Skip to content

Commit 91f4ef0

Browse files
Timo-1Timo-1
authored
Merge pull request #71 from ibm-hyper-protect/sample-paynow
Add PayNow Terraform example
2 parents 39d6bb4 + bc75ef6 commit 91f4ef0

File tree

5 files changed

+187
-0
lines changed

5 files changed

+187
-0
lines changed

‎terraform-hpvs/sample-paynow/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
## Contract generation example for the PayNow sample application
2+
3+
This sample creates an encrypted and signed contract and stores it locally in a file. You can later use the contract to provision a HPVS for VPC instance.
4+
The contract will define the container image, the container registry and the credentials for pulling your workload container image, as well as a server certificate and server key.
5+
6+
For more information, see this [tutorial](https://cloud.ibm.com/docs/vpc?topic=vpc-financial-transaction-confidential-computing-on-hyper-protect-virtual-server-for-vpc) and the [PayNow sample application](https://github.com/ibm-hyper-protect/paynow-website).
7+
8+
### Prerequisite
9+
10+
Prepare your local environment according to [these steps](../README.md)
11+
12+
### Define your settings
13+
14+
In file `compose\pod.yml` adapt the value for `image` to reference your container registry and your container image including the digest.
15+
16+
Define your settings:
17+
- logdna_ingestion_hostname: The ingestion host name of your Log instance which you provisioned previously
18+
- logdna_ingestion_key: The ingestion key of your Log instance
19+
- registry: The container registry where the workload container image is pulled from, e.g. `us.icr.io`
20+
- pull_username: The container registry username for pulling your workload container image
21+
- pull_password: The container registry password for pulling your workload container image
22+
- server_cert: The base64-encoded SSL server certificate
23+
- server_key: The base64-encoded SSL server key
24+
25+
The settings are defined in form of Terraform variables in a template file:
26+
27+
1. `cp my-settings.auto.tfvars-template my-settings.auto.tfvars`
28+
2. Fill the values in `my-settings.auto.tfvars`
29+
30+
### Create the contract
31+
32+
```bash
33+
terraform init
34+
terraform apply
35+
```
36+
37+
### Further steps
38+
39+
The contract will be written to the file `build/contract.yml` and can now be used for e.g. provisining a HPVS for VPC instance.
40+
41+
Note that you will need to create a public gateway in your VPC before creating the HPVS for VPC instance. This is necessary to allow the HPVS for VPC instance to reach your Log instance through the public gateway. Also assign a floating IP to your HPVS for VPC instance.

‎terraform-hpvs/sample-paynow/compose/pod.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: paynow
5+
spec:
6+
containers:
7+
- name: main
8+
image: ghcr.io/ibm-hyper-protect/paynow-website@sha256:ddba7d52d058f46b184d67783e8c55999a8d439a1eb11d3d5314cd787a928bc3
9+
ports:
10+
- containerPort: 8080
11+
hostPort: 8080
12+
protocol: tcp
13+
- containerPort: 8443
14+
hostPort: 8443
15+
protocol: tcp
16+
envFrom:
17+
- configMapRef:
18+
name: contract.config.map
19+
optional: false
20+
volumeMounts:
21+
- name: hyperprotect
22+
mountPath: /var/hyperprotect/
23+
restartPolicy: Never
24+
volumes:
25+
- name: hyperprotect
26+
hostPath:
27+
path: /var/hyperprotect/

‎terraform-hpvs/sample-paynow/my-settings.auto.tfvars-template‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
logdna_ingestion_key="Your LogDNA ingestion key" # You can find this in "Linux/ubuntu" section of `Logging sources` tab of "IBM Log Analysis" instance in [cloud.ibm.com](https://cloud.ibm.com)
2+
logdna_ingestion_hostname="rsyslog endpoint of IBM Log Analysis instance" # Example: "syslog-a.<log_region>.logging.cloud.ibm.com". Where <log_region> is the region on which IBM Log Analysis is deployed
3+
registry="Prefix for the dynamic registry" # e.g. docker.io/library or us.icr.io
4+
pull_username="Username for registry" # Username with read access to the container registry
5+
pull_password="Password for registry" # Password with read access to the container registry
6+
server_cert="Base64-encoded server certificate"
7+
server_key="Base64-encoded server key"

