boot volume encryption in cluster and workerpool

go.mod

@@ -3,7 +3,7 @@ module github.com/IBM-Cloud/terraform-provider-ibm
 go 1.16
 
 require (
-	github.com/IBM-Cloud/bluemix-go v0.0.0-20220407050707-b4cd0d4da813
+	github.com/IBM-Cloud/bluemix-go v0.0.0-20220512101601-701829d22dbc
 	github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20210705152127-41ca00fc9a62
 	github.com/IBM-Cloud/power-go-client v1.1.4
 	github.com/IBM/apigateway-go-sdk v0.0.0-20210714141226-a5d5d49caaca

go.sum

@@ -39,6 +39,12 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/IBM-Cloud/bluemix-go v0.0.0-20220407050707-b4cd0d4da813 h1:UgPApMMM6SglqB+U/EaFHyaoyaEM16RzxyiVah70g4o=
 github.com/IBM-Cloud/bluemix-go v0.0.0-20220407050707-b4cd0d4da813/go.mod h1:UOhxo7T8CdX6sdTY9Dn7rJSgyoTlz1KM9641XcPraH0=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220506091544-f67089f8d5d9 h1:zxeiJfE5hRMUH/h4hd+g9M98a4DRfUrD8nNbcteSlrc=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220506091544-f67089f8d5d9/go.mod h1:UOhxo7T8CdX6sdTY9Dn7rJSgyoTlz1KM9641XcPraH0=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220510085630-12dc05e70f29 h1:42c4MfIYppIOBymVz0WHNN3WO9zNPH+9aFNDP2ektYg=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220510085630-12dc05e70f29/go.mod h1:tfNN3lCKuA2+SQvndt0+5CjPr2qn/wdNLjrue1GrOhY=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220512101601-701829d22dbc h1:X3zq0LZyqBzsiX5KJvwzxH7Btl6M/oHqskS/2tL4B5A=
+github.com/IBM-Cloud/bluemix-go v0.0.0-20220512101601-701829d22dbc/go.mod h1:tfNN3lCKuA2+SQvndt0+5CjPr2qn/wdNLjrue1GrOhY=
 github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20210705152127-41ca00fc9a62 h1:MOkcr6qQGk4tY542ZJ1DggVh2WUP72EEyLB79llFVH8=
 github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20210705152127-41ca00fc9a62/go.mod h1:xUQL9SGAjoZFd4GNjrjjtEpjpkgU7RFXRyHesbKTjiY=
 github.com/IBM-Cloud/ibm-cloud-cli-sdk v0.5.3/go.mod h1:RiUvKuHKTBmBApDMUQzBL14pQUGKcx/IioKQPIcRQjs=
@@ -660,6 +666,7 @@ github.com/onsi/ginkgo v1.14.2/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9k
 github.com/onsi/ginkgo v1.16.2/go.mod h1:CObGmKUOKaSC0RjmoAK7tKyn4Azo5P2IWuoMnvwxz1E=
 github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=

ibm/acctest/acctest.go

@@ -90,10 +90,13 @@ var HpcsAdmin2 string
 var HpcsToken2 string
 var RealmName string
 var IksSa string
+var IksClusterID string
 var IksClusterVpcID string
 var IksClusterSubnetID string
 var IksClusterResourceGroupID string
 var IcdDbRegion string
+var KmsInstanceID string
+var CrkID string
 
 // For Power Colo
 
@@ -877,6 +880,21 @@ func init() {
 	if ClusterName == "" {
 		fmt.Println("[INFO] Set the environment variable IBM_CONTAINER_CLUSTER_NAME for ibm_container_nlb_dns resource or datasource else tests will fail if this is not set correctly")
 	}
+
+	KmsInstanceID = os.Getenv("IBM_KMS_INSTANCE_ID")
+	if KmsInstanceID == "" {
+		fmt.Println("[INFO] Set the environment variable IBM_KMS_INSTANCE_ID for ibm_container_vpc_cluster resource or datasource else tests will fail if this is not set correctly")
+	}
+
+	CrkID = os.Getenv("IBM_CRK_ID")
+	if CrkID == "" {
+		fmt.Println("[INFO] Set the environment variable IBM_CRK_ID for ibm_container_vpc_cluster resource or datasource else tests will fail if this is not set correctly")
+	}
+
+	IksClusterID = os.Getenv("IBM_CLUSTER_ID")
+	if IksClusterID == "" {
+		fmt.Println("[INFO] Set the environment variable IBM_CLUSTER_ID for ibm_container_vpc_worker_pool resource or datasource else tests will fail if this is not set correctly")
+	}
 }
 
