chore: add pulumi examples

.gitignore

@@ -71,3 +71,35 @@ terraform.rc
 
 # Go workspace file
 go.work
+
+# Byte-compiled / cache
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# Distribution / packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+pulumi/sdks
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+
+# IDEs
+.vscode/
+.idea/
+
+# Jupyter
+.ipynb_checkpoints/
+
+# Type checking
+.mypy_cache/

README.md

@@ -1,9 +1,11 @@
 # Sample Infrastructure as code (IaC) solutions
+
 A collection of sample Infrastructure as code (IaC) solutions for deploying infrastructure to IBM Cloud.
 
 <!-- Add a bullet point list below for each of the sample solutions and link them to the corresponding directory -->
 ## Contents
 
+- [Pulumi](pulumi/README.md)
 - [Terragrunt](terragrunt/README.md)
 
 <!-- Leave this section as is so that your module has a link to local development environment set-up steps for contributors to follow -->

pulumi/Pulumi.yaml

@@ -0,0 +1,45 @@
+name: pulumi-demo
+description: Provision Terraform IBM Modules using Pulumi.
+runtime:
+  name: python
+  options:
+    toolchain: pip
+    virtualenv: venv
+config:
+  pulumi:tags:
+    value:
+      pulumi:template: python
+packages:
+  ibm:
+    source: terraform-provider
+    version: 0.12.0
+    parameters:
+      - ibm-cloud/ibm
+  ibm_rg_module:
+    source: terraform-module
+    version: 0.1.8
+    parameters:
+      - terraform-ibm-modules/resource-group/ibm
+      - 1.4.6
+      - ibm_rg_module
+  ibm_cos_module:
+    source: terraform-module
+    version: 0.1.8
+    parameters:
+      - terraform-ibm-modules/cos/ibm
+      - 10.7.2
+      - ibm_cos_module
+  wx_discovery:
+    source: terraform-module
+    version: 0.1.8
+    parameters:
+      - terraform-ibm-modules/watsonx-discovery/ibm
+      - 1.12.0
+      - wx_discovery
+  ibm_kms_module:
+    source: terraform-module
+    version: 0.1.8
+    parameters:
+      - terraform-ibm-modules/kms-all-inclusive/ibm
+      - 5.5.5
+      - ibm_kms_module

pulumi/README.md

@@ -0,0 +1,104 @@
+# Description
+
+This Pulumi example will demonstrate how to provision Resource Group, Key Protect, Object Storage and Watson Discovery instances using Terraform IBM Modules.
+
+## Prerequisites
+
+Before you begin, ensure you have:
+
+a) [Pulumi CLI](https://www.pulumi.com/docs/get-started/download-install/) installed
+
+b) [IBM Cloud CLI](https://cloud.ibm.com/docs/cli) installed and configured (optional)
+
+c) An [IBM Cloud API key](https://cloud.ibm.com/docs/account?topic=account-userapikey)
+
+d) [Git](https://git-scm.com/install/) installed
+
+## Steps
+
+**1. Clone the repository**
+
+```sh
+git clone https://github.com/terraform-ibm-modules/sample-iac-solutions.git
+cd sample-iac-solutions/pulumi-egs/pulumi
+```
+
+**2. Log in to Pulumi (either you can create an account in Pulumi or use local-only mode).**
+
+```sh
+pulumi login --local
+```
+
+**3. Create new Pulumi Stack**
+
+Provide the Stack details and Passphrase to be used
+
+```sh
+pulumi stack init dev # dev is name of the new stack that will be created.
+```
+
+![initialize-stack](./images/initialize-stack.png)
+
+**4. Install dependencies**
+
+Add pulumi IBM provider package and Terraform modules to the project :
+
+```sh
+pulumi package add terraform-provider ibm-cloud/ibm
+pulumi package add terraform-module terraform-ibm-modules/cos/ibm 10.7.2 ibm_cos_module
+pulumi package add terraform-module terraform-ibm-modules/kms-all-inclusive/ibm 5.5.5 ibm_kms_module
+pulumi package add terraform-module terraform-ibm-modules/resource-group/ibm 1.4.6 ibm_rg_module
+pulumi package add terraform-module terraform-ibm-modules/watsonx-discovery/ibm 1.11.1 wx_discovery
+```
+
+![Add Packages](./images/add_packages.png)
+
+**5. Configure IBM Cloud credentials**
+
+Export your API key:
+
+```sh
+export IBMCLOUD_API_KEY=<your_ibmcloud_api_key> # pragma: allowlist secret
+```
+
+**6. Set Pulumi stack config**
+
+If required to change the default values, update the configuration file for region, prefix and access group:
+
+```sh
+pulumi config set region us-south # Provide region
+pulumi config set prefix pulumi-demo # Provide the prefix
+pulumi config set access_group "Public Access" # Replace with Access group of your choice. Make sure the provided Access Group exists in IBMCloud account.
+```
+
+![Add configuration](./images/config.png)
+
+**7. Preview the changes**
+
+```sh
+pulumi preview
+```
+
+![pulumi preview](./images/preview.png)
+
+**8. Apply the changes**
+
+```sh
+pulumi up
+```
+
+**9. Destroy the resources**
+
+```sh
+pulumi down
+```
+
+## Validation
+
+After deployment, verify that resources were provisioned successfully:
+
+- Pulumi Console Output – Confirm resource creation summary.
+- Login to IBM Cloud Console and verify –
+  - COS instance and bucket under Object Storage
+  - Watson Discovery instance in the dashboard
+  - Resource Group and Key Protect instance under Resource List

