "true" { + fmt.Println("Terratest failed. Debug the test and delete resources manually.") + } else { + logger.Log(t, "START: Destroy (existing resources)") + terraform.Destroy(t, existingTerraformOptions) + terraform.WorkspaceDelete(t, existingTerraformOptions, prefix) + logger.Log(t, "END: Destroy (existing resources)") } - require.NoError(t, options.RunSchematicTest(), "This should not have errored") - cleanupTerraform(t, existingTerraformOptions, prefix) } func TestRunUpgradeFullyConfigurable(t *testing.T) { @@ -122,28 +142,107 @@ func TestRunUpgradeFullyConfigurable(t *testing.T) { // Provision existing resources first prefix := fmt.Sprintf("pp-upg-%s", strings.ToLower(random.UniqueId())) - existingTerraformOptions := setupTerraform(t, prefix, "./resources") + options, existingTerraformOptions := setupFullyConfigurableOptions(t, prefix) - options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ - Testing: t, - Prefix: "ce-pp-upg", - TarIncludePatterns: []string{"*.tf", "scripts/*.sh", fullyConfigurableTerraformDir + "/*.*"}, - TemplateFolder: fullyConfigurableTerraformDir, - Tags: []string{"test-schematic"}, - DeleteWorkspaceOnFail: false, + if options == nil || existingTerraformOptions == nil { + t.Fatal("Failed to create agent schematic options (prerequisite Terraform deployment failed)") + } + options.CheckApplyResultForUpgrade = true + + err := options.RunSchematicUpgradeTest() + if !options.UpgradeTestSkipped { + assert.NoError(t, err, "Upgrade test should complete without errors") + } + + // Check if "DO_NOT_DESTROY_ON_FAILURE" is set + envVal, _ := os.LookupEnv("DO_NOT_DESTROY_ON_FAILURE") + // Destroy the temporary existing resources if required + if t.Failed() && strings.ToLower(envVal) == "true" { + fmt.Println("Terratest failed. Debug the test and delete resources manually.") + } else { + logger.Log(t, "START: Destroy (existing resources)") + terraform.Destroy(t, existingTerraformOptions) + terraform.WorkspaceDelete(t, existingTerraformOptions, prefix) + logger.Log(t, "END: Destroy (existing resources)") + } +} + +func TestFullyConfigurableSolutionExistingResources(t *testing.T) { + t.Parallel() + + // ------------------------------------------------------------------------------------ + // Create SLZ VPC, SM private cert, resource group first + // ------------------------------------------------------------------------------------ + + prefix := fmt.Sprintf("cts-s-ext-%s", strings.ToLower(random.UniqueId())) + realTerraformDir := "./resources" + tempTerraformDir, _ := files.CopyTerraformFolderToTemp(realTerraformDir, fmt.Sprintf(prefix+"-%s", strings.ToLower(random.UniqueId()))) + tags := common.GetTagsFromTravis() + + // Verify ibmcloud_api_key variable is set + checkVariable := "TF_VAR_ibmcloud_api_key" + val, present := os.LookupEnv(checkVariable) + require.True(t, present, checkVariable+" environment variable not set") + require.NotEqual(t, "", val, checkVariable+" environment variable is empty") + + // Programmatically determine region to use based on availability + region, _ := testhelper.GetBestVpcRegion(val, "../common-dev-assets/common-go-assets/cloudinfo-region-vpc-gen2-prefs.yaml", "eu-de") + + logger.Log(t, "Tempdir: ", tempTerraformDir) + existingTerraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{ + TerraformDir: tempTerraformDir, + Vars: map[string]interface{}{ + "prefix": prefix, + "region": region, + "resource_tags": tags, + "existing_secrets_manager_instance_crn": permanentResources["secretsManagerCRN"], + "certificate_template_name": permanentResources["privateCertTemplateName"], + }, + // Set Upgrade to true to ensure latest version of providers and modules are used by terratest. + // This is the same as setting the -upgrade=true flag with terraform. + Upgrade: true, }) - options.TerraformVars = []testschematic.TestSchematicTerraformVar{ - {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, - {Name: "prefix", Value: prefix, DataType: "string"}, - {Name: "region", Value: terraform.Output(t, existingTerraformOptions, "region"), DataType: "string"}, - {Name: "existing_resource_group_name", Value: terraform.Output(t, existingTerraformOptions, "resource_group_name"), DataType: "string"}, - {Name: "existing_subnet_id", Value: terraform.Output(t, existingTerraformOptions, "existing_subnet_id"), DataType: "string"}, - {Name: "private_path_service_endpoints", Value: []string{"vpc-pps.dev.internal"}, DataType: "list(string)"}, - {Name: "application_loadbalancer_pool_member_ip_address", Value: []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, DataType: "list(string)"}, - {Name: "application_loadbalancer_listener_protocol", Value: "http", DataType: "string"}, + terraform.WorkspaceSelectOrNew(t, existingTerraformOptions, prefix) + + _, existErr := terraform.InitAndApplyE(t, existingTerraformOptions) + if existErr != nil { + assert.True(t, existErr == nil, "Init and Apply of temp existing resource failed") + } else { + // ------------------------------------------------------------------------------------ + // Deploy Private path solution + // ------------------------------------------------------------------------------------ + options := testhelper.TestOptionsDefault(&testhelper.TestOptions{ + Testing: t, + TerraformDir: fullyConfigurableSolutionDir, + // Do not hard fail the test if the implicit destroy steps fail to allow a full destroy of resource to occur + ImplicitRequired: false, + TerraformVars: map[string]interface{}{ + "prefix": prefix, + "existing_resource_group_name": terraform.Output(t, existingTerraformOptions, "resource_group_name"), + "region": terraform.Output(t, existingTerraformOptions, "region"), + "application_loadbalancer_listener_certificate_crn": terraform.Output(t, existingTerraformOptions, "sm_private_cert_crn"), + "existing_subnet_id": []string{terraform.Output(t, existingTerraformOptions, "existing_subnet_id")}, + "existing_secrets_manager_instance_crn": permanentResources["secretsManagerCRN"], + "private_path_service_endpoints": []string{"vpc-pps.dev.internal"}, + "application_loadbalancer_pool_member_ip_address": []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, + "provider_visibility": "public", + }, + }) + output, err := options.RunTestConsistency() + assert.Nil(t, err, "This should not have errored") + assert.NotNil(t, output, "Expected some output") } - require.NoError(t, options.RunSchematicUpgradeTest(), "This should not have errored") - cleanupTerraform(t, existingTerraformOptions, prefix) + // Check if "DO_NOT_DESTROY_ON_FAILURE" is set + envVal, _ := os.LookupEnv("DO_NOT_DESTROY_ON_FAILURE") + // Destroy the temporary existing resources if required + if t.Failed() && strings.ToLower(envVal) == "true" { + fmt.Println("Terratest failed. Debug the test and delete resources manually.") + } else { + logger.Log(t, "START: Destroy (existing resources)") + terraform.Destroy(t, existingTerraformOptions) + terraform.WorkspaceDelete(t, existingTerraformOptions, prefix) + logger.Log(t, "END: Destroy (existing resources)") + } } diff --git a/tests/resources/main.tf b/tests/resources/main.tf index 21095c8..5320f6f 100644 --- a/tests/resources/main.tf +++ b/tests/resources/main.tf @@ -4,8 +4,8 @@ module "mock_resource_group" { source = "terraform-ibm-modules/resource-group/ibm" - version = "1.4.0" - resource_group_name = "${var.prefix}-mock-rg" + version = "1.4.3" + resource_group_name = "${var.prefix}-rg" } ############################################################################## @@ -113,3 +113,50 @@ resource "ibm_is_subnet" "provider_subnet" { ipv4_cidr_block = "10.100.10.0/24" tags = var.resource_tags } + +################################################################################# +# Secrets Manager resources +################################################################################# + +locals { + sm_region = var.existing_secrets_manager_instance_crn != null ? module.existing_sm_crn_parser[0].region : null + secrets_manager_guid = var.existing_secrets_manager_instance_crn != null ? module.existing_sm_crn_parser[0].service_instance : null +} + +module "existing_sm_crn_parser" { + count = var.existing_secrets_manager_instance_crn != null ? 1 : 0 + source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser" + version = "1.2.0" + crn = var.existing_secrets_manager_instance_crn +} + +# Create a secret group to place the certificate if provisioning a new certificate +module "secrets_manager_group" { + count = var.existing_secrets_manager_instance_crn != null ? 1 : 0 + source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" + version = "1.3.15" + region = local.sm_region + secrets_manager_guid = local.secrets_manager_guid + secret_group_name = "${var.prefix}-cert-secret-group" + secret_group_description = "secret group used for private certificates" + providers = { + ibm = ibm.ibm-sm + } +} + +# Create private certificate to use for VPN server +module "secrets_manager_private_certificate" { + count = var.existing_secrets_manager_instance_crn != null ? 