Skip to content

Commit b17ac9f

Browse files
akocbekakocbek
authored
fix: improve DA user experience (#490)
1 parent 5e3e5af commit b17ac9f

File tree

5 files changed

+75
-63
lines changed

5 files changed

+75
-63
lines changed

‎ibm_catalog.json‎

Lines changed: 37 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -22,37 +22,38 @@
2222
"OpenVPN"
2323
],
2424
"short_description": "Creates client-to-site VPN connectivity to VPC",
25-
"long_description": "Some VPC patterns are configured with private networks not available over the internet. To access these networks, there are several connectivity options. This deployable architecture pattern configures the client-to-site VPN Server connectivity with only a few required inputs to configure it within an existing VPC. Once deployed, you can install an OpenVPN client application and import a profile from the VPN Server on the devices you want to access the VPN. The configuration can include a list of users that will be provided access to the private network, controlled by IBM Cloud IAM.",
25+
"long_description": "Some VPC patterns are configured with private networks not available over the internet. To access these networks, there are several connectivity options. This deployable architecture pattern configures the client-to-site VPN Server connectivity with only a few required inputs to configure it within an existing VPC. Once deployed, you can install an [OpenVPN client application](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-vpn-client) and import a profile from the VPN Server on the devices you want to access the VPN. The configuration can include a list of users that will be provided access to the private network, controlled by IBM Cloud IAM.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
2626
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/blob/main/solutions/fully-configurable/README.md",
2727
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/main/images/c2s_vpn.svg",
2828
"provider_name": "IBM",
2929
"support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in the repository [https://github.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/issues](https://github.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/issues). Please note this product is not supported via the IBM Cloud Support Center.",
3030
"features": [
3131
{
32-
"description": "Supports using an existing Secrets Manager instance, to create a secret group and a new private cert.",
33-
"title": "Configures existing Secrets Manager instance, and create a secret group and a new private cert."
32+
"description": "Secrets Manager",
33+
"title": "Supports configuring an existing [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started) instance to create a secret group and a new private certificate."
3434
},
3535
{
36-
"description": "The network ACL on this subnet grants the access from sources according to the rules defined with 'network_acls' input variable.",
37-
"title": "A subnet named 'client-to-site-subnet' in the VPC"
36+
"description": "ACL rules",
37+
"title": "The [network ACL](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-acls-vpn) on the `client-to-site-subnet` subnet grants access based on the rules defined by the `network_acls` input variable."
3838
},
3939
{
40-
"description": "A new security group named 'client-to-site-sg' that allows incoming request from sources defined in'security_group_rules'",
41-
"title": "client-to-site Security Group"
40+
"description": "Security group",
41+
"title": "Creates a new [security group](https://cloud.ibm.com/docs/security-groups?topic=security-groups-about-ibm-security-groups) named `client-to-site-sg` that allows incoming requests from sources defined in the `security_group_rules` input variable."
4242
},
4343
{
44-
"description": "An IAM access group allowing users to authenticate and connect to the client-to-site VPN gateway",
45-
"title": "A new IAM Access Group for VPN users"
44+
"description": "IAM access group",
45+
"title": "Creates an [IAM access group](https://cloud.ibm.com/docs/account?topic=account-groups&interface=ui) that allows users to authenticate and connect to the client-to-site VPN gateway."
4646
},
4747
{
48-
"description": "VPN gateway located in the client-to-site-subnet subnet with routes configured to allow accessing the VPCs.",
49-
"title": "A client-to-site VPN server"
48+
"description": "VPN gateway",
49+
"title": "Creates a [VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) in the `client-to-site-subnet` subnet, with routes configured to allow access to the VPCs."
5050
}
5151
],
5252
"flavors": [
5353
{
5454
"label": "Fully configurable",
5555
"name": "fully-configurable",
56+
"index": 1,
5657
"install_type": "fullstack",
5758
"working_directory": "solutions/fully-configurable",
5859
"dependency_version_2": true,
@@ -101,7 +102,13 @@
101102
},
102103
{
103104
"key": "prefix",
104-
"required": true
105+
"value_constraints": [
106+
{
107+
"type": "regex",
108+
"description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen ('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters.",
109+
"value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$"
110+
}
111+
]
105112
},
106113
{
107114
"key": "vpn_name",
@@ -281,59 +288,45 @@
281288
"displayname": "public-and-private",
282289
"value": "public-and-private"
283290
}
284-
]
291+
],
292+
"hidden": true
285293
}
286294
],
287295
"iam_permissions": [
288296
{
289297
"role_crns": [
290-
"crn:v1:bluemix:public:iam::::role:Administrator"
298+
"crn:v1:bluemix:public:iam::::role:Viewer"
291299
],
292-
"service_name": "iam-identity"
300+
"service_name": "Resource group only",
301+
"notes": "Viewer access is required in the resource group you want to provision in."
293302
},
294303
{
295304
"role_crns": [
296-
"crn:v1:bluemix:public:iam::::role:Administrator"
305+
"crn:v1:bluemix:public:iam::::role:Editor"
297306
],
298-
"service_name": "is.vpc"
307+
"service_name": "iam-identity",
308+
"notes": "Required for defining IAM access groups, policies, and members for controlled access."
309+
},
310+
{
311+
"role_crns": [
312+
"crn:v1:bluemix:public:iam::::role:Editor"
313+
],
314+
"service_name": "is.vpc",
315+
"notes": "Required to manage and modify VPC resources."
299316
}
300317
],
301318
"architecture": {
302319
"features": [
303320
{
304-
"title": "Supports OpenVPN Clients",
305-
"description": "Yes"
306-
},
307-
{
308-
"title": "Separate IAM access list for VPN users",
309-
"description": "Yes"
310-
},
311-
{
312-
"title": "Separate secured VPC subnets for VPN Server",
313-
"description": "Yes"
314-
},
315-
{
316-
"title": "ACL that controls the access from different source",
317-
"description": "Yes"
318-
},
319-
{
320-
"title": "Security group that restricts the incoming request from different source",
321-
"description": "Yes"
322-
},
323-
{
324-
"title": "IBM-managed VPN Server",
325-
"description": "Yes"
326-
},
327-
{
328-
"title": "Access to private network via VPN clients",
329-
"description": "Yes"
321+
"title": " ",
322+
"description": "Configured to use IBM secure by default standards, but can be edited to fit your use case."
330323
}
331324
],
332325
"diagrams": [
333326
{
334327
"diagram": {
335328
"caption": "Client-to-site VPN configuration.",
336-
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/main/reference-architectures/reference-architectures/cts-fully-configurable-da.svg",
329+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/main/reference-architectures/reference-architectures/deployable-architecture-cts.svg",
337330
"type": "image/svg+xml"
338331
},
339332
"description": "Client-to-site VPN configuration."

