fix: Ubuntu Image vulnerability fixed<br>* Addition of P1, P2 test cases (#173)

Co-authored-by: Sagar BK <[email protected]>

Author: nupurg-ibm

ibm_catalog.json

@@ -331,7 +331,15 @@
                             "key": "bastion_security_group_id"
                         },
                         {
-                            "key": "bastion_ssh_private_key"
+                            "key": "bastion_ssh_private_key",
+                            "type": "multiline_secure_value",
+                            "display_name": "Multiline secure value",
+                            "required": false,
+                            "custom_config": {
+                                "grouping": "deployment",
+                                "original_grouping": "deployment",
+                                "type": "multiline_secure_value"
+                            }
                         },
                         {
                             "hidden": true,

modules/bootstrap/locals.tf

@@ -26,7 +26,7 @@ locals {
   bastion_node_name = format("%s-%s", local.prefix, "bastion")
 
   bastion_machine_type = "cx2-4x8"
-  bastion_image_name   = "ibm-ubuntu-22-04-3-minimal-amd64-1"
+  bastion_image_name   = "ibm-ubuntu-22-04-4-minimal-amd64-3"
 
   bastion_image_id = data.ibm_is_image.bastion.id
 

modules/custom/subnet_cidr_check/main.tf

@@ -1,19 +1,19 @@
 locals {
   image_region_map = {
-    "hpcaas-lsf10-rhel88-v8" = {
-      "us-east"  = "r014-ee8b808f-e129-4d9e-965e-fed7003132e7"
-      "eu-de"    = "r010-bfad7737-77f9-4af7-9446-4783fb582258"
-      "us-south" = "r006-d314bc1d-e904-4124-9055-0862e1a56579"
+    "hpcaas-lsf10-rhel88-v9" = {
+      "us-east"  = "r014-d2b18006-c0c4-428f-96f3-e033b970c582"
+      "eu-de"    = "r010-3bf3f57e-1985-431d-aefe-e9914ab7919c"
+      "us-south" = "r006-7b0aa90b-f52c-44b1-bab7-ccbfae9f1816"
     },
     "hpcaas-lsf10-rhel88-compute-v5" = {
       "us-east"  = "r014-deb34fb1-edbf-464c-9af3-7efa2efcff3f"
       "eu-de"    = "r010-2d04cfff-6f54-45d1-b3b3-7e259083d71f"
       "us-south" = "r006-236ee1f4-38de-4845-b7ec-e2ffa7df5d08"
     },
-    "hpcaas-lsf10-ubuntu2204-compute-v4" = {
-      "us-east"  = "r014-b15b5e51-ccb6-40e4-9d6b-d0d47864a8a2"
-      "eu-de"    = "r010-39f4de94-2a55-431e-ad86-613c5b23a030"
-      "us-south" = "r006-fe0e6afd-4d01-4794-a9ed-dd5353dda482"
+    "hpcaas-lsf10-ubuntu2204-compute-v5" = {
+      "us-east"  = "r014-ecbf4c89-16a3-472e-8bab-1e76d744e264"
+      "eu-de"    = "r010-9811d8bf-a7f8-4ee6-8342-e5af217bc513"
+      "us-south" = "r006-ed76cb75-f086-48e9-8090-e2dbc411abe7"
     }
   }
 }

modules/custom/subnet_cidr_check/outputs.tf

@@ -313,7 +313,7 @@ variable "ldap_vsi_profile" {
 
 variable "ldap_vsi_osimage_name" {
   type        = string
-  default     = "ibm-ubuntu-22-04-3-minimal-amd64-1"
+  default     = "ibm-ubuntu-22-04-4-minimal-amd64-3"
   description = "Image name to be used for provisioning the LDAP instances."
 }
 

modules/custom/subnet_cidr_check/variables.tf

@@ -20,7 +20,7 @@
     "enable_cos_integration"    : "false",
     "cos_instance_name"         : "__NULL__",
     "enable_fip"                : "true",
-    "management_image_name"     : "hpcaas-lsf10-rhel88-v8",
+    "management_image_name"     : "hpcaas-lsf10-rhel88-v9",
     "compute_image_name"        : "hpcaas-lsf10-rhel88-compute-v5",
     "login_image_name"          : "hpcaas-lsf10-rhel88-compute-v5",
     "login_node_instance_type"  : "bx2-2x8",
@@ -48,7 +48,7 @@
     "ldap_user_name"               : "",
     "ldap_user_password"           : "",
     "ldap_vsi_profile"             : "cx2-2x4",
-    "ldap_vsi_osimage_name"        : "ibm-ubuntu-22-04-3-minimal-amd64-1",
+    "ldap_vsi_osimage_name"        : "ibm-ubuntu-22-04-4-minimal-amd64-3",
     "skip_iam_authorization_policy" : "false",
     "skip_iam_share_authorization_policy" : "false",
     "scc_enable"                   : "false",

