IBM Cloud OpenShift Terraform Enterprise modules

Overview

This repository provides a top-level Terraform module for deploying and managing HashiCorp Terraform Enterprise (TFE) on IBM Cloud Red Hat OpenShift clusters. The module automates the setup of namespaces, secrets, Helm releases, OpenShift routes, and supporting resources required for a TFE installation.

Status: This module deploys a functional TFE infrastructure on IBM Cloud. However, it does not yet implement all production-ready requirements such as network isolation, security hardening, and compliance controls. The module interfaces and behaviors may change as these capabilities are added. Early adopters are encouraged to try it and provide feedback.

Required access policies

You need the following permissions to run this module:

• IBM Cloud Resource Group: Viewer access on the resource group
• IBM Cloud OpenShift: Editor or Administrator access to the cluster
• IBM Cloud Object Storage: Manager or Writer access for the S3 bucket
• IBM Cloud Databases for PostgreSQL/Redis: Manager or equivalent access
• IBM Cloud Secrets Manager: Writer access if the generated secrets are to be stored in Secrets Manager
• IBM Cloud Secrets Manager: SecretsReader access if the Terraform Enterprise license key is in Secrets Manager
• Ability to create and manage Kubernetes resources in the target OpenShift namespace

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.

Notes

The module integrates with IBM Cloud Secret Manager service. This integration takes two forms. If an optional IBM Cloud Secrets Manager instance CRN and secret group ID are provided, then the Redis admin user password and Terraform Enterprise admin token will be stored in Secrets Manager and the new secret CRNs will be returned instead of the secret values. If an optional Terraform Enterprise license secret CRN is provided, then the license will be retrieved from Secrets Manager, avoiding the need to pass the license key as a string.

Known issues

Tear down will fail at the Postgresql instance when delete protection is enabled. Set the delete protection flag to false and run terraform apply --target 'module.<top level module name>.module.icd_postgres.ibm_database.postgresql_db' before running the destroy to complete the tear down.