feat: adds the ability to pass CBR rules in DA. It adds a new variable cbr_rules in DA variables. (#156)

aatreyee2506 · web-flow · commit 495775496ac3 · 2025-02-14T10:29:01.000+05:30
diff --git a/README.md b/README.md
@@ -157,6 +157,7 @@ No resources.
 | <a name="input_apps"></a> [apps](#input\_apps) | A map of code engine apps to be created. | <pre>map(object({<br/>    image_reference = string<br/>    image_secret    = optional(string)<br/>    run_env_variables = optional(list(object({<br/>      type      = optional(string)<br/>      name      = optional(string)<br/>      value     = optional(string)<br/>      prefix    = optional(string)<br/>      key       = optional(string)<br/>      reference = optional(string)<br/>    })))<br/>    run_volume_mounts = optional(list(object({<br/>      mount_path = string<br/>      reference  = string<br/>      name       = optional(string)<br/>      type       = string<br/>    })))<br/>    image_port                    = optional(number)<br/>    managed_domain_mappings       = optional(string)<br/>    run_arguments                 = optional(list(string))<br/>    run_as_user                   = optional(number)<br/>    run_commands                  = optional(list(string))<br/>    run_service_account           = optional(string)<br/>    scale_concurrency             = optional(number)<br/>    scale_concurrency_target      = optional(number)<br/>    scale_cpu_limit               = optional(string)<br/>    scale_ephemeral_storage_limit = optional(string)<br/>    scale_initial_instances       = optional(number)<br/>    scale_max_instances           = optional(number)<br/>    scale_memory_limit            = optional(string)<br/>    scale_min_instances           = optional(number)<br/>    scale_request_timeout         = optional(number)<br/>    scale_down_delay              = optional(number)<br/>  }))</pre> | `{}` | no |
 | <a name="input_bindings"></a> [bindings](#input\_bindings) | A map of code engine bindings to be created. | <pre>map(object({<br/>    secret_name = string<br/>    components = list(object({<br/>      name          = string<br/>      resource_type = string<br/>    }))<br/>  }))</pre> | `{}` | no |
 | <a name="input_builds"></a> [builds](#input\_builds) | A map of code engine builds to be created. | <pre>map(object({<br/>    output_image       = string<br/>    output_secret      = string # pragma: allowlist secret<br/>    source_url         = string<br/>    strategy_type      = string<br/>    source_context_dir = optional(string)<br/>    source_revision    = optional(string)<br/>    source_secret      = optional(string)<br/>    source_type        = optional(string)<br/>    strategy_size      = optional(string)<br/>    strategy_spec_file = optional(string)<br/>    timeout            = optional(number)<br/>  }))</pre> | `{}` | no |
+| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | The list of context-based restrictions rules to create. | <pre>list(object({<br/>    description = string<br/>    account_id  = string<br/>    rule_contexts = list(object({<br/>      attributes = optional(list(object({<br/>        name  = string<br/>        value = string<br/>    }))) }))<br/>    enforcement_mode = string<br/>    operations = optional(list(object({<br/>      api_types = list(object({<br/>        api_type_id = string<br/>      }))<br/>    })))<br/>  }))</pre> | `[]` | no |
 | <a name="input_config_maps"></a> [config\_maps](#input\_config\_maps) | A map of code engine config maps to be created. | <pre>map(object({<br/>    data = map(string)<br/>  }))</pre> | `{}` | no |
 | <a name="input_domain_mappings"></a> [domain\_mappings](#input\_domain\_mappings) | A map of code engine domain mappings to be created. | <pre>map(object({<br/>    tls_secret = string # pragma: allowlist secret<br/>    components = list(object({<br/>      name          = string<br/>      resource_type = string<br/>    }))<br/>  }))</pre> | `{}` | no |
 | <a name="input_existing_project_id"></a> [existing\_project\_id](#input\_existing\_project\_id) | The ID of the existing project to which code engine resources will be added. It is required if var.project\_name is null. | `string` | `null` | no |
diff --git a/examples/apps/README.md b/examples/apps/README.md
@@ -8,3 +8,5 @@ An end-to-end apps example that will provision the following:
 - Code Engine TLS Secret
 - Code Engine Domain Mapping
 - Secrets Manager Resources (Public Engine, Group, Public Certificate)
+- A Virtual Private Cloud (VPC).
+- A context-based restriction (CBR) rule to allow Code Engine to be accessible from VPC.
diff --git a/examples/apps/main.tf b/examples/apps/main.tf
@@ -97,6 +97,46 @@ data "ibm_sm_public_certificate" "public_certificate" {
   secret_id   = local.cert_secret_id
 }
 
