From ede6b6f595f9c69cc33abd7d69055c069a6e8644 Mon Sep 17 00:00:00 2001 From: Rafael Lopez Date: Fri, 5 Jun 2026 11:09:35 -0600 Subject: [PATCH 1/3] feat: DOHRMY-148, DOHRMY-131 * Added validation in `PropertyManager.psm1` to verify that mPulse is available in the contract when the corresponding Terraform variable is enabled. * Removed the unused `dummy_test` variable. * Added the `forward_host_header` variable to support parameterization of the Forward Host Header setting within the module. * Updated the `additional_origins` variable to align with the Forward Host Header enhancements. * Added the `default_cpcode` variable to allow selection of the default CP Code. * Corrected typos in variable descriptions. * Updated `ip_behavior` validation to support only `IPV4` and `IPV6_COMPLIANCE`. Terraform variable templates (`.tfvars`) were updated to reflect the above changes. Additionally, several variable validation rules were refactored. Since newer Terraform versions no longer allow cross-variable references within validation conditions, equivalent pre-validation checks were implemented in `main.tf`. --- lib/templates/PropertyManager.psm1 | 19 +++ new-property/README.md | 23 ++-- new-property/environments/dev/dev.tfvars.dist | 14 ++- .../environments/prod/prod.tfvars.dist | 8 ++ new-property/environments/qa/qa.tfvars.dist | 14 ++- new-property/main.tf | 39 ++++++- new-property/variables.tf | 108 +++++------------- new-property/versions.tf | 2 +- 8 files changed, 125 insertions(+), 102 deletions(-) diff --git a/lib/templates/PropertyManager.psm1 b/lib/templates/PropertyManager.psm1 index d7a4de2..0e384bd 100644 --- a/lib/templates/PropertyManager.psm1 +++ b/lib/templates/PropertyManager.psm1 @@ -46,6 +46,25 @@ class PropertyManagerTemplate { Write-Host "Secure by Default not enabled - skipping product validation" -ForegroundColor Yellow } } + + + # Only validate if enable_mpulse is enabled and not skipped + if (-not $this.DeployParams.SkipValidation) { + $enableMPulseValue = Get-TfVarValue -FilePath $tfvarsPath -VarName "enable_mPulse" + + if ($enableMPulseValue -eq "true") { + Write-Host "mPulse enabled - validating product ID" -ForegroundColor Cyan + + $expectedProducts = @( + @{Id = "M-LC-161244"; Name = "mPulse::mPulse"} + ) + + Test-AkamaiProductId -TfVarsPath $tfvarsPath -ExpectedProducts $expectedProducts + } + else { + Write-Host "mPulse not enabled - skipping product validation" -ForegroundColor Yellow + } + } } [hashtable] BuildTerraformVars() { diff --git a/new-property/README.md b/new-property/README.md index 7b66803..799c513 100644 --- a/new-property/README.md +++ b/new-property/README.md @@ -101,9 +101,10 @@ module "example" { # Required variables additional_origins = contract_id = default_origin = @@ -123,10 +124,11 @@ module "example" { certificate_id = | default: null cpcode_name = | default: null customer_email = | default: null - dummy_test = | default: "dummy_test" + default_cpcode = | default: false edgerc_path = | default: "~/.edgerc" ehn_domain = | default: null enable_mPulse = | default: true + forward_host_header = | default: "REQUEST_HOST_HEADER" ip_behavior = | default: "IPV6_COMPLIANCE" noncompliance_reason = | default: [] other_noncompliance_reason = | default: null @@ -146,7 +148,7 @@ module "example" { | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.9.0 | -| [akamai](#requirement\_akamai) | ~> 9.0 | +| [akamai](#requirement\_akamai) | ~> 10.2 | ## Resources @@ -156,13 +158,13 @@ No resources. | Name | Source | Version | |------|--------|---------| -| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | v1.1.2 | +| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | fix/DOHRMY-148-delivery | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [additional\_origins](#input\_additional\_origins) | Additional origins for the property. For now the match is only by hostname. | 
map(object({
    origin_name    = string
    hostname_match = list(string)
    path_match     = list(string)
  }))
| n/a | yes | +| [additional\_origins](#input\_additional\_origins) | Additional origins for the property. For now the match is only by hostname. The field forward\_host\_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN\_HOSTNAME or REQUEST\_HOST\_HEADER. But the user can also select any host header they would like to use as a custom value. | 
map(object({
    origin_name         = string
    forward_host_header = string
    hostname_match      = list(string)
    path_match          = list(string)
  }))
| n/a | yes | | [contract\_id](#input\_contract\_id) | Contract ID for property/config creation | `string` | n/a | yes | | [default\_origin](#input\_default\_origin) | Default origin server for all properties | `string` | n/a | yes | | [edgerc\_section](#input\_edgerc\_section) | Section in the .edgerc file.

