Skip to content

Commit f55207e

Browse files
Vipin654Vipin654
authored
fix: fixed bug in the logic to determine the cluster ACL deny rule in the roks-ingress submodule (#264)
1 parent 1c317c2 commit f55207e

File tree

8 files changed

+126
-11
lines changed

8 files changed

+126
-11
lines changed

‎modules/roks-ingress/main.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@ locals {
2424
})
2525

2626
# Pick the first "Deny all" rule in the ACL to place new rules before that
27-
cluster_acl_deny_rule = [for rule in data.ibm_is_network_acl_rules.alb_acl_rules.rules : rule.rule_id if rule.action == "deny"][0]
27+
cluster_acl_deny_rule = length([for rule in data.ibm_is_network_acl_rules.alb_acl_rules.rules : rule.rule_id if rule.action == "deny"]) > 0 ? [for rule in data.ibm_is_network_acl_rules.alb_acl_rules.rules : rule.rule_id if rule.action == "deny"][0] : null
28+
29+
2830
}
2931

3032
data "ibm_container_nlb_dns" "cluster_nlb_dns" {
@@ -221,6 +223,7 @@ resource "ibm_is_network_acl_rule" "alb_https_req" {
221223
ignore_changes = [before]
222224
}
223225
}
226+
224227
resource "ibm_is_network_acl_rule" "alb_https_resp" {
225228
count = var.cluster_zone_count
226229
network_acl = data.ibm_is_network_acl.alb_acl.id

‎modules/roks-ingress/outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
output "cluster_workload_ingress_subdomain" {
22
description = "Public ingress subdomain"
33
value = local.ingress_subdomain
4+
45
}
56

67
output "cluster_workload_ingress_controller" {

‎tests/go.mod

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ go 1.22.4
55
toolchain go1.23.4
66

77
require (
8+
github.com/IBM/go-sdk-core v1.1.0
89
github.com/gruntwork-io/terratest v0.48.1
910
github.com/stretchr/testify v1.10.0
10-
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.42.10
11+
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.45.0
1112
)
1213

1314
require (
@@ -29,6 +30,7 @@ require (
2930
github.com/cloudflare/circl v1.3.7 // indirect
3031
github.com/cyphar/filepath-securejoin v0.3.6 // indirect
3132
github.com/davecgh/go-spew v1.1.1 // indirect
33+
github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
3234
github.com/emirpasic/gods v1.18.1 // indirect
3335
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
3436
github.com/ghodss/yaml v1.0.0 // indirect
@@ -95,6 +97,7 @@ require (
9597
golang.org/x/sys v0.29.0 // indirect
9698
golang.org/x/text v0.21.0 // indirect
9799
golang.org/x/tools v0.22.0 // indirect
100+
gopkg.in/go-playground/validator.v9 v9.31.0 // indirect
98101
gopkg.in/warnings.v0 v0.1.2 // indirect
99102
gopkg.in/yaml.v2 v2.4.0 // indirect
100103
gopkg.in/yaml.v3 v3.0.1 // indirect