‎reference-architectures/cts-fully-configurable-da.svg‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎reference-architectures/deployable-architecture-cts.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎solutions/fully-configurable/provider.tf‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
11
provider "ibm" {
2-
ibmcloud_api_key = var.ibmcloud_api_key
3-
region = module.existing_sm_crn_parser.region
4-
alias = "ibm-sm"
5-
visibility = var.provider_visibility
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = module.existing_sm_crn_parser.region
4+
alias = "ibm-sm"
5+
visibility = var.provider_visibility
6+
private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
67
}
78

89
provider "ibm" {
9-
ibmcloud_api_key = var.ibmcloud_api_key
10-
region = local.vpc_region
11-
visibility = var.provider_visibility
10+
ibmcloud_api_key = var.ibmcloud_api_key
11+
region = local.vpc_region
12+
visibility = var.provider_visibility
13+
private_endpoint_type = (var.provider_visibility == "private" && local.vpc_region == "ca-mon") ? "vpe" : null
1214
}

‎solutions/fully-configurable/variables.tf‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,28 @@ variable "ibmcloud_api_key" {
66

77
variable "prefix" {
88
type = string
9-
description = "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). Must begin with a letter and contain only lowercase letters, numbers, and - characters. To not use any prefix value, you can set this value to `null` or an empty string."
9+
nullable = true
10+
description = "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To skip using a prefix, set this value to `null` or an empty string. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)."
1011

1112
validation {
12-
error_message = "Prefix must begin with a letter and contain only lowercase letters, numbers, and - characters."
13-
condition = var.prefix == null || var.prefix == "" ? true : can(regex("^([A-z]|[a-z][-a-z0-9]*[a-z0-9])$", var.prefix))
13+
# - null and empty string is allowed
14+
# - Must not contain consecutive hyphens (--): length(regexall("--", var.prefix)) == 0
15+
# - Starts with a lowercase letter: [a-z]
16+
# - Contains only lowercase letters (a–z), digits (0–9), and hyphens (-)
17+
# - Must not end with a hyphen (-): [a-z0-9]
18+
condition = (var.prefix == null || var.prefix == "" ? true :
19+
alltrue([
20+
can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)),
21+
length(regexall("--", var.prefix)) == 0
22+
])
23+
)
24+
error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')."
25+
}
26+
27+
validation {
28+
# must not exceed 16 characters in length
29+
condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16
30+
error_message = "Prefix must not exceed 16 characters."
1431
}
1532
}
1633

@@ -26,12 +43,12 @@ variable "existing_resource_group_name" {
2643

2744
variable "existing_secrets_manager_instance_crn" {
2845
type = string
29-
description = "The CRN of existing secrets manager where the certificate to use for the VPN is stored or where the new private certificate will be created."
46+
description = "The CRN of existing secrets manager where the certificate to use for the VPN is stored or where the new private certificate will be created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)"
3047
}
3148

3249
variable "existing_secrets_manager_cert_crn" {
3350
type = string
34-
description = "The CRN of existing secrets manager private certificate to use to create VPN. If the value is null, then new private certificate is created."
51+
description = "The CRN of existing secrets manager private certificate to use to create VPN. If the value is null, then new private certificate is created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificates&interface=ui)"
3552
default = null
3653

3754
validation {
@@ -47,19 +64,19 @@ variable "existing_secrets_manager_cert_crn" {
4764

4865
variable "existing_secrets_manager_secret_group_id" {
4966
type = string
50-
description = "The ID of existing secrets manager secret group used for new created certificate. If the value is null, then new secrets manager secret group is created."
67+
description = "The ID of existing secrets manager secret group used for new created certificate. If the value is null, then new secrets manager secret group is created. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&interface=ui)"
5168
default = null
5269
}
5370

5471
variable "private_cert_engine_config_root_ca_common_name" {
5572
type = string
56-
description = "A fully qualified domain name or host domain name for the certificate to be created. Only used when `existing_secrets_manager_cert_crn` input variable is `null`."
73+
description = "A fully qualified domain name or host domain name for the certificate to be created. Only used when `existing_secrets_manager_cert_crn` input variable is `null`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)"
5774
default = null
5875
}
5976

6077
variable "private_cert_engine_config_template_name" {
6178
type = string
62-
description = "The name of the Certificate Template to create for a private certificate secret engine. When `existing_secrets_manager_cert_crn` input variable is `null`, then it has to be the existing template name that exists in the private cert engine."
79+
description = "The name of the Certificate Template to create for a private certificate secret engine. When `existing_secrets_manager_cert_crn` input variable is `null`, then it has to be the existing template name that exists in the private cert engine. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-private-certificates&interface=ui)"
6380
default = null
6481
}
6582

0 commit comments

Comments
 (0)