Skip to content

Commit fd31ea6

Browse files
akocbekakocbek
authored
feat: initial module release (#5)
1 parent b9f920c commit fd31ea6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+2463
-252
lines changed

‎.github/CODEOWNERS

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
# Primary owner should be listed first in list of global owners, followed by any secondary owners
2-
* @SirSpidey @ocofaigh
2+
* @akocbek @shemau

‎.github/settings.yml

+3-8
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,9 @@ repository:
1515
# By changing this field, you rename the repository.
1616

1717
# Uncomment this name property and set the name to the current repo name.
18-
# name: ""
18+
name: terraform-ibm-code-engine
1919

20-
# The description is displayed under the repository name on the
21-
# organization page and in the 'About' section of the repository.
22-
23-
# Uncomment this description property
24-
# and update the description to the current repo description.
25-
# description: ""
20+
description: "Creates IBM Cloud Code Engine resources."
2621

2722
# Use a comma-separated list of topics to set on the repo (ensure not to use any caps in the topic string).
28-
topics: terraform, ibm-cloud, terraform-module
23+
topics: terraform, ibm-cloud, terraform-module, code-engine, core-team, stable, supported

‎README.md

+113-41
Large diffs are not rendered by default.

‎common-dev-assets

‎cra-config.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/complete" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "examples/apps" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
PROFILE_ID: "0e6e7b5a-817d-4344-ab6f-e5d7a9c49520" # SCC profile ID (currently set to the FSCloud 1.4.0 profile).
7+
CRA_ENVIRONMENT_VARIABLES:
8+
TF_VAR_acme_letsencrypt_private_key: "DUMMY VALUE FOR CRA"
9+
TF_VAR_cis_id: "crn:v1:bluemix:public:internet-svcs:global:a/abac0df06b644a9cabc6e44f55b3880e:59aa1a88-ac47-45e4-bd96-2bc778d26ca7::"
710
# SCC_INSTANCE_ID: "" # The SCC instance ID to use to download profile for CRA scan. If not provided, a default global value will be used.
811
# SCC_REGION: "" # The IBM Cloud region that the SCC instance is in. If not provided, a default global value will be used.
912
# CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs.

‎cra-tf-validate-ignore-rules.json

+20-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
11
{
2-
"scc_rules": []
2+
"scc_rules": [
3+
{
4+
"scc_rule_id": "rule-4d86c074-097e-4ff3-a763-ccff128388e2",
5+
"description": "Check whether multifactor authentication (MFA) is enabled at the account level",
6+
"ignore_reason": "In order for this rule to pass, multifactor authentication (MFA) is enabled at the account level (tracking in https://github.ibm.com/workload-eng-services/HPCCluster/issues/3422).",
7+
"is_valid": true
8+
},
9+
{
10+
"scc_rule_id": "rule-0704e840-e443-4781-b9be-ec57469d09c1",
11+
"description": "Check whether permissions for API key creation are limited and configured in IAM settings for the account owner",
12+
"ignore_reason": "Need more exploration (tracking in https://github.ibm.com/workload-eng-services/HPCCluster/issues/3422).",
13+
"is_valid": true
14+
},
15+
{
16+
"scc_rule_id": "rule-0244c010-fde6-4db3-95aa-8952bd292ac3",
17+
"description": "Check whether permissions for service ID creation are limited and configured in IAM settings for the account owner",
18+
"ignore_reason": "Need more exploration (tracking in https://github.ibm.com/workload-eng-services/HPCCluster/issues/3422).",
19+
"is_valid": true
20+
}
21+
]
322
}

‎examples/apps/README.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Apps example
2+
3+
An end-to-end apps example that will provision the following:
4+
- A new resource group if one is not passed in.
5+
- Code Engine project
6+
- Code Engine App
7+
- Code Engine Config Map
8+
- Code Engine TLS Secret
9+
- Code Engine Domain Mapping
10+
- Secrets Manager Resources (Public Engine, Group, Public Certificate)

