Skip to content

Commit 1bd1a05

Browse files
imprateekshimprateeksh
authored
feat: init functional release (#15)
feat: init functional release
1 parent b57fe71 commit 1bd1a05

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+2438
-402
lines changed

‎.github/settings.yml

+2-5
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,9 @@ repository:
1414

1515
# By changing this field, you rename the repository.
1616

17-
# Uncomment this name property and set the name to the current repo name.
18-
# name: ""
17+
name: "terraform-ibm-base-ocp-vpc"
1918

2019
# The description is displayed under the repository name on the
2120
# organization page and in the 'About' section of the repository.
2221

23-
# Uncomment this description property
24-
# and update the description to the current repo description.
25-
# description: ""
22+
description: "Provision an IBM Cloud Red Hat OpenShift cluster on VPC Gen2"

‎.github/workflows/ci.yml

+3
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,6 @@ jobs:
1515
call-terraform-ci-pipeline:
1616
uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-terraform-module-ci.yml@v1.7.3
1717
secrets: inherit
18+
with:
19+
craTarget: "examples/standard"
20+
craGoalIgnoreFile: "cra-tf-validate-ignore-goals.json"

‎.gitignore

+4-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ crash.log
1616
#
1717
*.tfvars
1818

19+
.history/*
20+
1921
# Ignore files for local testing
2022
test.tf
2123

@@ -37,7 +39,7 @@ override.tf.json
3739
.terraformrc
3840
terraform.rc
3941

40-
# Ignore .tfsec
42+
# Ignore tfsec
4143
.tfsec/
4244

4345
# Ignore brew lock
@@ -52,5 +54,5 @@ Brewfile.lock.json
5254
# Node modules
5355
/node_modules
5456

55-
# Visual Studio Code
57+
# VS Code State
5658
.vscode/

‎.secrets.baseline

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
"name": "CloudantDetector"
2929
},
3030
{
31-
"ghe_instance": "github.ibm.com",
31+
"ghe_instance": "github.com",
3232
"name": "GheDetector"
3333
},
3434
{

‎README.md

+146-119
Large diffs are not rendered by default.

‎cra-tf-validate-ignore-goals.json

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"scc_goals": [
3+
{
4+
"scc_goal_id": "3000408",
5+
"description": "Check whether Flow Logs for VPC are enabled",
6+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3645",
7+
"is_valid": true
8+
},
9+
{
10+
"scc_goal_id": "3000902",
11+
"description:": "Check whether OpenShift clusters are accessible only by using private endpoints",
12+
"ignore_reason": "This is a valid issue - tracking in https://github.ibm.com/GoldenEye/issues/issues/174",
13+
"is_valid": true
14+
},
15+
{
16+
"scc_goal_id": "3000258",
17+
"description": "Check whether Cloud Object Storage has at least # users with the IAM manager role",
18+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
19+
"is_valid": true
20+
},
21+
{
22+
"scc_goal_id": "3000259",
23+
"description:": "Check whether Cloud Object Storage has at least # service IDs with the IAM manager role",
24+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
25+
"is_valid": true
26+
},
27+
{
28+
"scc_goal_id": "3000266",
29+
"description": "Check whether Key Protect has at least # users with the IAM manager role",
30+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
31+
"is_valid": true
32+
},
33+
{
34+
"scc_goal_id": "3000267",
35+
"description:": "Check whether Key Protect has at least # service IDs with the IAM manager role",
36+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
37+
"is_valid": true
38+
},
39+
{
40+
"scc_goal_id": "3000402",
41+
"description": "Check whether Cloud Internet Services (CIS) has DDoS protection enabled",
42+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
43+
"is_valid": true
44+
},
45+
{
46+
"scc_goal_id": "3000418",
47+
"description:": "Check whether account has at least one VPN or Direct Link configured",
48+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/3905",
49+
"is_valid": true
50+
},
51+
{
52+
"scc_goal_id": "3000441",
53+
"description": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to port 22",
54+
"ignore_reason": "This is a false alert. The way the subnets are arranged in the VPC ensures proper workload isolation. And it's not a violation of any NIST, SOC or other control. On the contrary, FedRAMP makes it clear that SG or ACLs are currently not seen as a security boundary, only subnets (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf)",
55+
"is_valid": false
56+
},
57+
{
58+
"scc_goal_id": "3000442",
59+
"description:": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to port 3389",
60+
"ignore_reason": "This is a false alert. The way the subnets are arranged in the VPC ensures proper workload isolation. And it's not a violation of any NIST, SOC or other control. On the contrary, FedRAMP makes it clear that SG or ACLs are currently not seen as a security boundary, only subnets (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf)",
61+
"is_valid": false
62+
},
63+
{
64+
"scc_goal_id": "3000451",
65+
"description": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port",
66+
"ignore_reason": "This is a false alert. The way the subnets are arranged in the VPC ensures proper workload isolation. And it's not a violation of any NIST, SOC or other control. On the contrary, FedRAMP makes it clear that SG or ACLs are currently not seen as a security boundary, only subnets (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf)",
67+
"is_valid": false
68+
},
69+
{
70+
"scc_goal_id": "3000452",
71+
"description:": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port",
72+
"ignore_reason": "This is a false alert. The way the subnets are arranged in the VPC ensures proper workload isolation. And it's not a violation of any NIST, SOC or other control. On the contrary, FedRAMP makes it clear that SG or ACLs are currently not seen as a security boundary, only subnets (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf)",
73+
"is_valid": false
74+
},
75+
{
76+
"scc_goal_id": "3000907",
77+
"description:": "Check whether OpenShift version is up-to-date",
78+
"ignore_reason": "Tracking in https://github.ibm.com/GoldenEye/issues/issues/4000",
79+
"is_valid": true
80+
}
81+
]
82+
}

