From 873f34d3e619ccf5e0121234d413003369429e4c Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Mon, 14 Jul 2025 10:36:28 +0530 Subject: [PATCH 01/16] refactor: Improve User experience --- ibm_catalog.json | 43 +++++++++++--------- solutions/fully-configurable/DA-cbr_rules.md | 6 +-- solutions/fully-configurable/DA-prefix.md | 38 ----------------- solutions/fully-configurable/README.md | 10 +---- solutions/fully-configurable/main.tf | 2 +- solutions/fully-configurable/provider.tf | 7 ++-- solutions/fully-configurable/variables.tf | 6 +-- 7 files changed, 36 insertions(+), 76 deletions(-) delete mode 100644 solutions/fully-configurable/DA-prefix.md diff --git a/ibm_catalog.json b/ibm_catalog.json index 7ed272f..d352bdd 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -9,7 +9,7 @@ "ibm_created", "terraform", "solution", - "support_ibm" + "target_terraform" ], "keywords": [ "terraform", @@ -26,13 +26,17 @@ "provider_name": "IBM", "features": [ { - "title": "Provision Collection", + "title": "Collection", "description": "Supports creation of collection to help manage feature flags and dynamic properties at scale." }, { "title": "CBR Enhanced Security", "description": "Provides support for defining context-based restrictions (CBR) to enhance security and control access based on network policies." }, + { + "title": "Trusted Profile", + "description": "Creates trusted profile needed with required access for configuration aggregator." + }, { "title": "Configuration Aggregator", "description": "Supports creation and management of configuration aggregator to manage configurations across multiple App Configuration instances." @@ -43,6 +47,7 @@ { "label": "Fully configurable", "name": "fully-configurable", + "index": 1, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", "compliance": { @@ -192,7 +197,13 @@ ] }, { - "key": "app_config_collections" + "key": "app_config_collections", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "app_config_tags", @@ -229,7 +240,13 @@ "key": "config_aggregator_enterprise_account_ids_to_assign" }, { - "key": "app_config_cbr_rules" + "key": "cbr_rules", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "provider_visibility", @@ -270,21 +287,9 @@ "descriptions": "This architecture supports creating and configuring an IBM Cloud App Configuration", "features": [ { - "title": "App Configuration instance with Collections", - "description": "Creates App Configuration instance. Collections can be created and configured for the instance" - }, - { - "title": "Use existing resource group", - "description": "Supports deployment into an existing IBM Cloud resource group." - }, - { - "title": "CBR Enhanced Security", - "description": "Enforces network-based access control through context-based restrictions (CBR) rules." - }, - { - "title": "Configuration Aggregator", - "description": "Enables the creation and management of configuration aggregator to consolidate and monitor configurations across multiple App Configuration instances." - } + "title": " ", + "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." + } ], "diagrams": [ { diff --git a/solutions/fully-configurable/DA-cbr_rules.md b/solutions/fully-configurable/DA-cbr_rules.md index 0581f0f..2edba81 100644 --- a/solutions/fully-configurable/DA-cbr_rules.md +++ b/solutions/fully-configurable/DA-cbr_rules.md @@ -1,12 +1,12 @@ # Configuring context-based restrictions (CBRs) -The `app_config_cbr_rules` input variable allows you to provide a rule for the target service to enforce access restrictions for the service based on the context of access requests. Contexts are criteria that include the network location of access requests, the endpoint type from where the request is sent, etc. +The `cbr_rules` input variable allows you to provide a rule for the target service to enforce access restrictions for the service based on the context of access requests. Contexts are criteria that include the network location of access requests, the endpoint type from where the request is sent, etc. -- Variable name: `app_config_cbr_rules`. +- Variable name: `cbr_rules`. - Type: A list of objects. Allows only one object representing a rule for the target service - Default value: An empty list (`[]`). -### Options for app_config_cbr_rules +### Options for cbr_rules - `description` (required): The description of the rule to create. - `account_id` (required): The IBM Cloud Account ID diff --git a/solutions/fully-configurable/DA-prefix.md b/solutions/fully-configurable/DA-prefix.md deleted file mode 100644 index 822c7d1..0000000 --- a/solutions/fully-configurable/DA-prefix.md +++ /dev/null @@ -1,38 +0,0 @@ -# Prefix in Deployable Architecture - -The **`prefix`** input variable allows you to prepend a custom string to the names of all resources created by this automation. This is especially useful for: - -- **Avoiding naming collisions** when deploying the same solution multiple times within the same account. -- **Creating identical infrastructure** across multiple regions or environments. -- **Improving resource traceability** by embedding environment or region identifiers into resource names. - -If you do not wish to use a prefix, you may set the value to `null` or an empty string (`""`). - -**Important**: The automation automatically inserts a hyphen between the prefix and the resource name. Therefore, you do not need to include a hyphen in the prefix yourself. - -### Examples - -Here are some common patterns for using the prefix: - -- **Environment-based**: - - `dev`, `test`, `prod` -- **Environment + Region**: - - `dev-eu-gb`, `prod-us-south`, `test-jp-tok` -- **Project-specific**: - - `webapp-dev`, `ml-prod`, `iot-test` -- **Team or department identifiers**: - - `fin-dev`, `hr-prod`, `eng-test` -- **Date or version-based** (for temporary or experimental deployments): - - `exp-202505`, `v2-dev` - -These conventions help ensure that resources are clearly grouped and easily identifiable, especially in shared or multi-tenant accounts. - -### Naming Rules - -To ensure compatibility and consistency, the prefix must follow these rules: - -- Must begin with a **lowercase letter** -- May contain only **lowercase letters**, **digits**, and **hyphens (`-`)** -- Must **not end** with a hyphen (`-`) -- Must **not contain consecutive hyphens** (`--`) -- Maximum length: **16 characters** diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index b4c8f7b..d9b8d3b 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -1,11 +1,3 @@ -# Cloud automation for App Configuration - -[![Catalog release](https://img.shields.io/badge/release-IBM%20Cloud%20Catalog-3662FF?logo=ibm)](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-apprapp-045c1169-d15a-4046-ae81-aa3d3348421f-global) - -This