modules/custom/subnet_cidr_check/version.tf

@@ -197,7 +197,7 @@
         },
         {
           "name": "management_image_name",
-          "value": "hpcaas-lsf10-rhel88-v8",
+          "value": "hpcaas-lsf10-rhel88-v9",
           "type": "string",
           "secure": false,
           "description": "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster management nodes. By default, the solution uses a RHEL88 base image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
@@ -207,15 +207,15 @@
           "value": "hpcaas-lsf10-rhel88-compute-v5",
           "type": "string",
           "secure": false,
-          "description": "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster dynamic compute nodes. By default, the solution uses a RHEL 8-6 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v4). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
+          "description": "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster dynamic compute nodes. By default, the solution uses a RHEL 8-6 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v5). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
 
         },
         {
           "name": "login_image_name",
           "value": "hpcaas-lsf10-rhel88-compute-v5",
           "type": "string",
           "secure": false,
-          "description": "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster login node. By default, the solution uses a RHEL 8-6 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v4). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
+          "description": "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster login node. By default, the solution uses a RHEL 8-6 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v5). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
         },
         {
           "name": "login_node_instance_type",
@@ -377,7 +377,7 @@
         },
         {
           "name": "ldap_vsi_osimage_name",
-          "value": "ibm-ubuntu-22-04-3-minimal-amd64-1",
+          "value": "ibm-ubuntu-22-04-4-minimal-amd64-3",
           "type": "string",
           "secure": false,
           "description": "Image name to be used for provisioning the LDAP instances."
@@ -456,28 +456,28 @@
           "value": "__NULL__",
           "type": "string",
           "secure": false,
-          "description" : "Bastion instance name. If none given then new bastion will be created."
+          "description" : "Provide the name of the bastion instance. If none given then new bastion will be created."
         },
         {
           "name": "bastion_instance_public_ip",
           "value": "__NULL__",
           "type": "string",
           "secure": false,
-          "description" : "Bastion instance public ip address."
+          "description" : "Provide the public ip address of the bastion instance to establish the remote connection."
         },
         {
           "name": "bastion_security_group_id",
           "value": "__NULL__",
           "type": "string",
           "secure": false,
-          "description" : "Bastion security group id."
+          "description" : "Provide the security group ID of the bastion server. This security group ID will be added as an allowlist rule on the HPC cluster nodes to establish an SSH connection through the bastion node."
         },
         {
           "name": "bastion_ssh_private_key",
           "value": "__NULL__",
           "type": "string",
           "secure": false,
-          "description" : "Bastion SSH private key path, which will be used to login to bastion host."
+          "description" : "Provide the private SSH key (named id_rsa) used during the creation and configuration of the bastion server to securely authenticate and connect to the bastion server. This allows access to internal network resources from a secure entry point. Note: The corresponding public SSH key (named id_rsa.pub) must already be available in the ~/.ssh/authorized_keys file on the bastion host to establish authentication."
         }
       ]
     }

modules/landing_zone_vsi/image_map.tf

@@ -39,11 +39,6 @@ data "ibm_is_vpc" "vpc" {
   depends_on = [module.landing_zone.vpc_name, data.ibm_is_vpc.existing_vpc]
 }
 
-data "ibm_is_vpc_address_prefixes" "existing_vpc" {
-  #count = var.vpc_name != "" ? 1 : 0
-  vpc = data.ibm_is_vpc.vpc.id
-}
-
 data "ibm_is_subnet" "existing_subnet" {
   # Lookup for this Subnet resources only if var.cluster_subnet_ids is not empty
   count      = (length(var.cluster_subnet_ids) == 1 && var.vpc_name != null) ? length(var.cluster_subnet_ids) : 0

modules/landing_zone_vsi/variables.tf

@@ -6,31 +6,7 @@
 # This file contains the complete information on all the validations performed from the code during the generate plan process
 # Validations are performed to make sure, the appropriate error messages are displayed to user in-order to provide required input parameter
 