 var TestAccProviders map[string]*schema.Provider

ibm/service/kubernetes/data_source_ibm_container_vpc_worker_pool.go

@@ -64,6 +64,14 @@ func DataSourceIBMContainerVpcClusterWorkerPool() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"kms_instance_id": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"crk": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -98,13 +106,16 @@ func dataSourceIBMContainerVpcClusterWorkerPoolRead(d *schema.ResourceData, meta
 	d.Set("worker_pool_name", workerPool.PoolName)
 	d.Set("flavor", workerPool.Flavor)
 	d.Set("worker_count", workerPool.WorkerCount)
-	d.Set("provider", workerPool.Provider)
 	d.Set("labels", workerPool.Labels)
 	d.Set("zones", zones)
 	d.Set("cluster", clusterName)
 	d.Set("vpc_id", workerPool.VpcID)
 	d.Set("isolation", workerPool.Isolation)
 	d.Set("resource_group_id", targetEnv.ResourceGroup)
+	if workerPool.WorkerVolumeEncryption != nil {
+		d.Set("kms_instance_id", workerPool.WorkerVolumeEncryption.KmsInstanceID)
+		d.Set("crk", workerPool.WorkerVolumeEncryption.WorkerVolumeCRKID)
+	}
 	d.SetId(workerPool.ID)
 	return nil
 }

ibm/service/kubernetes/data_source_ibm_container_vpc_worker_pool_test.go

@@ -37,3 +37,30 @@ func testAccCheckIBMContainerVPCClusterWorkerPoolDataSourceConfig(name string) s
 	}
 `
 }
+
+func TestAccIBMContainerVPCClusterWorkerPoolDataSourceEnvvar(t *testing.T) {
+	name := fmt.Sprintf("tf-vpc-wp-%d", acctest.RandIntRange(10, 100))
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { acc.TestAccPreCheck(t) },
+		Providers: acc.TestAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckIBMContainerVPCClusterWorkerPoolDataSourceEnvvar(name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("data.ibm_container_vpc_cluster_worker_pool.testacc_ds_worker_pool", "id"),
+					resource.TestCheckResourceAttr("data.ibm_container_vpc_cluster_worker_pool.testacc_ds_worker_pool", "crk", acc.CrkID),
+					resource.TestCheckResourceAttr("data.ibm_container_vpc_cluster_worker_pool.testacc_ds_worker_pool", "kms_instance_id", acc.KmsInstanceID),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckIBMContainerVPCClusterWorkerPoolDataSourceEnvvar(name string) string {
+	return testAccCheckIBMVpcContainerWorkerPoolEnvvar(name) + `
+	data "ibm_container_vpc_cluster_worker_pool" "testacc_ds_worker_pool" {
+	    cluster = "${ibm_container_vpc_worker_pool.test_pool.cluster}"
+	    worker_pool_name = "${ibm_container_vpc_worker_pool.test_pool.worker_pool_name}"
+	}
+`
+}

ibm/service/kubernetes/resource_ibm_container_vpc_cluster.go

@@ -276,6 +276,16 @@ func ResourceIBMContainerVpcCluster() *schema.Resource {
 				Computed:    true,
 				Description: "The URL of the IBM Cloud dashboard that can be used to explore and view details about this cluster",
 			},
+			"kms_instance_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Instance ID for boot volume encryption",
+			},
+			"crk": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Root Key ID for boot volume encryption",
+			},
 
 			//Get Cluster info Request
 			"state": {
@@ -472,11 +482,20 @@ func resourceIBMContainerVpcClusterCreate(d *schema.ResourceData, meta interface
 		}
 	}
 
+	kmsid := d.Get("kms_instance_id").(string)
+	crk := d.Get("crk").(string)
+
+	wve := v2.WorkerVolumeEncryption{
+		KmsInstanceID:     kmsid,
+		WorkerVolumeCRKID: crk,
+	}
+
 	workerpool := v2.WorkerPoolConfig{
-		VpcID:       vpcID,
-		Flavor:      flavor,
-		WorkerCount: workerCount,
-		Zones:       zonesList,
+		VpcID:                  vpcID,
+		Flavor:                 flavor,
+		WorkerCount:            workerCount,
+		Zones:                  zonesList,
+		WorkerVolumeEncryption: &wve,
 	}
 