‎examples/default/README.md

-8
This file was deleted.

‎examples/default/main.tf

-20
This file was deleted.

‎examples/default/outputs.tf

-18
This file was deleted.

‎examples/default/provider.tf

-4
This file was deleted.

‎examples/default/variables.tf

-29
This file was deleted.

‎examples/default/version.tf

-10
This file was deleted.

‎examples/existing-resources/README.md

-3
This file was deleted.

‎examples/existing-resources/main.tf

-3
This file was deleted.

‎examples/existing-resources/outputs.tf

-8
This file was deleted.

‎examples/existing-resources/provider.tf

-4
This file was deleted.

‎examples/existing-resources/variables.tf

-15
This file was deleted.

‎examples/existing-resources/version.tf

-10
This file was deleted.

‎examples/existing_cos/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Existing COS
2+
3+
The example will provision an OCP cluster into a given VPC using an existing COS instance.

‎examples/existing_cos/main.tf

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
##############################################################################
2+
# Provision an OCP cluster using an existing COS instance.
3+
##############################################################################
4+
5+
module "ocp_base" {
6+
source = "../.."
7+
ibmcloud_api_key = var.ibmcloud_api_key
8+
ocp_version = var.ocp_version
9+
region = var.region
10+
tags = var.resource_tags
11+
cluster_name = var.prefix
12+
resource_group_id = var.resource_group
13+
force_delete_storage = true
14+
vpc_id = var.vpc_id
15+
vpc_subnets = var.vpc_subnets
16+
use_existing_cos = true
17+
existing_cos_id = var.existing_cos_id
18+
}
19+
20+
##############################################################################

‎examples/existing_cos/outputs.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "cluster_name" {
6+
value = module.ocp_base.cluster_name
7+
description = "The name of the provisioned cluster."
8+
}
9+
10+
##############################################################################

‎examples/existing_cos/provider.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
##############################################################################
2+
# Terraform providers
3+
##############################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}
9+
10+
##############################################################################

‎examples/existing_cos/variables.tf

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
##############################################################################
2+
# Input Variables
3+
##############################################################################
4+
5+
variable "ibmcloud_api_key" {
6+
type = string
7+
description = "The IBM Cloud api token"
8+
sensitive = true
9+
}
10+
11+
variable "resource_group" {
12+
type = string
13+
description = "Resource group to provision the cluster in"
14+
default = null
15+
}
16+
17+
variable "resource_tags" {
18+
type = list(string)
19+
description = "Optional list of tags to be added to created resources"
20+
default = []
21+
}
22+
23+
variable "prefix" {
24+
type = string
25+
description = "Prefix for name of all resource created by this example"
26+
default = "base-ocp-prev-cos"
27+
validation {
28+
error_message = "Prefix must begin and end with a letter and contain only letters, numbers, and - characters."
29+
condition = can(regex("^([A-z]|[a-z][-a-z0-9]*[a-z0-9])$", var.prefix))
30+
}
31+
}
32+
33+
variable "region" {
34+
type = string
35+
description = "Region where resources are created"
36+
default = "eu-gb"
37+
}
38+
39+
variable "ocp_version" {
40+
type = string
41+
description = "Version of the OCP cluster to provision"
42+
default = null
43+
}
44+
45+
variable "vpc_subnets" {
46+
type = map(list(object({
47+
id = string
48+
zone = string
49+
cidr_block = string
50+
})))
51+
description = "Metadata that describes the VPC's subnets. Obtain this information from the VPC where this cluster will be created"
52+
}
53+
54+
variable "vpc_id" {
55+
type = string
56+
description = "Id of the VPC instance where this cluster will be provisioned"
57+
}
58+
59+
variable "existing_cos_id" {
60+
type = string
61+
description = "The ID of an existing COS instance to use for cluster provisioning"
62+
}
63+
64+
##############################################################################

0 commit comments

Comments
 (0)