From 3691aad458039ef2485b5e8ad5745cd103beb4fe Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Thu, 14 Aug 2025 07:28:10 +0530 Subject: [PATCH 01/15] DA improvement --- ibm_catalog.json | 44 +++++++++++++++++++++++++++++++++++++------- 1 file changed, 37 insertions(+), 7 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 74bf74db..e733d226 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -18,8 +18,8 @@ "cluster", "red_hat_openshift" ], - "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services.", - "long_description": "The Cloud automation for Red Hat OpenShift Container Platform on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", + "short_description": "Automates the deployment of Red Hat OpenShift container platform on IBM Cloud with optional integration of security and logging services", + "long_description": "The [Cloud automation for Red Hat OpenShift Container Platform](https://www.ibm.com/products/openshift) on VPC enables a scalable and flexible cloud environment for containerized applications with seamless integration to other security and observability services. This architecture can be deployed independently while also serving as a foundational deployable architecture for other architectures like [Cloud automation for Red Hat OpenShift AI](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-ocp-ai-ba708aed-bb8a-4ac0-83a7-53a066701db5-global) to deploy mission critical applications and AI-driven initiatives to market quickly and securely with a managed OpenShift service.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/blob/main/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-base-ocp-vpc/main/images/ocp_icon.svg", "provider_name": "IBM", @@ -66,7 +66,7 @@ { "label": "Fully configurable", "name": "fully-configurable", - "index": 2, + "index": 1, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", "compliance": { @@ -79,11 +79,32 @@ ] }, "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "All Identity and Access enabled services", + "notes": "(Optional) Only required if creating context-based restrictions which can be toggled using the `provision_cbr` input." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "Administrator access is required for resource group creation and deletion." + }, { "service_name": "containers-kubernetes", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" + "crn:v1:bluemix:public:iam::::role:Administrator" ], "notes": "Required to create and edit OpenShift cluster and the related resources." }, @@ -98,7 +119,8 @@ { "service_name": "is.vpc", "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "notes": "Required for creating Virtual Private Cloud(VPC)." }, @@ -164,6 +186,14 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "event-notifications", + "notes": "[Optional] Required if you are configuring an Event Notifications Instance." } ], "architecture": { @@ -746,7 +776,7 @@ }, { "key": "network_acls", - "type": "list(object)", + "type": "array", "default_value": "[\n {\n name = \"vpc-acl\"\n add_ibm_cloud_internal_rules = true\n add_vpc_connectivity_rules = true\n prepend_ibm_rules = true\n rules = [\n {\n name = \"allow-all-443-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 443\n port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n port_min = 80\n port_max = 80\n source_port_min = 80\n source_port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-inbound\"\n action = \"allow\"\n direction = \"inbound\"\n tcp = {\n source_port_min = 30000\n source_port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-443-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 443\n source_port_max = 443\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-80-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n source_port_min = 80\n source_port_max = 80\n port_min = 80\n port_max = 80\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n },\n {\n name = \"allow-all-ingress-outbound\"\n action = \"allow\"\n direction = \"outbound\"\n tcp = {\n port_min = 30000\n port_max = 32767\n }\n destination = \"0.0.0.0/0\"\n source = \"0.0.0.0/0\"\n }\n ]\n }\n]", "description": "The list of ACLs to create. Provide at least one rule for each ACL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#network-acls-).", "required": false, @@ -1011,7 +1041,7 @@ { "label": "QuickStart", "name": "quickstart", - "index": 1, + "index": 2, "install_type": "fullstack", "working_directory": "solutions/quickstart", "iam_permissions": [ From 0ab5c4e40c9290f4222d54657f7bf8543110c8a2 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Sun, 17 Aug 2025 11:06:15 +0530 Subject: [PATCH 02/15] minor changes --- ibm_catalog.json | 47 +++++++++++++++++++---------------------------- 1 file changed, 19 insertions(+), 28 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index e733d226..8fe0a04f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -91,7 +91,7 @@ "crn:v1:bluemix:public:iam::::role:Viewer" ], "service_name": "All Identity and Access enabled services", - "notes": "(Optional) Only required if creating context-based restrictions which can be toggled using the `provision_cbr` input." + "notes": "[Optional] Only required if creating context-based restrictions which can be toggled using the `provision_cbr` input." }, { "role_crns": [ @@ -130,7 +130,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "Required to create Cloud Object Storage (COS) Instance." + "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance." }, { "service_name": "hs-crypto", @@ -154,7 +154,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud monitoring." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." }, { "service_name": "logs", @@ -162,7 +162,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Cloud logs." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." }, { "service_name": "logs-router", @@ -177,7 +177,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, { "service_name": "secrets-manager", @@ -200,7 +200,7 @@ "features": [ { "title": " ", - "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." + "description": "Configured to use IBM secure-by-default standards, but can be edited to fit your use case." } ], "diagrams": [ @@ -487,36 +487,27 @@ }, { "key": "enable_platform_metrics", - "type": "string", - "default_value": "true", - "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. ⚠️ You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", + "type": "boolean", + "default_value": false, + "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true, - "options": [ - { - "displayname": "true", - "value": "true" - }, - { - "displayname": "false", - "value": "false" - } - ] + "virtual": true }, { "key": "logs_routing_tenant_regions", - "type": "list(string)", + "type": "array", "default_value": "[]", - "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. For example: [\"us-south\", \"us-east\"]. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", + "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, - "virtual": true, "custom_config": { + "type": "array", "grouping": "deployment", "original_grouping": "deployment", "config_constraints": { - "type": "string" + "type": "string" } - } + }, + "virtual": true }, { "key": "existing_resource_group_name", @@ -791,16 +782,16 @@ "key": "provider_visibility", "options": [ { - "displayname": "private", + "displayname": "Private", "value": "private" }, { - "displayname": "public", + "displayname": "Public", "value": "public" }, { "displayname": "public-and-private", - "value": "public-and-private" + "value": "Public-and-Private" } ], "hidden": true From 1e837de224dcdd4e29ea0891ddf441abd16569f9 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Sun, 17 Aug 2025 11:20:51 +0530 Subject: [PATCH 03/15] minor changes --- ibm_catalog.json | 12 +++++++++++- solutions/fully-configurable/variables.tf | 4 +--- solutions/quickstart/variables.tf | 12 +++++++++--- 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 8fe0a04f..74049f70 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -491,7 +491,17 @@ "default_value": false, "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true + "virtual": true, + "options": [ + { + "displayname": "true", + "value": true + }, + { + "displayname": "false", + "value": false + } + ] }, { "key": "logs_routing_tenant_regions", diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 545b54ec..67bf16f2 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -13,8 +13,7 @@ variable "ibmcloud_api_key" { variable "prefix" { type = string - nullable = true - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-0405-ocp. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: wx-0205-orch. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { # - null and empty string is allowed @@ -30,7 +29,6 @@ variable "prefix" { ) error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." } - validation { # must not exceed 16 characters in length condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 diff --git a/solutions/quickstart/variables.tf b/solutions/quickstart/variables.tf index 558c4fca..2f62dda3 100644 --- a/solutions/quickstart/variables.tf +++ b/solutions/quickstart/variables.tf @@ -24,9 +24,14 @@ variable "provider_visibility" { variable "prefix" { type = string - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). Example: `prod-0205-ocpqs`. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." - nullable = true + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: wx-0205-orch. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + validation { + # - null and empty string is allowed + # - Must not contain consecutive hyphens (--): length(regexall("--", var.prefix)) == 0 + # - Starts with a lowercase letter: [a-z] + # - Contains only lowercase letters (a–z), digits (0–9), and hyphens (-) + # - Must not end with a hyphen (-): [a-z0-9] condition = (var.prefix == null || var.prefix == "" ? true : alltrue([ can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), @@ -36,14 +41,15 @@ variable "prefix" { error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." } validation { + # must not exceed 16 characters in length condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 error_message = "Prefix must not exceed 16 characters." } } variable "region" { + description = "The region to provision all resources in. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services." type = string - description = "Region in which all the resources will be deployed. [Learn More](https://terraform-ibm-modules.github.io/documentation/#/region)." default = "us-south" } From ea886bfec1ff62095818de42434e69755c177d1a Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Mon, 18 Aug 2025 14:09:46 +0530 Subject: [PATCH 04/15] minor changes --- tests/existing-resources/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/existing-resources/main.tf b/tests/existing-resources/main.tf index 4578297c..646aafbf 100644 --- a/tests/existing-resources/main.tf +++ b/tests/existing-resources/main.tf @@ -4,7 +4,7 @@ module "resource_group" { source = "terraform-ibm-modules/resource-group/ibm" version = "1.3.0" - resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null + resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group-yz" : null existing_resource_group_name = var.resource_group } @@ -41,9 +41,9 @@ module "cos" { version = "8.21.25" resource_group_id = module.resource_group.resource_group_id region = var.region - cos_instance_name = "${var.prefix}-cos" + cos_instance_name = "${var.prefix}-cos-yz" cos_tags = var.resource_tags - bucket_name = "${var.prefix}-bucket" + bucket_name = "${var.prefix}-bucket-yz" retention_enabled = false kms_encryption_enabled = false } From d8bb0a5c24cb4d5f1633d5cf3cd9be303bb5bb04 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 19 Aug 2025 00:38:43 +0530 Subject: [PATCH 05/15] minor changes --- ibm_catalog.json | 61 +++++++++++-------- modules/kube-audit/README.md | 2 +- modules/kube-audit/scripts/set_webhook.sh | 4 +- modules/kube-audit/variables.tf | 2 +- ...hitecture-ocp-cluster-qs-Page-2.drawio.svg | 4 ++ ...deployable-architecture-ocp-cluster-qs.svg | 4 -- .../deployable-architecture-ocp-cluster.svg | 2 +- .../scripts/delete_secrets.sh | 2 +- solutions/fully-configurable/variables.tf | 2 +- 9 files changed, 45 insertions(+), 38 deletions(-) create mode 100644 reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg delete mode 100644 reference-architecture/deployable-architecture-ocp-cluster-qs.svg diff --git a/ibm_catalog.json b/ibm_catalog.json index 74049f70..f0f29de9 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -91,100 +91,103 @@ "crn:v1:bluemix:public:iam::::role:Viewer" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Only required if creating context-based restrictions which can be toggled using the `provision_cbr` input." + "notes": "[Optional] Required to view IAM-enabled resources across the account." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "Administrator access is required for resource group creation and deletion." + "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups." }, { - "service_name": "containers-kubernetes", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" ], + "service_name": "containers-kubernetes", "notes": "Required to create and edit OpenShift cluster and the related resources." }, { - "service_name": "iam-identity", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], + "service_name": "iam-identity", "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud." }, { - "service_name": "is.vpc", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], + "service_name": "is.vpc", "notes": "Required for creating Virtual Private Cloud(VPC)." }, { - "service_name": "cloud-object-storage", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "cloud-object-storage", "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance." }, { - "service_name": "hs-crypto", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "hs-crypto", "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." }, { - "service_name": "kms", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "kms", "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket." }, { - "service_name": "sysdig-monitor", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "sysdig-monitor", "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." }, { - "service_name": "logs", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "logs", "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." }, { - "service_name": "logs-router", - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager" - ], - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Logs Routing." - }, - { - "service_name": "atracker", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "atracker", "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, { - "service_name": "secrets-manager", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], + "service_name": "secrets-manager", "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." }, { @@ -771,7 +774,7 @@ "key": "subnets", "type": "object", "default_value": "{\n zone-1 = [\n {\n name = \"subnet-a\"\n cidr = \"10.10.10.0/24\"\n public_gateway = true\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-2 = [\n {\n name = \"subnet-b\"\n cidr = \"10.20.10.0/24\"\n public_gateway = false\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ],\n zone-3 = [\n {\n name = \"subnet-c\"\n cidr = \"10.30.10.0/24\"\n public_gateway = false\n acl_name = \"vpc-acl\"\n no_addr_prefix = false\n }\n ]\n }", - "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addressess. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", + "description": "List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/fully-configurable/DA-types.md#subnets-).", "required": false, "virtual": true }, @@ -1047,34 +1050,38 @@ "working_directory": "solutions/quickstart", "iam_permissions": [ { - "service_name": "containers-kubernetes", + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" ], + "service_name": "containers-kubernetes", "notes": "Required to reset the cluster API key, create and edit the OpenShift cluster, and manage all related resources." }, { - "service_name": "iam-identity", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], + "service_name": "iam-identity", "notes": "Required to create the cluster API key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment." }, { - "service_name": "is.vpc", + "role_crns": [ "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "is.vpc", "notes": "Required for creating Virtual Private Cloud (VPC)." }, { - "service_name": "cloud-object-storage", - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" ], + "service_name": "cloud-object-storage", "notes": "Required for creating the OpenShift cluster's internal registry storage bucket." }, { diff --git a/modules/kube-audit/README.md b/modules/kube-audit/README.md index da3dbc4d..0cc061f3 100644 --- a/modules/kube-audit/README.md +++ b/modules/kube-audit/README.md @@ -80,7 +80,7 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [audit\_deployment\_name](#input\_audit\_deployment\_name) | The name of log collection deployement and service. | `string` | `"ibmcloud-kube-audit"` | no | +| [audit\_deployment\_name](#input\_audit\_deployment\_name) | The name of log collection deployment and service. | `string` | `"ibmcloud-kube-audit"` | no | | [audit\_log\_policy](#input\_audit\_log\_policy) | Specify the amount of information that is logged to the API server audit logs by choosing the audit log policy profile to use. Supported values are `default` and `WriteRequestBodies`. | `string` | `"default"` | no | | [audit\_namespace](#input\_audit\_namespace) | The name of the namespace where log collection service and a deployment will be created. | `string` | `"ibm-kube-audit"` | no | | [audit\_webhook\_listener\_image](#input\_audit\_webhook\_listener\_image) | The audit webhook listener image reference in the format of `[registry-url]/[namespace]/[image]`.The sub-module uses the `icr.io/ibm/ibmcloud-kube-audit-to-ibm-cloud-logs` image to forward logs to IBM Cloud Logs. This image is for demonstration purposes only. For a production solution, configure and maintain your own log forwarding image. | `string` | `"icr.io/ibm/ibmcloud-kube-audit-to-ibm-cloud-logs"` | no | diff --git a/modules/kube-audit/scripts/set_webhook.sh b/modules/kube-audit/scripts/set_webhook.sh index c65cccb4..483567ae 100755 --- a/modules/kube-audit/scripts/set_webhook.sh +++ b/modules/kube-audit/scripts/set_webhook.sh @@ -20,7 +20,7 @@ get_cloud_endpoint() { get_cloud_endpoint -# This is a workaround function added to retrive a new token, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6107) is fixed. +# This is a workaround function added to retrieve a new token, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6107) is fixed. fetch_token() { if [ "$IBMCLOUD_IAM_API_ENDPOINT" = "iam.cloud.ibm.com" ]; then if [ "$PRIVATE_ENV" = true ]; then @@ -38,7 +38,7 @@ fetch_token() { fetch_token -# This is a workaround function added to retrive the CA cert, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6068) is fixed. +# This is a workaround function added to retrieve the CA cert, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6068) is fixed. get_ca_cert() { if [ "$IBMCLOUD_CS_API_ENDPOINT" = "containers.cloud.ibm.com" ]; then if [ "$PRIVATE_ENV" = true ]; then diff --git a/modules/kube-audit/variables.tf b/modules/kube-audit/variables.tf index a9e5a7f1..d8f71300 100644 --- a/modules/kube-audit/variables.tf +++ b/modules/kube-audit/variables.tf @@ -81,7 +81,7 @@ variable "audit_namespace" { variable "audit_deployment_name" { type = string - description = "The name of log collection deployement and service." + description = "The name of log collection deployment and service." default = "ibmcloud-kube-audit" } diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg new file mode 100644 index 00000000..a0b0951b --- /dev/null +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg deleted file mode 100644 index fdbad4f2..00000000 --- a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 2c9a3c33..3eeb06b5 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
ACL
IBM Cloud
IBM Cloud
Region
RegionCloud logs
Observability
Observabil...
