diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml index 1d84f733..f796bf85 100644 --- a/.catalog-onboard-pipeline.yaml +++ b/.catalog-onboard-pipeline.yaml @@ -13,3 +13,6 @@ offerings: instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 region: us-south scope_resource_group_var_name: existing_resource_group_name + - name: quickstart + mark_ready: true + install_type: fullstack diff --git a/ibm_catalog.json b/ibm_catalog.json index 309c6e3e..1a7e9a5f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -63,8 +63,8 @@ "flavors": [ { "label": "Standard - Integrated setup with configurable services", - "name": "fully-configurable", "short_description": "Ideal for users who want flexibility with a reliable starting point.", + "name": "fully-configurable", "index": 1, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", @@ -771,6 +771,218 @@ "dependency_version_2": true, "terraform_version": "1.12.2", "ignore_readme": true + }, + { + "label": "QuickStart - Basic and simple", + "short_description": "Ideal for users new to IBM Cloud or Virtual Private Cloud (VPC) who want to get started without configuring underlying infrastructure.", + "name": "quickstart", + "index": 2, + "install_type": "fullstack", + "working_directory": "solutions/quickstart", + "release_notes_url": "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-secure-infrastructure-vpc-relnotes", + "architecture": { + "features": [ + { + "title": " ", + "description": "Ideal for users new to IBM Cloud or Virtual Private Cloud (VPC) who want to get started without configuring underlying infrastructure." + }, + { + "title": " ", + "description": "A lightweight, experimental configuration for quickly provisioning Virtual Private Cloud (VPC) instances on IBM Cloud." + } + ], + "diagrams": [ + { + "diagram": { + "caption": "Virtual Private Cloud topology - Quickstart (Basic and simple)", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/reference-architectures/deployable-architecture-quickstart-vpc.svg", + "type": "image/svg+xml" + }, + "description": "This architecture provisions and configures a Virtual Private Cloud (VPC) environment. This basic configuration creates a VPC with one subnet in each zone (three subnets total) and applies a predefined network ACL." + } + ] + }, + "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Identity and Access enabled services", + "notes": "[Optional] Required to to create trusted profile for App Configuration aggregator which is used for compliance scanning." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "is.vpc", + "notes": "Required to create Virtual Private Cloud(VPC)" + }, + { + "service_name": "cloud-object-storage", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "notes": "[Optional] Required if VPC Flow Logs are enabled." + } + ], + "configuration": [ + { + "key": "ibmcloud_api_key" + }, + { + "key": "existing_resource_group_name", + "display_name": "resource_group", + "custom_config": { + "type": "resource_group", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "identifier": "rg_name" + } + }, + "default_value": "Default", + "description": "The name of an existing resource group to provision the resources." + }, + { + "key": "prefix", + "required": true, + "default_value": "dev", + "random_string": { + "length": 4 + }, + "value_constraints": [ + { + "type": "regex", + "description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters.", + "value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$" + } + ] + }, + { + "key": "region", + "required": true, + "custom_config": { + "config_constraints": { + "generationType": "2" + }, + "grouping": "deployment", + "original_grouping": "deployment", + "type": "vpc_region" + } + }, + { + "key": "vpc_name", + "required": true + }, + { + "key": "network_profile", + "type": "string", + "displayname": "Network Profile", + "required": true, + "default_value": "common", + "description": "Select the predefined network profile that controls allowed traffic and security posture for the VPC.", + "options": [ + { + "displayname": "Open", + "value": "open", + "description": "Allows all inbound and outbound traffic. Suitable for testing or unrestricted workloads." + }, + { + "displayname": "Standard", + "value": "common", + "description": "Allows standard access (SSH, HTTP, HTTPS) and includes IBM internal + VPC connectivity rules. Recommended default for most workloads." + }, + { + "displayname": "IBM Internal", + "value": "ibm-internal", + "description": "Blocks all customer inbound traffic. Only IBM internal and VPC connectivity traffic is allowed." + }, + { + "displayname": "Closed", + "value": "closed", + "description": "Fully restricted network profile. No inbound or outbound traffic