 	if l, ok := d.GetOk("worker_labels"); ok {

ibm/service/kubernetes/resource_ibm_container_vpc_cluster_test.go

@@ -365,3 +365,61 @@ func testAccCheckIBMContainerVpcClusterImageSecuritySetting(name, setting string
 		image_security_enforcement = %s
 	  }`, name, acc.IksClusterVpcID, acc.IksClusterResourceGroupID, acc.SubnetID, setting)
 }
+
+// This test is here to help to focus on given resources, but requires everything else existing already
+func TestAccIBMContainerVpcClusterEnvvar(t *testing.T) {
+	name := fmt.Sprintf("tf-vpc-cluster-%d", acctest.RandIntRange(10, 100))
+	var conf *v2.ClusterInfo
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { acc.TestAccPreCheck(t) },
+		Providers:    acc.TestAccProviders,
+		CheckDestroy: testAccCheckIBMContainerVpcClusterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckIBMContainerVpcClusterEnvvar(name),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckIBMContainerVpcExists("ibm_container_vpc_cluster.cluster", conf),
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_cluster.cluster", "name", name),
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_cluster.cluster", "worker_count", "1"),
+				),
+			},
+			{
+				ResourceName:      "ibm_container_vpc_cluster.cluster",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"wait_till", "update_all_workers", "kms_config", "force_delete_storage", "wait_for_worker_update", "kms_instance_id", "crk"},
+			},
+		},
+	})
+}
+
+// You need to set up env vars:
+// export IBM_CLUSTER_VPC_ID
+// export IBM_CLUSTER_VPC_SUBNET_ID
+// export IBM_CLUSTER_VPC_RESOURCE_GROUP_ID
+// export IBM_KMS_INSTANCE_ID
+// export IBM_CRK_ID
+// for acc.IksClusterVpcID, acc.IksClusterResourceGroupID, acc.IksClusterSubnetID, acc.KmsInstanceID, acc.CrkID
+func testAccCheckIBMContainerVpcClusterEnvvar(name string) string {
+	config := fmt.Sprintf(`
+	resource "ibm_container_vpc_cluster" "cluster" {
+		name              = "%[1]s"
+		vpc_id            = "%[2]s"
+		flavor            = "bx2.4x16"
+		worker_count      = 1
+		resource_group_id = "%[3]s"
+		zones {
+			subnet_id = "%[4]s"
+			name      = "us-south-1"
+		}
+		kms_instance_id = "%[5]s"
+		crk = "%[6]s"
+	}
+	`, name, acc.IksClusterVpcID, acc.IksClusterResourceGroupID, acc.IksClusterSubnetID, acc.KmsInstanceID, acc.CrkID)
+	fmt.Println(config)
+	return config
+}

ibm/service/kubernetes/resource_ibm_container_vpc_worker_pool.go

@@ -151,6 +151,16 @@ func ResourceIBMContainerVpcWorkerPool() *schema.Resource {
 				Computed:    true,
 				Description: "Resource Controller URL",
 			},
+			"kms_instance_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Instance ID for boot volume encryption",
+			},
+			"crk": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Root Key ID for boot volume encryption",
+			},
 		},
 	}
 }
@@ -194,19 +204,20 @@ func resourceIBMContainerVpcWorkerPoolCreate(d *schema.ResourceData, meta interf
 
 	}
 
-	// for _, e := range d.Get("zones").(*schema.Set).List() {
-	// 	value := e.(map[string]interface{})
-	// 	id := value["id"].(string)
-	// 	subnetid := value["subnet_id"].(string)
-
-	// }
+	kmsid := d.Get("kms_instance_id").(string)
+	crk := d.Get("crk").(string)
 
+	wve := v2.WorkerVolumeEncryption{
+		KmsInstanceID:     kmsid,
+		WorkerVolumeCRKID: crk,
+	}
 	workerPoolConfig := v2.WorkerPoolConfig{
-		Name:        d.Get("worker_pool_name").(string),
-		VpcID:       d.Get("vpc_id").(string),
-		Flavor:      d.Get("flavor").(string),
-		WorkerCount: d.Get("worker_count").(int),
-		Zones:       zone,
+		Name:                   d.Get("worker_pool_name").(string),
+		VpcID:                  d.Get("vpc_id").(string),
+		Flavor:                 d.Get("flavor").(string),
+		WorkerCount:            d.Get("worker_count").(int),
+		Zones:                  zone,
+		WorkerVolumeEncryption: &wve,
 	}
 