[Optional]
[Option...Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Cloud Object Storage 
[Optional] KMS
[Optional] KMS
Key Ring
Key Ring   Key for Registry BucketResource GroupVPC
Zone 3
Zone 3OpenShift
Zone 2
Zone 2
Zone 1
Zone 1Worker NodeWorker Node
Worker Pool
Worker PoolText is not SVG - cannot display \ No newline at end of file +
ACL
ACL
IBM Cloud
IBM Cloud
Region
RegionCloud logs
Observability
Observabil...
[Optional]
[Option...Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Cloud Object Storage 
[Optional] KMS
[Optional] KMS
Key Ring
Key Ring   Key for Registry BucketResource GroupVPC
Zone 3
Zone 3OpenShift
Zone 2
Zone 2
Zone 1
Zone 1Worker NodeWorker Node
Worker Pool
Worker PoolText is not SVG - cannot display \ No newline at end of file diff --git a/solutions/fully-configurable/scripts/delete_secrets.sh b/solutions/fully-configurable/scripts/delete_secrets.sh index bf0fc773..a4425da3 100755 --- a/solutions/fully-configurable/scripts/delete_secrets.sh +++ b/solutions/fully-configurable/scripts/delete_secrets.sh @@ -59,7 +59,7 @@ if [[ "$secrets_length" == 0 ]];then fi # delete the secrets inside the secret group -# retrycount for deleting a particular secret incase curl command for delete command fails +# retrycount for deleting a particular secret in case curl command for delete command fails retryCount=2; for ((i=0; i Date: Tue, 19 Aug 2025 00:41:22 +0530 Subject: [PATCH 06/15] minor changes --- tests/existing-resources/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/existing-resources/main.tf b/tests/existing-resources/main.tf index 646aafbf..4578297c 100644 --- a/tests/existing-resources/main.tf +++ b/tests/existing-resources/main.tf @@ -4,7 +4,7 @@ module "resource_group" { source = "terraform-ibm-modules/resource-group/ibm" version = "1.3.0" - resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group-yz" : null + resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null existing_resource_group_name = var.resource_group } @@ -41,9 +41,9 @@ module "cos" { version = "8.21.25" resource_group_id = module.resource_group.resource_group_id region = var.region - cos_instance_name = "${var.prefix}-cos-yz" + cos_instance_name = "${var.prefix}-cos" cos_tags = var.resource_tags - bucket_name = "${var.prefix}-bucket-yz" + bucket_name = "${var.prefix}-bucket" retention_enabled = false kms_encryption_enabled = false } From e290a5ce06ca820cfaa114e7133aea8df045b344 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 19 Aug 2025 09:19:10 +0530 Subject: [PATCH 07/15] diagram modifications --- .../deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg | 4 ---- .../deployable-architecture-ocp-cluster-qs.svg | 4 ++++ .../deployable-architecture-ocp-cluster.svg | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) delete mode 100644 reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg create mode 100644 reference-architecture/deployable-architecture-ocp-cluster-qs.svg diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg deleted file mode 100644 index a0b0951b..00000000 --- a/reference-architecture/deployable-architecture-ocp-cluster-qs-Page-2.drawio.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - -
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster-qs.svg b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg new file mode 100644 index 00000000..5f8fe84a --- /dev/null +++ b/reference-architecture/deployable-architecture-ocp-cluster-qs.svg @@ -0,0 +1,4 @@ + + + +
ACL
locked
IBM Cloud
Region
Resource GroupVPC
Worker node
Openshift
Zone 3
Zone 2
Zone 1
Subnet
Worker Node
Worker Pool
Registry Bucket
           Cloud Object Storage 
 \ No newline at end of file diff --git a/reference-architecture/deployable-architecture-ocp-cluster.svg b/reference-architecture/deployable-architecture-ocp-cluster.svg index 3eeb06b5..2946fbce 100644 --- a/reference-architecture/deployable-architecture-ocp-cluster.svg +++ b/reference-architecture/deployable-architecture-ocp-cluster.svg @@ -1,4 +1,4 @@ -
ACL
ACL
IBM Cloud
IBM Cloud
Region
RegionCloud logs
Observability
Observabil...