1 : 0 + source = "terraform-ibm-modules/secrets-manager-private-cert/ibm" + version = "1.7.0" + cert_name = "${var.prefix}-cts-vpn-private-cert" + cert_description = "an example private cert" + cert_template = var.certificate_template_name + cert_secrets_group_id = module.secrets_manager_group[0].secret_group_id + cert_common_name = "${var.prefix}-example.com" + secrets_manager_guid = local.secrets_manager_guid + secrets_manager_region = local.sm_region + providers = { + ibm = ibm.ibm-sm + } +} diff --git a/tests/resources/outputs.tf b/tests/resources/outputs.tf index c3bcaa9..fd8df67 100644 --- a/tests/resources/outputs.tf +++ b/tests/resources/outputs.tf @@ -26,3 +26,8 @@ output "region" { value = var.region description = "Region of the resources." } + +output "sm_private_cert_crn" { + value = var.existing_secrets_manager_instance_crn != null ? module.secrets_manager_private_certificate[0].secret_crn : null + description = "CRN of secrets manager private certificate" +} diff --git a/tests/resources/provider.tf b/tests/resources/provider.tf index df45ef5..1032b23 100644 --- a/tests/resources/provider.tf +++ b/tests/resources/provider.tf @@ -2,3 +2,9 @@ provider "ibm" { ibmcloud_api_key = var.ibmcloud_api_key region = var.region } + +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + region = local.sm_region + alias = "ibm-sm" +} diff --git a/tests/resources/variables.tf b/tests/resources/variables.tf index 0dcda66..0e7f0d2 100644 --- a/tests/resources/variables.tf +++ b/tests/resources/variables.tf @@ -21,3 +21,15 @@ variable "resource_tags" { description = "Optional list of tags to be added to created resources." default = ["private-path"] } + +variable "existing_secrets_manager_instance_crn" { + type = string + description = "The CRN of existing secrets manager to use to create service credential secrets." + default = null +} + +variable "certificate_template_name" { + type = string + description = "The name of the Certificate Template to create for a private certificate" + default = null +} From b6f43f8361abf857129dad8c5b9b9a79275ba64e Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 12:46:12 +0530 Subject: [PATCH 05/30] review changes --- ibm_catalog.json | 32 ++++++++++++++++------- solutions/fully-configurable/variables.tf | 4 +-- 2 files changed, 25 insertions(+), 11 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 2f9bad6..9d0c429 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -159,9 +159,7 @@ "grouping": "deployment", "original_grouping": "deployment", "type": "vpc_region" - }, - "description": "Region in which all resources will be deployed. [Learn More](https://terraform-ibm-modules.github.io/documentation/#/region).", - "default_value": "us-south" + } }, { "key": "prefix", @@ -205,11 +203,22 @@ }, { "key": "enable_platform_metrics", - "type": "string", - "default_value": true, - "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", + "type": "boolean", + "default_value": false, + "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. ⚠️ You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true + "virtual": true, + "hidden": true, + "options": [ + { + "displayname": "true", + "value": "true" + }, + { + "displayname": "false", + "value": "false" + } + ] }, { "key": "logs_routing_tenant_regions", @@ -594,7 +603,7 @@ "dependencies": [ { "name": "deploy-arch-ibm-slz-vpc", - "description": "Configure the VPC and subnets required to deploy VPN Server.", + "description": "Configure the VPC and subnets required to deploy VPC private path.", "id": "9fc0fa64-27af-4fed-9dce-47b3640ba739-global", "version": "v8.8.3", "flavors": [ @@ -636,12 +645,17 @@ "dependency_input": "network_acls", "version_input": "network_acls", "reference_version": true + }, + { + "dependency_input": "enable_platform_metrics", + "version_input": "enable_platform_metrics", + "reference_version": true } ] }, { "name": "deploy-arch-secrets-manager-private-cert", - "description": "Configures secrets manager instance, private certificate engine and VPN server certificate. Client certificate will not get created and will have to be created manually.", + "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", "id": "422283a7-9cb2-4149-8093-a36a799e1d27-global", "version": "v1.7.4", "flavors": [ diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index a5cf36f..1730a74 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -209,7 +209,7 @@ variable "application_loadbalancer_listener_certificate_crn" { variable "existing_secrets_manager_instance_crn" { type = string - description = "The CRN of existing secrets manager where the certificate to use for the VPN is stored or where the new private certificate will be created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)" + description = "The CRN of existing secrets manager where the certificate to use for the ALB listener is stored or where the new private certificate will be created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)" } variable "existing_secrets_manager_secret_group_id" { @@ -220,7 +220,7 @@ variable "existing_secrets_manager_secret_group_id" { variable "private_cert_engine_config_root_ca_common_name" { type = string - description = "A fully qualified domain name or host domain name for the certificate to be created. Only used when `application_loadbalancer_listener_certificate_crn` input variable is `null`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)" + description = "A fully qualified domain name or host domain name for the certificate to be created. Required if `application_loadbalancer_listener_certificate_crn` input variable is `null`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)" default = null } From f30edefca6571d952e6c776c636154e7fe680ff4 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 13:02:01 +0530 Subject: [PATCH 06/30] test --- ibm_catalog.json | 375 +++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 347 insertions(+), 28 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 9d0c429..5e480a3 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -65,6 +65,7 @@ "name": "fully-configurable", "index": 1, "install_type": "fullstack", + "short_description": "Ideal for users who want flexibility with a reliable starting point.", "working_directory": "solutions/fully-configurable", "iam_permissions": [ { @@ -176,31 +177,6 @@ } ] }, - { - "key": "subnets", - "default_value": "{\n zone-1 = [\n {\n name = \"subnet-a\"\n cidr = \"10.10.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-2 = [\n {\n name = \"subnet-b\"\n cidr = \"10.20.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-3 = []\n }", - "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", - "required": false, - "virtual": true, - "custom_config": { - "grouping": "deployment", - "original_grouping": "deployment", - "type": "code_editor" - } - }, - { - "key": "network_acls", - "type": "list(object)", - "default_value": "[\n {\n name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-all-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 80\n port_max = 80\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-443-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-udp-80-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n udp = {\n port_min = 80\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-udp-all-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n udp = {\n port_min = 1\n port_max = 65535\n source_port_min = 1\n source_port_max = 65535\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]", - "description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).", - "required": false, - "virtual": true, - "custom_config": { - "type": "code_editor", - "grouping": "deployment", - "original_grouping": "deployment" - } - }, { "key": "enable_platform_metrics", "type": "boolean", @@ -222,11 +198,12 @@ }, { "key": "logs_routing_tenant_regions", - "type": "list(string)", + "type": "array", "default_value": [], - "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", + "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. For example: [\"us-south\", \"us-east\"]. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, "virtual": true, + "hidden": true, "custom_config": { "grouping": "deployment", "original_grouping": "deployment", @@ -249,13 +226,24 @@ }, { "key": "existing_vpc_crn", + "display_name": "existing_vpc", "value_constraints": [ { "type": "regex", "description": "The value provided for 'existing_vpc_crn' is not valid.", "value": "^crn:(.*:){3}is:(.*:){2}:vpc:[0-9a-z]{4}-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" } - ] + ], + "custom_config": { + "type": "platform_resource", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "resourceType": "vpc", + "selection": "single_select", + "valueType": "crn" + } + } }, { "key": "existing_subnet_id", @@ -362,6 +350,25 @@ } ] }, + { + "key": "secrets_manager_service_plan", + "type_metadata": "string", + "virtual": true, + "required": true, + "default_value": "standard", + "options": [ + { + "description": "Centrally manage secrets in a dedicated instance. Unlimited Secrets Manager instances per IBM Cloud account. Unlimited access to all service capabilities.", + "displayname": "Standard", + "value": "standard" + }, + { + "description": "Choose this option only if your account does not already have a Trial plan instance. Only one Trial plan instance is allowed per account. After it expires, upgrade to the Standard plan to keep using Secrets Manager.", + "displayname": "Trial (30 days)", + "value": "trial" + } + ] + }, { "key": "existing_secrets_manager_instance_crn", "value_constraints": [ @@ -580,6 +587,65 @@ "value": "public-and-private" } ] + }, + { + "key": "existing_cos_instance_crn", + "display_name": "existing_cos_instance", + "hidden": true, + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_cos_instance' is not valid.", + "value": "^crn:(.*:){3}cloud-object-storage:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ], + "custom_config": { + "type": "platform_resource", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "resourceType": "cloud-object-storage", + "selection": "single_select", + "valueType": "crn" + } + } + }, + { + "key": "subnets", + "default_value": "{\n zone-1 = [\n {\n name = \"subnet-a\"\n cidr = \"10.10.