‎tests/go.sum

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ github.com/IBM-Cloud/power-go-client v1.9.0 h1:nnErpb/7TJQe8P7OfIlJPhSJVq5oyuCJl
66
github.com/IBM-Cloud/power-go-client v1.9.0/go.mod h1:UDyXeIKEp6r7yWUXYu3r0ZnFSlNZ2YeQTHwM2Tmlgv0=
77
github.com/IBM/cloud-databases-go-sdk v0.7.1 h1:5kK4/3NUsGxZzmuUe+1ftajpOQbeDVh5VeemrPgROP4=
88
github.com/IBM/cloud-databases-go-sdk v0.7.1/go.mod h1:JYucI1PdwqbAd8XGdDAchxzxRP7bxOh1zUnseovHKsc=
9+
github.com/IBM/go-sdk-core v1.1.0 h1:pV73lZqr9r1xKb3h08c1uNG3AphwoV5KzUzhS+pfEqY=
10+
github.com/IBM/go-sdk-core v1.1.0/go.mod h1:2pcx9YWsIsZ3I7kH+1amiAkXvLTZtAq9kbxsfXilSoY=
911
github.com/IBM/go-sdk-core/v5 v5.9.2/go.mod h1:YlOwV9LeuclmT/qi/LAK2AsobbAP42veV0j68/rlZsE=
1012
github.com/IBM/go-sdk-core/v5 v5.18.5 h1:g0JRl3sYXJczB/yuDlrN6x22LJ6jIxhp0Sa4ARNW60c=
1113
github.com/IBM/go-sdk-core/v5 v5.18.5/go.mod h1:KonTFRR+8ZSgw5cxBSYo6E4WZoY1+7n1kfHM82VcjFU=
@@ -48,6 +50,8 @@ github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGL
4850
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4951
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5052
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
53+
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
54+
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
5155
github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ=
5256
github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
5357
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -106,9 +110,11 @@ github.com/go-openapi/validate v0.22.4 h1:5v3jmMyIPKTR8Lv9syBAIRxG6lY0RqeBPB1LKE
106110
github.com/go-openapi/validate v0.22.4/go.mod h1:qm6O8ZIcPVdSY5219468Jv7kBdGvkiZLPOmqnqTUZ2A=
107111
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
108112
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
113+
github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
109114
github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
110115
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
111116
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
117+
github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
112118
github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
113119
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
114120
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
@@ -192,6 +198,7 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
192198
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
193199
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
194200
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
201+
github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
195202
github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
196203
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
197204
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
@@ -294,8 +301,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
294301
github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
295302
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
296303
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
297-
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.42.10 h1:nyPAuFwSJhp157NBJNZfdpVycOjJa/xGz6qX1V0532c=
298-
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.42.10/go.mod h1:RpHvmlmqbmry1YvwWsx90rlirNe4KZ8o8GmntjKViJA=
304+
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.45.0 h1:jbKoB7MbiTUnXKB0JXBw67Eo/AnvcIEjUFNDZbtq5Iw=
305+
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.45.0/go.mod h1:RpHvmlmqbmry1YvwWsx90rlirNe4KZ8o8GmntjKViJA=
299306
github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
300307
github.com/tmccombs/hcl2json v0.6.4 h1:/FWnzS9JCuyZ4MNwrG4vMrFrzRgsWEOVi+1AyYUVLGw=
301308
github.com/tmccombs/hcl2json v0.6.4/go.mod h1:+ppKlIW3H5nsAsZddXPy2iMyvld3SHxyjswOZhavRDk=
@@ -506,7 +513,10 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
506513
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
507514
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
508515
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
516+
gopkg.in/go-playground/assert.v1 v1.2.1 h1:xoYuJVE7KT85PYWrN730RguIQO0ePzVRfFMXadIrXTM=
509517
gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
518+
gopkg.in/go-playground/validator.v9 v9.30.0/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
519+
gopkg.in/go-playground/validator.v9 v9.31.0 h1:bmXmP2RSNtFES+bn4uYuHT7iJFJv7Vj+an+ZQdDaD1M=
510520
gopkg.in/go-playground/validator.v9 v9.31.0/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
511521
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
512522
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=

‎tests/pr_test.go

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"strings"
99
"testing"
1010

11+
"github.com/IBM/go-sdk-core/core"
1112
"github.com/gruntwork-io/terratest/modules/files"
1213
"github.com/gruntwork-io/terratest/modules/logger"
1314
"github.com/gruntwork-io/terratest/modules/random"
@@ -45,8 +46,9 @@ func TestMain(m *testing.M) {
4546