[Optional]
[Option...Cloud MonitoringSecrets ManagerRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] Cloud Object Storage 
[Optional] KMS
[Optional] KMS
Key Ring
Key Ring   Key for Registry BucketResource GroupVPC
Zone 3
Zone 3OpenShift
Zone 2
Zone 2
Zone 1
Zone 1Worker NodeWorker Node
Worker Pool
Worker PoolText is not SVG - cannot display \ No newline at end of file +
IBM Cloud
Region
Resource GroupRegistry Bucket
[Optional] Cloud Object Storage 
[Optional] KMS
Key Ring
Key for Registry BucketVPC
Zone 3
OpenShift
Zone 2
Zone 1
Worker NodeWorker Node
Worker Pool
Cloud logs
Observability
[Optional]
Cloud MonitoringSecrets Manager \ No newline at end of file From 289d34e40dba77c37e8ae59e98889f3a68b1877a Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 19 Aug 2025 13:41:30 +0530 Subject: [PATCH 08/15] minor changes --- ibm_catalog.json | 4 ++-- solutions/fully-configurable/variables.tf | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index f0f29de9..0e76ed80 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -196,7 +196,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "event-notifications", - "notes": "[Optional] Required if you are configuring an Event Notifications Instance." + "notes": "[Optional] Required if you are consuming the Secrets Manager deployable architecture." } ], "architecture": { @@ -509,7 +509,7 @@ { "key": "logs_routing_tenant_regions", "type": "array", - "default_value": "[]", + "default_value": [], "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, "custom_config": { diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 3f62f474..e4497f74 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -13,7 +13,7 @@ variable "ibmcloud_api_key" { variable "prefix" { type = string - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: wx-0205-orch. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: ocp-0205-vpc. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { # - null and empty string is allowed From 729bc1265b3e4da3030ac8b7f2304f220585a6db Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 19 Aug 2025 14:22:11 +0530 Subject: [PATCH 09/15] minor changes --- solutions/quickstart/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solutions/quickstart/variables.tf b/solutions/quickstart/variables.tf index 2f62dda3..002055be 100644 --- a/solutions/quickstart/variables.tf +++ b/solutions/quickstart/variables.tf @@ -24,7 +24,7 @@ variable "provider_visibility" { variable "prefix" { type = string - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: wx-0205-orch. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: ocp-0205-vpc. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { # - null and empty string is allowed From 20a595e12acea40f69cd5767535ab81219dc0b78 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 19 Aug 2025 19:45:43 +0530 Subject: [PATCH 10/15] minor changes --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 0e76ed80..032e2544 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -196,7 +196,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "event-notifications", - "notes": "[Optional] Required if you are consuming the Secrets Manager deployable architecture." + "notes": "[Optional] Required if you are configuring an Event Notifications Instance." } ], "architecture": { From 1ba8c79b6cecc69def9add0c91eaadca4cfc0643 Mon Sep 17 00:00:00 2001 From: Aatreyee Mukherjee Date: Thu, 21 Aug 2025 11:21:35 +0530 Subject: [PATCH 11/15] Update ibm_catalog.json Co-authored-by: prateek --- ibm_catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 032e2544..ecebdbbc 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -196,7 +196,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "event-notifications", - "notes": "[Optional] Required if you are configuring an Event Notifications Instance." + "notes": "[Optional] Required for creating an Event Notifications instance." } ], "architecture": { From f3287453789cd2d8ac874a671561e56472047ecb Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Thu, 21 Aug 2025 11:28:38 +0530 Subject: [PATCH 12/15] resolved comments --- ibm_catalog.