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-2 = [\n {\n name = \"subnet-b\"\n cidr = \"10.20.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-3 = [\n {\n name = \"subnet-c\"\n cidr = \"10.30.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ]\n }", + "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", + "required": false, + "virtual": true, + "hidden": true, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "type": "code_editor", + "config_constraints": { + "supportedLanguages": [ + "hcl" + ] + } + } + }, + { + "key": "network_acls", + "type": "list(object)", + "default_value": "[\n { name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-443-inbound-source\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-inbound-dest\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_max = 443\n port_min = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-outbound-source\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-443-outbound-dest\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]", + "description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).", + "required": false, + "virtual": true, + "hidden": true, + "custom_config": { + "type": "code_editor", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "supportedLanguages": [ + "hcl" + ] + } + } } ], "architecture": { @@ -645,6 +711,144 @@ "dependency_input": "network_acls", "version_input": "network_acls", "reference_version": true + } + ] + }, + { + "name": "deploy-arch-ibm-kms", + "description": "Integrate IBM Key Protect to manage encryption keys for your cluster, securing persistent volumes and supporting compliance. If unselected, encryption is still applied using IBM-managed keys.", + "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", + "version": "v5.4.8", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "version_input": "kms_encryption_enabled_cluster", + "value": true + }, + { + "dependency_output": "kms_instance_crn", + "version_input": "existing_kms_instance_crn" + }, + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + } + ] + }, + { + "name": "deploy-arch-ibm-cos", + "description": "Set up a Cloud Object Storage (COS) instance and bucket to serve as internal registry storage for your OpenShift cluster.", + "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", + "version": "v10.5.5", + "flavors": [ + "instance" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": false, + "on_by_default": true, + "input_mapping": [ + { + "dependency_output": "cos_instance_crn", + "version_input": "existing_cos_instance_crn" + }, + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + } + ] + }, + { + "name": "deploy-arch-ibm-cloud-logs", + "description": "Set up an IBM Cloud Logs instance to analyze platform logs.", + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "flavors": [ + "fully-configurable" + ], + "id": "63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global", + "version": "v1.9.10", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + }, + { + "dependency_input": "existing_cos_instance_crn", + "version_input": "existing_cos_instance_crn", + "reference_version": true + }, + { + "dependency_input": "existing_kms_instance_crn", + "version_input": "existing_kms_instance_crn", + "reference_version": true + }, + { + "dependency_input": "logs_routing_tenant_regions", + "version_input": "logs_routing_tenant_regions", + "reference_version": true + } + ] + }, + { + "name": "deploy-arch-ibm-cloud-monitoring", + "description": "Set up a Cloud Monitoring instance to collect platform metrics.", + "id": "73debdbf-894f-4c14-81c7-5ece3a70b67d-global", + "version": "v1.10.6", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true }, { "dependency_input": "enable_platform_metrics", @@ -653,6 +857,121 @@ } ] }, + { + "name": "deploy-arch-ibm-activity-tracker", + "description": "Configure Activity Tracker Event Routing to direct auditing events appropriately.", + "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", + "version": "v1.4.11", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "existing_cos_instance_crn", + "version_input": "existing_cos_instance_crn", + "reference_version": true + }, + { + "dependency_input": "existing_kms_instance_crn", + "version_input": "existing_kms_instance_crn", + "reference_version": true + } + ] + }, + { + "name": "deploy-arch-ibm-secrets-manager", + "description": "Provision a Secrets Manager instance to securely store and manage sensitive credentials—such as certificates—used by services integrated with your cluster.", + "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", + "version": "v2.11.6", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + }, + { + "dependency_input": "service_plan", + "version_input": "secrets_manager_service_plan", + "reference_version": true + }, + { + "dependency_input": "secrets_manager_endpoint_type", + "version_input": "secrets_manager_endpoint_type", + "reference_version": true + }, + { + "dependency_output": "secrets_manager_crn", + "version_input": "existing_secrets_manager_instance_crn" + }, + { + "version_input": "enable_secrets_manager_integration", + "value": true + } + ] + }, + { + "name": "deploy-arch-ibm-scc-workload-protection", + "description": "Integrate with Workload Protection to monitor and manage your cluster’s security posture, helping detect misconfigurations and enforce compliance.", + "id": "4322cf44-2289-49aa-a719-dd79e39b14dc-global", + "version": "v1.15.3", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + } + ] + }, { "name": "deploy-arch-secrets-manager-private-cert", "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", From 9bc2ffce9f8570318e4af1baa59fe9f82de43be7 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 13:13:05 +0530 Subject: [PATCH 07/30] test --- ibm_catalog.json | 223 ----------------------------------------------- 1 file changed, 223 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 5e480a3..7b796c4 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -589,28 +589,6 @@ ] }, { - "key": "existing_cos_instance_crn", - "display_name": "existing_cos_instance", - "hidden": true, - "value_constraints": [ - { - "type": "regex", - "description": "The value provided for 'existing_cos_instance' is not valid.", - "value": "^crn:(.*:){3}cloud-object-storage:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" - } - ], - "custom_config": { - "type": "platform_resource", - "grouping": "deployment", - "original_grouping": "deployment", - "config_constraints": { - "resourceType": "cloud-object-storage", - "selection": "single_select", - "valueType": "crn" - } - } - }, - { "key": "subnets", "default_value": "{\n zone-1 = [\n {\n name = \"subnet-a\"\n cidr = \"10.10.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-2 = [\n {\n name = \"subnet-b\"\n cidr = \"10.20.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-3 = [\n {\n name = \"subnet-c\"\n cidr = \"10.30.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ]\n }", "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", @@ -711,144 +689,11 @@ "dependency_input": "network_acls", "version_input": "network_acls", "reference_version": true - } - ] - }, - { - "name": "deploy-arch-ibm-kms", - "description": "Integrate IBM Key Protect to manage encryption keys for your cluster, securing persistent volumes and supporting compliance. If unselected, encryption is still applied using IBM-managed keys.", - "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", - "version": "v5.4.8", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "version_input": "kms_encryption_enabled_cluster", - "value": true - }, - { - "dependency_output": "kms_instance_crn", - "version_input": "existing_kms_instance_crn" - }, - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ] - }, - { - "name": "deploy-arch-ibm-cos", - "description": "Set up a Cloud Object Storage (COS) instance and bucket to serve as internal registry storage for your OpenShift cluster.", - "id": "68921490-2778-4930-ac6d-bae7be6cd958-global", - "version": "v10.5.5", - "flavors": [ - "instance" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": false, - "on_by_default": true, - "input_mapping": [ - { - "dependency_output": "cos_instance_crn", - "version_input": "existing_cos_instance_crn" - }, - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - } - ] - }, - { - "name": "deploy-arch-ibm-cloud-logs", - "description": "Set up an IBM Cloud Logs instance to analyze platform logs.", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "flavors": [ - "fully-configurable" - ], - "id": "63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global", - "version": "v1.9.10", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - }, - { - "dependency_input": "existing_cos_instance_crn", - "version_input": "existing_cos_instance_crn", - "reference_version": true - }, - { - "dependency_input": "existing_kms_instance_crn", - "version_input": "existing_kms_instance_crn", - "reference_version": true }, { "dependency_input": "logs_routing_tenant_regions", "version_input": "logs_routing_tenant_regions", "reference_version": true - } - ] - }, - { - "name": "deploy-arch-ibm-cloud-monitoring", - "description": "Set up a Cloud Monitoring instance to collect platform metrics.", - "id": "73debdbf-894f-4c14-81c7-5ece3a70b67d-global", - "version": "v1.10.6", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true }, { "dependency_input": "enable_platform_metrics", @@ -857,45 +702,6 @@ } ] }, - { - "name": "deploy-arch-ibm-activity-tracker", - "description": "Configure Activity Tracker Event Routing to direct auditing events