allowed." + } + ] + }, + { + "key": "resource_tags", + "custom_config": { + "type": "array", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "access_tags", + "custom_config": { + "type": "array", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "enable_vpc_flow_logs", + "type": "boolean", + "type_metadata": "boolean", + "options": [ + { + "description": "Do not collect VPC network traffic metadata.", + "displayname": "False", + "value": false + }, + { + "description": "Collect and store IP traffic metadata from VPC network interfaces to Cloud Object Storage for monitoring, security analysis, and troubleshooting.", + "displayname": "True", + "value": true + } + ] + }, + { + "key": "skip_vpc_cos_iam_auth_policy", + "hidden": true + }, + { + "key": "provider_visibility", + "hidden": true, + "options": [ + { + "displayname": "private", + "value": "private" + }, + { + "displayname": "public", + "value": "public" + }, + { + "displayname": "public-and-private", + "value": "public-and-private" + } + ] + } + ], + "terraform_version": "1.12.2", + "ignore_readme": true } ] } diff --git a/reference-architectures/deploy-arch-ibm-vpc-quickstart-vpc.md b/reference-architectures/deploy-arch-ibm-vpc-quickstart-vpc.md new file mode 100644 index 00000000..a91505b6 --- /dev/null +++ b/reference-architectures/deploy-arch-ibm-vpc-quickstart-vpc.md @@ -0,0 +1,147 @@ +--- + +copyright: + years: 2025 +lastupdated: "2025-12-02" + +keywords: + +subcollection: deployable-reference-architectures + +authors: + - name: "Khuzaima Shakeel" + +# The release that the reference architecture describes +version: 1.0.0 + +# Whether the reference architecture is published to Cloud Docs production. +# When set to false, the file is available only in staging. Default is false. +production: true + +# Use if the reference architecture has deployable code. +# Value is the URL to land the user in the IBM Cloud catalog details page +# for the deployable architecture. +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button +deployment-url: https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-vpc-9fc0fa64-27af-4fed-9dce-47b3640ba739-global + +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc + +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/reference-architectures/deployable-architecture-quickstart-vpc.svg + +related_links: + - title: "Cloud foundation for VPC (Standard - Integrated setup with configurable services)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vpc-fully-configurable" + description: "A deployable architecture that provides full control over VPC networking, security, and connectivity components." + - title: "Cloud foundation for VPC (Standard - Financial Services edition)" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vpc-ra" + description: "A VPC architecture based on IBM Cloud for Financial Services controls." + +use-case: Foundational Infrastructure +compliance: None + +content-type: reference-architecture + +--- + +{{site.data.keyword.attribute-definition-list}} + +# Cloud foundation for VPC – QuickStart (Basic and simple) +{: #vpc-quickstart-ra} +{: toc-content-type="reference-architecture"} +{: toc-industry="CrossIndustry"} +{: toc-use-case="Foundational Infrastructure"} +{: toc-version="1.0.0"} + +The QuickStart variation provides a **simple and beginner-friendly** Virtual Private Cloud (VPC) deployment that requires minimal configuration. It helps users rapidly create a functional network environment on IBM Cloud without needing to define subnets, ACL rules, security groups, or connectivity patterns manually. +This variation is ideal for users who want a **basic VPC setup**, lightweight networking defaults, and the option to enable VPC Flow Logs. + +Unlike the fully configurable architecture, QuickStart intentionally limits complexity and deploys a clean, minimal network footprint that can be used as a stepping stone toward more advanced architectures. + +--- + +## Architecture diagram +{: #ra-vpc-quickstart-architecture} + +![Architecture diagram for the QuickStart variation of Cloud foundation for VPC](deployable-architecture-quickstart-vpc.svg "QuickStart VPC architecture"){: caption="QuickStart VPC architecture" caption-side="bottom"}{: external download="deployable-architecture-quickstart-vpc.svg"} + +--- + +## Design requirements +{: #ra-vpc-quickstart-design-requirements} + +![Design requirements for QuickStart VPC](heat-map-deploy-arch-slz-vpc-quickstart.svg "Design requirements"){: caption="Scope of the QuickStart design requirements" caption-side="bottom"} + +--- + +## Components +{: #ra-vpc-quickstart-components} + +### VPC architecture decisions +{: #ra-vpc-quickstart-components-arch} + +| Requirement | Component | Reasons for choice | Alternative | +|------------|-----------|--------------------|-------------| +| *Provide a basic, ready-to-use VPC with minimal inputs* | Predefined VPC | Deploys a VPC quickly without requiring the user to design the network | Use the fully configurable variation for deeper customization | +| *Create