solution supports provisioning and configuring the following infrastructure: - -- App Config instance and collections -- Optional context-based restrictions (CBR) -- Configuration aggregator +# Cloud automation for App Configuration (Fully configurable) :exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf index 31fccda..87d2a95 100644 --- a/solutions/fully-configurable/main.tf +++ b/solutions/fully-configurable/main.tf @@ -31,5 +31,5 @@ module "app_config" { config_aggregator_enterprise_trusted_profile_template_name = "${local.prefix}${var.config_aggregator_enterprise_trusted_profile_template_name}" config_aggregator_enterprise_account_group_ids_to_assign = var.config_aggregator_enterprise_account_group_ids_to_assign config_aggregator_enterprise_account_ids_to_assign = var.config_aggregator_enterprise_account_ids_to_assign - cbr_rules = var.app_config_cbr_rules + cbr_rules = var.cbr_rules } diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf index f69fb6d..146dea9 100644 --- a/solutions/fully-configurable/provider.tf +++ b/solutions/fully-configurable/provider.tf @@ -1,5 +1,6 @@ provider "ibm" { - ibmcloud_api_key = var.ibmcloud_api_key - region = var.region - visibility = var.provider_visibility + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null } diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 51f35b6..6c1607c 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -30,7 +30,7 @@ variable "existing_resource_group_name" { variable "prefix" { type = string nullable = true - description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-us-south. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/tree/main/solutions/fully-configurable/DA-prefix.md)." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-us-south. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { # - null and empty string is allowed @@ -50,7 +50,7 @@ variable "prefix" { variable "region" { type = string - description = "The region to provision resources to." + description = "The region to provision all resources in. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services." default = "us-south" nullable = false } @@ -197,7 +197,7 @@ variable "config_aggregator_enterprise_account_ids_to_assign" { # Context-based restriction (CBR) ############################################################## -variable "app_config_cbr_rules" { +variable "cbr_rules" { type = list(object({ description = string account_id = string From bbb518a6fc0eabb78a6900b66c1f507423525992 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Wed, 16 Jul 2025 01:25:28 +0530 Subject: [PATCH 02/16] update iam permissions --- ibm_catalog.json | 74 ++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index d352bdd..5f2a952 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -269,10 +269,11 @@ ], "iam_permissions": [ { - "service_name": "resource-group", "role_crns": [ "crn:v1:bluemix:public:iam::::role:Viewer" - ] + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." }, { "role_crns": [ @@ -281,6 +282,75 @@ ], "service_name": "apprapp", "notes": "Required for provisioning the App Configuration instance." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "iam-identity", + "notes": "Administrator access is required in the resource group you want to provision in." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Identity and Access enabled services", + "notes": "[Optional] Only required if you have enabled `enable_config_aggregator` flag that creates trusted profile for authentication or consuming Account Configuration deployable architecture which creates resource group with account settings." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "atracker", + "notes": "[Optional] Only required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "sysdig-monitor", + "notes": "[Optional] Only required if you are consuming the Observability deployable architecture which sets up Cloud Monitoring." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "logs", + "notes": "[Optional] Only required if you are consuming the Observability deployable architecture which sets up Cloud Logs." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "hs-crypto", + "notes": "[Optional] Only required if you are enabling Observability deployable architecture for Hyper Protect Crypto Services." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "kms", + "notes": "[Optional] Only required if you are enabling Observability deployable architecture for KMS encryption." + }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "service_name": "cloud-object-storage", + "notes": "[Optional] Only required if you are enabling Observability deployable architecture for COS." } ], "architecture": { From 59d2ff23c9ca7e990ea9f12b16bb7219119a0fd1 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Wed, 16 Jul 2025 01:37:13 +0530 Subject: [PATCH 03/16] update iam permissions --- ibm_catalog.json | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 5f2a952..cd343d2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -283,26 +283,19 @@ "service_name": "apprapp", "notes": "Required for provisioning the App Configuration instance." }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "service_name": "iam-identity", - "notes": "Administrator access is required in the resource group you want to provision in." - }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group." + "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group or have enabled `enable_config_aggregator` flag." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Only required if you have enabled `enable_config_aggregator` flag that creates trusted profile for authentication or consuming Account Configuration deployable architecture which creates resource group with account settings." + "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group with account setting or have enabled `enable_config_aggregator` flag that creates trusted profile for authentication." }, { "role_crns": [ From 9026d097664a40bf2490e8912bbbaae1a97c8ad7 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Wed, 16 Jul 2025 15:07:11 +0530 Subject: [PATCH 04/16] PR changes --- ibm_catalog.json | 95 ++++++++++++++------ reference-architecture/app_configuration.svg | 2 +- 2 files changed, 68 insertions(+), 29 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index cd343d2..6280e5a 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -27,7 +27,7 @@ "features": [ { "title": "Collection", - "description": "Supports creation of collection to help manage feature flags and dynamic properties at scale." + "description": "Supports creation of one or more collections depending on the plan to help manage feature flags and dynamic properties at scale." }, { "title": "CBR Enhanced Security", @@ -288,14 +288,14 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group or have enabled `enable_config_aggregator` flag." + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group or enabling `enable_config_aggregator` flag." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Only required if you are consuming Account Configuration deployable architecture which creates resource group with account setting or have enabled `enable_config_aggregator` flag that creates trusted profile for authentication." + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account setting or enabling `enable_config_aggregator` flag that creates trusted profile for authentication." }, { "role_crns": [ @@ -303,7 +303,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "atracker", - "notes": "[Optional] Only required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, { "role_crns": [ @@ -311,7 +311,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Only required if you are consuming the Observability deployable architecture which sets up Cloud Monitoring." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." }, { "role_crns": [ @@ -319,7 +319,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Only required if you are consuming the Observability deployable architecture which sets up Cloud Logs." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." }, { "role_crns": [ @@ -327,7 +327,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Only required if you are enabling Observability deployable architecture for Hyper Protect Crypto Services." + "notes": "[Optional] Required for enabling Hyper Protect Crypto Services in Observability deployable architecture." }, { "role_crns": [ @@ -335,7 +335,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Only required if you are enabling Observability deployable architecture for KMS encryption." + "notes": "[Optional] Required for enabling KMS encryption in Observability deployable architecture." }, { "role_crns": [ @@ -343,7 +343,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Only required if you are enabling Observability deployable architecture for COS." + "notes": "[Optional] Required for enabling COS in Observability deployable architecture." } ], "architecture": { @@ -375,7 +375,10 @@ "resource-groups-with-account-settings" ], "default_flavor": "resource-group-only", + "version": "v3.0.7", "id": "63641cec-6093-4b4f-b7b0-98d2f4185cd6-global", + "optional": true, + "on_by_default": false, "input_mapping": [ { "dependency_output": "workload_resource_group_name", @@ -391,48 +394,84 @@ "version_input": "provider_visibility", "reference_version": true } - ], - "optional": true, - "on_by_default": false, - "version": "v3.0.7" + ] }, { - "name": "deploy-arch-ibm-observability", - "description": "Enable to provision and configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", + "name": "deploy-arch-ibm-cloud-logs", + "description": "Enable this to create an IBM Cloud Logs (ICL) Instance which can be used for storage and analysis of events ingested by Activity Tracker. ", + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ - "instances" + "fully-configurable" ], - "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "id": "63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global", + "version": "v1.5.6", + "optional": true, + "on_by_default": true, "input_mapping": [ - { - "dependency_output": "cloud_monitoring_crn", - "version_input": "existing_monitoring_crn" - }, { "dependency_input": "prefix", "version_input": "prefix", "reference_version": true }, + { + "dependency_input": "existing_resource_group_name", + "version_input": "existing_resource_group_name", + "reference_version": true + }, { "dependency_input": "region", "version_input": "region", "reference_version": true - }, + } + ] + }, + { + "name": "deploy-arch-ibm-cloud-monitoring", + "description": "Enable IBM Cloud Monitoring to gain operational visibility into your cloud storage buckets.", + "id": "73debdbf-894f-4c14-81c7-5ece3a70b67d-global", + "version": "v1.3.0", + "flavors": [ + "fully-configurable" + ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + "optional": true, + "on_by_default": true, + "input_mapping": [ { - "dependency_input": "enable_platform_metrics", - "version_input": "enable_platform_metrics", + "dependency_input": "prefix", + "version_input": "prefix", "reference_version": true }, { - "dependency_input": "logs_routing_tenant_regions", - "version_input": "logs_routing_tenant_regions", + "dependency_input": "region", + "version_input": "region", "reference_version": true } + ] + }, + { + "name": "deploy-arch-ibm-activity-tracker", + "description": "Enable to provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance.", + "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", + "version": "v1.1.3", + "flavors": [ + "fully-configurable" ], + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "optional": true, "on_by_default": true, - "version": "v3.0.3" + "input_mapping": [ + { + "dependency_input": "prefix", + "version_input": "prefix", + "reference_version": true + }, + { + "dependency_input": "region", + "version_input": "region", + "reference_version": true + } + ] } ], "dependency_version_2": true, diff --git a/reference-architecture/app_configuration.svg b/reference-architecture/app_configuration.svg index 2d05474..267ae1c 100644 --- a/reference-architecture/app_configuration.svg +++ b/reference-architecture/app_configuration.svg @@ -1,4 +1,4 @@ -
IBM Cloud
Region
Resource Group
App Config
 \ No newline at end of file +IBM CloudRegion[Optional]
Observability
Cloud LogsCloud Monitoring
Activity Tracker
Resource Group
App Config
