Skip to content

Commit c8ddb0c

Browse files
jor2jor2
authored
fix: fix bug in the DA which can occur when using BYOK / KYOK for data encryption, but using the default ICD key for backups encryption (#571)
1 parent 658f852 commit c8ddb0c

File tree

2 files changed

+76
-41
lines changed

2 files changed

+76
-41
lines changed

‎main.tf

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,30 +38,35 @@ locals {
3838
# Parse info from KMS key CRNs
3939
########################################################################################################################
4040

41+
locals {
42+
parse_kms_key = !var.use_ibm_owned_encryption_key
43+
parse_backup_kms_key = !var.use_ibm_owned_encryption_key && !var.use_default_backup_encryption_key
44+
}
45+
4146
module "kms_key_crn_parser" {
42-
count = var.use_ibm_owned_encryption_key ? 0 : 1
47+
count = local.parse_kms_key ? 1 : 0
4348
source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser"
4449
version = "1.1.0"
4550
crn = var.kms_key_crn
4651
}
4752

4853
module "backup_key_crn_parser" {
49-
count = var.use_ibm_owned_encryption_key ? 0 : 1
54+
count = local.parse_backup_kms_key ? 1 : 0
5055
source = "terraform-ibm-modules/common-utilities/ibm//modules/crn-parser"
5156
version = "1.1.0"
5257
crn = local.backup_encryption_key_crn
5358
}
5459

5560
# Put parsed values into locals
5661
locals {
57-
kms_service = !var.use_ibm_owned_encryption_key ? module.kms_key_crn_parser[0].service_name : null
58-
kms_account_id = !var.use_ibm_owned_encryption_key ? module.kms_key_crn_parser[0].account_id : null
59-
kms_key_id = !var.use_ibm_owned_encryption_key ? module.kms_key_crn_parser[0].resource : null
60-
kms_key_instance_guid = !var.use_ibm_owned_encryption_key ? module.kms_key_crn_parser[0].service_instance : null
61-
backup_kms_service = !var.use_ibm_owned_encryption_key ? module.backup_key_crn_parser[0].service_name : null
62-
backup_kms_account_id = !var.use_ibm_owned_encryption_key ? module.backup_key_crn_parser[0].account_id : null
63-
backup_kms_key_id = !var.use_ibm_owned_encryption_key ? module.backup_key_crn_parser[0].resource : null
64-
backup_kms_key_instance_guid = !var.use_ibm_owned_encryption_key ? module.backup_key_crn_parser[0].service_instance : null
62+
kms_service = local.parse_kms_key ? module.kms_key_crn_parser[0].service_name : null
63+
kms_account_id = local.parse_kms_key ? module.kms_key_crn_parser[0].account_id : null
64+
kms_key_id = local.parse_kms_key ? module.kms_key_crn_parser[0].resource : null
65+
kms_key_instance_guid = local.parse_kms_key ? module.kms_key_crn_parser[0].service_instance : null
66+
backup_kms_service = local.parse_backup_kms_key ? module.backup_key_crn_parser[0].service_name : null
67+
backup_kms_account_id = local.parse_backup_kms_key ? module.backup_key_crn_parser[0].account_id : null
68+
backup_kms_key_id = local.parse_backup_kms_key ? module.backup_key_crn_parser[0].resource : null
69+
backup_kms_key_instance_guid = local.parse_backup_kms_key ? module.backup_key_crn_parser[0].service_instance : null
6570
}
6671

6772
########################################################################################################################

‎tests/pr_test.go

Lines changed: 61 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -124,59 +124,89 @@ func TestRunStandardSolution(t *testing.T) {
124124
assert.NotNil(t, output, "Expected some output")
125125
}
126126

127-
// Test the DA when using IBM owned encryption keys
128-
func TestRunStandardSolutionIBMKeys(t *testing.T) {
127+
func TestRunStandardUpgradeSolution(t *testing.T) {
129128
t.Parallel()
130129

131130
options := testhelper.TestOptionsDefault(&testhelper.TestOptions{
132131
Testing: t,
133132
TerraformDir: standardSolutionTerraformDir,
134133
Region: "us-south",
135-
Prefix: "postgres-icd-key",
134+
Prefix: "postgres-st-da-upg",
136135
ResourceGroup: resourceGroup,
137136
})
138137