availability-zone redundancy* | Fixed three-zone subnets | One subnet per zone to ensure multi-AZ coverage | Single-zone deployment (not recommended) | +| *Basic traffic governance* | Network profile selector (open, common, ibm-internal, closed) | Users can choose the desired security posture without written ACL rules | Manually writing custom ACLs | + +{: caption="VPC architecture decisions" caption-side="bottom"} + +--- + +### Networking and connectivity decisions +{: #ra-vpc-quickstart-components-connectivity} + +| Requirement | Component | Reason | Alternative | +|------------|-----------|--------|-------------| +| *Optional access to the internet* | Public gateways per zone (automatic) | Enabled only for `open` and `common` profiles | No public gateways for locked-down profiles | +| *Subnet-level traffic control* | Network ACL profiles | Simplifies security without requiring rule definitions | Fully customizable ACLs (in advanced variation) | +| *Instance-level default security* | Default VPC security group | Automatically cleaned when selecting restrictive profiles (`ibm-internal`, `closed`) | Custom security group rules | + +{: caption="Networking and connectivity decisions" caption-side="bottom"} + +--- + +### Simplicity and user experience decisions +{: #ra-vpc-quickstart-components-simplicity} + +| Requirement | Component | Reasons | Alternative | +|------------|-----------|---------|-------------| +| *Zero-effort deployment* | Predefined subnets + ACL mapping | Users only pick prefix, region, and profile | Manual subnet planning | +| *Clear security posture options* | User-friendly “Network Profile” widget | Shows descriptions and recommendations | Plain text input | +| *Simple observability integration* | Optional VPC Flow Logs → COS | Enabled via toggle | External log collectors | + +{: caption="Simplicity decision points" caption-side="bottom"} + +--- + +## Key features +{: #ra-vpc-quickstart-features} + +### Core VPC Setup +- Automatically creates a new VPC with IBM-recommended defaults +- Deploys **one subnet per zone** (three total) + +### Built-in Network Profiles +- **Open** – Unrestricted +- **Standard (Common)** – SSH/HTTP/HTTPS + IBM internal rules +- **IBM Internal** – No inbound customer traffic +- **Closed** – Fully restricted + +### Security & Network Defaults +- ACLs applied according to selected network profile +- Security group automatically cleaned for restrictive profiles +- Public gateways created only when allowed by the profile + +### Optional Flow Logs +- Enable VPC Flow Logs to create a COS instance and bucket automatically + + +--- + diff --git a/reference-architectures/deployable-architecture-quickstart-vpc.svg b/reference-architectures/deployable-architecture-quickstart-vpc.svg new file mode 100644 index 00000000..cbcb5d32 --- /dev/null +++ b/reference-architectures/deployable-architecture-quickstart-vpc.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource GroupFlow Logs bucket
[Optional] Object Storage 
VPC
Zone 3
Zone 2
Zone 1
ACL
Subnet
 \ No newline at end of file diff --git a/solutions/quickstart/README.md b/solutions/quickstart/README.md new file mode 100644 index 00000000..334b1b52 --- /dev/null +++ b/solutions/quickstart/README.md @@ -0,0 +1,3 @@ +# Cloud foundation for VPC (Quickstart) + +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/quickstart/catalogValidationValues.json.template b/solutions/quickstart/catalogValidationValues.json.template new file mode 100644 index 00000000..41ce44f9 --- /dev/null +++ b/solutions/quickstart/catalogValidationValues.json.template @@ -0,0 +1,7 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY, + "region": "us-south", + "resource_tags": $TAGS, + "existing_resource_group_name": "geretain-test-resources", + "prefix": $PREFIX +} diff --git a/solutions/quickstart/main.tf b/solutions/quickstart/main.tf new file mode 100644 index 00000000..564daff1 --- /dev/null +++ b/solutions/quickstart/main.tf @@ -0,0 +1,173 @@ +locals { + prefix = var.prefix != null ? (trimspace(var.prefix) != "" ? "${var.prefix}-" : "") : "" +} + +############################################################################## +# Resource Group +############################################################################## + +module "resource_group" { + source = "terraform-ibm-modules/resource-group/ibm" + version = "1.4.0" + existing_resource_group_name = var.existing_resource_group_name +} + + +############################################################################# +# Provision cloud object storage and bucket +############################################################################# + +module "cos" { + count = var.enable_vpc_flow_logs ? 