Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: service credential source service role #304

Merged
merged 2 commits into from
Feb 5, 2025
Merged

fix: service credential source service role #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b67731e
fix: service credential source service role
shemau Jan 27, 2025
fdeb219
Merge branch 'main' into role-crn
shemau Jan 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 6 additions & 10 deletions solutions/standard/DA-types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ In the configuration, specify the secret group name, whether it already exists o
#### Options for service_credentials

- `secret_name`: (required): A unique human-readable name of the secret to create.
- `service_credentials_source_service_role`: (required): The role to give the service credential in the Databases for RabbitMQ service. Acceptable values are `Writer`, `Reader`, `Manager`, and `None`
- `service_credentials_source_service_role_crn`: (required): The CRN of the role to give the service credential in the IBM Cloud Database service. Service credentials role CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role.
- `secret_labels`: (optional, default = `[]`): Labels of the secret to create. Up to 30 labels can be created. Labels can be 2 - 30 characters, including spaces. Special characters that are not permitted include the angled brackets (<>), comma (,), colon (:), ampersand (&), and vertical pipe character (|).
- `secret_auto_rotation`: (optional, default = `true`): Whether to configure automatic rotation of service credential.
- `secret_auto_rotation_unit`: (optional, default = `day`): Specifies the unit of time for rotation of a secret. Acceptable values are `day` or `month`.
Expand All @@ -69,11 +69,11 @@ The following example includes all the configuration options for four service cr
{
"secret_group_name": "sg-1"
"existing_secret_group": true
"service_credentials": [ # pragma: allowlist secret
"service_credentials": [ # pragma: allowlist secret
{
"secret_name": "cred-1"
"service_credentials_source_service_role": "Writer"
"secret_labels": ["test-writer-1", "test-writer-2"]
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor"
"secret_labels": ["test-editor-1", "test-editor-2"]
"secret_auto_rotation": true
"secret_auto_rotation_unit": "day"
"secret_auto_rotation_interval": 89
Expand All @@ -82,7 +82,7 @@ The following example includes all the configuration options for four service cr
},
{
"secret_name": "cred-2"
"service_credentials_source_service_role": "Reader"
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
}
]
},
Expand All @@ -91,11 +91,7 @@ The following example includes all the configuration options for four service cr
"service_credentials": [ # pragma: allowlist secret
{
"secret_name": "cred-3"
"service_credentials_source_service_role": "Editor"
},
{
"secret_name": "cred-4"
"service_credentials_source_service_role": "None"
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
}
]
}
Expand Down
22 changes: 11 additions & 11 deletions solutions/standard/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,16 +298,16 @@ locals {
existing_secret_group = service_credentials.existing_secret_group
secrets = [
for secret in service_credentials.service_credentials : {
secret_name = secret.secret_name
secret_labels = secret.secret_labels
secret_auto_rotation = secret.secret_auto_rotation
secret_auto_rotation_unit = secret.secret_auto_rotation_unit
secret_auto_rotation_interval = secret.secret_auto_rotation_interval
service_credentials_ttl = secret.service_credentials_ttl
service_credential_secret_description = secret.service_credential_secret_description
service_credentials_source_service_role = secret.service_credentials_source_service_role
service_credentials_source_service_crn = module.rabbitmq.crn
secret_type = "service_credentials" #checkov:skip=CKV_SECRET_6
secret_name = secret.secret_name
secret_labels = secret.secret_labels
secret_auto_rotation = secret.secret_auto_rotation
secret_auto_rotation_unit = secret.secret_auto_rotation_unit
secret_auto_rotation_interval = secret.secret_auto_rotation_interval
service_credentials_ttl = secret.service_credentials_ttl
service_credential_secret_description = secret.service_credential_secret_description
service_credentials_source_service_role_crn = secret.service_credentials_source_service_role_crn
service_credentials_source_service_crn = module.rabbitmq.crn
secret_type = "service_credentials" #checkov:skip=CKV_SECRET_6
}
]
}
Expand All @@ -325,7 +325,7 @@ module "secrets_manager_service_credentials" {
count = length(local.service_credential_secrets) > 0 ? 1 : 0
depends_on = [time_sleep.wait_for_rabbitmq_authorization_policy]
source = "terraform-ibm-modules/secrets-manager/ibm//modules/secrets"
version = "1.19.10"
version = "1.22.0"
existing_sm_instance_guid = local.existing_secrets_manager_instance_guid
existing_sm_instance_region = local.existing_secrets_manager_instance_region
endpoint_type = var.existing_secrets_manager_endpoint_type
Expand Down
25 changes: 12 additions & 13 deletions solutions/standard/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,30 +263,29 @@ variable "service_credential_secrets" {
secret_group_description = optional(string)
existing_secret_group = optional(bool)
service_credentials = list(object({
secret_name = string
service_credentials_source_service_role = string
secret_labels = optional(list(string))
secret_auto_rotation = optional(bool)
secret_auto_rotation_unit = optional(string)
secret_auto_rotation_interval = optional(number)
service_credentials_ttl = optional(string)
service_credential_secret_description = optional(string)
secret_name = string
service_credentials_source_service_role_crn = string
secret_labels = optional(list(string))
secret_auto_rotation = optional(bool)
secret_auto_rotation_unit = optional(string)
secret_auto_rotation_interval = optional(number)
service_credentials_ttl = optional(string)
service_credential_secret_description = optional(string)

}))
}))
default = []
description = "Service credential secrets configuration for Databases for RabbitMQ. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-icd-rabbitmq/tree/main/solutions/standard/DA-types.md#service-credential-secrets)."

validation {
# Service roles CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role
condition = alltrue([
for group in var.service_credential_secrets : alltrue([
for credential in group.service_credentials : contains(
["Writer", "Reader", "Manager", "None"], credential.service_credentials_source_service_role
)
# crn:v?:bluemix; two non-empty segments; three possibly empty segments; :serviceRole or role: non-empty segment
for credential in group.service_credentials : can(regex("^crn:v[0-9]:bluemix(:..*){2}(:.*){3}:(serviceRole|role):..*$", credential.service_credentials_source_service_role_crn))
])
])
error_message = "service_credentials_source_service_role role must be one of 'Writer', 'Reader', 'Manager', and 'None'."

error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles"
}
}

Expand Down
4 changes: 2 additions & 2 deletions tests/pr_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,11 +134,11 @@ func TestRunStandardSolutionSchematics(t *testing.T) {
"service_credentials": []map[string]string{
{
"secret_name": fmt.Sprintf("%s-cred-reader", options.Prefix),
"service_credentials_source_service_role": "Reader",
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer",
},
{
"secret_name": fmt.Sprintf("%s-cred-writer", options.Prefix),
"service_credentials_source_service_role": "Writer",
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor",
},
},
},
Expand Down