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 032e2544..a65f1e7f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -498,7 +498,7 @@ "options": [ { "displayname": "true", - "value": true + "value": true }, { "displayname": "false", @@ -803,8 +803,8 @@ "value": "public" }, { - "displayname": "public-and-private", - "value": "Public-and-Private" + "displayname": "Public-and-Private", + "value": "public-and-private" } ], "hidden": true From 090fc77f91248b69a4de61b85512e49ecb0f0eb1 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 26 Aug 2025 20:07:38 +0530 Subject: [PATCH 13/15] fix --- ibm_catalog.json | 136 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 108 insertions(+), 28 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index be40d08a..94d6dae2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -153,16 +153,9 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" ], + "service_name": "containers-kubernetes", "notes": "Required to create and manage the Openshift cluster." }, - { - "service_name": "is.vpc", - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "kms", - "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket." - }, { "role_crns": [ @@ -190,13 +183,6 @@ "service_name": "atracker", "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, - { - - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "notes": "[Optional] Required to enable metrics routing to the Cloud Monitoring." - }, { "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", @@ -212,6 +198,15 @@ ], "service_name": "event-notifications", "notes": "[Optional] Required for creating an Event Notifications instance." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms", + "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket." } ], "architecture": { @@ -1064,6 +1059,27 @@ "install_type": "fullstack", "working_directory": "solutions/quickstart", "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "All Identity and Access enabled services", + "notes": "[Optional] Required to view IAM-enabled resources across the account." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups." + }, { "role_crns": [ @@ -1071,40 +1087,104 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "containers-kubernetes", - "notes": "Required to reset the cluster API key, create and edit the OpenShift cluster, and manage all related resources." + "notes": "Required to create and edit OpenShift cluster and the related resources." }, { "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" ], "service_name": "iam-identity", - "notes": "Required to create the cluster API key needed by the OpenShift cluster on IBM Cloud and for managing and operating resources within the IBM Cloud environment." + "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud." }, { "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Editor" + "crn:v1:bluemix:public:iam::::role:Administrator", + "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "service_name": "is.vpc", - "notes": "Required for creating Virtual Private Cloud (VPC)." + "notes": "Required for creating Virtual Private Cloud(VPC)." }, { "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "cloud-object-storage", - "notes": "Required for creating the OpenShift cluster's internal registry storage bucket." + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "cloud-object-storage", + "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance." }, { + "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Viewer" + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" ], - "service_name": "Resource group only", - "notes":"Viewer access is required in the resource group you want to provision in." + "service_name": "hs-crypto", + "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "containers-kubernetes", + "notes": "Required to create and manage the Openshift cluster." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "sysdig-monitor", + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "logs", + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "atracker", + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "secrets-manager", + "notes": "[Optional] Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "event-notifications", + "notes": "[Optional] Required for creating an Event Notifications instance." + }, + { + + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms", + "notes": "[Optional] Required if KMS encryption is enabled and Key protect is used for encryption of Kubernetes Secrets and Object Storage bucket." } ], "architecture": { From 4176ae783233830275b60ec260acf59e3ac2ec33 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 2 Sep 2025 10:13:38 +0530 Subject: [PATCH 14/15] resolved conflicts --- common-dev-assets | 2 +- ibm_catalog.