1 : 0 + source = "terraform-ibm-modules/cos/ibm" + version = "10.5.8" + resource_group_id = module.resource_group.resource_group_id + region = var.region + cos_instance_name = "${var.prefix}-cos" + cos_tags = var.resource_tags + bucket_name = "${var.prefix}-bucket" + kms_encryption_enabled = false +} + +########################################################################### +# NETWORK ACL PROFILES +########################################################################### + +locals { + acl_profiles = { + open = [ + { + name = "${local.prefix}acl" + add_ibm_cloud_internal_rules = false + add_vpc_connectivity_rules = false + prepend_ibm_rules = false + rules = [ + { + name = "allow-all-inbound" + action = "allow" + direction = "inbound" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + }, + { + name = "allow-all-outbound" + action = "allow" + direction = "outbound" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + } + ] + } + ] + common = [ + { + name = "${local.prefix}acl" + add_ibm_cloud_internal_rules = true + add_vpc_connectivity_rules = true + prepend_ibm_rules = true + rules = [ + { + name = "allow-ssh" + action = "allow" + direction = "inbound" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + tcp = { port_min = 22, port_max = 22 } + }, + { + name = "allow-https" + action = "allow" + direction = "inbound" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + tcp = { port_min = 443, port_max = 443 } + }, + { + name = "allow-http" + action = "allow" + direction = "inbound" + source = "0.0.0.0/0" + destination = "0.0.0.0/0" + tcp = { port_min = 80, port_max = 80 } + } + ] + } + ] + ibm-internal = [ + { + name = "${local.prefix}acl" + add_ibm_cloud_internal_rules = true + add_vpc_connectivity_rules = true + prepend_ibm_rules = true + rules = [] + } + ] + closed = [ + { + name = "${local.prefix}acl" + add_ibm_cloud_internal_rules = false + add_vpc_connectivity_rules = false + prepend_ibm_rules = false + rules = [] + } + ] + } + network_acls = lookup(local.acl_profiles, var.network_profile, local.acl_profiles["common"]) + clean_default_sg_acl = contains(["ibm-internal", "closed"], var.network_profile) + allow_public_gateway = contains(["open", "common"], var.network_profile) +} + +############################################################################# +# VPC +############################################################################# + +module "vpc" { + source = "../../" + resource_group_id = module.resource_group.resource_group_id + region = var.region + create_vpc = true + name = var.vpc_name + prefix = local.prefix != "" ? trimspace(var.prefix) : null + tags = var.resource_tags + access_tags = var.access_tags + subnets = { + zone-1 = [ + { + name = "${local.prefix}subnet-a" + cidr = "10.10.10.0/24" + public_gateway = local.allow_public_gateway + acl_name = "${local.prefix}acl" + no_addr_prefix = false + } + ] + zone-2 = [ + { + name = "${local.prefix}subnet-b" + cidr = "10.20.10.0/24" + public_gateway = local.allow_public_gateway + acl_name = "${local.prefix}acl" + no_addr_prefix = false + } + ] + zone-3 = [ + { + name = "${local.prefix}subnet-c" + cidr = "10.30.10.0/24" + public_gateway = local.allow_public_gateway + acl_name = "${local.prefix}acl" + no_addr_prefix = false + } + ] + } + network_acls = local.network_acls + clean_default_sg_acl = local.clean_default_sg_acl + use_public_gateways = { + zone-1 = local.allow_public_gateway + zone-2 = local.allow_public_gateway + zone-3 = local.allow_public_gateway + } + enable_vpc_flow_logs = var.enable_vpc_flow_logs + create_authorization_policy_vpc_to_cos = !var.skip_vpc_cos_iam_auth_policy + existing_cos_instance_guid = var.enable_vpc_flow_logs ? module.cos[0].cos_instance_guid : null + existing_storage_bucket_name = var.enable_vpc_flow_logs ? module.cos[0].bucket_name : null +} diff --git a/solutions/quickstart/outputs.tf b/solutions/quickstart/outputs.tf new file mode 100644 index 00000000..2280b4a4 --- /dev/null +++ b/solutions/quickstart/outputs.tf @@ -0,0 +1,96 @@ +############################################################################## +# VPC +############################################################################## + +output "vpc_name" { + description = "Name of the VPC created." + value = module.vpc.vpc_name +} + +output "vpc_id" { + description = "ID of the VPC created." + value = module.vpc.vpc_id +} + +output "vpc_crn" { + description = "CRN of the VPC created." + value = module.vpc.vpc_crn +} + +output "network_acls" { + description = "List of shortnames and IDs of network ACLs." + value = local.network_acls +} + +############################################################################## +# Subnet Outputs +############################################################################## + +output "subnet_ids" { + description = "The IDs of the subnets." + value = module.vpc.subnet_ids +} + +output "private_path_subnet_id" { + description = "The IDs of the subnets." + value = length(module.vpc.subnet_ids) > 0 ? module.vpc.subnet_ids[0] : null +} + +output "subnet_detail_list" { + description = "A list of subnets