feat: Add validation for OCP AI add-ons

main.tf

@@ -51,6 +51,18 @@ locals {
   disable_outbound_traffic_protection = startswith(local.ocp_version, "4.14") ? null : var.disable_outbound_traffic_protection
 }
 
+########################################################################################################################
+# Get OCP AI Add-on Versions
+########################################################################################################################
+
+data "external" "ocp_ai_addon_versions" {
+  program = ["bash", "${path.module}/scripts/get_ocp_ai_addon_versions.sh"]
+  query = {
+    ibmcloud_api_key = "xxxxxxxxxxxxxxxx", # Not sure where to get the API key; it’s required to log in to the IBM Cloud CLI.
+    region           = var.region
+  }
+}
+
 # Local block to verify validations for OCP AI Addon.
 locals {
 
@@ -63,6 +75,7 @@ locals {
       is_gpu    = contains(["gx2", "gx3", "gx4"], split(".", pool.machine_type)[0])
     }
   }
+  ocp_addon_versions_map = data.external.ocp_ai_addon_versions.result
 }
 
 # Separate local block to handle os validations

scripts/get_ocp_ai_addon_versions.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+#############################################
+# Read Input
+#############################################
+
+INPUT="$(tee)"
+REGION="$(echo "$INPUT" | jq -r '.region // empty')"
+IBMCLOUD_API_KEY="$(echo "$INPUT" | jq -r '.ibmcloud_api_key // empty')"
+
+#############################################
+# Validate Input
+#############################################
+
+if [[ -z "$IBMCLOUD_API_KEY" ]]; then
+  echo "Error: IBMCLOUD_API_KEY is required." >&2
+  exit 1
+fi
+
+if [[ -z "$REGION" ]]; then
+  echo "Error: REGION is required." >&2
+  exit 1
+fi
+
+#############################################
+# IBM Cloud Login
+#############################################
+
+if ! ibmcloud login --apikey "$IBMCLOUD_API_KEY" -r "$REGION" >&2; then
+  echo "Error: Failed to authenticate with IBM Cloud." >&2
+  exit 1
+fi
+
+#############################################
+# Fetch and Extract 'openshift-ai' Add-on Versions
+#############################################
+
+OCP_AI_ADDON_VERSION_LIST="$(ibmcloud oc cluster addon versions --output json 2>/dev/null | jq -r '.[] | select(.name == "openshift-ai") | "\(.version) \(.supportedOCPRange)"' || true)"
+
+if [[ -z "$OCP_AI_ADDON_VERSION_LIST" ]]; then
+  echo "Error: Failed to retrieve or parse openshift-ai add-on versions." >&2
+  exit 1
+fi
+
+
+#############################################
+# Convert to JSON Output
+#############################################
+
+OUTPUT_JSON="$(echo "$OCP_AI_ADDON_VERSION_LIST" | jq -R -s -c 'split("\n")[:-1] | map(split(" ")) | map({ (.[0]): (.[1] + " " + .[2]) }) | add')"
+
+if [[ -z "$OUTPUT_JSON" ]]; then
+  echo "Error: Failed to produce JSON output." >&2
+  exit 1
+fi
+
+#############################################
+# Final Output
+#############################################
+
+echo "$OUTPUT_JSON"

variables.tf

@@ -364,9 +364,22 @@ variable "addons" {
   nullable    = false
   default     = {}
 
+  ########################################################################################################################
+  # OCP AI Addon version validation
+  ########################################################################################################################
+
   validation {
-    condition     = (lookup(var.addons, "openshift-ai", null) != null ? lookup(var.addons["openshift-ai"], "version", null) == null : true) || (tonumber(local.ocp_version_num) >= 4.16)
-    error_message = "OCP AI add-on requires OCP version >= 4.16.0"
+    condition = (
+      lookup(var.addons, "openshift-ai", null) == null ||
+      lookup(var.addons["openshift-ai"], "version", null) == null ||
+      (contains(keys(local.ocp_addon_versions_map), var.addons["openshift-ai"].version) &&
+        (local.ocp_version_num >= tonumber(regexall("\\d+\\.\\d+", split(" ", lookup(local.ocp_addon_versions_map, var.addons["openshift-ai"].version, null))[0])[0])) &&
+        (local.ocp_version_num < tonumber(regexall("\\d+\\.\\d+", split(" ", lookup(local.ocp_addon_versions_map, var.addons["openshift-ai"].version, null))[1])[0]))
+      )
+    )
+    error_message = (var.addons["openshift-ai"] != null && var.addons["openshift-ai"].version != null) ? (contains(keys(local.ocp_addon_versions_map), var.addons["openshift-ai"].version) ?
+      format("OCP AI add-on version: %s requires OCP version %s", var.addons["openshift-ai"].version, local.ocp_addon_versions_map[var.addons["openshift-ai"].version]) :
+    format("OCP AI add-on version: %s is not supported.", var.addons["openshift-ai"].version)) : null
   }
 
   validation {