4647
func setupOptions(t *testing.T, prefix string, existingTerraformOptions *terraform.Options) *testhelper.TestOptions {
4748
options := testhelper.TestOptionsDefault(&testhelper.TestOptions{
48-
Testing: t,
49-
TerraformDir: bankingSolutionsDir,
49+
Testing: t,
50+
TerraformDir: bankingSolutionsDir,
51+
ApiDataIsSensitive: core.BoolPtr(false),
5052
// Do not hard fail the test if the implicit destroy steps fail to allow a full destroy of resource to occur
5153
ImplicitRequired: false,
5254
Region: region,
@@ -75,6 +77,7 @@ func setupOptions(t *testing.T, prefix string, existingTerraformOptions *terrafo
7577
"create_secrets": false,
7678
},
7779
})
80+
7881
return options
7982
}
8083

@@ -98,14 +101,14 @@ func TestRunBankingSolutions(t *testing.T) {
98101
existingTerraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
99102
TerraformDir: tempTerraformDir,
100103
Vars: map[string]interface{}{
101-
"prefix": prefix,
102-
"region": region,
104+
"prefix": prefix,
105+
"region": region,
106+
"create_ocp_cluster": true,
103107
},
104108
// Set Upgrade to true to ensure latest version of providers and modules are used by terratest.
105109
// This is the same as setting the -upgrade=true flag with terraform.
106110
Upgrade: true,
107111
})
108-
109112
terraform.WorkspaceSelectOrNew(t, existingTerraformOptions, prefix)
110113
_, existErr := terraform.InitAndApplyE(t, existingTerraformOptions)
111114
if existErr != nil {
@@ -116,6 +119,8 @@ func TestRunBankingSolutions(t *testing.T) {
116119
// ------------------------------------------------------------------------------------
117120
options := setupOptions(t, prefix, existingTerraformOptions)
118121

122+
options.TerraformVars["cluster_name"] = terraform.Output(t, existingTerraformOptions, "cluster_name")
123+
119124
output, err := options.RunTest()
120125
assert.Nil(t, err, "This should not have errored")
121126
assert.NotNil(t, output, "Expected some output")
@@ -151,8 +156,9 @@ func TestRunUpgradeExample(t *testing.T) {
151156
existingTerraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
152157
TerraformDir: tempTerraformDir,
153158
Vars: map[string]interface{}{
154-
"prefix": prefix,
155-
"region": region,
159+
"prefix": prefix,
160+
"region": region,
161+
"create_ocp_cluster": true,
156162
},
157163
// Set Upgrade to true to ensure latest version of providers and modules are used by terratest.
158164
// This is the same as setting the -upgrade=true flag with terraform.
@@ -169,6 +175,8 @@ func TestRunUpgradeExample(t *testing.T) {
169175
// ------------------------------------------------------------------------------------
170176
options := setupOptions(t, prefix, existingTerraformOptions)
171177

178+
options.TerraformVars["cluster_name"] = terraform.Output(t, existingTerraformOptions, "cluster_name")
179+
172180
options.IgnoreDestroys = testhelper.Exemptions{
173181
List: []string{
174182
"module.configure_discovery_project[0].null_resource.discovery_file_upload",

‎tests/resources/existing-resources/main.tf

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,25 @@
11
locals {
2+
23
signing_key_payload = sensitive("secret-signing-key-payload")
4+
cluster_vpc_subnets = {
5+
default = [
6+
{
7+
id = var.create_ocp_cluster ? ibm_is_subnet.subnet_zone_1[0].id : null
8+
cidr_block = var.create_ocp_cluster ? ibm_is_subnet.subnet_zone_1[0].ipv4_cidr_block : null
9+
zone = var.create_ocp_cluster ? ibm_is_subnet.subnet_zone_1[0].zone : null
10+
}
11+
]
12+
}
13+
14+
worker_pools = [
15+
{
16+
subnet_prefix = "default"
17+
pool_name = "default" # ibm_container_vpc_cluster automatically names default pool "default" (See https://github.com/IBM-Cloud/terraform-provider-ibm/issues/2849)
18+
machine_type = "bx2.4x16"
19+
workers_per_zone = 2 # minimum of 2 is allowed when using single zone
20+
operating_system = "REDHAT_8_64"
21+
}
22+
]
323
}
424