For professional services, it is recommended to create a new section for
each account managed. | `string` | n/a | yes | @@ -179,11 +181,12 @@ No resources. | [certificate\_id](#input\_certificate\_id) | Certificate enrollment id. Only applicable if enhanced\_tls is true, and secure\_by\_default
is false.

Can be retrieved using AkamaiPowershell or the Akamai CPS CLI. | `number` | `null` | no | | [cpcode\_name](#input\_cpcode\_name) | Default CP Code name. Will be the property name (var.name) if null. | `string` | `null` | no | | [customer\_email](#input\_customer\_email) | Email address of the customer that acknowledged, tested and accepted the change | `string` | `null` | no | -| [dummy\_test](#input\_dummy\_test) | n/a | `string` | `"dummy_test"` | no | +| [default\_cpcode](#input\_default\_cpcode) | Boolean to enable the default CP Code for all properties. If false, the CP Code must be specified in the property definition. | `bool` | `false` | no | | [edgerc\_path](#input\_edgerc\_path) | Path to the .edgerc file. | `string` | `"~/.edgerc"` | no | | [ehn\_domain](#input\_ehn\_domain) | EdgeHostname domain, e.g. edgesuite.net or edgekey.net. Will default to one or
the other, based on the value of etls variable. | `string` | `null` | no | -| [enable\_mPulse](#input\_enable\_mPulse) | Boolean tod ecide whether to inject the mpulse behavior | `bool` | `true` | no | -| [ip\_behavior](#input\_ip\_behavior) | EdgeHostname IP behaviour. | `string` | `"IPV6_COMPLIANCE"` | no | +| [enable\_mPulse](#input\_enable\_mPulse) | Boolean to decide whether to inject the mpulse behavior | `bool` | `true` | no | +| [forward\_host\_header](#input\_forward\_host\_header) | Host header to be forwarded to the origin server. Possible fixed values are ORIGIN\_HOSTNAME or REQUEST\_HOST\_HEADER. But the user can also select any host header they would like to use as a custom value. | `string` | `"REQUEST_HOST_HEADER"` | no | +| [ip\_behavior](#input\_ip\_behavior) | EdgeHostname IP behaviour.Possible values are IPV4 or IPV6\_COMPLIANCE. | `string` | `"IPV6_COMPLIANCE"` | no | | [noncompliance\_reason](#input\_noncompliance\_reason) | Allowed values for noncompliance\_reason are "NO\_PRODUCTION\_TRAFFIC", "EMERGENCY", "NONE". (OR null for the customer, as None will require the complaince block) | `list(string)` | `[]` | no | | [other\_noncompliance\_reason](#input\_other\_noncompliance\_reason) | Describes the reason why the activation must occur immediately, out of compliance with the standard procedure | `string` | `null` | no | | [peer\_reviewed\_by](#input\_peer\_reviewed\_by) | Email address of the peer who performed the review | `string` | `null` | no | diff --git a/new-property/environments/dev/dev.tfvars.dist b/new-property/environments/dev/dev.tfvars.dist index 3074e7d..894d8b8 100644 --- a/new-property/environments/dev/dev.tfvars.dist +++ b/new-property/environments/dev/dev.tfvars.dist @@ -19,16 +19,21 @@ name = "" hostnames = ["dev.example.com", "dev-api.example.com"] etls = true default_origin = "dev-origin.example.com" +forward_host_header = "REQUEST_HOST_HEADER" + # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. +The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { - origin_name = "dev-api-origin.example.com" - hostname_match = ["dev-api.example.com"] + origin_name = "api-origin.example.com" + hostname_match = ["api.example.com"] + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/api/*"] }, "images_origin" = { - origin_name = "dev-images-origin.example.com" + origin_name = "images-origin.example.com" hostname_match = null + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/images/*"] } } @@ -36,6 +41,9 @@ sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +# Enable only if product is Fresca or SPM +enable_mpulse = false + ## ---------------------------------------------------------------------------- ## Activation ## ---------------------------------------------------------------------------- diff --git a/new-property/environments/prod/prod.tfvars.dist b/new-property/environments/prod/prod.tfvars.dist index 45b138d..b03daac 100644 --- a/new-property/environments/prod/prod.tfvars.dist +++ b/new-property/environments/prod/prod.tfvars.dist @@ -19,16 +19,21 @@ name = "" hostnames = ["www.example.com", "api.example.com"] etls = true default_origin = "origin.example.com" +forward_host_header = "REQUEST_HOST_HEADER" + # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. +The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { origin_name = "api-origin.example.com" hostname_match = ["api.example.com"] + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/api/*"] }, "images_origin" = { origin_name = "images-origin.example.com" hostname_match = null + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/images/*"] } } @@ -36,6 +41,9 @@ sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +# Enable only if product is Fresca or SPM +enable_mpulse = false + ## ---------------------------------------------------------------------------- ## Activation ## ---------------------------------------------------------------------------- diff --git a/new-property/environments/qa/qa.tfvars.dist b/new-property/environments/qa/qa.tfvars.dist index 605a752..b249ca7 100644 --- a/new-property/environments/qa/qa.tfvars.dist +++ b/new-property/environments/qa/qa.tfvars.dist @@ -19,16 +19,21 @@ name = "" hostnames = ["qa.example.com", "qa-api.example.com"] etls = true default_origin = "qa-origin.example.com" +forward_host_header = "REQUEST_HOST_HEADER" + # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. +The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { - origin_name = "qa-api-origin.example.com" - hostname_match = ["qa-api.example.com"] + origin_name = "api-origin.example.com" + hostname_match = ["api.example.com"] + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/api/*"] }, "images_origin" = { - origin_name = "qa-images-origin.example.com" + origin_name = "images-origin.example.com" hostname_match = null + forward_host_header = "REQUEST_HOST_HEADER" path_match = ["/images/*"] } } @@ -36,6 +41,9 @@ sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +# Enable only if product is Fresca or SPM +enable_mpulse = false + ## ---------------------------------------------------------------------------- ## Activation ## ---------------------------------------------------------------------------- diff --git a/new-property/main.tf b/new-property/main.tf index 3f08d57..da0931e 100644 --- a/new-property/main.tf +++ b/new-property/main.tf @@ -93,7 +93,7 @@ module "property" { - source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=v1.1.2" + source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=fix/DOHRMY-148-delivery" contract_id = var.contract_id group_id = var.group_id @@ -101,10 +101,11 @@ module "property" { product_id = var.product_id name = var.name - version_notes = "${var.version_notes}${var.dummy_test}" + version_notes = var.version_notes hostnames = var.hostnames etls = var.etls default_origin = var.default_origin + forward_host_header = var.forward_host_header additional_origins = var.additional_origins sure_route_test_object = var.sure_route_test_object td_region = var.td_region @@ -123,7 +124,8 @@ module "property" { activation_to_staging_exists = var.activation_to_staging_exists activation_to_production_exists = var.activation_to_production_exists - cpcode_name = var.cpcode_name + default_cpcode = var.default_cpcode + cpcode_name = var.cpcode_name secure_by_default = var.secure_by_default certificate_id = var.certificate_id @@ -134,4 +136,35 @@ module "property" { providers = { akamai = akamai } +} + +check "production_activation_compliance" { + assert { + condition = ( + !var.activate_to_production || + ( + length(var.noncompliance_reason) == 1 && + ( + contains(var.noncompliance_reason, "EMERGENCY") || + contains(var.noncompliance_reason, "OTHER") || + contains(var.noncompliance_reason, "NO_PRODUCTION_TRAFFIC") || + contains(var.noncompliance_reason, "NONE") + ) && + var.ticket_id != null && + ( + !contains(var.noncompliance_reason, "OTHER") || + var.other_noncompliance_reason != null + ) && + ( + !contains(var.noncompliance_reason, "NONE") || + ( + var.peer_reviewed_by != null && + var.customer_email != null && + var.unit_tested != null + ) + ) + ) + ) + error_message = "When activate_to_production is true, set exactly one noncompliance_reason from EMERGENCY, OTHER, NO_PRODUCTION_TRAFFIC, NONE and provide required compliance fields (ticket_id, and additional fields for OTHER or NONE)." + } } \ No newline at end of file diff --git a/new-property/variables.tf b/new-property/variables.tf index a4a33d2..df850ef 100644 --- a/new-property/variables.tf +++ b/new-property/variables.tf @@ -77,12 +77,19 @@ variable "default_origin" { type = string } +variable "forward_host_header" { + description = "Host header to be forwarded to the origin server. Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." + type = string + default = "REQUEST_HOST_HEADER" +} + variable "additional_origins" { - description = "Additional origins for the property. For now the match is only by hostname." + description = "Additional origins for the property. For now the match is only by hostname. The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." type = map(object({ - origin_name = string - hostname_match = list(string) - path_match = list(string) + origin_name = string + forward_host_header = string + hostname_match = list(string) + path_match = list(string) })) } @@ -102,7 +109,7 @@ variable "td_region" { } variable "enable_mPulse" { - description = "Boolean tod ecide whether to inject the mpulse behavior" + description = "Boolean to decide whether to inject the mpulse behavior" type = bool default = true } @@ -138,19 +145,14 @@ variable "noncompliance_reason" { default = [] validation { condition = ( + length(var.noncompliance_reason) == 0 || ( - !var.activate_to_production || + length(var.noncompliance_reason) == 1 && ( - ( - length(var.noncompliance_reason) == 1 && - var.activate_to_production - ) && - ( - contains(var.noncompliance_reason, "EMERGENCY") || - contains(var.noncompliance_reason, "OTHER") || - contains(var.noncompliance_reason, "NO_PRODUCTION_TRAFFIC") || - contains(var.noncompliance_reason, "NONE") - ) + contains(var.noncompliance_reason, "EMERGENCY") || + contains(var.noncompliance_reason, "OTHER") || + contains(var.noncompliance_reason, "NO_PRODUCTION_TRAFFIC") || + contains(var.noncompliance_reason, "NONE") ) ) ) @@ -162,16 +164,6 @@ variable "ticket_id" { type = string description = "Identifies the ticket that describes the need for the activation" default = null - validation { - condition = ( - !var.activate_to_production || - ( - var.ticket_id != null && - var.activate_to_production - ) - ) - error_message = " a ticket id should be logged for complaince reasons" - } } # tflint-ignore: terraform_unused_declarations @@ -179,72 +171,24 @@ variable "other_noncompliance_reason" { type = string description = "Describes the reason why the activation must occur immediately, out of compliance with the standard procedure" default = null - validation { - condition = ( - !var.activate_to_production || - !contains(var.noncompliance_reason, "OTHER") || - ( - var.other_noncompliance_reason != null && - var.activate_to_production && - contains(var.noncompliance_reason, "OTHER") - ) - ) - error_message = "The other reason explanantion needs to be logged" - } } variable "peer_reviewed_by" { type = string description = "Email address of the peer who performed the review" default = null - validation { - condition = ( - !var.activate_to_production || - !contains(var.noncompliance_reason, "NONE") || - ( - var.peer_reviewed_by != null && - var.activate_to_production && - contains(var.noncompliance_reason, "NONE") - ) - ) - error_message = "When NONE is choosen as the non compliance reason the peer_reviewed_by field is required" - } } variable "customer_email" { type = string description = "Email address of the customer that acknowledged, tested and accepted the change" default = null - validation { - condition = ( - !var.activate_to_production || - !contains(var.noncompliance_reason, "NONE") || - ( - var.customer_email != null && - var.activate_to_production && - contains(var.noncompliance_reason, "NONE") - ) - ) - error_message = "When