appropriately.", - "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", - "version": "v1.4.11", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "existing_cos_instance_crn", - "version_input": "existing_cos_instance_crn", - "reference_version": true - }, - { - "dependency_input": "existing_kms_instance_crn", - "version_input": "existing_kms_instance_crn", - "reference_version": true - } - ] - }, { "name": "deploy-arch-ibm-secrets-manager", "description": "Provision a Secrets Manager instance to securely store and manage sensitive credentials—such as certificates—used by services integrated with your cluster.", @@ -943,35 +749,6 @@ } ] }, - { - "name": "deploy-arch-ibm-scc-workload-protection", - "description": "Integrate with Workload Protection to monitor and manage your cluster’s security posture, helping detect misconfigurations and enforce compliance.", - "id": "4322cf44-2289-49aa-a719-dd79e39b14dc-global", - "version": "v1.15.3", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ] - }, { "name": "deploy-arch-secrets-manager-private-cert", "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", From d965f8e5fbe75e2091d783c765234b9c4f620c6d Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 13:18:18 +0530 Subject: [PATCH 08/30] test --- ibm_catalog.json | 47 ----------------------------------------------- 1 file changed, 47 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 7b796c4..0be9440 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -702,53 +702,6 @@ } ] }, - { - "name": "deploy-arch-ibm-secrets-manager", - "description": "Provision a Secrets Manager instance to securely store and manage sensitive credentials—such as certificates—used by services integrated with your cluster.", - "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", - "version": "v2.11.6", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - }, - { - "dependency_input": "service_plan", - "version_input": "secrets_manager_service_plan", - "reference_version": true - }, - { - "dependency_input": "secrets_manager_endpoint_type", - "version_input": "secrets_manager_endpoint_type", - "reference_version": true - }, - { - "dependency_output": "secrets_manager_crn", - "version_input": "existing_secrets_manager_instance_crn" - }, - { - "version_input": "enable_secrets_manager_integration", - "value": true - } - ] - }, { "name": "deploy-arch-secrets-manager-private-cert", "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", From ef9b6e2bdcba6ed3af508442b1659700cf1be3a8 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 13:29:10 +0530 Subject: [PATCH 09/30] test --- ibm_catalog.json | 195 +++++++++++++++++++++-------------------------- 1 file changed, 89 insertions(+), 106 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 0be9440..32aab0f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -322,26 +322,9 @@ { "key": "network_loadbalancer_name" }, - { - "key": "secrets_manager_service_plan", - "required": true, - "virtual": true, - "type": "string", - "options": [ - { - "displayname": "Standard", - "value": "standard" - }, - { - "displayname": "Trial", - "value": "trial" - } - ], - "default_value": "standard", - "description": "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)." - }, { "key": "application_loadbalancer_listener_certificate_crn", + "required": true, "value_constraints": [ { "type": "regex", @@ -350,92 +333,6 @@ } ] }, - { - "key": "secrets_manager_service_plan", - "type_metadata": "string", - "virtual": true, - "required": true, - "default_value": "standard", - "options": [ - { - "description": "Centrally manage secrets in a dedicated instance. Unlimited Secrets Manager instances per IBM Cloud account. Unlimited access to all service capabilities.", - "displayname": "Standard", - "value": "standard" - }, - { - "description": "Choose this option only if your account does not already have a Trial plan instance. Only one Trial plan instance is allowed per account. After it expires, upgrade to the Standard plan to keep using Secrets Manager.", - "displayname": "Trial (30 days)", - "value": "trial" - } - ] - }, - { - "key": "existing_secrets_manager_instance_crn", - "value_constraints": [ - { - "type": "regex", - "description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.", - "value": "^crn:(.*:){3}secrets-manager:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" - } - ] - }, - { - "key": "existing_secrets_manager_secret_group_id" - }, - { - "key": "private_cert_engine_config_root_ca_common_name" - }, - { - "key": "private_cert_engine_config_template_name" - }, - { - "key": "root_ca_name", - "type": "string", - "required": false, - "virtual": true, - "default_value": "root-ca", - "description": "The name of the Root Certificate Authority you want to create." - }, - { - "key": "root_ca_common_name", - "type": "string", - "required": false, - "virtual": true, - "default_value": "example-root.com", - "description": "The common name of the Root Certificate Authority you want to create." - }, - { - "key": "intermediate_ca_name", - "type": "string", - "required": false, - "virtual": true, - "default_value": "intermediate-ca", - "description": "The name of the Intermediate Certificate Authority you want to create." - }, - { - "key": "intermediate_ca_common_name", - "type": "string", - "required": false, - "virtual": true, - "default_value": "example-int.com", - "description": "The common name of the Intermediate Certificate Authority you want to create." - }, - { - "key": "certificate_template_name", - "type": "string", - "required": false, - "virtual": true, - "default_value": "template", - "description": "The name of the Certificate Template you want to create." - }, - { - "key": "template_max_ttl", - "type": "string", - "required": false, - "virtual": true, - "default_value": "8760h", - "description": "Max TTL for the certificate template you want to create." - }, { "key": "application_loadbalancer_listener_idle_timeout" }, @@ -570,6 +467,92 @@ { "key": "network_loadbalancer_pool_member_port" }, + { + "key": "secrets_manager_service_plan", + "type_metadata": "string", + "virtual": true, + "default_value": "standard", + "options": [ + { + "description": "Centrally manage secrets in a dedicated instance. Unlimited Secrets Manager instances per IBM Cloud account. Unlimited access to all service capabilities.", + "displayname": "Standard", + "value": "standard" + }, + { + "description": "Choose this option only if your account does not already have a Trial plan instance. Only one Trial plan instance is allowed per account. After it expires, upgrade to the Standard plan to keep using Secrets Manager.", + "displayname": "Trial (30 days)", + "value": "trial" + } + ] + }, + { + "key": "existing_secrets_manager_instance_crn", + "required": false, + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.", + "value": "^crn:(.*:){3}secrets-manager:(.*:){2}[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] + }, + { + "key": "existing_secrets_manager_secret_group_id" + }, + { + "key": "private_cert_engine_config_root_ca_common_name" + }, + { + "key": "private_cert_engine_config_template_name" + }, + { + "key": "root_ca_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "root-ca", + "description": "The name of the Root Certificate Authority you want to create." + }, + { + "key": "root_ca_common_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "example-root.com", + "description": "The common name of the Root Certificate Authority you want to create." + }, + { + "key": "intermediate_ca_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "intermediate-ca", + "description": "The name of the Intermediate Certificate Authority you want to create." + }, + { + "key": "intermediate_ca_common_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "example-int.com", + "description": "The common name of the Intermediate Certificate Authority you want to create." + }, + { + "key": "certificate_template_name", + "type": "string", + "required": false, + "virtual": true, + "default_value": "template", + "description": "The name of the Certificate Template you want to create." + }, + { + "key": "template_max_ttl", + "type": "string", + "required": false, + "virtual": true, + "default_value": "8760h", + "description": "Max TTL for the certificate template you want to create." + }, { "key": "provider_visibility", "hidden": true, @@ -673,8 +656,8 @@ "reference_version": true }, { - "dependency_output": "subnet_ids", - "version_input": "existing_subnet_ids" + "dependency_output": "private_path_subnet_id", + "version_input": "existing_subnet_id" }, { "dependency_output": "vpc_crn", From 81360a1a0c74a273a186a547eccc151813b5863f Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 13:46:02 +0530 Subject: [PATCH 10/30] update diagram --- ...ployable-architecture-private-path-external-connectivity.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/deployable-architecture-private-path-external-connectivity.svg b/reference-architectures/deployable-architecture-private-path-external-connectivity.svg index 1d9d825..c521e04 100644 --- a/reference-architectures/deployable-architecture-private-path-external-connectivity.svg +++ b/reference-architectures/deployable-architecture-private-path-external-connectivity.svg @@ -1,4 +1,4 @@ -On-Premisesworkload / service
IBM Cloud
IBM Cloud
Region
RegionResource GroupVPCSubnetApplicationLoadBalancerPrivate PathNLB
Private Path service
Private Path serviceFlow Logs bucket
[Optional] Object Storage 
[Optional] Object Storage Cloud logsCloud MonitoringActivity Tracker Event Routing
Observability
Observability
[Optional]
[Option...