‎examples/apps/main.tf

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
########################################################################################################################
2+
# Resource group
3+
########################################################################################################################
4+
5+
module "resource_group" {
6+
source = "terraform-ibm-modules/resource-group/ibm"
7+
version = "1.1.5"
8+
# if an existing resource group is not set (null) create a new one using prefix
9+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
10+
existing_resource_group_name = var.resource_group
11+
}
12+
13+
########################################################################################################################
14+
# Secrets Manager resources
15+
########################################################################################################################
16+
17+
locals {
18+
sm_guid = var.existing_sm_instance_guid == null ? ibm_resource_instance.secrets_manager[0].guid : var.existing_sm_instance_guid
19+
sm_region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
20+
21+
# Certificate issuance is rate limited by domain, by default pick different domains to avoid rate limits during testing
22+
cert_common_name = var.existing_cert_common_name == null ? "${var.prefix}.goldeneye.dev.cloud.ibm.com" : var.existing_cert_common_name
23+
cert_secret_id = var.existing_cert_secret_id == null ? resource.ibm_sm_public_certificate.secrets_manager_public_certificate[0].secret_id : var.existing_cert_secret_id
24+
25+
}
26+
27+
# Create a new SM instance if not using an existing one
28+
resource "ibm_resource_instance" "secrets_manager" {
29+
count = var.existing_sm_instance_guid == null ? 1 : 0
30+
name = "${var.prefix}-sm-instance"
31+
service = "secrets-manager"
32+
plan = var.sm_service_plan
33+
location = local.sm_region
34+
resource_group_id = module.resource_group.resource_group_id
35+
timeouts {
36+
create = "20m" # Extending provisioning time to 20 minutes
37+
}
38+
provider = ibm.ibm-sm
39+
}
40+
41+
# Configure public cert engine if provisioning a new SM instance
42+
module "secrets_manager_public_cert_engine" {
43+
depends_on = [ibm_resource_instance.secrets_manager]
44+
count = var.existing_sm_instance_guid == null ? 1 : 0
45+
source = "terraform-ibm-modules/secrets-manager-public-cert-engine/ibm"
46+
version = "1.0.0"
47+
providers = {
48+
ibm = ibm.ibm-sm
49+
ibm.secret-store = ibm.ibm-sm
50+
}
51+
secrets_manager_guid = local.sm_guid
52+
region = local.sm_region
53+
internet_services_crn = var.cis_id
54+
dns_config_name = var.dns_provider_name
55+
ca_config_name = var.ca_name
56+
acme_letsencrypt_private_key = var.acme_letsencrypt_private_key
57+
private_key_secrets_manager_instance_guid = var.private_key_secrets_manager_instance_guid
58+
private_key_secrets_manager_secret_id = var.private_key_secrets_manager_secret_id
59+
private_key_secrets_manager_region = var.private_key_secrets_manager_region
60+
}
61+
62+
# Create a secret group to place the certificate in
63+
module "secrets_manager_group" {
64+
count = var.existing_cert_secret_id == null ? 1 : 0
65+
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
66+
version = "1.1.4"
67+
region = local.sm_region
68+
secrets_manager_guid = local.sm_guid
69+
secret_group_name = "${var.prefix}-certificates-secret-group"
70+
secret_group_description = "secret group used for private certificates"
71+
providers = {
72+
ibm = ibm.ibm-sm
73+
}
74+
}
75+
76+
resource "ibm_sm_public_certificate" "secrets_manager_public_certificate" {
77+
depends_on = [module.secrets_manager_public_cert_engine]
78+
count = var.existing_cert_secret_id == null ? 1 : 0
79+
80+
instance_id = local.sm_guid
81+
region = local.sm_region
82+
name = local.cert_common_name
83+
description = "Certificate for ${local.cert_common_name} domain"
84+
ca = var.ca_name
85+
dns = var.dns_provider_name
86+
common_name = local.cert_common_name
87+
secret_group_id = module.secrets_manager_group[0].secret_group_id
88+
rotation {
89+
auto_rotate = true
90+
}
91+
}
92+
93+
data "ibm_sm_public_certificate" "public_certificate" {
94+
depends_on = [resource.ibm_sm_public_certificate.secrets_manager_public_certificate]
95+
instance_id = local.sm_guid
96+
region = local.sm_region
97+
secret_id = local.cert_secret_id
98+
}
99+
100+
########################################################################################################################
101+
# Code Engine instance
102+
########################################################################################################################
103+
104+
module "code_engine" {
105+
depends_on = [resource.ibm_sm_public_certificate.secrets_manager_public_certificate]
106+
source = "../.."
107+
resource_group_id = module.resource_group.resource_group_id
108+
project_name = "${var.prefix}-project"
109+
apps = {
110+
"${var.prefix}-app" = {
111+
image_reference = "icr.io/codeengine/helloworld"
112+
run_env_variables = [{
113+
type = "literal"
114+
name = "name_1"
115+
value = "value_1"
116+
},
117+
{
118+
type = "literal"
119+
name = "name_2"
120+
value = "value_2"
121+
}]
122+
scale_cpu_limit = "4",
123+
scale_memory_limit = "32G"
124+
scale_ephemeral_storage_limit = "300M"
125+
managed_domain_mappings = "local_private"
126+
}
127+
"${var.prefix}-app2" = {
128+
image_reference = "icr.io/codeengine/helloworld"
129+
}
130+
}
131+
config_maps = {
132+
"${var.prefix}-cm" = {
133+
data = { "key_1" : "value_1", "key_2" : "value_2" }
134+
}
135+
}
136+
secrets = {
137+
"${var.prefix}-tls" = {
138+
format = "tls"
139+
data = {
140+
"tls_cert" = format("%s%s", data.ibm_sm_public_certificate.public_certificate.certificate, data.ibm_sm_public_certificate.public_certificate.intermediate)
141+
"tls_key" = data.ibm_sm_public_certificate.public_certificate.private_key
142+
}
143+
}
144+
}
145+
domain_mappings = {
146+
# tflint-ignore: terraform_deprecated_interpolation
147+
"${local.cert_common_name}" = {
148+
components = [{
149+
name = "${var.prefix}-app"
150+
resource_type = "app_v2"
151+
}]
152+
tls_secret = "${var.prefix}-tls"
153+
}
154+
}
155+
}