containing names, CIDR blocks, and zones." + value = module.vpc.subnet_detail_list +} + +output "subnet_zone_list" { + description = "A list of subnet IDs and subnet zones." + value = module.vpc.subnet_zone_list +} + +output "subnet_detail_map" { + description = "A map of subnets containing IDs, CIDR blocks, and zones." + value = module.vpc.subnet_detail_map +} + +############################################################################## +# Public Gateways +############################################################################## + +output "public_gateways" { + description = "Map of the public gateways by zone." + value = module.vpc.public_gateways +} + + +############################################################################## +# Security Group Details +############################################################################## + +output "security_group_details" { + description = "Details of security group." + value = module.vpc.security_group_details +} + +output "next_steps_text" { + value = "Your Virtual Private Cloud is ready." + description = "Next steps text" +} + +output "next_step_primary_label" { + value = "Go to Virtual Private Cloud" + description = "Primary label" +} + +output "next_step_primary_url" { + value = "https://cloud.ibm.com/infrastructure/network/vpc/${var.region}~${module.vpc.vpc_id}/overview" + description = "Primary URL" +} + +output "next_step_secondary_label" { + value = "Virtual Private Cloud overview page" + description = "Secondary label" +} + +output "next_step_secondary_url" { + value = "https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpc" + description = "Secondary URL" +} diff --git a/solutions/quickstart/provider.tf b/solutions/quickstart/provider.tf new file mode 100644 index 00000000..17cfc770 --- /dev/null +++ b/solutions/quickstart/provider.tf @@ -0,0 +1,10 @@ +######################################################################################################################## +# Provider config +######################################################################################################################## + +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null +} diff --git a/solutions/quickstart/variables.tf b/solutions/quickstart/variables.tf new file mode 100644 index 00000000..008d6ac5 --- /dev/null +++ b/solutions/quickstart/variables.tf @@ -0,0 +1,108 @@ +############################################################################## +# Input Variables +############################################################################## + +variable "ibmcloud_api_key" { + type = string + description = "The IBM Cloud API key to deploy resources." + sensitive = true +} + +variable "provider_visibility" { + description = "Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints)." + type = string + default = "private" + + validation { + condition = contains(["public", "private", "public-and-private"], var.provider_visibility) + error_message = "Invalid visibility option. Allowed values are 'public', 'private', or 'public-and-private'." + } +} + +variable "existing_resource_group_name" { + type = string + description = "The name of an existing resource group to provision the resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-rgs&interface=ui#create_rgs) about how to create a resource group." + default = "Default" +} + +variable "prefix" { + type = string + nullable = true + description = "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To skip using a prefix, set this value to null or an empty string. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + + validation { + # - null and empty string is allowed + # - Must not contain consecutive hyphens (--): length(regexall("--", var.prefix)) == 0 + # - Starts with a lowercase letter: [a-z] + # - Contains only lowercase letters (a–z), digits (0–9), and hyphens (-) + # - Must not end with a hyphen (-): [a-z0-9] + condition = (var.prefix == null || var.prefix == "" ? true : + alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), + length(regexall("--", var.prefix)) == 0 + ]) + ) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + + validation { + # must not exceed 16 characters in length + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." + } +} + +variable "vpc_name" { + default = "vpc" + description = "Name of the VPC. If a prefix input variable is specified, the prefix is added to the name in the `-` format." + type = string +} + +variable "region" { + type = string + description = "The region to provision all resources in." + default = "us-south" +} + +variable "resource_tags" { + type = list(string) + description = "The list of tags to add to the VPC instance." + default = [] +} + +variable "access_tags" { + type = list(string) + description = "The list of access tags to add to the VPC instance." + default = [] +} + +############################################################################## +# Network