 \ No newline at end of file From 80d71e49dd96216f81d70590d019b4833e9266c4 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 17 Jul 2025 01:41:56 +0530 Subject: [PATCH 05/16] Update notes for catalog --- ibm_catalog.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 6280e5a..f9d666b 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -303,7 +303,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "atracker", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required for consuming Activity Tracker Event Routing deployable architecture." }, { "role_crns": [ @@ -311,7 +311,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Monitoring." + "notes": "[Optional] Required for consuming Cloud Monitoring deployable architecture." }, { "role_crns": [ @@ -319,7 +319,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud Logs." + "notes": "[Optional] Required for consuming Cloud Logs deployable architecture." }, { "role_crns": [ @@ -327,7 +327,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Required for enabling Hyper Protect Crypto Services in Observability deployable architecture." + "notes": "[Optional] Required for enabling Hyper Protect Crypto Services in Event Routing and Cloud Logs deployable architecture." }, { "role_crns": [ @@ -335,7 +335,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Required for enabling KMS encryption in Observability deployable architecture." + "notes": "[Optional] Required for enabling KMS encryption in Event Routing and Cloud Logs deployable architecture." }, { "role_crns": [ @@ -343,7 +343,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required for enabling COS in Observability deployable architecture." + "notes": "[Optional] Required for enabling COS in Event Routing and Cloud Logs deployable architecture." } ], "architecture": { From 6d1ebdf117bbec8760eed4146b07a4dd93cc7d3b Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 17 Jul 2025 11:05:38 +0530 Subject: [PATCH 06/16] Update depends on --- ibm_catalog.json | 15 +++++++++++++-- reference-architecture/app_configuration.svg | 2 +- solutions/fully-configurable/provider.tf | 7 +++---- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index f9d666b..7f12914 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -9,7 +9,8 @@ "ibm_created", "terraform", "solution", - "target_terraform" + "target_terraform", + "converged_infra" ], "keywords": [ "terraform", @@ -422,6 +423,11 @@ "dependency_input": "region", "version_input": "region", "reference_version": true + }, + { + "dependency_input": "logs_routing_tenant_regions", + "version_input": "logs_routing_tenant_regions", + "reference_version": true } ] }, @@ -437,6 +443,11 @@ "optional": true, "on_by_default": true, "input_mapping": [ + { + "dependency_input": "enable_platform_metrics", + "version_input": "enable_platform_metrics", + "reference_version": true + }, { "dependency_input": "prefix", "version_input": "prefix", @@ -451,7 +462,7 @@ }, { "name": "deploy-arch-ibm-activity-tracker", - "description": "Enable to provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance.", + "description": "Enable to provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance to a Cloud logs target instance.", "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", "version": "v1.1.3", "flavors": [ diff --git a/reference-architecture/app_configuration.svg b/reference-architecture/app_configuration.svg index 267ae1c..7cfb13b 100644 --- a/reference-architecture/app_configuration.svg +++ b/reference-architecture/app_configuration.svg @@ -1,4 +1,4 @@ -IBM CloudRegion[Optional]
Observability
Cloud LogsCloud Monitoring
Activity Tracker
Resource Group
App Config
 \ No newline at end of file +IBM CloudRegion[Optional]
Observability
Cloud LogsCloud Monitoring
Activity Tracker
Event Routing
Resource Group
App Config
 \ No newline at end of file diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf index 146dea9..f69fb6d 100644 --- a/solutions/fully-configurable/provider.tf +++ b/solutions/fully-configurable/provider.tf @@ -1,6 +1,5 @@ provider "ibm" { - ibmcloud_api_key = var.ibmcloud_api_key - region = var.region - visibility = var.provider_visibility - private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility } From 32d72a4582ad2e8c2623fae2b4b2464c9b68f373 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 17 Jul 2025 22:51:33 +0530 Subject: [PATCH 07/16] Update virtual variables --- ibm_catalog.json | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 7f12914..5931566 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -138,30 +138,20 @@ }, { "key": "enable_platform_metrics", - "type": "string", - "default_value": "true", + "type": "boolean", + "default_value": true, "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true, - "options": [ - { - "displayname": "true", - "value": "true" - }, - { - "displayname": "false", - "value": "false" - } - ] + "virtual": true }, { "key": "logs_routing_tenant_regions", - "type": "list(string)", - "default_value": "[]", "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, + "default_value": "[]", "virtual": true, "custom_config": { + "type": "array", "grouping": "deployment", "original_grouping": "deployment", "config_constraints": { @@ -464,7 +454,7 @@ "name": "deploy-arch-ibm-activity-tracker", "description": "Enable to provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance to a Cloud logs target instance.", "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", - "version": "v1.1.3", + "version": "v1.1.4", "flavors": [ "fully-configurable" ], From 20ad5d0d8a193e8b2c304a0c66ba2a1992024077 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 24 Jul 2025 16:19:18 +0530 Subject: [PATCH 08/16] update description --- common-dev-assets | 2 +- ibm_catalog.json | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/common-dev-assets b/common-dev-assets index 6739b3a..fb0c336 160000 --- a/common-dev-assets +++ b/common-dev-assets @@ -1 +1 @@ -Subproject commit 6739b3a089aa08a072dd83c8b594311e42fc96d4 +Subproject commit fb0c336ba3864be28a8367e78074d79cd70d406d diff --git a/ibm_catalog.json b/ibm_catalog.json index 5931566..9e91440 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -389,7 +389,7 @@ }, { "name": "deploy-arch-ibm-cloud-logs", - "description": "Enable this to create an IBM Cloud Logs (ICL) Instance which can be used for storage and analysis of events ingested by Activity Tracker. ", + "description": "Provision and configure IBM Cloud Logs (ICL) instance which can be used for analysing logs generated by App Configuration instance. ", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "fully-configurable" @@ -423,7 +423,7 @@ }, { "name": "deploy-arch-ibm-cloud-monitoring", - "description": "Enable IBM Cloud Monitoring to gain operational visibility into your cloud storage buckets.", + "description": "Provision and configure IBM Cloud Monitoring for metrics generated by the App Configuration instance.", "id": "73debdbf-894f-4c14-81c7-5ece3a70b67d-global", "version": "v1.3.0", "flavors": [ @@ -452,7 +452,7 @@ }, { "name": "deploy-arch-ibm-activity-tracker", - "description": "Enable to provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance to a Cloud logs target instance.", + "description": "Provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance to a Cloud logs target instance.", "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", "version": "v1.1.4", "flavors": [ From f4dc54d27f7c4aed42bb9f5cc5bf6af99fe996ac Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 24 Jul 2025 16:23:54 +0530 Subject: [PATCH 09/16] update description --- ibm_catalog.