 	if l, ok := d.GetOk("labels"); ok {
@@ -463,6 +474,10 @@ func resourceIBMContainerVpcWorkerPoolRead(d *schema.ResourceData, meta interfac
 	if workerPool.Taints != nil {
 		d.Set("taints", flattenWorkerPoolTaints(workerPool))
 	}
+	if workerPool.WorkerVolumeEncryption != nil {
+		d.Set("kms_instance_id", workerPool.WorkerVolumeEncryption.KmsInstanceID)
+		d.Set("crk", workerPool.WorkerVolumeEncryption.WorkerVolumeCRKID)
+	}
 	controller, err := flex.GetBaseController(meta)
 	if err != nil {
 		return err

ibm/service/kubernetes/resource_ibm_container_vpc_worker_pool_test.go

@@ -80,9 +80,12 @@ func testAccCheckIBMVpcContainerWorkerPoolDestroy(s *terraform.State) error {
 		target := v2.ClusterTargetHeader{}
 
 		// Try to find the key
-		_, err = wpClient.WorkerPools().GetWorkerPool(cluster, workerPoolID, target)
+		wp, err := wpClient.WorkerPools().GetWorkerPool(cluster, workerPoolID, target)
 
 		if err == nil {
+			if wp.ActualState == "deleted" && wp.DesiredState == "deleted" {
+				return nil
+			}
 			return fmt.Errorf("Worker pool still exists: %s", rs.Primary.ID)
 		} else if !strings.Contains(err.Error(), "404") {
 			return fmt.Errorf("[ERROR] Error waiting for worker pool (%s) to be destroyed: %s", rs.Primary.ID, err)
@@ -207,3 +210,53 @@ func testAccCheckIBMVpcContainerWorkerPoolUpdate(name string) string {
 	}
 		`, name)
 }
+
+func TestAccIBMContainerVpcClusterWorkerPoolEnvvar(t *testing.T) {
+
+	name := fmt.Sprintf("tf-vpc-worker-%d", acctest.RandIntRange(10, 100))
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { acc.TestAccPreCheck(t) },
+		Providers:    acc.TestAccProviders,
+		CheckDestroy: testAccCheckIBMVpcContainerWorkerPoolDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCheckIBMVpcContainerWorkerPoolEnvvar(name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_worker_pool.test_pool", "flavor", "bx2.4x16"),
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_worker_pool.test_pool", "zones.#", "1"),
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_worker_pool.test_pool", "kms_instance_id", acc.KmsInstanceID),
+					resource.TestCheckResourceAttr(
+						"ibm_container_vpc_worker_pool.test_pool", "crk", acc.CrkID),
+				),
+			},
+			{
+				ResourceName:      "ibm_container_vpc_worker_pool.test_pool",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"kms_instance_id", "crk"},
+			},
+		},
+	})
+}
+
+func testAccCheckIBMVpcContainerWorkerPoolEnvvar(name string) string {
+	return fmt.Sprintf(`
+	resource "ibm_container_vpc_worker_pool" "test_pool" {
+	  cluster           = "%[2]s"
+	  worker_pool_name  = "%[1]s"
+	  flavor            = "bx2.4x16"
+	  vpc_id            = "%[3]s"
+	  worker_count      = 1
+	  zones {
+		subnet_id = "%[4]s"
+		name      = "us-south-1"
+	  }
+	  kms_instance_id = "%[5]s"
+	  crk = "%[6]s"
+	}
+		`, name, acc.IksClusterID, acc.IksClusterVpcID, acc.IksClusterSubnetID, acc.KmsInstanceID, acc.CrkID)
+}

website/docs/d/container_vpc_cluster.html.markdown

@@ -78,3 +78,5 @@ In addition to all argument reference list, you can access the following attribu
 			- `id` - (String) The ID of the subnet that the worker pool is attached to in the zone.
 			- `primary` -  (Bool) If set to **true**, the subnet is used as the primary subnet.
 		- `worker_count` - (Integer) The number of worker nodes in this worker pool.
+- `crk` - Root Key ID for boot volume encryption.
+- `kms_instance_id` - Instance ID for boot volume encryption.

website/docs/d/container_worker_pool.html.markdown

@@ -40,3 +40,5 @@ Review the attribute references that are exported.
 	- `public_vlan` - (String) The ID of the public VLAN.
 	- `worker_count` - (String) Number of workers attached to this zone.
   - `zone` - (String) Zone name.
+- `crk` - Root Key ID for boot volume encryption.
+- `kms_instance_id` - Instance ID for boot volume encryption.