+##############################################################################
+# Get Cloud Account ID
+##############################################################################
+
+data "ibm_iam_account_settings" "iam_account_settings" {
+}
+
+##############################################################################
+# VPC
+##############################################################################
+resource "ibm_is_vpc" "example_vpc" {
+  name           = "${var.prefix}-vpc"
+  resource_group = module.resource_group.resource_group_id
+  tags           = var.resource_tags
+}
+
+resource "ibm_is_subnet" "testacc_subnet" {
+  name                     = "${var.prefix}-subnet"
+  vpc                      = ibm_is_vpc.example_vpc.id
+  zone                     = "${var.region}-1"
+  total_ipv4_address_count = 256
+  resource_group           = module.resource_group.resource_group_id
+}
+
+##############################################################################
+# Create CBR Zone
+##############################################################################
+
+module "cbr_vpc_zone" {
+  source           = "terraform-ibm-modules/cbr/ibm//modules/cbr-zone-module"
+  version          = "1.29.0"
+  name             = "${var.prefix}-VPC-network-zone"
+  zone_description = "CBR Network zone representing VPC"
+  account_id       = data.ibm_iam_account_settings.iam_account_settings.account_id
+  addresses = [{
+    type  = "vpc",
+    value = ibm_is_vpc.example_vpc.crn
+  }]
+}
+
 ########################################################################################################################
 # Code Engine instance
 ########################################################################################################################
@@ -106,6 +146,25 @@ module "code_engine" {
   source            = "../.."
   resource_group_id = module.resource_group.resource_group_id
   project_name      = "${var.prefix}-project"
+  cbr_rules = [
+    {
+      description      = "${var.prefix}-code engine access only from vpc"
+      enforcement_mode = "enabled"
+      account_id       = data.ibm_iam_account_settings.iam_account_settings.account_id
+      rule_contexts = [{
+        attributes = [
+          {
+            "name" : "endpointType",
+            "value" : "public"
+          },
+          {
+            name  = "networkZoneId"
+            value = module.cbr_vpc_zone.zone_id
+        }]
+      }]
+    }
+  ]
+
   apps = {
     "${var.prefix}-app" = {
       image_reference = "icr.io/codeengine/helloworld"
diff --git a/examples/apps/variables.tf b/examples/apps/variables.tf
@@ -26,6 +26,13 @@ variable "resource_group" {
   default     = null
 }
 
+variable "resource_tags" {
+  type        = list(string)
+  description = "Optional list of tags to be added to created resources"
+  default     = []
+}
+
+
 ##############################################################
 # Secret Manager
 ##############################################################
diff --git a/ibm_catalog.json b/ibm_catalog.json
@@ -66,6 +66,7 @@
               }
             ]
           },
+
           "iam_permissions": [
             {
               "role_crns": [
@@ -161,6 +162,9 @@
               }
             },
             {
+            "key": "cbr_rules"
+          },
+          {
               "key": "project_name"
             },
             {
diff --git a/main.tf b/main.tf
@@ -12,6 +12,7 @@ module "project" {
   source            = "./modules/project"
   name              = var.project_name
   resource_group_id = var.resource_group_id
+  cbr_rules         = var.cbr_rules
 }
 
 ##############################################################################
diff --git a/modules/project/README.md b/modules/project/README.md
@@ -38,7 +38,9 @@ You need the following permissions to run this module.
 