‎examples/apps/outputs.tf

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
########################################################################################################################
2+
# Outputs
3+
########################################################################################################################
4+
5+
output "project_id" {
6+
description = "ID of the created code engine project."
7+
value = module.code_engine.project_id
8+
}
9+
10+
output "app" {
11+
description = "Configuration of the created code engine app."
12+
value = module.code_engine.app
13+
}
14+
15+
output "config_map" {
16+
description = "Configuration of the created code engine config map."
17+
value = module.code_engine.config_map
18+
}
19+
20+
output "secret" {
21+
description = "Configuration of the created code engine secret."
22+
value = module.code_engine.secret
23+
}
24+
25+
output "domain_mapping" {
26+
description = "Configuration of the created code engine domain maping."
27+
value = module.code_engine.domain_mapping
28+
}

‎examples/apps/provider.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
########################################################################################################################
2+
# Provider config
3+
########################################################################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}
9+
10+
provider "ibm" {
11+
ibmcloud_api_key = var.ibmcloud_api_key
12+
region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
13+
alias = "ibm-sm"
14+
}

‎examples/apps/variables.tf

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
########################################################################################################################
2+
# Input variables
3+
########################################################################################################################
4+
5+
variable "ibmcloud_api_key" {
6+
type = string
7+
description = "The IBM Cloud API Key"
8+
sensitive = true
9+
}
10+
11+
variable "region" {
12+
type = string
13+
description = "Region to provision all resources created by this example"
14+
default = "us-south"
15+
}
16+
17+
variable "prefix" {
18+
type = string
19+
description = "Prefix to append to all resources created by this example"
20+
default = "ce-apps"
21+
}
22+
23+
variable "resource_group" {
24+
type = string
25+
description = "The name of an existing resource group to provision resources in to. If not set a new resource group will be created using the prefix variable"
26+
default = null
27+
}
28+
29+
##############################################################
30+
# Secret Manager
31+
##############################################################
32+
33+
variable "sm_service_plan" {
34+
type = string
35+
description = "The service/pricing plan to use when provisioning a new Secrets Manager instance. Allowed values: `standard` and `trial`. Only used if `provision_sm_instance` is set to true."
36+
default = "standard"
37+
}
38+
39+
variable "existing_sm_instance_guid" {
40+
type = string
41+
description = "An existing Secrets Manager GUID. The existing Secret Manager instance must have private certificate engine configured. If not provided an new instance will be provisioned."
42+
default = null
43+
}
44+
45+
variable "existing_sm_instance_region" {
46+
type = string
47+
description = "Required if value is passed into `var.existing_sm_instance_guid`."
48+
default = null
49+
}
50+
51+
variable "existing_cert_common_name" {
52+
type = string
53+
description = "Required if value is passed into `var.existing_sm_instance_guid`."
54+
default = null
55+
}
56+
57+
variable "existing_cert_secret_id" {
58+
type = string
59+
description = "Required if value is passed into `var.existing_sm_instance_guid`."
60+
default = null
61+
}
62+
63+
variable "cis_id" {
64+
type = string
65+
description = "Cloud Internet Service ID"
66+
default = null
67+
}
68+
69+
variable "dns_provider_name" {
70+
type = string
71+
description = "Secret Managers DNS provider name"
72+
default = "certificate-dns"
73+
}
74+
75+
variable "private_key_secrets_manager_instance_guid" {
76+
type = string
77+
description = "The Secrets Manager instance GUID of the Secrets Manager containing your ACME private key. Required if acme_letsencrypt_private_key is not set."
78+
default = null
79+
}
80+
81+
variable "private_key_secrets_manager_secret_id" {
82+
type = string
83+
description = "The secret ID of your ACME private key. Required if acme_letsencrypt_private_key is not set. If both are set, this value will be used as the private key."
84+
default = null
85+
}
86+
87+
variable "private_key_secrets_manager_region" {
88+
type = string
89+
description = "The region of the Secrets Manager instance containing your ACME private key. (Only needed if different from the region variable)"
90+
default = "us-south"
91+
}
92+
93+
variable "ca_name" {
94+
type = string
95+
description = "Secret Managers certificate authority name"
96+
default = "certificate-ca"
97+
}
98+
99+
variable "acme_letsencrypt_private_key" {
100+
type = string
101+
description = "Lets Encrypt private key for certificate authority. If not provided, all created public certs will be immediately deactivated."
102+
default = null
103+
sensitive = true
104+
}

‎examples/apps/version.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
terraform {
3+
required_version = ">= 1.3.0, <1.7.0"
4+
required_providers {
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.63.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)