-# Module for the private cluster_subnet and login subnet cidr validation.
-module "ipvalidation_cluster_subnet" {
-  count              = length(var.vpc_cluster_private_subnets_cidr_blocks)
-  source             = "../../modules/custom/subnet_cidr_check"
-  subnet_cidr        = var.vpc_cluster_private_subnets_cidr_blocks[count.index]
-  vpc_address_prefix = [local.prefixes_in_given_zone_1][count.index]
-}
-
-module "ipvalidation_login_subnet" {
-  source             = "../../modules/custom/subnet_cidr_check"
-  subnet_cidr        = var.vpc_cluster_login_private_subnets_cidr_blocks[0]
-  vpc_address_prefix = local.prefixes_in_given_zone_login
-}
-
 locals {
-  # Copy address prefixes and CIDR of given zone into a new tuple
-  prefixes_in_given_zone_login = [
-    for prefix in data.ibm_is_vpc_address_prefixes.existing_vpc[*].address_prefixes[0] :
-  prefix.cidr if prefix.zone[0].name == var.zones[0]]
-
-  # To get the address prefix of zone1
-  prefixes_in_given_zone_1 = [
-    for prefix in data.ibm_is_vpc_address_prefixes.existing_vpc[*].address_prefixes[0] :
-  prefix.cidr if var.zones[0] == prefix.zone[0].name]
-
   # validation for the boot volume encryption toggling.
   validate_enable_customer_managed_encryption     = anytrue([alltrue([var.kms_key_name != null, var.kms_instance_name != null]), (var.kms_key_name == null), (var.key_management != "key_protect")])
   validate_enable_customer_managed_encryption_msg = "Please make sure you are passing the kms_instance_name if you are passing kms_key_name."

samples/configs/hpc_catalog_values.json

@@ -176,21 +176,21 @@ variable "login_node_instance_type" {
 }
 variable "management_image_name" {
   type        = string
-  default     = "hpcaas-lsf10-rhel88-v8"
+  default     = "hpcaas-lsf10-rhel88-v9"
   description = "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster management nodes. By default, the solution uses a RHEL88 base image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
 
 }
 
 variable "compute_image_name" {
   type        = string
   default     = "hpcaas-lsf10-rhel88-compute-v5"
-  description = "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster dynamic compute nodes. By default, the solution uses a RHEL 8-8 base OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v4). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
+  description = "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster dynamic compute nodes. By default, the solution uses a RHEL 8-8 base OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v5). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
 }
 
 variable "login_image_name" {
   type        = string
   default     = "hpcaas-lsf10-rhel88-compute-v5"
-  description = "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster login node. By default, the solution uses a RHEL 8-8 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v4). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
+  description = "Name of the custom image that you want to use to create virtual server instances in your IBM Cloud account to deploy the IBM Cloud HPC cluster login node. By default, the solution uses a RHEL 8-8 OS image with additional software packages mentioned [here](https://cloud.ibm.com/docs/ibm-spectrum-lsf#create-custom-image). The solution also offers, Ubuntu 22-04 OS base image (hpcaas-lsf10-ubuntu2204-compute-v5). If you would like to include your application-specific binary files, follow the instructions in [ Planning for custom images ](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) to create your own custom image and use that to build the IBM Cloud HPC cluster through this offering."
 }
 
 variable "management_node_instance_type" {
@@ -496,7 +496,7 @@ variable "ldap_vsi_profile" {
 
 variable "ldap_vsi_osimage_name" {
   type        = string
-  default     = "ibm-ubuntu-22-04-3-minimal-amd64-1"
+  default     = "ibm-ubuntu-22-04-4-minimal-amd64-3"
   description = "Image name to be used for provisioning the LDAP instances. By default ldap server are created on Ubuntu based OS flavour."
 }
 
@@ -560,24 +560,24 @@ variable "TF_VALIDATION_SCRIPT_FILES" {
 variable "bastion_instance_name" {
   type        = string
   default     = null
-  description = "Bastion instance name. If none given then new bastion will be created."
+  description = "Provide the name of the bastion instance. If none given then new bastion will be created."
 }
 
 variable "bastion_instance_public_ip" {
   type        = string
   default     = null
-  description = "Bastion instance public ip address."
+  description = "Provide the public ip address of the bastion instance to establish the remote connection."
 }
 
 variable "bastion_security_group_id" {
   type        = string
   default     = null
-  description = "Bastion security group id."
+  description = "Provide the security group ID of the bastion server. This security group ID will be added as an allowlist rule on the HPC cluster nodes to establish an SSH connection through the bastion node."
 }
 
 variable "bastion_ssh_private_key" {
   type        = string
   sensitive   = true
   default     = null
-  description = "Bastion SSH private key path, which will be used to login to bastion host."
+  description = "Provide the private SSH key (named id_rsa) used during the creation and configuration of the bastion server to securely authenticate and connect to the bastion server. This allows access to internal network resources from a secure entry point. Note: The corresponding public SSH key (named id_rsa.pub) must already be available in the ~/.ssh/authorized_keys file on the bastion host to establish authentication."
 }