 ### Modules
 
-No modules.
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_cbr_rules"></a> [cbr\_rules](#module\_cbr\_rules) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.29.0 |
 
 ### Resources
 
@@ -50,6 +52,7 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | The list of context-based restrictions rules to create. | <pre>list(object({<br/>    description = string<br/>    account_id  = string<br/>    rule_contexts = list(object({<br/>      attributes = optional(list(object({<br/>        name  = string<br/>        value = string<br/>    }))) }))<br/>    enforcement_mode = string<br/>    operations = optional(list(object({<br/>      api_types = list(object({<br/>        api_type_id = string<br/>      }))<br/>    })))<br/>  }))</pre> | `[]` | no |
 | <a name="input_name"></a> [name](#input\_name) | The name of the project. | `string` | n/a | yes |
 | <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | ID of resource group to use when creating resources | `string` | n/a | yes |
 
diff --git a/modules/project/main.tf b/modules/project/main.tf
@@ -8,3 +8,35 @@ resource "ibm_code_engine_project" "ce_project" {
   name              = var.name
   resource_group_id = var.resource_group_id
 }
+
+##############################################################################
+# Context Based Restrictions
+##############################################################################
+
+module "cbr_rules" {
+  count            = length(var.cbr_rules) > 0 ? length(var.cbr_rules) : 0
+  source           = "terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module"
+  version          = "1.29.0"
+  rule_description = var.cbr_rules[count.index].description
+  enforcement_mode = var.cbr_rules[count.index].enforcement_mode
+  rule_contexts    = var.cbr_rules[count.index].rule_contexts
+  resources = [{
+    attributes = [
+      {
+        name     = "accountId"
+        value    = var.cbr_rules[count.index].account_id
+        operator = "stringEquals"
+      },
+      {
+        name     = "serviceInstance"
+        value    = ibm_code_engine_project.ce_project.id
+        operator = "stringEquals"
+      },
+      {
+        name     = "serviceName"
+        value    = "codeengine"
+        operator = "stringEquals"
+      }
+    ]
+  }]
+}
diff --git a/modules/project/variables.tf b/modules/project/variables.tf
@@ -11,3 +11,23 @@ variable "name" {
   description = "The name of the project."
   type        = string
 }
+
+variable "cbr_rules" {
+  type = list(object({
+    description = string
+    account_id  = string
+    rule_contexts = list(object({
+      attributes = optional(list(object({
+        name  = string
+        value = string
+    }))) }))
+    enforcement_mode = string
+    operations = optional(list(object({
+      api_types = list(object({
+        api_type_id = string
+      }))
+    })))
+  }))
+  description = "The list of context-based restrictions rules to create."
+  default     = []
+}
diff --git a/solutions/project/DA-cbr_rules.md b/solutions/project/DA-cbr_rules.md
@@ -0,0 +1,62 @@
+# Configuring complex inputs for Code Engine in IBM Cloud projects
+
+Several optional input variables in the IBM Cloud [Code Engine deployable architecture](https://cloud.ibm.com/catalog#deployable_architecture) use complex object types. You specify these inputs when you configure deployable architecture.
+
+* Context-Based Restrictions Rules (`cbr_rules`)
+
+
+## Rules For Context-Based Restrictions <a name="cbr_rules"></a>
+
+The `cbr_rules` input variable allows you to provide a rule for the target service to enforce access restrictions for the service based on the context of access requests. Contexts are criteria that include the network location of access requests, the endpoint type from where the request is sent, etc.
+
+- Variable name: `cbr_rules`.
+- Type: A list of objects. Allows only one object representing a rule for the target service
+- Default value: An empty list (`[]`).
+
+### Options for cbr_rules
+
+  - `description` (required): The description of the rule to create.
+  - `account_id` (required): The IBM Cloud Account ID