NONE is choosen as the non compliance reason the customer_email field is required" - } } variable "unit_tested" { type = bool description = "Whether the metadata to activate has been fully tested" default = null - validation { - condition = ( - !var.activate_to_production || - !contains(var.noncompliance_reason, "NONE") || - ( - var.unit_tested != null && - var.activate_to_production && - contains(var.noncompliance_reason, "NONE") - ) - ) - error_message = "When NONE is choosen as the non compliance reason the unit_tested field is required" - } } variable "activation_notes" { @@ -270,6 +214,11 @@ variable "activation_to_production_exists" { ## ---------------------------------------------------------------------------- ## CP Code ## ---------------------------------------------------------------------------- +variable "default_cpcode" { + description = "Boolean to enable the default CP Code for all properties. If false, the CP Code must be specified in the property definition." + type = bool + default = false +} variable "cpcode_name" { description = "Default CP Code name. Will be the property name (var.name) if null." @@ -321,18 +270,13 @@ variable "ehn_domain" { variable "ip_behavior" { description = <<-EOD - EdgeHostname IP behaviour. + EdgeHostname IP behaviour.Possible values are IPV4 or IPV6_COMPLIANCE. EOD type = string default = "IPV6_COMPLIANCE" validation { - condition = length(regexall("^(IPV4|IPV6_COMPLIANCE|IPV6_PERFORMANCE)$", var.ip_behavior)) > 0 - error_message = "ERROR: Valid types are IPV4, IPV6_COMPLIANCE or IPV6_PERFORMANCE." + condition = length(regexall("^(IPV4|IPV6_COMPLIANCE)$", var.ip_behavior)) > 0 + error_message = "ERROR: Valid types are IPV4 or IPV6_COMPLIANCE." } -} - -variable "dummy_test" { - type = string - default = "dummy_test" } \ No newline at end of file diff --git a/new-property/versions.tf b/new-property/versions.tf index c905f0d..675c9e4 100644 --- a/new-property/versions.tf +++ b/new-property/versions.tf @@ -2,7 +2,7 @@ terraform { required_providers { akamai = { source = "akamai/akamai" - version = "~> 9.0" + version = "~> 10.2" } } required_version = ">= 1.9.0" From 64da1013c746927d0a02c553fe7b712f12ff992a Mon Sep 17 00:00:00 2001 From: Rafael Lopez Date: Wed, 17 Jun 2026 13:09:21 -0600 Subject: [PATCH 2/3] fix: several changes as follows - adjust deploy script and update provider/variable configurations - Run drift only when state file existed before initializing terraform - Move check blocks to variables file - Set akamai provider version to "10.1" - Add default_cpcode to tfvar sample files --- lib/core/TerraformRunner.psm1 | 9 +++- new-property/README.md | 4 +- new-property/environments/dev/dev.tfvars.dist | 3 +- .../environments/prod/prod.tfvars.dist | 3 +- new-property/environments/qa/qa.tfvars.dist | 3 +- new-property/main.tf | 34 +------------ new-property/variables.tf | 50 +++++++++++++++++++ new-property/versions.tf | 2 +- 8 files changed, 67 insertions(+), 41 deletions(-) diff --git a/lib/core/TerraformRunner.psm1 b/lib/core/TerraformRunner.psm1 index b31d8ba..630ebd3 100644 --- a/lib/core/TerraformRunner.psm1 +++ b/lib/core/TerraformRunner.psm1 @@ -34,6 +34,8 @@ function Initialize-TerraformBackend { # Create backend config file $backendConfig = "path=`"./$ConfigPath/$StateFileName`"" $backendConfigPath = "./$TemplateFolder/$ConfigPath/config.backend" + $stateFilePath = "./$TemplateFolder/$ConfigPath/$StateFileName" + $stateFileExistedBeforeInit = Test-Path $stateFilePath $backendConfig | Out-File -FilePath $backendConfigPath -Force @@ -47,8 +49,8 @@ function Initialize-TerraformBackend { throw "Terraform initialization failed" } - # Drift detection — only when a varfile is supplied and -Force is not set - if ($VarFilePath -and -not $Force) { + # Drift detection only makes sense when a state file existed before init, varfile is supplied and -Force is not set + if ($VarFilePath -and -not $Force -and $stateFileExistedBeforeInit) { $driftResult = Invoke-TerraformDriftCheck -TemplateFolder $TemplateFolder -VarFilePath $VarFilePath -Variables $Variables if ($driftResult.HasDrift) { Write-Host "" @@ -67,6 +69,9 @@ function Initialize-TerraformBackend { Write-Host "No drift detected." -ForegroundColor Green } } + elseif ($VarFilePath -and -not $Force) { + Write-Host "Skipping drift detection because no Terraform state file existed before initialization." -ForegroundColor DarkGray + } } function Invoke-TerraformPlan { diff --git a/new-property/README.md b/new-property/README.md index 799c513..17dffab 100644 --- a/new-property/README.md +++ b/new-property/README.md @@ -148,7 +148,7 @@ module "example" { | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.9.0 | -| [akamai](#requirement\_akamai) | ~> 10.2 | +| [akamai](#requirement\_akamai) | ~> 10.1 | ## Resources @@ -158,7 +158,7 @@ No resources. | Name | Source | Version | |------|--------|---------| -| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | fix/DOHRMY-148-delivery | +| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | integration | ## Inputs diff --git a/new-property/environments/dev/dev.tfvars.dist b/new-property/environments/dev/dev.tfvars.dist index 894d8b8..83048d2 100644 --- a/new-property/environments/dev/dev.tfvars.dist +++ b/new-property/environments/dev/dev.tfvars.dist @@ -22,7 +22,7 @@ default_origin = "dev-origin.example.com" forward_host_header = "REQUEST_HOST_HEADER" # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. -The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." +# The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { origin_name = "api-origin.example.com" @@ -40,6 +40,7 @@ additional_origins = { sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +default_cpcode = false # Enable only if product is Fresca or SPM enable_mpulse = false diff --git a/new-property/environments/prod/prod.tfvars.dist b/new-property/environments/prod/prod.tfvars.dist index b03daac..0f32f41 100644 --- a/new-property/environments/prod/prod.tfvars.dist +++ b/new-property/environments/prod/prod.tfvars.dist @@ -22,7 +22,7 @@ default_origin = "origin.example.com" forward_host_header = "REQUEST_HOST_HEADER" # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. -The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." +# The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { origin_name = "api-origin.example.com" @@ -40,6 +40,7 @@ additional_origins = { sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +default_cpcode = false # Enable only if product is Fresca or SPM enable_mpulse = false diff --git a/new-property/environments/qa/qa.tfvars.dist b/new-property/environments/qa/qa.tfvars.dist index b249ca7..aaff0c8 100644 --- a/new-property/environments/qa/qa.tfvars.dist +++ b/new-property/environments/qa/qa.tfvars.dist @@ -22,7 +22,7 @@ default_origin = "qa-origin.example.com" forward_host_header = "REQUEST_HOST_HEADER" # Set additional_origins=null if no additional origins are needed. In a similar fashion, set path_match or hostname_match to null if not needed. -The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." +# The field forward_host_header allows specifying a custom host header for each additional origin.Possible fixed values are ORIGIN_HOSTNAME or REQUEST_HOST_HEADER. But the user can also select any host header they would like to use as a custom value." additional_origins = { "api_origin" = { origin_name = "api-origin.example.com" @@ -40,6 +40,7 @@ additional_origins = { sure_route_test_object = "/terraform/srto.html" td_region = "CH2" cpcode_name = "cpcode_name" +default_cpcode = false # Enable only if product is Fresca or SPM enable_mpulse = false diff --git a/new-property/main.tf b/new-property/main.tf index da0931e..198b2d0 100644 --- a/new-property/main.tf +++ b/new-property/main.tf @@ -93,8 +93,7 @@ module "property" { - source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=fix/DOHRMY-148-delivery" - + source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=integration" contract_id = var.contract_id group_id = var.group_id @@ -136,35 +135,4 @@ module "property" { providers = { akamai = akamai } -} - -check "production_activation_compliance" { - assert { - condition = ( - !var.activate_to_production || - ( - length(var.noncompliance_reason) == 