139138
options.TerraformVars = map[string]interface{}{
140-
"pg_version": "16",
141-
"provider_visibility": "public",
142-
"resource_group_name": options.Prefix,
143-
"use_ibm_owned_encryption_key": true,
139+
"existing_kms_instance_crn": permanentResources["hpcs_south_crn"],
140+
"kms_endpoint_type": "public",
141+
"provider_visibility": "public",
142+
"resource_group_name": options.Prefix,
143+
"admin_pass": GetRandomAdminPassword(t),
144144
}
145145

146-
output, err := options.RunTestConsistency()
147-
assert.Nil(t, err, "This should not have errored")
148-
assert.NotNil(t, output, "Expected some output")
146+
output, err := options.RunTestUpgrade()
147+
if !options.UpgradeTestSkipped {
148+
assert.Nil(t, err, "This should not have errored")
149+
assert.NotNil(t, output, "Expected some output")
150+
}
149151
}
150152

151-
func TestRunStandardUpgradeSolution(t *testing.T) {
153+
func TestPlanValidation(t *testing.T) {
152154
t.Parallel()
153155

154-
// Generate a 15 char long random string for the admin_pass.
155-
randomBytes := make([]byte, 13)
156-
_, randErr := rand.Read(randomBytes)
157-
require.Nil(t, randErr) // do not proceed if we can't gen a random password
156+
options := &terraform.Options{
157+
TerraformDir: "../" + standardSolutionTerraformDir,
158+
Vars: map[string]interface{}{
159+
"prefix": "validate-plan",
160+
"region": "us-south",
161+
"kms_endpoint_type": "public",
162+
"provider_visibility": "public",
163+
"resource_group_name": "validate-plan",
164+
"admin_pass": GetRandomAdminPassword(t),
165+
},
166+
Upgrade: true,
167+
}
158168

159-
randomPass := "A1" + base64.URLEncoding.EncodeToString(randomBytes)[:13]
169+
_, initErr := terraform.InitE(t, options)
170+
assert.Nil(t, initErr, "This should not have errored")
160171

161-
options := testhelper.TestOptionsDefault(&testhelper.TestOptions{
162-
Testing: t,
163-
TerraformDir: standardSolutionTerraformDir,
164-
Region: "us-south",
165-
Prefix: "postgres-st-da-upg",
166-
ResourceGroup: resourceGroup,
167-
})
172+
// Test the DA when using IBM owned encryption keys
173+
var ibmOwnedEncrytionKeyTFVars = map[string]interface{}{
174+
"use_default_backup_encryption_key": false,
175+
"use_ibm_owned_encryption_key": true,
176+
}
168177

169-
options.TerraformVars = map[string]interface{}{
170-
"existing_kms_instance_crn": permanentResources["hpcs_south_crn"],
171-
"kms_endpoint_type": "public",
172-
"provider_visibility": "public",
173-
"resource_group_name": options.Prefix,
174-
"admin_pass": randomPass,
178+
// Test the DA when using Default Backup Encryption Key and not IBM owned encryption keys
179+
var notIbmOwnedEncrytionKeyTFVars = map[string]interface{}{
180+
"existing_kms_instance_crn": permanentResources["hpcs_south_crn"],
181+
"use_default_backup_encryption_key": true,
182+
"use_ibm_owned_encryption_key": false,
175183
}
176184

177-
output, err := options.RunTestUpgrade()
178-
if !options.UpgradeTestSkipped {
185+
// Create a list (slice) of the maps
186+
tfVarsList := []map[string]interface{}{
187+
ibmOwnedEncrytionKeyTFVars,
188+
notIbmOwnedEncrytionKeyTFVars,
189+
}
190+
191+
// Iterate over the slice of maps
192+
for _, tfVars := range tfVarsList {
193+
// Iterate over the keys and values in each map
194+
for key, value := range tfVars {
195+
options.Vars[key] = value
196+
}
197+
output, err := terraform.PlanE(t, options)
179198
assert.Nil(t, err, "This should not have errored")
180199
assert.NotNil(t, output, "Expected some output")
181200
}
182201
}
202+
203+
func GetRandomAdminPassword(t *testing.T) string {
204+
// Generate a 15 char long random string for the admin_pass
205+
randomBytes := make([]byte, 13)
206+
_, randErr := rand.Read(randomBytes)
207+
require.Nil(t, randErr) // do not proceed if we can't gen a random password
208+
209+
randomPass := "A1" + base64.URLEncoding.EncodeToString(randomBytes)[:13]
210+
211+
return randomPass
212+
}

0 commit comments

Comments
 (0)