‎terraform-hpvs/sample-paynow/terraform.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
terraform {
2+
required_providers {
3+
hpcr = {
4+
source = "ibm-hyper-protect/hpcr"
5+
version = ">= 0.1.6"
6+
}
7+
}
8+
}
9+
10+
# archive of the folder containing the pod.yml file. This folder could create additional resources such as files
11+
# to be mounted into containers, environment files etc. This is why all of these files get bundled in a tgz file (base64 encoded)
12+
resource "hpcr_tgz" "contract" {
13+
folder = "compose"
14+
}
15+
16+
locals {
17+
# contract in clear text
18+
contract = yamlencode({
19+
"env" : {
20+
"type" : "env",
21+
"logging" : {
22+
"logDNA" : {
23+
"ingestionKey" : var.logdna_ingestion_key,
24+
"hostname" : var.logdna_ingestion_hostname,
25+
}
26+
},
27+
"auths" : {
28+
(var.registry) : {
29+
"username" : var.pull_username,
30+
"password" : var.pull_password
31+
}
32+
},
33+
"env" : {
34+
"REGISTRY" : var.registry,
35+
"CERT": var.server_cert,
36+
"KEY": var.server_key
37+
}
38+
},
39+
"workload" : {
40+
"type" : "workload",
41+
"play" : {
42+
"archive" : hpcr_tgz.contract.rendered
43+
}
44+
}
45+
})
46+
}
47+
48+
# In this step we encrypt the fields of the contract and sign the env and workload field. The certificate to execute the
49+
# encryption it built into the provider and matches the latest HPCR image. If required it can be overridden.
50+
# We use a temporary, random keypair to execute the signature. This could also be overriden.
51+
resource "hpcr_contract_encrypted" "contract" {
52+
contract = local.contract
53+
}
54+
55+
resource "local_file" "contract" {
56+
content = hpcr_contract_encrypted.contract.rendered
57+
filename = "${path.module}/build/contract.yml"
58+
}

‎terraform-hpvs/sample-paynow/variables.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
variable "logdna_ingestion_key" {
2+
type = string
3+
sensitive = true
4+
description = <<-DESC
5+
Ingestion key for IBM Log Analysis instance. This can be
6+
obtained from "Linux/Ubuntu" section of "Logging resource"
7+
tab of IBM Log Analysis instance
8+
DESC
9+
}
10+
11+
variable "logdna_ingestion_hostname" {
12+
type = string
13+
description = <<-DESC
14+
rsyslog endpoint of IBM Log Analysis instance.
15+
Don't include the port. Example:
16+
syslog-a.<log_region>.logging.cloud.ibm.com
17+
log_region is the region where IBM Log Analysis is deployed
18+
DESC
19+
}
20+
21+
variable "registry" {
22+
type = string
23+
description = <<-DESC
24+
Prefix of the container registry used to pull the image
25+
DESC
26+
}
27+
28+
variable "pull_username" {
29+
type = string
30+
description = <<-DESC
31+
Username to pull from the above registry
32+
DESC
33+
}
34+
35+
variable "pull_password" {
36+
type = string
37+
description = <<-DESC
38+
Password to pull from the above registry
39+
DESC
40+
}
41+
42+
variable "server_cert" {
43+
type = string
44+
description = <<-DESC
45+
Base64-encoded server certificate
46+
DESC
47+
}
48+
49+
variable "server_key" {
50+
type = string
51+
description = <<-DESC
52+
Base64-encoded server key
53+
DESC
54+
}

0 commit comments

Comments
 (0)