Terraform Code Engine Module

This module provisions the IBM Cloud Code Engine fully managed and serverless platform. It supports deployment of containerized workloads, including web apps, batch jobs, builds, config maps, bindings, domain mappings, or secrets. For more information, see About Code Engine

Overview

• terraform-ibm-code-engine
• Submodules
  • app
  • binding
  • build
  • config_map
  • domain_mapping
  • job
  • project
  • secret
• Examples
  • Apps example
  • Jobs example
• Contributing

terraform-ibm-code-engine

Known limitations

Currently, IBM provider supports basic functionalities, such as create/delete/update code engine projects, apps, jobs, builds and etc.

Known limitations are:

• No support to create/delete/update code engine functions. https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5230
• No support to create/delete/update code engine subscriptions. https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5231
• Apply twice keeps on showing changes for ibm_code_engine_app and ibm_code_engine_job terraform resource https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4719
• CLI/API service binding implementation/interface is different from terraform implementation. For example, CLI or UI code engine has a support to create access secret, service credential and all bindings automatically, while code_engine_binding_instance terraform resource requires that access secret exists before the binding is created. The second discrepancy between implementations is that terraform code_engine_binding_instance terraform resource requires prefix while using CLI or UI prefix is an optional parameter. https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5229
• Visibility for application can not be set. While CLI uses --visibility=private flag to set the visibility, terraform provider doesn't support it. https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5228
• Apply twice throwns an error for ibm_code_engine_secret terraform resource https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5232

Usage

module "code_engine" {
  source       = "terraform-ibm-modules/code-engine/ibm"
  version      = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
  project_name = "your-project-name"
  apps         = {
                  "your-app-name-1" = {
                    image_reference = "container_registry_url"
                    run_env_variables = [{
                      type  = "literal"
                      name  = "env_name"
                      value = "env_value"
                      }]
                  },
                  "your-app-name-2" = {
                    image_reference = "container_registry_url"
                  }
                }
  jobs         = {
                  "your-job-name" = {
                    image_reference = "container_registry_url"
                    run_env_variables = [{
                      type  = "literal"
                      name  = "env_name"
                      value = "env_value"
                    }]
                  }
                }
  config_maps  = {
                  "your-config-name" = {
                    data = { "key_1" : "value_1", "key_2" : "value_2" }
                  }
                }
  secrets      = {
                  "your-secret-name" = {
                    format = "generic"
                    data   = { "key_1" : "value_1", "key_2" : "value_2" }
                  }
                }
  builds       = {
                  "your-build-name" = {
                    output_image  = "container_registry_url"
                    output_secret = "secret-name" # pragma: allowlist secret
                    source_url    = "https://github.com/IBM/CodeEngine"
                    strategy_type = "dockerfile"
                  }
                }
}

Required IAM access policies

You need the following permissions to run this module.

• Account Management
  • Resource Group service
    • Viewer platform access
• IAM Services
  • Code Engine service
    • Editor platform access
    • Writer service access

Requirements

Modules

Resources

No resources.

Inputs

map(object({
    image_reference = string
    image_secret    = optional(string)
    run_env_variables = optional(list(object({
      type      = optional(string)
      name      = optional(string)
      value     = optional(string)
      prefix    = optional(string)
      key       = optional(string)
      reference = optional(string)
    })))
    run_volume_mounts = optional(list(object({
      mount_path = string
      reference  = string
      name       = optional(string)
      type       = string
    })))
    image_port                    = optional(number)
    managed_domain_mappings       = optional(string)
    run_arguments                 = optional(list(string))
    run_as_user                   = optional(number)
    run_commands                  = optional(list(string))
    run_service_account           = optional(string)
    scale_concurrency             = optional(number)
    scale_concurrency_target      = optional(number)
    scale_cpu_limit               = optional(string)
    scale_ephemeral_storage_limit = optional(string)
    scale_initial_instances       = optional(number)
    scale_max_instances           = optional(number)
    scale_memory_limit            = optional(string)
    scale_min_instances           = optional(number)
    scale_request_timeout         = optional(number)
  }))

map(object({
    secret_name = string
    components = list(object({
      name          = string
      resource_type = string
    }))
  }))

map(object({
    output_image       = string
    output_secret      = string # pragma: allowlist secret
    source_url         = string
    strategy_type      = string
    source_context_dir = optional(string)
    source_revision    = optional(string)
    source_secret      = optional(string)
    source_type        = optional(string)
    strategy_size      = optional(string)
    strategy_spec_file = optional(string)
    timeout            = optional(number)
  }))

map(object({
    data = map(string)
  }))

map(object({
    tls_secret = string # pragma: allowlist secret
    components = list(object({
      name          = string
      resource_type = string
    }))
  }))

map(object({
    image_reference = string
    image_secret    = optional(string)
    run_env_variables = optional(list(object({
      type      = optional(string)
      name      = optional(string)
      value     = optional(string)
      prefix    = optional(string)
      key       = optional(string)
      reference = optional(string)
    })))
    run_volume_mounts = optional(list(object({
      mount_path = string
      reference  = string
      name       = optional(string)
      type       = string
    })))
    run_arguments                 = optional(list(string))
    run_as_user                   = optional(number)
    run_commands                  = optional(list(string))
    run_mode                      = optional(string)
    run_service_account           = optional(string)
    scale_array_spec              = optional(string)
    scale_cpu_limit               = optional(string)
    scale_ephemeral_storage_limit = optional(string)
    scale_max_execution_time      = optional(number)
    scale_memory_limit            = optional(string)
    scale_retry_limit             = optional(number)
  }))

map(object({
    format = string
    data   = map(string)
    # Issue with provider, service_access is not supported at the moment. https://github.com/IBM-Cloud/terraform-provider-ibm/issues/5232
    # service_access = optional(list(object({
    #   resource_key = list(object({
    #     id = optional(string)
    #   }))
    #   role = list(object({
    #     crn = optional(string)
    #   }))
    #   service_instance = list(object({
    #     id = optional(string)
    #   }))
    # })))
  }))

Outputs

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.