1 && - ( - contains(var.noncompliance_reason, "EMERGENCY") || - contains(var.noncompliance_reason, "OTHER") || - contains(var.noncompliance_reason, "NO_PRODUCTION_TRAFFIC") || - contains(var.noncompliance_reason, "NONE") - ) && - var.ticket_id != null && - ( - !contains(var.noncompliance_reason, "OTHER") || - var.other_noncompliance_reason != null - ) && - ( - !contains(var.noncompliance_reason, "NONE") || - ( - var.peer_reviewed_by != null && - var.customer_email != null && - var.unit_tested != null - ) - ) - ) - ) - error_message = "When activate_to_production is true, set exactly one noncompliance_reason from EMERGENCY, OTHER, NO_PRODUCTION_TRAFFIC, NONE and provide required compliance fields (ticket_id, and additional fields for OTHER or NONE)." - } } \ No newline at end of file diff --git a/new-property/variables.tf b/new-property/variables.tf index df850ef..d550c82 100644 --- a/new-property/variables.tf +++ b/new-property/variables.tf @@ -139,6 +139,56 @@ variable "activate_to_production" { default = false } +check "production_activation_noncompliance_reason" { + assert { + condition = ( + !var.activate_to_production || length( + setsubtract( + toset(var.noncompliance_reason), + toset(["EMERGENCY", "OTHER", "NO_PRODUCTION_TRAFFIC", "NONE"]) + ) + ) == 0) + error_message = "When activate_to_production is true, noncompliance_reason should be a list of any of the above EMERGENCY, OTHER, NO_PRODUCTION_TRAFFIC, or NONE." + } +} + +check "production_activation_ticket_id" { + assert { + condition = ( + !var.activate_to_production || + contains(var.noncompliance_reason, "NO_PRODUCTION_TRAFFIC") || + var.ticket_id != null + ) + error_message = "When activate_to_production is true, ticket_id is required." + } +} + +check "production_activation_other_reason" { + assert { + condition = ( + !var.activate_to_production || + !contains(var.noncompliance_reason, "OTHER") || + var.other_noncompliance_reason != null + ) + error_message = "When noncompliance_reason is OTHER, other_noncompliance_reason is required." + } +} + +check "production_activation_none_compliance" { + assert { + condition = ( + !var.activate_to_production || + !contains(var.noncompliance_reason, "NONE") || + ( + var.peer_reviewed_by != null && + var.customer_email != null && + var.unit_tested != null + ) + ) + error_message = "When noncompliance_reason is NONE, peer_reviewed_by, customer_email, and unit_tested are required." + } +} + variable "noncompliance_reason" { type = list(string) description = "Allowed values for noncompliance_reason are \"NO_PRODUCTION_TRAFFIC\", \"EMERGENCY\", \"NONE\". (OR null for the customer, as None will require the complaince block)" diff --git a/new-property/versions.tf b/new-property/versions.tf index 675c9e4..326740b 100644 --- a/new-property/versions.tf +++ b/new-property/versions.tf @@ -2,7 +2,7 @@ terraform { required_providers { akamai = { source = "akamai/akamai" - version = "~> 10.2" + version = "~> 10.1" } } required_version = ">= 1.9.0" From c443275f5f5d1afda6822069e9afa4c234cf08cd Mon Sep 17 00:00:00 2001 From: Rafael Lopez Date: Wed, 1 Jul 2026 11:20:41 -0600 Subject: [PATCH 3/3] fix: change module source ref to pass test --- new-property/README.md | 2 +- new-property/main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/new-property/README.md b/new-property/README.md index 6db6507..426abb4 100644 --- a/new-property/README.md +++ b/new-property/README.md @@ -158,7 +158,7 @@ No resources. | Name | Source | Version | |------|--------|---------| -| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | v1.3.3 | +| [property](#module\_property) | git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery | integration | ## Inputs diff --git a/new-property/main.tf b/new-property/main.tf index 016c8c2..8c4b385 100644 --- a/new-property/main.tf +++ b/new-property/main.tf @@ -93,7 +93,7 @@ module "property" { - source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=v1.3.3" + source = "git::ssh://git@github.com/akamai/terraform-templates-modules.git//delivery?ref=integration" contract_id = var.contract_id group_id = var.group_id