SCC Workload Protection
SCC Workload Pr...
App Configuration
App Config...
[Optional] Key Protect
[Optional] Key Protect
Key Ring
Key RingKey For Flow Logs BucketText is not SVG - cannot display \ No newline at end of file +On-Premisesworkload / service
IBM Cloud
Region
Resource GroupVPCSubnet load-balancer--application ApplicationLoadBalancer load-balancer--network Private PathNLB
Private Path service
Flow Logs bucket
[Optional] Object Storage 
Cloud logsCloud MonitoringActivity Tracker Event Routing
Observability
[Optional]
SCC Workload Protection
App Configuration
[Optional] Key Protect
Key Ring
Key For Flow Logs Bucket
Secrets Manager
Private Certificate \ No newline at end of file From da27d53f66e9335a872681a4bb1fda3e68c12e5c Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:10:10 +0530 Subject: [PATCH 11/30] test --- ibm_catalog.json | 79 ------------------------------------------------ 1 file changed, 79 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 32aab0f..3470e9d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -684,85 +684,6 @@ "reference_version": true } ] - }, - { - "name": "deploy-arch-secrets-manager-private-cert", - "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", - "id": "422283a7-9cb2-4149-8093-a36a799e1d27-global", - "version": "v1.7.4", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "ignore_auto_referencing": [ - "*" - ], - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_output": "secrets_manager_crn", - "version_input": "existing_secrets_manager_instance_crn" - }, - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "secrets_manager_region", - "version_input": "region", - "reference_version": true - }, - { - "dependency_input": "secrets_manager_service_plan", - "version_input": "secrets_manager_service_plan", - "reference_version": true - }, - { - "dependency_input": "root_ca_name", - "version_input": "root_ca_name", - "reference_version": true - }, - { - "dependency_input": "root_ca_common_name", - "version_input": "root_ca_common_name", - "reference_version": true - }, - { - "dependency_input": "intermediate_ca_name", - "version_input": "intermediate_ca_name", - "reference_version": true - }, - { - "dependency_input": "intermediate_ca_common_name", - "version_input": "intermediate_ca_common_name", - "reference_version": true - }, - { - "dependency_input": "certificate_template_name", - "version_input": "certificate_template_name", - "reference_version": true - }, - { - "dependency_input": "template_max_ttl", - "version_input": "template_max_ttl", - "reference_version": true - }, - { - "version_input": "enable_certificate_auth", - "value": false - }, - { - "dependency_output": "secret_crn", - "version_input": "application_loadbalancer_listener_certificate_crn" - } - ] } ], "dependency_version_2": true, From b258e177b3b7039e58a864194fa16a3cb80aa191 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:11:18 +0530 Subject: [PATCH 12/30] test --- ibm_catalog.json | 81 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 80 insertions(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 3470e9d..a9791d4 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -632,7 +632,7 @@ "name": "deploy-arch-ibm-slz-vpc", "description": "Configure the VPC and subnets required to deploy VPC private path.", "id": "9fc0fa64-27af-4fed-9dce-47b3640ba739-global", - "version": "v8.8.3", + "version": "v8.9.3", "flavors": [ "fully-configurable" ], @@ -684,6 +684,85 @@ "reference_version": true } ] + }, + { + "name": "deploy-arch-secrets-manager-private-cert", + "description": "Configures secrets manager instance, private certificate engine and ALB listener certificate. Client certificate will not get created and will have to be created manually.", + "id": "422283a7-9cb2-4149-8093-a36a799e1d27-global", + "version": "v1.7.4", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "ignore_auto_referencing": [ + "*" + ], + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_output": "secrets_manager_crn", + "version_input": "existing_secrets_manager_instance_crn" + }, + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "secrets_manager_region", + "version_input": "region", + "reference_version": true + }, + { + "dependency_input": "secrets_manager_service_plan", + "version_input": "secrets_manager_service_plan", + "reference_version": true + }, + { + "dependency_input": "root_ca_name", + "version_input": "root_ca_name", + "reference_version": true + }, + { + "dependency_input": "root_ca_common_name", + "version_input": "root_ca_common_name", + "reference_version": true + }, + { + "dependency_input": "intermediate_ca_name", + "version_input": "intermediate_ca_name", + "reference_version": true + }, + { + "dependency_input": "intermediate_ca_common_name", + "version_input": "intermediate_ca_common_name", + "reference_version": true + }, + { + "dependency_input": "certificate_template_name", + "version_input": "certificate_template_name", + "reference_version": true + }, + { + "dependency_input": "template_max_ttl", + "version_input": "template_max_ttl", + "reference_version": true + }, + { + "version_input": "enable_certificate_auth", + "value": false + }, + { + "dependency_output": "secret_crn", + "version_input": "application_loadbalancer_listener_certificate_crn" + } + ] } ], "dependency_version_2": true, From 9b8ce75bd5f89ac5b7b3468dafaf138cd5cb23f7 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:22:27 +0530 Subject: [PATCH 13/30] test --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index a9791d4..32aab0f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -632,7 +632,7 @@ "name": "deploy-arch-ibm-slz-vpc", "description": "Configure the VPC and subnets required to deploy VPC private path.", "id": "9fc0fa64-27af-4fed-9dce-47b3640ba739-global", - "version": "v8.9.3", + "version": "v8.8.3", "flavors": [ "fully-configurable" ], From bf75c433987ef3ac802743ef825dabb4f7d9f837 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:41:31 +0530 Subject: [PATCH 14/30] test --- ibm_catalog.json | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 32aab0f..9f97cdc 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -672,16 +672,6 @@ "dependency_input": "network_acls", "version_input": "network_acls", "reference_version": true - }, - { - "dependency_input": "logs_routing_tenant_regions", - "version_input": "logs_routing_tenant_regions", - "reference_version": true - }, - { - "dependency_input": "enable_platform_metrics", - "version_input": "enable_platform_metrics", - "reference_version": true } ] }, From 72722589cf52ed99ff30eae7fdc3ed72ea8203f7 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:42:58 +0530 Subject: [PATCH 15/30] test --- ibm_catalog.json | 35 ----------------------------------- 1 file changed, 35 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 9f97cdc..0b005db 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -177,41 +177,6 @@ } ] }, - { - "key": "enable_platform_metrics", - "type": "boolean", - "default_value": false, - "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. ⚠️ You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", - "required": true, - "virtual": true, - "hidden": true, - "options": [ - { - "displayname": "true", - "value": "true" - }, - { - "displayname": "false", - "value": "false" - } - ] - }, - { - "key": "logs_routing_tenant_regions", - "type": "array", - "default_value": [], - "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. For example: [\"us-south\", \"us-east\"]. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", - "required": true, - "virtual": true, - "hidden": true, - "custom_config": { - "grouping": "deployment", - "original_grouping": "deployment", - "config_constraints": { - "type": "string" - } - } - }, { "key": "existing_resource_group_name", "display_name": "resource_group", From 3e5b8e8b4f27135c55cdf45c99df50cffa4bc3ce Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Mon, 15 Dec 2025 15:47:36 +0530 Subject: [PATCH 16/30] test --- ibm_catalog.json | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/ibm_catalog.json b/ibm_catalog.json index 0b005db..3ff4647 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -572,6 +572,24 @@ ] } } + }, + { + "key": "enable_platform_metrics", + "type": "boolean", + "default_value": false, + "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", + "required": true, + "virtual": true, + "options": [ + { + "displayname": "true", + "value": "true" + }, + { + "displayname": "false", + "value": "false" + } + ] } ], "architecture": { @@ -610,6 +628,11 @@ "version_input": "prefix", "reference_version": true }, + { + "dependency_input": "enable_platform_metrics", + "version_input": "enable_platform_metrics", + "reference_version": true + }, { "dependency_input": "existing_resource_group_name", "version_input": "existing_resource_group_name", From 9457c6d2cc7708f5e67d74435f7acbf509884d14 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 12:26:01 +0530 Subject: [PATCH 17/30] update --- ibm_catalog.json | 31 +++++++-------------------- tests/pr_test.go | 55 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 23 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 3ff4647..db82593 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -143,6 +143,14 @@ ], "service_name": "atracker", "notes": "[Optional] Required when enabling the Activity Tracker Event Routing." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Administrator", + "crn:v1:bluemix:public:iam::::serviceRole:Manager" + ], + "service_name": "secrets-manager", + "notes": "[optional] Required for creating an Secrets Manager instance." } ], "configuration": [ @@ -572,24 +580,6 @@ ] } } - }, - { - "key": "enable_platform_metrics", - "type": "boolean", - "default_value": false, - "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", - "required": true, - "virtual": true, - "options": [ - { - "displayname": "true", - "value": "true" - }, - { - "displayname": "false", - "value": "false" - } - ] } ], "architecture": { @@ -628,11 +618,6 @@ "version_input": "prefix", "reference_version": true }, - { - "dependency_input": "enable_platform_metrics", - "version_input": "enable_platform_metrics", - "reference_version": true - }, { "dependency_input": "existing_resource_group_name", "version_input": "existing_resource_group_name", diff --git a/tests/pr_test.go b/tests/pr_test.go index 8627c88..1aef0f9 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -13,6 +13,7 @@ import ( "github.com/gruntwork-io/terratest/modules/random" "github.com/gruntwork-io/terratest/modules/terraform" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/common" + "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testaddons" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testschematic" "github.com/stretchr/testify/assert" @@ -246,3 +247,57 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { logger.Log(t, "END: Destroy (existing resources)") } } + +// Skipping addons test due to this bug: https://github.ibm.com/ibmcloud/content-catalog/issues/6057 +func TestAddonsDefaultConfiguration(t *testing.T) { + + t.Skip() + + options := testaddons.TestAddonsOptionsDefault(&testaddons.TestAddonOptions{ + Testing: t, + Prefix: "pp-vpc", + QuietMode: false, // Suppress logs except on failure + }) + + options.AddonConfig = cloudinfo.NewAddonConfigTerraform( + options.Prefix, + "deploy-arch-ibm-is-private-path-ext-conn", + "fully-configurable", + map[string]interface{}{ + "region": "eu-de", + "secrets_manager_service_plan": "trial", + }, + ) + + // use existing secrets manager instance to prevent hitting 20 trial instance limit in account + options.AddonConfig.Dependencies = []cloudinfo.AddonConfig{ + { + OfferingName: "deploy-arch-ibm-secrets-manager", + OfferingFlavor: "fully-configurable", + Inputs: map[string]interface{}{ + "existing_secrets_manager_crn": permanentResources["privateOnlySecMgrCRN"], + "service_plan": "__NULL__", // no plan value needed when using existing SM + "skip_secrets_manager_iam_auth_policy": true, // since using an existing Secrets Manager instance, attempting to re-create auth policy can cause conflicts if the policy already exists + "secret_groups": []string{}, // passing empty array for secret groups as default value is creating general group and it will cause conflicts as we are using an existing SM + }, + }, + // // Disable target / route creation to prevent hitting quota in account + { + OfferingName: "deploy-arch-ibm-cloud-monitoring", + OfferingFlavor: "fully-configurable", + Inputs: map[string]interface{}{ + "enable_metrics_routing_to_cloud_monitoring": false, + }, + }, + { + OfferingName: "deploy-arch-ibm-activity-tracker", + OfferingFlavor: "fully-configurable", + Inputs: map[string]interface{}{ + "enable_activity_tracker_event_routing_to_cloud_logs": false, + }, + }, + } + + err := options.RunAddonTest() + require.NoError(t, err) +} From edf6718340112394ea2c784bff0cc13d82b0768a Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 13:28:28 +0530 Subject: [PATCH 18/30] fix test --- .../fully-configurable/catalogValidationValues.json.template | 3 ++- tests/pr_test.go | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/solutions/fully-configurable/catalogValidationValues.json.template b/solutions/fully-configurable/catalogValidationValues.json.template index e7afba3..48e3fb5 100644 --- a/solutions/fully-configurable/catalogValidationValues.json.template +++ b/solutions/fully-configurable/catalogValidationValues.json.template @@ -3,5 +3,6 @@ "region": "us-south", "prefix": $PREFIX, "private_path_name": $PREFIX, - "private_path_service_endpoints": ["vpc-pps.dev.internal"] + "private_path_service_endpoints": ["vpc-pps.dev.internal"], + "existing_secrets_manager_instance_crn": $SM_CRN } diff --git a/tests/pr_test.go b/tests/pr_test.go index 1aef0f9..e07e71a 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -223,7 +223,7 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { "existing_resource_group_name": terraform.Output(t, existingTerraformOptions, "resource_group_name"), "region": terraform.Output(t, existingTerraformOptions, "region"), "application_loadbalancer_listener_certificate_crn": terraform.Output(t, existingTerraformOptions, "sm_private_cert_crn"), - "existing_subnet_id": []string{terraform.Output(t, existingTerraformOptions, "existing_subnet_id")}, + "existing_subnet_id": terraform.Output(t, existingTerraformOptions, "existing_subnet_id"), "existing_secrets_manager_instance_crn": permanentResources["secretsManagerCRN"], "private_path_service_endpoints": []string{"vpc-pps.dev.internal"}, "application_loadbalancer_pool_member_ip_address": []string{terraform.Output(t, existingTerraformOptions, "member_ip_address")}, From 60397ef3f13aab74bbda9a2ae1ab1dcd9dc7d9cb Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 14:45:45 +0530 Subject: [PATCH 19/30] update test --- tests/resources/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/resources/main.tf b/tests/resources/main.tf index 5320f6f..1c0afd9 100644 --- a/tests/resources/main.tf +++ b/tests/resources/main.tf @@ -5,7 +5,7 @@ module "mock_resource_group" { source = "terraform-ibm-modules/resource-group/ibm" version = "1.4.3" - resource_group_name = "${var.prefix}-rg" + resource_group_name = "${var.prefix}-mock-rg" } ############################################################################## From f9e0804f6987d87bc9e9a46ecaea4d895010e763 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 19:44:07 +0530 Subject: [PATCH 20/30] add addon test --- tests/pr_test.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index e07e71a..ad28456 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -248,10 +248,8 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { } } -// Skipping addons test due to this bug: https://github.ibm.com/ibmcloud/content-catalog/issues/6057 func TestAddonsDefaultConfiguration(t *testing.T) { - - t.Skip() + t.Parallel() options := testaddons.TestAddonsOptionsDefault(&testaddons.TestAddonOptions{ Testing: t, From 55b9f9be074a00bd0dd258d0604d2731f529007e Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 20:24:21 +0530 Subject: [PATCH 21/30] update test --- tests/pr_test.