+  - `rule_contexts` (required): (List) The contexts the rule applies to
+      - `attributes` (optional): (List) Individual context attributes
+        - `name` (required): The attribute name.
+        - `value`(required): The attribute value.
+
+  - `enforcement_mode` (required): The rule enforcement mode can have the following values:
+      - `enabled` - The restrictions are enforced and reported. This is the default.
+      - `disabled` - The restrictions are disabled. Nothing is enforced or reported.
+      - `report` - The restrictions are evaluated and reported, but not enforced.
+  - `operations` (optional): The operations this rule applies to
+    - `api_types`(required): (List) The API types this rule applies to.
+        - `api_type_id`(required):The API type ID
+
+
+### Example Rule For Context-Based Restrictions Configuration
+
+```hcl
+cbr_rules = [
+  {
+  description = "Code Engine can be accessed from xyz"
+  account_id = "defc0df06b644a9cabc6e44f55b3880s."
+  rule_contexts= [{
+      attributes = [
+                {
+                              "name" : "endpointType",
+                              "value" : "private"
+                },
+                {
+                  name  = "networkZoneId"
+                  value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret
+                }
+        ]
+     }
+   ]
+  enforcement_mode = "enabled"
+  operations = [{
+    api_types = [{
+     api_type_id = "crn:v1:bluemix:public:context-based-restrictions::::api-type:"
+      }]
+    }]
+  }
+]
+```
diff --git a/solutions/project/main.tf b/solutions/project/main.tf
@@ -17,4 +17,5 @@ module "project" {
   source            = "../../modules/project"
   name              = var.prefix != null ? "${var.prefix}-${var.project_name}" : var.project_name
   resource_group_id = module.resource_group.resource_group_id
+  cbr_rules         = var.cbr_rules
 }
diff --git a/solutions/project/variables.tf b/solutions/project/variables.tf
@@ -45,3 +45,23 @@ variable "project_name" {
   description = "The name of the project to add the IBM Cloud Code Engine."
   type        = string
 }
+
+variable "cbr_rules" {
+  type = list(object({
+    description = string
+    account_id  = string
+    rule_contexts = list(object({
+      attributes = optional(list(object({
+        name  = string
+        value = string
+    }))) }))
+    enforcement_mode = string
+    operations = optional(list(object({
+      api_types = list(object({
+        api_type_id = string
+      }))
+    })))
+  }))
+  description = "The list of context-based restrictions rules to create.[Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-code-engine/blob/main/solutions/project/DA-cbr_rules.md)"
+  default     = []
+}
diff --git a/variables.tf b/variables.tf
@@ -163,3 +163,23 @@ variable "bindings" {
   }))
   default = {}
 }
+
+variable "cbr_rules" {
+  type = list(object({
+    description = string
+    account_id  = string
+    rule_contexts = list(object({
+      attributes = optional(list(object({
+        name  = string
+        value = string
+    }))) }))
+    enforcement_mode = string
+    operations = optional(list(object({
+      api_types = list(object({
+        api_type_id = string
+      }))
+    })))
+  }))
+  description = "The list of context-based restrictions rules to create."
+  default     = []
+}

Original file line number	Diff line number	Diff line change
`@@ -66,6 +66,7 @@`
`66`	`66`	`}`
`67`	`67`	`]`
`68`	`68`	`},`
	`69`	`+`
`69`	`70`	`"iam_permissions": [`
`70`	`71`	`{`
`71`	`72`	`"role_crns": [`
`@@ -161,6 +162,9 @@`
`161`	`162`	`}`
`162`	`163`	`},`
`163`	`164`	`{`
	`165`	`+ "key": "cbr_rules"`
	`166`	`+ },`
	`167`	`+ {`
`164`	`168`	`"key": "project_name"`
`165`	`169`	`},`
`166`	`170`	`{`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ module "project" {`
`12`	`12`	`source = "./modules/project"`
`13`	`13`	`name = var.project_name`
`14`	`14`	`resource_group_id = var.resource_group_id`
	`15`	`+ cbr_rules = var.cbr_rules`
`15`	`16`	`}`
`16`	`17`
`17`	`18`	`##############################################################################`