diff --git a/src/000-cloud/031-fabric/terraform/README.md b/src/000-cloud/031-fabric/terraform/README.md index f94ce5d70..b79e7281a 100644 --- a/src/000-cloud/031-fabric/terraform/README.md +++ b/src/000-cloud/031-fabric/terraform/README.md @@ -25,6 +25,7 @@ Contains all the resources needed for Fabric based resources. | [terraform_data.defer_fabric_capacity_created](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | | [terraform_data.defer_fabric_capacity_existing](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | | [terraform_data.defer_fabric_workspace](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | +| [terraform_data.validate_inputs](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | | [fabric_capacity.created](https://registry.terraform.io/providers/microsoft/fabric/1.10.0/docs/data-sources/capacity) | data source | | [fabric_capacity.existing](https://registry.terraform.io/providers/microsoft/fabric/1.10.0/docs/data-sources/capacity) | data source | | [fabric_workspace.existing](https://registry.terraform.io/providers/microsoft/fabric/1.10.0/docs/data-sources/workspace) | data source | diff --git a/src/000-cloud/031-fabric/terraform/main.tf b/src/000-cloud/031-fabric/terraform/main.tf index dc7769481..948500127 100644 --- a/src/000-cloud/031-fabric/terraform/main.tf +++ b/src/000-cloud/031-fabric/terraform/main.tf @@ -14,6 +14,20 @@ locals { workspace_id = try(module.fabric_workspace[0].workspace.id, data.fabric_workspace.existing[0].id, null) } +/* + * Input Validation + */ + +// Validates rules that span multiple input variables. +resource "terraform_data" "validate_inputs" { + lifecycle { + precondition { + condition = !var.should_create_fabric_capacity || length(var.fabric_capacity_admins) > 0 + error_message = "At least one administrator must be specified for Fabric capacity when creating a capacity." + } + } +} + // Defer computation to prevent `data` objects from querying for state on `terraform plan`. // Needed for testing and build system compatibility. resource "terraform_data" "defer_fabric_capacity_created" { diff --git a/src/000-cloud/031-fabric/terraform/tests/base.tftest.hcl b/src/000-cloud/031-fabric/terraform/tests/base.tftest.hcl index 857999b7a..b2f0cee76 100644 --- a/src/000-cloud/031-fabric/terraform/tests/base.tftest.hcl +++ b/src/000-cloud/031-fabric/terraform/tests/base.tftest.hcl @@ -163,6 +163,6 @@ run "create_capacity_without_admins" { } expect_failures = [ - var.fabric_capacity_admins, + terraform_data.validate_inputs, ] } diff --git a/src/000-cloud/031-fabric/terraform/variables.tf b/src/000-cloud/031-fabric/terraform/variables.tf index 94344f4f9..8b5b7901a 100644 --- a/src/000-cloud/031-fabric/terraform/variables.tf +++ b/src/000-cloud/031-fabric/terraform/variables.tf @@ -54,10 +54,6 @@ variable "fabric_capacity_admins" { EOT type = list(string) default = [] - validation { - condition = !var.should_create_fabric_capacity || length(var.fabric_capacity_admins) > 0 - error_message = "At least one administrator must be specified for Fabric capacity when creating a capacity." - } } variable "fabric_capacity_sku" { diff --git a/src/000-cloud/036-managed-redis/terraform/README.md b/src/000-cloud/036-managed-redis/terraform/README.md index 5db735dd1..09c50a2dd 100644 --- a/src/000-cloud/036-managed-redis/terraform/README.md +++ b/src/000-cloud/036-managed-redis/terraform/README.md @@ -19,9 +19,10 @@ Supports Microsoft Entra ID authentication and customer-managed key encryption. ## Resources -| Name | Type | -|----------------------------------------------------------------------------------------------------------------|----------| -| [terraform_data.defer](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | +| Name | Type | +|--------------------------------------------------------------------------------------------------------------------------|----------| +| [terraform_data.defer](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | +| [terraform_data.validate_inputs](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | ## Modules diff --git a/src/000-cloud/036-managed-redis/terraform/main.tf b/src/000-cloud/036-managed-redis/terraform/main.tf index 524bce657..d11625aec 100644 --- a/src/000-cloud/036-managed-redis/terraform/main.tf +++ b/src/000-cloud/036-managed-redis/terraform/main.tf @@ -9,6 +9,20 @@ locals { redis_name = "redis-${var.resource_prefix}-${var.environment}-${var.instance}" } +/* + * Input Validation + */ + +// Validates rules that span multiple input variables. +resource "terraform_data" "validate_inputs" { + lifecycle { + precondition { + condition = var.should_enable_private_endpoint ? var.private_endpoint_subnet != null : true + error_message = "private_endpoint_subnet is required when should_enable_private_endpoint is true." + } + } +} + /* * Azure Managed Redis Cache */ @@ -17,6 +31,9 @@ module "managed_redis" { count = var.should_deploy_redis ? 1 : 0 source = "./modules/managed-redis" + // Keeps the input precondition in targeted plans. The module has no data sources, so this defers no reads. + depends_on = [terraform_data.validate_inputs] + // Core Configuration location = var.location name = local.redis_name @@ -36,7 +53,7 @@ module "managed_redis" { private_endpoint_subnet_id = try(var.private_endpoint_subnet.id, null) private_dns_zone_id = var.private_dns_zone_id should_create_private_dns_zone = var.should_create_private_dns_zone - should_enable_private_endpoint = var.should_enable_private_endpoint + should_enable_private_endpoint = var.should_enable_private_endpoint && var.private_endpoint_subnet != null virtual_network_id = try(var.virtual_network.id, null) } diff --git a/src/000-cloud/036-managed-redis/terraform/variables.deps.tf b/src/000-cloud/036-managed-redis/terraform/variables.deps.tf index 9cb51a33b..5ec953423 100644 --- a/src/000-cloud/036-managed-redis/terraform/variables.deps.tf +++ b/src/000-cloud/036-managed-redis/terraform/variables.deps.tf @@ -16,11 +16,6 @@ variable "private_endpoint_subnet" { id = string }) default = null - - validation { - condition = var.should_enable_private_endpoint ? var.private_endpoint_subnet != null : true - error_message = "private_endpoint_subnet is required when should_enable_private_endpoint is true." - } } variable "resource_group" { diff --git a/src/000-cloud/080-azureml/terraform/main.tf b/src/000-cloud/080-azureml/terraform/main.tf index b85d524d4..fcd38f53d 100644 --- a/src/000-cloud/080-azureml/terraform/main.tf +++ b/src/000-cloud/080-azureml/terraform/main.tf @@ -6,7 +6,32 @@ * existing cloud infrastructure including Key Vault, Storage Account, Application Insights, and networking. */ -data "azurerm_client_config" "current" {} +/* + * Input Validation + */ + +// Validates rules that span multiple input variables. +// On a data source rather than a managed resource, so it adds no planned changes. +data "azurerm_client_config" "current" { + lifecycle { + precondition { + condition = !var.should_assign_ml_workload_identity_roles || var.ml_workload_identity != null + error_message = "ml_workload_identity must be provided when should_assign_ml_workload_identity_roles is true." + } + precondition { + condition = !var.should_associate_network_security_group || var.network_security_group != null + error_message = "network_security_group must be provided when should_associate_network_security_group is true." + } + precondition { + condition = !var.should_enable_nat_gateway || var.nat_gateway != null + error_message = "nat_gateway must be provided when should_enable_nat_gateway is true." + } + precondition { + condition = var.compute_cluster_min_nodes <= var.compute_cluster_max_nodes + error_message = "Minimum node count must be less than or equal to compute_cluster_max_nodes." + } + } +} /* * Network Module for Azure ML Compute Cluster @@ -17,6 +42,9 @@ module "network" { source = "./modules/network" + // Keeps the input preconditions in targeted plans (workspace and inference integration inherit it). + depends_on = [data.azurerm_client_config.current] + // Resource dependencies first resource_group = var.resource_group network_security_group = var.network_security_group @@ -29,9 +57,9 @@ module "network" { // Optional parameters default_outbound_access_enabled = var.default_outbound_access_enabled - should_associate_network_security_group = var.should_associate_network_security_group - should_enable_nat_gateway = var.should_enable_nat_gateway - nat_gateway_id = var.should_enable_nat_gateway ? var.nat_gateway.id : null + should_associate_network_security_group = var.should_associate_network_security_group && var.network_security_group != null + should_enable_nat_gateway = var.should_enable_nat_gateway && var.nat_gateway != null + nat_gateway_id = try(var.nat_gateway.id, null) subnet_address_prefixes_azureml = var.subnet_address_prefixes_azureml } @@ -57,7 +85,7 @@ module "workspace" { should_assign_current_user_workspace_roles = var.should_assign_current_user_workspace_roles current_user_object_id = var.should_assign_current_user_workspace_roles ? data.azurerm_client_config.current.object_id : null ml_workload_identity = var.ml_workload_identity - should_assign_ml_workload_identity_roles = var.should_assign_ml_workload_identity_roles + should_assign_ml_workload_identity_roles = var.should_assign_ml_workload_identity_roles && var.ml_workload_identity != null // Role assignment configuration should_assign_workspace_managed_identity_roles = var.should_assign_workspace_managed_identity_roles @@ -171,7 +199,7 @@ module "inference_cluster_integration" { ml_workload_identity = var.ml_workload_identity ml_workload_subjects = var.ml_workload_subjects - should_configure_ml_workload_identity = var.should_assign_ml_workload_identity_roles + should_configure_ml_workload_identity = var.should_assign_ml_workload_identity_roles && var.ml_workload_identity != null // App Configuration integration for volcano scheduler volcano_scheduler_configmap_name = try(var.kubernetes.app_configuration_configmap_name, null) diff --git a/src/000-cloud/080-azureml/terraform/tests/base.tftest.hcl b/src/000-cloud/080-azureml/terraform/tests/base.tftest.hcl index 097ba9171..b95f46250 100644 --- a/src/000-cloud/080-azureml/terraform/tests/base.tftest.hcl +++ b/src/000-cloud/080-azureml/terraform/tests/base.tftest.hcl @@ -294,3 +294,154 @@ run "reject_invalid_resource_prefix" { var.resource_prefix, ] } + +# Test 8: NAT gateway association requires a NAT gateway object +run "reject_nat_gateway_enabled_without_nat_gateway" { + command = plan + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + should_enable_nat_gateway = true + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} + +# Test 9: A plan targeting only the network module still enforces the NAT gateway rule +run "reject_nat_gateway_enabled_without_nat_gateway_targeted" { + command = plan + + plan_options { + target = [module.network] + } + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + should_enable_nat_gateway = true + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} + +# Test 10: A plan targeting only the network module still enforces the NSG rule +run "reject_nsg_association_without_nsg_targeted" { + command = plan + + plan_options { + target = [module.network] + } + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + should_associate_network_security_group = true + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} + +# Test 11: Workload identity role assignment requires a workload identity object +run "reject_workload_identity_roles_without_identity" { + command = plan + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + should_assign_ml_workload_identity_roles = true + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} + +# Test 12: A plan targeting only the workspace module still enforces the workload identity rule +run "reject_workload_identity_roles_without_identity_targeted" { + command = plan + + plan_options { + target = [module.workspace] + } + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + should_assign_ml_workload_identity_roles = true + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} + +# Test 13: Minimum node count cannot exceed the maximum node count +run "reject_min_nodes_above_max_nodes" { + command = plan + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "test" + location = run.setup_tests.location + resource_group = run.setup_tests.resource_group + application_insights = run.setup_tests.application_insights + key_vault = run.setup_tests.key_vault + storage_account = run.setup_tests.storage_account + acr = run.setup_tests.acr + virtual_network = run.setup_tests.virtual_network + + compute_cluster_min_nodes = 3 + compute_cluster_max_nodes = 2 + } + + expect_failures = [ + data.azurerm_client_config.current, + ] +} diff --git a/src/000-cloud/080-azureml/terraform/variables.deps.tf b/src/000-cloud/080-azureml/terraform/variables.deps.tf index 1398ec1da..f6d7bb60e 100644 --- a/src/000-cloud/080-azureml/terraform/variables.deps.tf +++ b/src/000-cloud/080-azureml/terraform/variables.deps.tf @@ -74,10 +74,6 @@ variable "ml_workload_identity" { }) description = "AzureML workload managed identity object from security identity containing id and principal_id." default = null - validation { - condition = (!var.should_assign_ml_workload_identity_roles) || (var.ml_workload_identity != null) - error_message = "ml_workload_identity must be provided when should_assign_ml_workload_identity_roles is true." - } } variable "network_security_group" { @@ -86,10 +82,6 @@ variable "network_security_group" { }) description = "Network security group from 050-networking component." default = null - validation { - condition = (!var.should_associate_network_security_group) || (var.network_security_group != null) - error_message = "network_security_group must be provided when should_associate_network_security_group is true." - } } variable "virtual_network" { @@ -108,8 +100,4 @@ variable "nat_gateway" { }) description = "NAT gateway object from the networking component for managed outbound access." default = null - validation { - condition = (!var.should_enable_nat_gateway) || (var.nat_gateway != null) - error_message = "nat_gateway must be provided when should_enable_nat_gateway is true." - } } diff --git a/src/000-cloud/080-azureml/terraform/variables.tf b/src/000-cloud/080-azureml/terraform/variables.tf index be4a188dd..3ce48d7c4 100644 --- a/src/000-cloud/080-azureml/terraform/variables.tf +++ b/src/000-cloud/080-azureml/terraform/variables.tf @@ -131,8 +131,8 @@ variable "compute_cluster_min_nodes" { default = 0 validation { - condition = var.compute_cluster_min_nodes >= 0 && var.compute_cluster_min_nodes <= var.compute_cluster_max_nodes - error_message = "Minimum node count must be greater than or equal to 0 and less than or equal to compute_cluster_max_nodes." + condition = var.compute_cluster_min_nodes >= 0 + error_message = "Minimum node count must be greater than or equal to 0." } } diff --git a/src/100-edge/100-cncf-cluster/terraform/main.tf b/src/100-edge/100-cncf-cluster/terraform/main.tf index bcb76268c..263f30632 100644 --- a/src/100-edge/100-cncf-cluster/terraform/main.tf +++ b/src/100-edge/100-cncf-cluster/terraform/main.tf @@ -17,12 +17,48 @@ locals { } /* - * Data Sources + * Input Validation */ +// Validates rules that span multiple input variables. +// On a data source rather than a managed resource, so it adds no planned changes. data "azurerm_client_config" "current" { + lifecycle { + precondition { + condition = !var.should_assign_roles || anytrue([var.arc_onboarding_identity != null, var.arc_onboarding_sp != null, var.arc_onboarding_principal_ids != null]) + error_message = "Either 'arc_onboarding_identity', 'arc_onboarding_sp', or 'arc_onboarding_principal_ids' required when should_assign_roles is 'true'" + } + precondition { + condition = !var.should_assign_roles || (sum([var.arc_onboarding_identity != null ? 1 : 0, var.arc_onboarding_sp != null ? 1 : 0, var.arc_onboarding_principal_ids != null ? 1 : 0]) <= 1) + error_message = "Only one of 'arc_onboarding_identity', 'arc_onboarding_sp', or 'arc_onboarding_principal_ids' can be provided" + } + precondition { + condition = !var.should_upload_to_key_vault || var.key_vault != null + error_message = "'key_vault' is required when 'should_upload_to_key_vault' is true" + } + precondition { + condition = var.cluster_server_token != null ? !var.should_generate_cluster_server_token : true + error_message = "'should_generate_cluster_server_token' must be false if 'cluster_server_token' has been provided." + } + precondition { + condition = var.should_upload_to_key_vault || !var.should_use_script_from_secrets_for_deploy + error_message = "'should_use_script_from_secrets_for_deploy' cannot be true when 'should_upload_to_key_vault' is false: no script would be present in Key Vault to fetch." + } + precondition { + condition = !var.should_deploy_over_ssh || var.should_deploy_arc_machines + error_message = "'should_deploy_over_ssh' requires 'should_deploy_arc_machines' to be true" + } + precondition { + condition = !var.should_deploy_over_ssh || (var.ssh_local_user != null && var.ssh_private_key_path != null) + error_message = "'ssh_local_user' and 'ssh_private_key_path' are required when 'should_deploy_over_ssh' is true" + } + } } +/* + * Data Sources + */ + resource "terraform_data" "defer_azuread_user" { count = var.should_add_current_user_cluster_admin ? 