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index ad28456..4509c98 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -262,8 +262,9 @@ func TestAddonsDefaultConfiguration(t *testing.T) { "deploy-arch-ibm-is-private-path-ext-conn", "fully-configurable", map[string]interface{}{ - "region": "eu-de", - "secrets_manager_service_plan": "trial", + "region": "eu-de", + "secrets_manager_service_plan": "trial", + "private_path_service_endpoints": []string{"vpc-pps.dev.internal"}, }, ) From 514376c7bb26ed585f87d2da25862d950989b57c Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 21:18:12 +0530 Subject: [PATCH 22/30] test --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index db82593..38fd22f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -610,7 +610,7 @@ "fully-configurable" ], "catalog_id": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc", - "optional": true, + "optional": false, "on_by_default": true, "input_mapping": [ { From 998e2d9282e6649cc939bb2bda7afc56710f0013 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 21:46:23 +0530 Subject: [PATCH 23/30] test --- ibm_catalog.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 38fd22f..4208c17 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -610,8 +610,8 @@ "fully-configurable" ], "catalog_id": "1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc", - "optional": false, - "on_by_default": true, + "optional": true, + "on_by_default": false, "input_mapping": [ { "dependency_input": "prefix", From c80113a470c88c34bf8d9b464d3ef0589e20eaf7 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Tue, 16 Dec 2025 22:28:30 +0530 Subject: [PATCH 24/30] skip addon test --- tests/pr_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index 4509c98..8360dce 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -249,7 +249,7 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { } func TestAddonsDefaultConfiguration(t *testing.T) { - t.Parallel() + t.Skip() // See, https://github.ibm.com/ibmcloud/content-catalog/issues/6057 options := testaddons.TestAddonsOptionsDefault(&testaddons.TestAddonOptions{ Testing: t, From 1d45e600e8d70fb70203b063c8f6bdac7f2a2333 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Wed, 17 Dec 2025 07:43:40 +0530 Subject: [PATCH 25/30] update test --- tests/pr_test.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index 8360dce..3f3adc1 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -249,7 +249,7 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { } func TestAddonsDefaultConfiguration(t *testing.T) { - t.Skip() // See, https://github.ibm.com/ibmcloud/content-catalog/issues/6057 + t.Parallel() options := testaddons.TestAddonsOptionsDefault(&testaddons.TestAddonOptions{ Testing: t, @@ -268,8 +268,16 @@ func TestAddonsDefaultConfiguration(t *testing.T) { }, ) - // use existing secrets manager instance to prevent hitting 20 trial instance limit in account options.AddonConfig.Dependencies = []cloudinfo.AddonConfig{ + // The VPC must be created explicitly because it is disabled by default in the catalog configuration due to this issue(https://github.ibm.com/ibmcloud/content-catalog/issues/6057). + { + OfferingName: "deploy-arch-ibm-slz-vpc", + OfferingFlavor: "fully-configurable", + Inputs: map[string]interface{}{ + "region": "eu-de", + }, + }, + // use existing secrets manager instance to prevent hitting 20 trial instance limit in account { OfferingName: "deploy-arch-ibm-secrets-manager", OfferingFlavor: "fully-configurable", @@ -280,7 +288,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { "secret_groups": []string{}, // passing empty array for secret groups as default value is creating general group and it will cause conflicts as we are using an existing SM }, }, - // // Disable target / route creation to prevent hitting quota in account + // Disable target / route creation to prevent hitting quota in account { OfferingName: "deploy-arch-ibm-cloud-monitoring", OfferingFlavor: "fully-configurable", From 4203c93a6a926b9c4c98e70dd4813086909c4c32 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Thu, 18 Dec 2025 18:32:52 +0530 Subject: [PATCH 26/30] Update pr_test.go --- tests/pr_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/pr_test.go b/tests/pr_test.go index 3f3adc1..7abad19 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -273,6 +273,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { { OfferingName: "deploy-arch-ibm-slz-vpc", OfferingFlavor: "fully-configurable", + Enabled: core.BoolPtr(true), Inputs: map[string]interface{}{ "region": "eu-de", }, From 5bba9559760b6847b3a7f7b0afd77b0fe38fea28 Mon Sep 17 00:00:00 2001 From: Shikha Maheshwari Date: Thu, 18 Dec 2025 19:15:31 +0530 Subject: [PATCH 27/30] fix pre-commit failure --- tests/pr_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index 7abad19..cb9360b 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -8,6 +8,7 @@ import ( "strings" "testing" + "github.com/IBM/go-sdk-core/v5/core" "github.com/gruntwork-io/terratest/modules/files" "github.com/gruntwork-io/terratest/modules/logger" "github.com/gruntwork-io/terratest/modules/random" @@ -273,7 +274,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { { OfferingName: "deploy-arch-ibm-slz-vpc", OfferingFlavor: "fully-configurable", - Enabled: core.BoolPtr(true), + Enabled: core.BoolPtr(true), Inputs: map[string]interface{}{ "region": "eu-de", }, From a5f09c4c71c2a764e4a8d855abac19c1aaa255b1 Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Fri, 19 Dec 2025 12:52:06 +0530 Subject: [PATCH 28/30] update region --- tests/pr_test.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index cb9360b..ab5e1e4 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -252,6 +252,15 @@ func TestFullyConfigurableSolutionExistingResources(t *testing.T) { func TestAddonsDefaultConfiguration(t *testing.T) { t.Parallel() + // Verify ibmcloud_api_key variable is set + checkVariable := "TF_VAR_ibmcloud_api_key" + val, present := os.LookupEnv(checkVariable) + require.True(t, present, checkVariable+" environment variable not set") + require.NotEqual(t, "", val, checkVariable+" environment variable is empty") + + // Programmatically determine region to use based on availability + region, _ := testhelper.GetBestVpcRegion(val, "../common-dev-assets/common-go-assets/cloudinfo-region-vpc-gen2-prefs.yaml", "eu-de") + options := testaddons.TestAddonsOptionsDefault(&testaddons.TestAddonOptions{ Testing: t, Prefix: "pp-vpc", @@ -263,7 +272,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { "deploy-arch-ibm-is-private-path-ext-conn", "fully-configurable", map[string]interface{}{ - "region": "eu-de", + "region": region, "secrets_manager_service_plan": "trial", "private_path_service_endpoints": []string{"vpc-pps.dev.internal"}, }, @@ -276,7 +285,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { OfferingFlavor: "fully-configurable", Enabled: core.BoolPtr(true), Inputs: map[string]interface{}{ - "region": "eu-de", + "region": region, }, }, // use existing secrets manager instance to prevent hitting 20 trial instance limit in account From f7ce67fa1651f6ac00f98fc6c2b3a7303d0485fc Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Fri, 19 Dec 2025 13:50:35 +0530 Subject: [PATCH 29/30] update secret manager --- tests/pr_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/pr_test.go b/tests/pr_test.go index ab5e1e4..66afb4e 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -293,7 +293,7 @@ func TestAddonsDefaultConfiguration(t *testing.T) { OfferingName: "deploy-arch-ibm-secrets-manager", OfferingFlavor: "fully-configurable", Inputs: map[string]interface{}{ - "existing_secrets_manager_crn": permanentResources["privateOnlySecMgrCRN"], + "existing_secrets_manager_crn": permanentResources["secretsManagerCRN"], "service_plan": "__NULL__", // no