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 9e91440..974d7e7 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -142,7 +142,17 @@ "default_value": true, "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true + "virtual": true, + "options": [ + { + "displayname": "true", + "value": "true" + }, + { + "displayname": "false", + "value": "false" + } + ] }, { "key": "logs_routing_tenant_regions", From 02a31e5777906f8a2c29ffe53a72a8774cbe51c4 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Fri, 25 Jul 2025 13:53:14 +0530 Subject: [PATCH 10/16] restore workaround --- ibm_catalog.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 974d7e7..fb8bfe7 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -138,8 +138,8 @@ }, { "key": "enable_platform_metrics", - "type": "boolean", - "default_value": true, + "type": "string", + "default_value": "true", "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, "virtual": true, @@ -156,12 +156,12 @@ }, { "key": "logs_routing_tenant_regions", + "type": "list(string)", + "default_value": "[]", "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, - "default_value": "[]", "virtual": true, "custom_config": { - "type": "array", "grouping": "deployment", "original_grouping": "deployment", "config_constraints": { From 1bb12c28fc0f95905972aee00d5b5dfd5d3828ca Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Mon, 4 Aug 2025 10:07:33 +0530 Subject: [PATCH 11/16] restore Observability --- ibm_catalog.json | 75 +++++++++--------------------------------------- 1 file changed, 13 insertions(+), 62 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index fb8bfe7..80da5e6 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -397,26 +397,22 @@ } ] }, - { - "name": "deploy-arch-ibm-cloud-logs", - "description": "Provision and configure IBM Cloud Logs (ICL) instance which can be used for analysing logs generated by App Configuration instance. ", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", + { + "name": "deploy-arch-ibm-observability", + "description": "Enable to provision and configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", "flavors": [ - "fully-configurable" + "instances" ], - "id": "63d8ae58-fbf3-41ce-b844-0fb5b85882ab-global", - "version": "v1.5.6", - "optional": true, - "on_by_default": true, + "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", + "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "input_mapping": [ { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true + "dependency_output": "cloud_monitoring_crn", + "version_input": "existing_monitoring_crn" }, { - "dependency_input": "existing_resource_group_name", - "version_input": "existing_resource_group_name", + "dependency_input": "prefix", + "version_input": "prefix", "reference_version": true }, { @@ -424,65 +420,20 @@ "version_input": "region", "reference_version": true }, - { - "dependency_input": "logs_routing_tenant_regions", - "version_input": "logs_routing_tenant_regions", - "reference_version": true - } - ] - }, - { - "name": "deploy-arch-ibm-cloud-monitoring", - "description": "Provision and configure IBM Cloud Monitoring for metrics generated by the App Configuration instance.", - "id": "73debdbf-894f-4c14-81c7-5ece3a70b67d-global", - "version": "v1.3.0", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "optional": true, - "on_by_default": true, - "input_mapping": [ { "dependency_input": "enable_platform_metrics", "version_input": "enable_platform_metrics", "reference_version": true }, { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", + "dependency_input": "logs_routing_tenant_regions", + "version_input": "logs_routing_tenant_regions", "reference_version": true } - ] - }, - { - "name": "deploy-arch-ibm-activity-tracker", - "description": "Provision and configure Activity Tracker event routing for routing cloud events generated by the App Configuration instance to a Cloud logs target instance.", - "id": "918453c3-4f97-4583-8c4a-83ef12fc7916-global", - "version": "v1.1.4", - "flavors": [ - "fully-configurable" ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "optional": true, "on_by_default": true, - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ] + "version": "v3.0.3" } ], "dependency_version_2": true, From 369aab9fdd3257c959557142db66f46f1659d8b5 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Mon, 4 Aug 2025 10:10:35 +0530 Subject: [PATCH 12/16] restore Observability --- ibm_catalog.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 80da5e6..36dc6cd 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -376,10 +376,7 @@ "resource-groups-with-account-settings" ], "default_flavor": "resource-group-only", - "version": "v3.0.7", "id": "63641cec-6093-4b4f-b7b0-98d2f4185cd6-global", - "optional": true, - "on_by_default": false, "input_mapping": [ { "dependency_output": "workload_resource_group_name", @@ -395,9 +392,12 @@ "version_input": "provider_visibility", "reference_version": true } - ] + ], + "optional": true, + "on_by_default": false, + "version": "v3.0.7" }, - { + { "name": "deploy-arch-ibm-observability", "description": "Enable to provision and configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", "flavors": [ From 7c27820fcd4aafe341dd27043f33729e511e31a4 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Tue, 5 Aug 2025 14:45:40 +0530 Subject: [PATCH 13/16] PR changes --- ibm_catalog.json | 24 ++++++++++---------- reference-architecture/app_configuration.svg | 2 +- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 36dc6cd..3abd5b9 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -27,7 +27,7 @@ "provider_name": "IBM", "features": [ { - "title": "Collection", + "title": "Collections", "description": "Supports creation of one or more collections depending on the plan to help manage feature flags and dynamic properties at scale." }, { @@ -43,7 +43,7 @@ "description": "Supports creation and management of configuration aggregator to manage configurations across multiple App Configuration instances." } ], - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/issues](https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/issues). Please note this product is not supported via the IBM Cloud Support Center.", + "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [here](https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/issues). Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ { "label": "Fully configurable", @@ -289,14 +289,14 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group or enabling `enable_config_aggregator` flag." + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group or creating trusted profile for app configuration aggregator." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account setting or enabling `enable_config_aggregator` flag that creates trusted profile for authentication." + "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account setting or creating trusted profile for app configuration aggregator." }, { "role_crns": [ @@ -304,7 +304,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "atracker", - "notes": "[Optional] Required for consuming Activity Tracker Event Routing deployable architecture." + "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, { "role_crns": [ @@ -312,7 +312,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Required for consuming Cloud Monitoring deployable architecture." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud monitoring." }, { "role_crns": [ @@ -320,7 +320,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Required for consuming Cloud Logs deployable architecture." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud logs." }, { "role_crns": [ @@ -328,7 +328,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Required for enabling Hyper Protect Crypto Services in Event Routing and Cloud Logs deployable architecture." + "notes": "[Optional] Required if you are creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption." }, { "role_crns": [ @@ -336,7 +336,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Required for enabling KMS encryption in Event Routing and Cloud Logs deployable architecture." + "notes": "[Optional] Required if KMS encryption is enabled to encrypt the Object Storage bucket used for storing flow logs." }, { "role_crns": [ @@ -344,7 +344,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required for enabling COS in Event Routing and Cloud Logs deployable architecture." + "notes": "[Optional] Required if you are enabling VPC flow logs." } ], "architecture": { @@ -362,7 +362,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-app-configuration/main/reference-architecture/app_configuration.svg", "type": "image/svg+xml" }, - "description": "**App Configuration on IBM Cloud**

Description
This architecture automates the setup of IBM Cloud App Configuration. The modular design includes the creation of a collection to streamline the management of feature flags and properties, consolidation of multiple App Cpnfiguration instances via configuration aggregator and optionally integrates context-based restrictions (CBR) to improve access control and align with your network security policies." + "description": "This architecture automates the setup of IBM Cloud App Configuration. The modular design includes the creation of a collection to streamline the management of feature flags and properties, consolidation of multiple App Cpnfiguration instances via configuration aggregator and optionally integrates context-based restrictions (CBR) to improve access control and align with your network security policies." } ] }, @@ -399,7 +399,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Enable to provision and configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", + "description": "Configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", "flavors": [ "instances" ], diff --git a/reference-architecture/app_configuration.svg b/reference-architecture/app_configuration.svg index 7cfb13b..d4b5066 100644 --- a/reference-architecture/app_configuration.svg +++ b/reference-architecture/app_configuration.svg @@ -1,4 +1,4 @@ -IBM CloudRegion[Optional]
Observability
Cloud LogsCloud Monitoring
Activity Tracker
Event Routing
Resource Group
App Config
 \ No newline at end of file +IBM CloudRegion[Optional]
Observability
Cloud LogsCloud MonitoringResource Group
App Config
 \ No newline at end of file From 40a77ba96b74cdc2c99240ea2170fd90a942c0a5 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Tue, 5 Aug 2025 15:36:29 +0530 Subject: [PATCH 14/16] new region --- README.md | 2 +- ibm_catalog.json | 16 ++++++++++++---- tests/pr_test.go | 2 ++ variables.tf | 6 +++--- 4 files changed, 18 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index d18f2ab..6e438e7 100644 --- a/README.md +++ b/README.md @@ -117,7 +117,7 @@ For more information on access and permissions, see [config\_aggregator\_resource\_collection\_regions](#input\_config\_aggregator\_resource\_collection\_regions) | From which region do you want to collect configuration data? Only applies if `enable_config_aggregator` is set to true. | `list(string)` | 
[
  "all"
]
| no | | [config\_aggregator\_trusted\_profile\_name](#input\_config\_aggregator\_trusted\_profile\_name) | The name to give the trusted profile that will be created if `enable_config_aggregator` is set to `true`. | `string` | `"config-aggregator-trusted-profile"` | no | | [enable\_config\_aggregator](#input\_enable\_config\_aggregator) | Set to true to enable configuration aggregator. By setting to true a trusted profile will be created with the required access to record configuration data from all resources across regions in your account. [Learn more](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator). | `bool` | `false` | no | -| [region](#input\_region) | The region to provision the App Configuration service, valid regions are au-syd, jp-osa, jp-tok, eu-de, eu-gb, eu-es, us-east, us-south, ca-tor, br-sao, eu-fr2. | `string` | `"us-south"` | no | +| [region](#input\_region) | The region to provision the App Configuration service, valid regions are au-syd, jp-osa, jp-tok, eu-de, eu-gb, eu-es, us-east, us-south, ca-tor, br-sao, eu-fr2, ca-mon. | `string` | `"us-south"` | no | | [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where resources will be provisioned. | `string` | n/a | yes | ### Outputs diff --git a/ibm_catalog.json b/ibm_catalog.json index 3abd5b9..f183bc6 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -111,6 +111,14 @@ { "displayname": "Sao Paulo (br-sao)", "value": "br-sao" + }, + { + "displayname": "BNPP_EU", + "value": "eu-fr2" + }, + { + "displayname": "Montreal (ca-mon)", + "value": "ca-mon" } ] }, @@ -304,7 +312,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "atracker", - "notes": "[Optional] Required if you are consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." }, { "role_crns": [ @@ -328,7 +336,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Required if you are creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption." + "notes": "[Optional] Required for creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption." }, { "role_crns": [ @@ -344,7 +352,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required if you are enabling VPC flow logs." + "notes": "[Optional] Required for enabling