1 : 0 input = { diff --git a/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/main.tf b/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/main.tf index d3c4bd30d..181909de7 100644 --- a/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/main.tf +++ b/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/main.tf @@ -92,6 +92,13 @@ resource "random_string" "cluster_server_token" { numeric = true upper = true lower = true + + lifecycle { + precondition { + condition = var.cluster_server_token == null + error_message = "'should_generate_cluster_server_token' must be false if 'cluster_server_token' has been provided." + } + } } resource "local_sensitive_file" "cluster_server_setup_script" { diff --git a/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/variables.tf b/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/variables.tf index d0b4955bb..0229e99dd 100644 --- a/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/variables.tf +++ b/src/100-edge/100-cncf-cluster/terraform/modules/ubuntu-k3s/variables.tf @@ -99,10 +99,6 @@ variable "cluster_server_token" { variable "should_generate_cluster_server_token" { type = bool description = "Should generate token used by the server. ('cluster_server_token' must be null if this is 'true')" - validation { - condition = var.cluster_server_token != null ? !var.should_generate_cluster_server_token : true - error_message = "'should_generate_cluster_server_token' must be false if 'cluster_server_token' has been provided." - } } variable "cluster_server_host_machine_username" { diff --git a/src/100-edge/100-cncf-cluster/terraform/tests/cluster.tftest.hcl b/src/100-edge/100-cncf-cluster/terraform/tests/cluster.tftest.hcl index d77662b2c..238f7d57c 100644 --- a/src/100-edge/100-cncf-cluster/terraform/tests/cluster.tftest.hcl +++ b/src/100-edge/100-cncf-cluster/terraform/tests/cluster.tftest.hcl @@ -207,7 +207,7 @@ run "create_default_cluster_with_principal_id" { run "test_invalid_multiple_identities" { command = plan expect_failures = [ - var.arc_onboarding_identity + data.azurerm_client_config.current, ] variables { @@ -225,3 +225,74 @@ run "test_invalid_multiple_identities" { } } + +# Test invalid configuration fetching scripts from Key Vault without uploading them +run "test_invalid_script_from_secrets_without_key_vault_upload" { + command = plan + expect_failures = [ + data.azurerm_client_config.current, + ] + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "dev" + resource_group = run.setup_tests.aio_resource_group + should_get_custom_locations_oid = false + should_deploy_script_to_vm = true + should_assign_roles = false + arc_onboarding_sp = run.setup_tests.mock_sp + custom_locations_oid = run.setup_tests.mock_custom_locations_oid + key_vault = run.setup_tests.key_vault + cluster_server_machine = run.setup_tests.cluster_server_machine + should_upload_to_key_vault = false + should_use_script_from_secrets_for_deploy = true + } +} + +# Test invalid configuration deploying over SSH without Arc machines +run "test_invalid_ssh_without_arc_machines" { + command = plan + expect_failures = [ + data.azurerm_client_config.current, + ] + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "dev" + resource_group = run.setup_tests.aio_resource_group + should_get_custom_locations_oid = false + should_deploy_script_to_vm = true + should_assign_roles = false + arc_onboarding_sp = run.setup_tests.mock_sp + custom_locations_oid = run.setup_tests.mock_custom_locations_oid + key_vault = run.setup_tests.key_vault + cluster_server_machine = run.setup_tests.cluster_server_machine + should_deploy_over_ssh = true + should_deploy_arc_machines = false + ssh_local_user = "azureuser" + ssh_private_key_path = "~/.ssh/id_rsa" + } +} + +# Test invalid configuration deploying over SSH without SSH credentials +run "test_invalid_ssh_without_credentials" { + command = plan + expect_failures = [ + data.azurerm_client_config.current, + ] + + variables { + resource_prefix = run.setup_tests.resource_prefix + environment = "dev" + resource_group = run.setup_tests.aio_resource_group + should_get_custom_locations_oid = false + should_deploy_script_to_vm = true + should_assign_roles = false + arc_onboarding_sp = run.setup_tests.mock_sp + custom_locations_oid = run.setup_tests.mock_custom_locations_oid + key_vault = run.setup_tests.key_vault + cluster_server_machine = run.setup_tests.cluster_server_machine + should_deploy_over_ssh = true + should_deploy_arc_machines = true + } +} diff --git a/src/100-edge/100-cncf-cluster/terraform/variables.deps.tf b/src/100-edge/100-cncf-cluster/terraform/variables.deps.tf index 98d54e87a..9bedd7d9d 100644 --- a/src/100-edge/100-cncf-cluster/terraform/variables.deps.tf +++ b/src/100-edge/100-cncf-cluster/terraform/variables.deps.tf @@ -52,16 +52,6 @@ variable "arc_onboarding_identity" { }) description = "The User Assigned Managed Identity that will be used for onboarding the cluster to Arc" default = null - - validation { - condition = !var.should_assign_roles || anytrue([var.arc_onboarding_identity != null, var.arc_onboarding_sp != null, var.arc_onboarding_principal_ids != null]) - error_message = "Either 'arc_onboarding_identity', 'arc_onboarding_sp', or 'arc_onboarding_principal_ids' required when should_assign_roles is 'true'" - } - - validation { - condition = !var.should_assign_roles || (sum([var.arc_onboarding_identity != null ? 1 : 0, var.arc_onboarding_sp != null ? 1 : 0, var.arc_onboarding_principal_ids != null ? 1 : 0]) <= 1) - error_message = "Only one of 'arc_onboarding_identity', 'arc_onboarding_sp', or 'arc_onboarding_principal_ids' can be provided" - } } variable "arc_onboarding_sp" { @@ -82,11 +72,6 @@ variable "key_vault" { }) description = "The Key Vault object containing id, name, and vault_uri properties" default = null - - validation { - condition = !var.should_upload_to_key_vault || var.key_vault != null - error_message = "'key_vault' is required when 'should_upload_to_key_vault' is true" - } } variable "private_key_pem" { diff --git a/src/100-edge/100-cncf-cluster/terraform/variables.tf b/src/100-edge/100-cncf-cluster/terraform/variables.tf index 7902eb467..2c98f6819 100644 --- a/src/100-edge/100-cncf-cluster/terraform/variables.tf +++ b/src/100-edge/100-cncf-cluster/terraform/variables.tf @@ -18,11 +18,6 @@ variable "should_use_script_from_secrets_for_deploy" { type = bool description = "Whether to use the deploy-script-secrets.sh script to fetch and execute deployment scripts from Key Vault" default = true - - validation { - condition = var.should_upload_to_key_vault || !var.should_use_script_from_secrets_for_deploy - error_message = "'should_use_script_from_secrets_for_deploy' cannot be true when 'should_upload_to_key_vault' is false: no script would be present in Key Vault to fetch." - } } variable "key_vault_script_secret_prefix" { @@ -71,16 +66,6 @@ variable "should_deploy_over_ssh" { type = bool description = "Should deliver the setup script over 'az ssh arc' instead of a CustomScript extension. Requires Azure CLI with the 'ssh' extension where Terraform runs." default = false - - validation { - condition = !var.should_deploy_over_ssh || var.should_deploy_arc_machines - error_message = "'should_deploy_over_ssh' requires 'should_deploy_arc_machines' to be true" - } - - validation { - condition = !var.should_deploy_over_ssh || (var.ssh_local_user != null && var.ssh_private_key_path != null) - error_message = "'ssh_local_user' and 'ssh_private_key_path' are required when 'should_deploy_over_ssh' is true" - } } variable "ssh_local_user" { @@ -195,10 +180,6 @@ variable "should_generate_cluster_server_token" { type = bool description = "Should generate token used by the server. ('cluster_server_token' must be null if this is 'true')" default = false - validation { - condition = var.cluster_server_token != null ? !var.should_generate_cluster_server_token : true - error_message = "'should_generate_cluster_server_token' must be false if 'cluster_server_token' has been provided." - } } variable "cluster_server_host_machine_username" {