plan value needed when using existing SM "skip_secrets_manager_iam_auth_policy": true, // since using an existing Secrets Manager instance, attempting to re-create auth policy can cause conflicts if the policy already exists "secret_groups": []string{}, // passing empty array for secret groups as default value is creating general group and it will cause conflicts as we are using an existing SM From b62667026aa141e2ddb21e46c3777970ef1c0c7e Mon Sep 17 00:00:00 2001 From: "aashiq.jacob@ibm.com" Date: Fri, 19 Dec 2025 19:37:14 +0530 Subject: [PATCH 30/30] update wrapper --- tests/go.mod | 26 ++++++++++++-------------- tests/go.sum | 44 ++++++++++++++++++++++---------------------- 2 files changed, 34 insertions(+), 36 deletions(-) diff --git a/tests/go.mod b/tests/go.mod index 6933441..99492a3 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -1,22 +1,20 @@ module github.com/terraform-ibm-modules/terraform-ibm-vpc-private-path-external-connectivity -go 1.24.0 - -toolchain go1.25.4 +go 1.25.5 require ( + github.com/IBM/go-sdk-core/v5 v5.21.2 github.com/gruntwork-io/terratest v0.54.0 github.com/stretchr/testify v1.11.1 - github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.34 + github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.64.0 ) require ( dario.cat/mergo v1.0.0 // indirect github.com/IBM-Cloud/bluemix-go v0.0.0-20240719075425-078fcb3a55be // indirect - github.com/IBM-Cloud/power-go-client v1.14.3 // indirect + github.com/IBM-Cloud/power-go-client v1.14.4 // indirect github.com/IBM/cloud-databases-go-sdk v0.8.1 // indirect - github.com/IBM/go-sdk-core/v5 v5.21.2 // indirect - github.com/IBM/platform-services-go-sdk v0.90.4 // indirect + github.com/IBM/platform-services-go-sdk v0.91.0 // indirect github.com/IBM/project-go-sdk v0.4.0 // indirect github.com/IBM/schematics-go-sdk v0.4.0 // indirect github.com/IBM/vpc-go-sdk v1.0.2 // indirect @@ -37,7 +35,7 @@ require ( github.com/go-logr/logr v1.4.2 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-openapi/analysis v0.23.0 // indirect - github.com/go-openapi/errors v0.22.4 // indirect + github.com/go-openapi/errors v0.22.5 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect github.com/go-openapi/loads v0.22.0 // indirect @@ -90,13 +88,13 @@ require ( go.opentelemetry.io/otel/metric v1.35.0 // indirect go.opentelemetry.io/otel/trace v1.35.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect - golang.org/x/crypto v0.45.0 // indirect - golang.org/x/mod v0.29.0 // indirect + golang.org/x/crypto v0.46.0 // indirect + golang.org/x/mod v0.30.0 // indirect golang.org/x/net v0.47.0 // indirect - golang.org/x/sync v0.18.0 // indirect - golang.org/x/sys v0.38.0 // indirect - golang.org/x/text v0.31.0 // indirect - golang.org/x/tools v0.38.0 // indirect + golang.org/x/sync v0.19.0 // indirect + golang.org/x/sys v0.39.0 // indirect + golang.org/x/text v0.32.0 // indirect + golang.org/x/tools v0.39.0 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/tests/go.sum b/tests/go.sum index 15db54f..d7a5dfb 100644 --- a/tests/go.sum +++ b/tests/go.sum @@ -2,15 +2,15 @@ dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= github.com/IBM-Cloud/bluemix-go v0.0.0-20240719075425-078fcb3a55be h1:USOcBHkYQ4o/ccoEvoHinrba8NQthLJpFXnAoBY+MI4= github.com/IBM-Cloud/bluemix-go v0.0.0-20240719075425-078fcb3a55be/go.mod h1:/7hMjdZA6fEpd/dQAOEABxKEwN0t72P3PlpEDu0Y7bE= -github.com/IBM-Cloud/power-go-client v1.14.3 h1:qRA+DnqKSRfcgCeJRDUQXlqipYd6nWtNblubDeRYmhY= -github.com/IBM-Cloud/power-go-client v1.14.3/go.mod h1:SpTK1ttW8bfMNUVQS8qOEuWn2KOkzaCLyzfze8MG1JE= +github.com/IBM-Cloud/power-go-client v1.14.4 h1:XXQp4atVwvCfDps1nF5zyi2FzNbsuHtszz5nBJ9yCYg= +github.com/IBM-Cloud/power-go-client v1.14.4/go.mod h1:TT0jJbptQuDRwB9PPYDcGe0ZwFSl5GiSrNuQeJzJYco= github.com/IBM/cloud-databases-go-sdk v0.8.1 h1:ULQ5L8V/9z79/qS185LqbIK2LD4kMtk3Hdhp4lFMVcw= github.com/IBM/cloud-databases-go-sdk v0.8.1/go.mod h1:JYucI1PdwqbAd8XGdDAchxzxRP7bxOh1zUnseovHKsc= github.com/IBM/go-sdk-core/v5 v5.9.2/go.mod h1:YlOwV9LeuclmT/qi/LAK2AsobbAP42veV0j68/rlZsE= github.com/IBM/go-sdk-core/v5 v5.21.2 h1:mJ5QbLPOm4g5qhZiVB6wbSllfpeUExftGoyPek2hk4M= github.com/IBM/go-sdk-core/v5 v5.21.2/go.mod h1:ngpMgwkjur1VNUjqn11LPk3o5eCyOCRbcfg/0YAY7Hc= -github.com/IBM/platform-services-go-sdk v0.90.4 h1:60oLi1S/9C23/BidRSC1MWNlQVEezk+x4giOb9NkEPQ= -github.com/IBM/platform-services-go-sdk v0.90.4/go.mod h1:KAnBhxKaYsu9It2aVXV6oCPEj78imvTs2qSG0ScZKpM= +github.com/IBM/platform-services-go-sdk v0.91.0 h1:5o4XotMmP9UfCg9BKG0cx/pTAMhBh0KzjyFQQyHZTgE= +github.com/IBM/platform-services-go-sdk v0.91.0/go.mod h1:KAnBhxKaYsu9It2aVXV6oCPEj78imvTs2qSG0ScZKpM= github.com/IBM/project-go-sdk v0.4.0 h1:72pEtVHJn434+MYRawER7Hk/kblapdfotoLBBhjv/jo= github.com/IBM/project-go-sdk v0.4.0/go.mod h1:FOJM9ihQV3EEAY6YigcWiTNfVCThtdY8bLC/nhQHFvo= github.com/IBM/schematics-go-sdk v0.4.0 h1:x01f/tPquYJYLQzJLGuxWfCbV/EdSMXRikOceNy/JLM= @@ -83,8 +83,8 @@ github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC0 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo= github.com/go-openapi/errors v0.19.8/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M= github.com/go-openapi/errors v0.20.3/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk= -github.com/go-openapi/errors v0.22.4 h1:oi2K9mHTOb5DPW2Zjdzs/NIvwi2N3fARKaTJLdNabaM= -github.com/go-openapi/errors v0.22.4/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk= +github.com/go-openapi/errors v0.22.5 h1:Yfv4O/PRYpNF3BNmVkEizcHb3uLVVsrDt3LNdgAKRY4= +github.com/go-openapi/errors v0.22.5/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk= github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic= github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk= github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ= @@ -297,8 +297,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.34 h1:eED28nDc2If2KjsEi5VBAUt0at+FxVJw/lUcwzeW8Ck= -github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.60.34/go.mod h1:VCaRJKjjwIqWMdXqMwvC/9WCwWe8lBTRZrkYrQbcNUU= +github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.64.0 h1:uaGN3RMlOpmkqCXPjlygPiCqnGhszYP6YU3rWWsp0wc= +github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.64.0/go.mod h1:HqX0S0Ue19y7TJRGR5+Np2Aq0xElgw3mM3zZCWwQc1I= github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tmccombs/hcl2json v0.6.4 h1:/FWnzS9JCuyZ4MNwrG4vMrFrzRgsWEOVi+1AyYUVLGw= github.com/tmccombs/hcl2json v0.6.4/go.mod h1:+ppKlIW3H5nsAsZddXPy2iMyvld3SHxyjswOZhavRDk= @@ -347,8 +347,8 @@ golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98y golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= +golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -359,8 +359,8 @@ golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= -golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= +golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= +golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -400,8 +400,8 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= -golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= +golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -438,8 +438,8 @@ golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= -golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= +golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -454,8 +454,8 @@ golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= +golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= +golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -472,8 +472,8 @@ golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= -golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= +golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= @@ -489,8 +489,8 @@ golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0= -golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= -golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= +golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ= +golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=