525
########################################################################################################################
@@ -102,3 +122,61 @@ resource "ibm_cd_toolchain_tool_pipeline" "cd_toolchain_tool_pipeline_instance"
102122
resource "ibm_cd_tekton_pipeline" "cd_tekton_pipeline_instance" {
103123
pipeline_id = ibm_cd_toolchain_tool_pipeline.cd_toolchain_tool_pipeline_instance.tool_id
104124
}
125+
126+
127+
128+
########################################################################################################################
129+
# VPC + Subnet + Public Gateway
130+
#
131+
# NOTE: This is a very simple VPC with single subnet in a single zone with a public gateway enabled, that will allow
132+
# all traffic ingress/egress by default.
133+
# For production use cases this would need to be enhanced by adding more subnets and zones for resiliency, and
134+
# ACLs/Security Groups for network security.
135+
########################################################################################################################
136+
137+
resource "ibm_is_vpc" "vpc" {
138+
count = var.create_ocp_cluster ? 1 : 0
139+
name = "${var.prefix}-vpc"
140+
resource_group = module.resource_group.resource_group_id
141+
address_prefix_management = "auto"
142+
tags = []
143+
}
144+
145+
resource "ibm_is_public_gateway" "gateway" {
146+
count = var.create_ocp_cluster ? 1 : 0
147+
name = "${var.prefix}-gateway-1"
148+
vpc = ibm_is_vpc.vpc[0].id
149+
resource_group = module.resource_group.resource_group_id
150+
zone = "${var.region}-1"
151+
}
152+
153+
resource "ibm_is_subnet" "subnet_zone_1" {
154+
count = var.create_ocp_cluster ? 1 : 0
155+
name = "${var.prefix}-subnet-1"
156+
vpc = ibm_is_vpc.vpc[0].id
157+
resource_group = module.resource_group.resource_group_id
158+
zone = "${var.region}-1"
159+
total_ipv4_address_count = 256
160+
public_gateway = ibm_is_public_gateway.gateway[0].id
161+
}
162+
163+
164+
module "ocp_base" {
165+
166+
count = var.create_ocp_cluster ? 1 : 0
167+
source = "terraform-ibm-modules/base-ocp-vpc/ibm"
168+
version = "3.35.10"
169+
resource_group_id = module.resource_group.resource_group_id
170+
region = var.region
171+
tags = []
172+
cluster_name = var.prefix
173+
force_delete_storage = true
174+
vpc_id = ibm_is_vpc.vpc[0].id
175+
vpc_subnets = local.cluster_vpc_subnets
176+
ocp_version = null
177+
worker_pools = local.worker_pools
178+
access_tags = []
179+
ocp_entitlement = null
180+
disable_outbound_traffic_protection = true # set as True to enable outbound traffic; required for accessing Operator Hub in the OpenShift console.
181+
import_default_worker_pool_on_create = false
182+
}

‎tests/resources/existing-resources/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,8 @@ output "signing_key" {
5353
sensitive = true
5454
description = "Signing key payload."
5555
}
56+
57+
output "cluster_name" {
58+
value = var.create_ocp_cluster ? module.ocp_base[0].cluster_name : null
59+
description = "The name of the provisioned cluster."
60+
}

‎tests/resources/existing-resources/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,10 @@ variable "region" {
2020
description = "Region where resources are deployed"
2121
type = string
2222
}
23+
24+
variable "create_ocp_cluster" {
25+
26+
description = "Openshift cluster for deployment of sample rag app"
27+
type = bool
28+
default = false
29+
}

0 commit comments

Comments
 (0)