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/common-dev-assets b/common-dev-assets index abf631a1..2ba5cc2c 160000 --- a/common-dev-assets +++ b/common-dev-assets @@ -1 +1 @@ -Subproject commit abf631a16a48a308e609896937e1eed16b4aae4e +Subproject commit 2ba5cc2c867361e8bcf34bd95f7359cc03d82b25 diff --git a/ibm_catalog.json b/ibm_catalog.json index 7675fd7c..9268e07d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -1135,7 +1135,7 @@ "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." }, { - + "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" From 49bd25b7581e9b3e9360ffaddb534811b1ed1198 Mon Sep 17 00:00:00 2001 From: aatreyee257 Date: Tue, 2 Sep 2025 10:22:03 +0530 Subject: [PATCH 15/15] fixes --- common-dev-assets | 2 +- ibm_catalog.json | 27 +++------------------------ 2 files changed, 4 insertions(+), 25 deletions(-) diff --git a/common-dev-assets b/common-dev-assets index 2ba5cc2c..abf631a1 160000 --- a/common-dev-assets +++ b/common-dev-assets @@ -1 +1 @@ -Subproject commit 2ba5cc2c867361e8bcf34bd95f7359cc03d82b25 +Subproject commit abf631a16a48a308e609896937e1eed16b4aae4e diff --git a/ibm_catalog.json b/ibm_catalog.json index 9268e07d..22515fe2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -86,7 +86,7 @@ "crn:v1:bluemix:public:iam::::role:Viewer" ], "service_name": "Resource group only", - "notes": "Viewer access is required in the resource group you want to provision in." + "notes": "Viewer access is required in the resource group you want to provision in." }, { "role_crns": [ @@ -103,7 +103,6 @@ "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" @@ -112,7 +111,6 @@ "notes": "Required to create and edit OpenShift cluster and the related resources." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" @@ -121,7 +119,6 @@ "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam::::serviceRole:Manager" @@ -130,7 +127,6 @@ "notes": "Required for creating Virtual Private Cloud(VPC)." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -139,7 +135,6 @@ "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -148,7 +143,6 @@ "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" @@ -157,7 +151,6 @@ "notes": "Required to create and manage the Openshift cluster." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" @@ -166,7 +159,6 @@ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -175,7 +167,6 @@ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" @@ -200,7 +191,6 @@ "notes": "[Optional] Required for creating an Event Notifications instance." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -527,7 +517,7 @@ "grouping": "deployment", "original_grouping": "deployment", "config_constraints": { - "type": "string" + "type": "string" } }, "virtual": true @@ -1090,7 +1080,6 @@ "notes": "[Optional] Required to deploy Cloud automation for account configuration, which creates foundational IBM Cloud account resources, like IAM settings, trusted profiles, access groups, and resource groups." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" @@ -1099,7 +1088,6 @@ "notes": "Required to create and edit OpenShift cluster and the related resources." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::role:Operator", "crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator" @@ -1108,7 +1096,6 @@ "notes": "Required to create the containers-kubernetes-key needed by the OpenShift cluster on IBM Cloud." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator", "crn:v1:bluemix:public:iam::::serviceRole:Manager" @@ -1117,7 +1104,6 @@ "notes": "Required for creating Virtual Private Cloud(VPC)." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -1126,7 +1112,6 @@ "notes": "[Optional] Required to create Cloud Object Storage (COS) Instance." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -1135,7 +1120,6 @@ "notes": "[Optional] Required if KMS encryption is enabled and IBM Hyper Protect Crypto Services is used to encrypt the Kubernetes Secrets and Object Storage bucket." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -1144,7 +1128,6 @@ "notes": "Required for creating the OpenShift cluster's internal registry storage bucket." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" @@ -1153,16 +1136,14 @@ "notes": "Required to create and manage the Openshift cluster." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor" @@ -1171,7 +1152,6 @@ "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Writer", "crn:v1:bluemix:public:iam::::role:Editor" @@ -1196,7 +1176,6 @@ "notes": "[Optional] Required for creating an Event Notifications instance." }, { - "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Editor"