add : fully configurable version

[Aayush-Abhyarthi]

Description

https://github.ibm.com/GoldenEye/issues/issues/12575

Release required?

• No release
• Patch release (x.x.X)
• Minor release (x.X.x)
• Major release (X.x.x)

Release notes content

This PR releases two variations of the Deployable Architecture -

• Fully configurable
  • KMS encrypted not enforced
• Security-enforced
  • Wrapper around "Fully configurable" with KMS encryption and private endpoint enforced

The Solutions variation is depricated.

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

• If relevant, a test for the change is included or updated with this PR.
• If relevant, documentation for the change is included or updated with this PR.

For mergers

• Use a conventional commit message to set the release level. Follow the guidelines.
• Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
• Use the Squash and merge option.

[ocofaigh]

Do not use spaces in directory names. The renamed directory should be solutions/security-enforced. The label name should be Security-enforced and the programmtic variation name should be security-enforced. I think you need to check your changes against the recent updates that were made to the standard variation. Several variables were renamed, and it seems you do not have the new names.
I think the direction we are going is the the whole code in the standard (security-enforced) directory will go away, and that new Security-enforced variation will actually just call the Fully configurable variation in the ibm_catalog.json but will hard code a few variables, and force require others to lock it down. Otherwise we end up with alot of code duplication for now reason. Such a change will be a full breaking major version release. see below comment

[ocofaigh]

@Aayush-Abhyarthi We talked more about what to do with the current standard (new name Security-enforced) variation. We should take the same approach as the fscloud submodule and have the code be a wrapper around the Fully configurable variation. Since it will a major version change, you can actually go ahead and change the programatic name of the variation in the ibm_catalog,json to security-enforced

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[ocofaigh]

@Aayush-Abhyarthi Can you review all the variable descriptions please? Make sure they reference any related inputs.

Can you also make sure you are consistent everywhere with the changes in terraform-ibm-modules/terraform-ibm-scc#249?

The DA is missing the skip_iam_authorization_policy input that was added to the root level module for enabling the IAM credentials engine.

Diagram updates:

• Resource Group -> Existing resource group
• Make it more clear that IAM Engine is enabled now via an s2s policy. I would move the icon into the outer IBM Cloud box and rename it 'IAM'. And add the text 's2s IAM auth' along the arror that points to it
• Event Notifications -> Existing Event Notifications

Update the topic name to include the secrets manager GUID (like I did here)

[Aayush-Abhyarthi]

/run pipeline

[ocofaigh]

#295 should be merged first

[Aayush-Abhyarthi]

/run pipeline

[ocofaigh]

Please review the test coverage:

• You can remove TestRunUpgradeExample - we don't need an upgrade test on an example since we have one for the DA
• I see no point in having both TestRunSecretsManagerSecurityEnforcedUpgradeSchematic and TestRunSecretsManagerFullyConfigurableUpgradeSchematic since security enforced variation is a wrapper around fully configurable. I don't think we will introduce much of a test gap if we just have an upgrade test for security enforced.
• There is no test that does not use KMS encryption
• There is no test that uses existing KMS key
• There is no test that uses existing secrets manager instance

Please try to plug these test gaps, but if keep the number of tests as low as possible so we don't create lots of secrets manager instances that will take up our quota

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[Aayush-Abhyarthi]

/run pipeline

[ocofaigh]

some final comments

[Aayush-Abhyarthi]

/run pipeline

[terraform-ibm-modules-ops]

🎉 This PR is included in version 2.0.0 🎉

The release is available on:

• GitHub release
• v2.0.0

Your semantic-release bot 📦🚀