and storing App Configuration flow logs." } ], "architecture": { @@ -399,7 +407,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Configure IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", + "description": "Configures IBM Cloud Logs, Cloud Monitoring, Metrics routing and Activity Tracker event routing for analysing logs and metrics generated by the App Configuration instance.", "flavors": [ "instances" ], diff --git a/tests/pr_test.go b/tests/pr_test.go index a38801d..2a25d0d 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -30,6 +30,8 @@ var validRegions = []string{ "us-south", "ca-tor", "br-sao", + "eu-fr2", + "ca-mon", } func setupOptions(t *testing.T, prefix string, dir string) *testhelper.TestOptions { diff --git a/variables.tf b/variables.tf index fca58dc..4fb5617 100644 --- a/variables.tf +++ b/variables.tf @@ -8,13 +8,13 @@ variable "resource_group_id" { } variable "region" { - description = "The region to provision the App Configuration service, valid regions are au-syd, jp-osa, jp-tok, eu-de, eu-gb, eu-es, us-east, us-south, ca-tor, br-sao, eu-fr2." + description = "The region to provision the App Configuration service, valid regions are au-syd, jp-osa, jp-tok, eu-de, eu-gb, eu-es, us-east, us-south, ca-tor, br-sao, eu-fr2, ca-mon." type = string default = "us-south" validation { - condition = contains(["au-syd", "jp-osa", "jp-tok", "eu-de", "eu-gb", "eu-es", "us-east", "us-south", "ca-tor", "br-sao", "eu-fr2"], var.region) - error_message = "Value for region must be one of the following: ${join(", ", ["jp-osa", "au-syd", "jp-tok", "eu-de", "eu-gb", "eu-es", "us-east", "us-south", "ca-tor", "br-sao", "eu-fr2"])}" + condition = contains(["au-syd", "jp-osa", "jp-tok", "eu-de", "eu-gb", "eu-es", "us-east", "us-south", "ca-tor", "br-sao", "eu-fr2", "ca-mon"], var.region) + error_message = "Value for region must be one of the following: ${join(", ", ["jp-osa", "au-syd", "jp-tok", "eu-de", "eu-gb", "eu-es", "us-east", "us-south", "ca-tor", "br-sao", "eu-fr2", "ca-mon"])}" } } From 836446247bb7e5d920d634b4aa42ca6d93dc4989 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Thu, 7 Aug 2025 11:14:53 +0530 Subject: [PATCH 15/16] PR changes --- ibm_catalog.json | 35 ++++++++------------ solutions/fully-configurable/DA-cbr_rules.md | 6 ++-- solutions/fully-configurable/provider.tf | 7 ++-- 3 files changed, 20 insertions(+), 28 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index f183bc6..d683cba 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -20,8 +20,8 @@ "IaC", "infrastructure as code" ], - "short_description": "Creates and configures an App Configuration service on IBM Cloud", - "long_description": "This deployable architecture automates the provisioning of IBM Cloud App Configuration along with initial collection to help you manage feature flags and dynamic properties at scale. It also includes support for configuration aggregators, enabling centralized monitoring and management of configurations across multiple App Configuration instances. It simplifies onboarding by preconfiguring key resources and provides support for defining context-based restrictions (CBR) to enhance security and control access based on network policies. Ideal for teams adopting feature flagging, experimentation, or remote configuration strategies in cloud-native applications, this solution accelerates setup while following IBM Cloud best practices. Refer [this](https://cloud.ibm.com/docs/app-configuration) for more information.", + "short_description": "Creates and configures an App Configuration service on IBM Cloud with optional integration of observability", + "long_description": "This deployable architecture automates the provisioning of IBM Cloud App Configuration along with initial collection to help you manage feature flags and dynamic properties at scale. It also includes support for configuration aggregators, enabling centralized monitoring and management of configurations across multiple App Configuration instances. It simplifies onboarding by preconfiguring key resources and provides support for defining context-based restrictions (CBR) to enhance security and control access based on network policies. Ideal for teams adopting feature flagging, experimentation, or remote configuration strategies in cloud-native applications, this solution accelerates setup while following IBM Cloud best practices. Refer [this](https://cloud.ibm.com/docs/app-configuration) for more information.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/blob/main/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-app-configuration/main/images/app_config-icon.png", "provider_name": "IBM", @@ -146,36 +146,27 @@ }, { "key": "enable_platform_metrics", - "type": "string", - "default_value": "true", + "type": "boolean", + "default_value": false, "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true, - "options": [ - { - "displayname": "true", - "value": "true" - }, - { - "displayname": "false", - "value": "false" - } - ] + "virtual": true }, { "key": "logs_routing_tenant_regions", - "type": "list(string)", + "type": "array", "default_value": "[]", "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, - "virtual": true, "custom_config": { + "type": "array", "grouping": "deployment", "original_grouping": "deployment", "config_constraints": { - "type": "string" + "type": "string" } - } + }, + "virtual": true }, { "key": "existing_resource_group_name", @@ -344,7 +335,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Required if KMS encryption is enabled to encrypt the Object Storage bucket used for storing flow logs." + "notes": "[Optional] Required if KMS encryption is enabled to encrypt the Object Storage bucket used for storing App Configuration logs." }, { "role_crns": [ @@ -352,7 +343,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required for enabling and storing App Configuration flow logs." + "notes": "[Optional] Required for storing App Configuration logs." } ], "architecture": { @@ -360,7 +351,7 @@ "features": [ { "title": " ", - "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." + "description": "Configured to use IBM secure-by-default standards, but can be edited to fit your use case." } ], "diagrams": [ diff --git a/solutions/fully-configurable/DA-cbr_rules.md b/solutions/fully-configurable/DA-cbr_rules.md index 2edba81..56e34e3 100644 --- a/solutions/fully-configurable/DA-cbr_rules.md +++ b/solutions/fully-configurable/DA-cbr_rules.md @@ -28,8 +28,8 @@ The `cbr_rules` input variable allows you to provide a rule for the target servi [ { description = "Restrict access to App Config from trusted network" - account_id = "" - enforcement_mode = "enabled" + account_id = "" + enforcement_mode = "report" tags = [ { name = "env" @@ -41,7 +41,7 @@ The `cbr_rules` input variable allows you to provide a rule for the target servi attributes = [ { name = "networkZoneId" - value = "" + value = "" }, { "name" : "endpointType", diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf index f69fb6d..146dea9 100644 --- a/solutions/fully-configurable/provider.tf +++ b/solutions/fully-configurable/provider.tf @@ -1,5 +1,6 @@ provider "ibm" { - ibmcloud_api_key = var.ibmcloud_api_key - region = var.region - visibility = var.provider_visibility + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null } From 2264a494d04f67668437629edf6f0628277e9af6 Mon Sep 17 00:00:00 2001 From: mukul-palit Date: Tue, 12 Aug 2025 11:32:31 +0530 Subject: [PATCH 16/16] PR changes --- ibm_catalog.json | 38 ++++++++++++++--------- solutions/fully-configurable/variables.tf | 4 +-- 2 files changed, 26 insertions(+), 16 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index d683cba..4e5ea21 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -28,19 +28,19 @@ "features": [ { "title": "Collections", - "description": "Supports creation of one or more collections depending on the plan to help manage feature flags and dynamic properties at scale." + "description": "Supports creation of one or more [collections](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-collections) depending on the plan to help manage feature flags and dynamic properties at scale." }, { "title": "CBR Enhanced Security", - "description": "Provides support for defining context-based restrictions (CBR) to enhance security and control access based on network policies." + "description": "Provides support for defining context-based restrictions ([CBR](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-restrict-access-cbr)) to enhance security and control access based on network policies." }, { "title": "Trusted Profile", - "description": "Creates trusted profile needed with required access for configuration aggregator." + "description": "Creates [trusted profile](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator#ac-enable-configuration-aggregator-single-account) needed with required access for configuration aggregator." }, { "title": "Configuration Aggregator", - "description": "Supports creation and management of configuration aggregator to manage configurations across multiple App Configuration instances." + "description": "Supports creation and management of configuration [aggregator](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator) to manage configurations across multiple App Configuration instances." } ], "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [here](https://github.com/terraform-ibm-modules/terraform-ibm-app-configuration/issues). Please note this product is not supported via the IBM Cloud Support Center.", @@ -150,12 +150,22 @@ "default_value": false, "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", "required": true, - "virtual": true + "virtual": true, + "options": [ + { + "displayname": "true", + "value": true + }, + { + "displayname": "false", + "value": false + } + ] }, { "key": "logs_routing_tenant_regions", "type": "array", - "default_value": "[]", + "default_value": [], "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", "required": true, "custom_config": { @@ -288,14 +298,14 @@ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Account Management services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group or creating trusted profile for app configuration aggregator." + "notes": "[Optional] Required to deploy Cloud automation for account configuration which creates resource group and to create trusted profile for App Configuration aggregator." }, { "role_crns": [ "crn:v1:bluemix:public:iam::::role:Administrator" ], "service_name": "All Identity and Access enabled services", - "notes": "[Optional] Required for consuming Account Configuration deployable architecture which creates resource group with account setting or creating trusted profile for app configuration aggregator." + "notes": "[Optional] Required to deploy Cloud automation for account configuration which creates foundational IBM Cloud account resources, like resource group with account settings and to create trusted profile for App Configuration aggregator." }, { "role_crns": [ @@ -303,7 +313,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "atracker", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Activity Tracker Event Routing." + "notes": "[Optional] Required to configure Activity Tracker Event Routing with Cloud automation for Observability." }, { "role_crns": [ @@ -311,7 +321,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "sysdig-monitor", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud monitoring." + "notes": "[Optional] Required to create an instance of Cloud Monitoring." }, { "role_crns": [ @@ -319,7 +329,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "logs", - "notes": "[Optional] Required for consuming Observability deployable architecture which sets up Cloud logs." + "notes": "[Optional] Required to create an instance of Cloud Logs." }, { "role_crns": [ @@ -327,7 +337,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "hs-crypto", - "notes": "[Optional] Required for creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption." + "notes": "[Optional] Required if Hyper Protect Crypto Services is used in Cloud automation for Observability." }, { "role_crns": [ @@ -335,7 +345,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "kms", - "notes": "[Optional] Required if KMS encryption is enabled to encrypt the Object Storage bucket used for storing App Configuration logs." + "notes": "[Optional] Required to deploy Cloud automation for Key Protect, so you can use your own managed encryption keys." }, { "role_crns": [ @@ -343,7 +353,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required for storing App Configuration logs." + "notes": "[Optional] Required to deploy Cloud automation for Object Storage." } ], "architecture": { diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 36bf55e..ab7ad33 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -61,14 +61,14 @@ variable "region" { variable "app_config_name" { type = string - description = "Name for the App Configuration service instance" + description = "Name for the App Configuration service instance." default = "app-config" nullable = false } variable "app_config_plan" { type = string - description = "Plan for the App Configuration service instance" + description = "Plan for the App Configuration service instance." default = "standardv2" nullable = false }