ACLs +############################################################################## + +variable "network_profile" { + description = "Predefined ACL profile options: open (allow all inbound and outbound traffic), common (allow SSH 22, HTTP 80, HTTPS 443, and includes IBM internal + VPC connectivity rules), ibm-internal (only IBM internal and VPC connectivity rules; no customer inbound traffic), closed (fully restricted; no inbound or outbound traffic)." + type = string + default = "common" + validation { + condition = contains(["open", "common", "ibm-internal", "closed"], var.network_profile) + error_message = "Valid values: open, common, ibm-internal, closed." + } +} +############################################################################## +# VPC Flow Logs +############################################################################## + +variable "enable_vpc_flow_logs" { + description = "To enable VPC Flow logs, set this to true." + type = bool + nullable = false + default = false +} + +variable "skip_vpc_cos_iam_auth_policy" { + description = "To skip creating an IAM authorization policy that allows the VPC to access the Cloud Object Storage, set this variable to `true`. Required only if `enable_vpc_flow_logs` is set to true." + type = bool + nullable = false + default = false +} diff --git a/solutions/quickstart/version.tf b/solutions/quickstart/version.tf new file mode 100644 index 00000000..0d77e06a --- /dev/null +++ b/solutions/quickstart/version.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.9.0" + required_providers { + # Lock DA into an exact provider version - renovate automation will keep it updated + ibm = { + source = "IBM-Cloud/ibm" + version = "1.80.0" + } + } +} diff --git a/tests/pr_test.go b/tests/pr_test.go index 2024642e..9f2a66b8 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -33,6 +33,7 @@ const existingVPCExampleTerraformDir = "examples/existing_vpc" const specificZoneExampleTerraformDir = "examples/specific-zone-only" const vpcWithDnsExampleTerraformDir = "examples/vpc-with-dns" const fullyConfigFlavorDir = "solutions/fully-configurable" +const quickStartFlavorDir = "solutions/quickstart" const resourceGroup = "geretain-test-resources" const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml" @@ -139,6 +140,74 @@ func TestFullyConfigurable(t *testing.T) { assert.Nil(t, err, "This should not have errored") } +func TestQuickstartDefaultConfigSchematics(t *testing.T) { + t.Parallel() + + options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ + Testing: t, + Region: "eu-de", + Prefix: "vpc-qs", + TarIncludePatterns: []string{ + "*.tf", + "dynamic_values/*.tf", + "dynamic_values/config_modules/*/*.tf", + quickStartFlavorDir + "/*.tf", + }, + TemplateFolder: quickStartFlavorDir, + Tags: []string{"vpc-qs-test"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 120, + TerraformVersion: terraformVersion, + }) + + options.TerraformVars = []testschematic.TestSchematicTerraformVar{ + {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, + {Name: "existing_resource_group_name", Value: resourceGroup, DataType: "string"}, + {Name: "region", Value: options.Region, DataType: "string"}, + {Name: "resource_tags", Value: options.Tags, DataType: "list(string)"}, + {Name: "access_tags", Value: permanentResources["accessTags"], DataType: "list(string)"}, + {Name: "prefix", Value: options.Prefix, DataType: "string"}, + } + + err := options.RunSchematicTest() + assert.Nil(t, err, "This should not have errored") +} + +func TestQuickstartDefaultConfigUpgradeSchematics(t *testing.T) { + t.Parallel() + + options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ + Testing: t, + Region: "us-south", + Prefix: "vpc-qs", + TarIncludePatterns: []string{ + "*.tf", + "dynamic_values/*.tf", + "dynamic_values/config_modules/*/*.tf", + quickStartFlavorDir + "/*.tf", + }, + TemplateFolder: quickStartFlavorDir, + Tags: []string{"vpc-qs-test"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 120, + TerraformVersion: terraformVersion, + }) + + options.TerraformVars = []testschematic.TestSchematicTerraformVar{ + {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, + {Name: "existing_resource_group_name", Value: resourceGroup, DataType: "string"}, + {Name: "region", Value: options.Region, DataType: "string"}, + {Name: "resource_tags", Value: options.Tags, DataType: "list(string)"}, + {Name: "access_tags", Value: permanentResources["accessTags"], DataType: "list(string)"}, + {Name: "prefix", Value: options.Prefix, DataType: "string"}, + } + + err := options.RunSchematicUpgradeTest() + if !options.UpgradeTestSkipped { + assert.Nil(t, err, "This should not have errored") + } +} + func validateEnvVariable(t *testing.T, varName string) string { val, present := os.LookupEnv(varName) require.True(t, present, "%s environment variable not set", varName)