pulumi/__main__.py

@@ -0,0 +1,57 @@
+# ----------------------------------------------------------------------------------------------------
+# Pulumi Program: Provision IBM Cloud Object Storage (COS) instance & buckets
+#                 and Watson Discovery instance using terraform-ibm-modules.
+#
+# Required Pulumi packages:
+#   - IBM provider package
+#       pulumi package add terraform-provider ibm-cloud/ibm
+# ----------------------------------------------------------------------------------------------------
+
+
+from constants import COS_ENDPOINT
+from terraform_ibm_modules.object_storage import (
+    configure_bucket_website,
+    configure_public_access,
+    create_cos_instance,
+    upload_static_files,
+)
+from terraform_ibm_modules.resource_group import create_resource_group
+from terraform_ibm_modules.watson_discovery import create_watson_discovery
+
+import pulumi
+
+
+def main():
+    """Main method to provision resources."""
+
+    # Resource Group
+    rg = create_resource_group()
+
+    # Cloud Object Storage
+    cos = create_cos_instance(rg)
+    configure_public_access(cos)
+    upload_static_files(cos)
+    configure_bucket_website(cos)
+
+    # Uncomment below to use Key Protect and COS with Key protect enabled
+    # kms_instance = create_kms_instance(rg)
+    # cos = create_cos_instance(rg, kms_instance)
+
+    # Watson Discovery
+    watson_discovery = create_watson_discovery(rg)
+
+    # Export outputs
+    pulumi.export("resource_group_name", rg.resource_group_name)
+    # pulumi.export("kms_instance_crn", kms_instance.key_protect_crn) # Uncomment if provisioning Key Protect.
+    pulumi.export("bucket_name", cos.bucket_name)
+    pulumi.export("cos_instance_name", cos.cos_instance_name)
+    pulumi.export(
+        "website_endpoint",
+        cos.bucket_crn.apply(lambda crn: f"https://{cos.bucket_name}.{COS_ENDPOINT}"),
+    )
+    pulumi.export("watson_discovery_id", watson_discovery.id)
+    pulumi.export("watson_discovery_dashboard", watson_discovery.dashboard_url)
+
+
+if __name__ == "__main__":
+    main()

pulumi/config.py

@@ -0,0 +1,22 @@
+from constants import KMS_KEY_NAME, KMS_KEY_RING_NAME
+
+import pulumi
+
+config = pulumi.Config()
+REGION = config.get("region") or "us-south"
+PREFIX = config.get("prefix") or "pul-eg"
+ACCESS_GROUP = config.get("access_group") or "Public Access"
+
+KMS_KEY_CONFIGURATION = {
+    "key_name": KMS_KEY_NAME,
+    "standard_key": True,
+    "rotation_interval_month": 4,
+    "dual_auth_delete_enabled": True,
+    "force_delete": True,
+}
+
+KMS_KEYS = {
+    "key_ring_name": KMS_KEY_RING_NAME,
+    "existing_key_ring": False,
+    "keys": [KMS_KEY_CONFIGURATION],
+}

pulumi/constants.py

@@ -0,0 +1,21 @@
+EXISTING_RESOURCE_GROUP = (
+    "Default"  # Change to None if want to create a new Resource Group.
+)
+NEW_RG_NAME = "new-rg"  # If want to create a new Resource Group EXISTING_RESOURCE_GROUP should be changed to None
+
+# KMS Configuration
+KP_NAME = "key-protect"
+KMS_KEY_NAME = "pulumi-key-for-cos"
+KMS_KEY_RING_NAME = "pulumi-key-ring"
+
+COS_SERVICE_NAME = "cloud-object-storage"
+COS_INSTANCE_NAME = "pulumi-cos"
+
+BUCKET_STORAGE_CLASS = "standard"
+BUCKET_NAME = "pulumi-bucket"
+BUCKET_TYPE = "bucket"
+COS_ENDPOINT = "s3.us-south.cloud-object-storage.appdomain.cloud"
+
+STATIC_DIR_NAME = "static"
+
+WATSON_DISCOVERY_NAME = "watson-discovery"

pulumi/requirements.txt

@@ -0,0 +1 @@
+pulumi>=3.0.0,<4.0.0

pulumi/terraform_ibm_modules/key_protect.py

@@ -0,0 +1,20 @@
+# ----------------------------------------------------------------------------------------------------
+# Required Pulumi packages:
+#   - IBM Cloud KMS All Inclusive module:
+#       pulumi package add terraform-module terraform-ibm-modules/kms-all-inclusive/ibm 5.5.5 ibm_kms_module
+# ----------------------------------------------------------------------------------------------------
+
+import pulumi_ibm_kms_module as ibm_kms_module
+from config import KMS_KEYS, PREFIX, REGION
+from constants import KP_NAME
+
+
+def create_kms_instance(rg):
+    """Create Key Protect Instance which can be used for Encrypting COS buckets."""
+    return ibm_kms_module.Module(
+        "pulumi-key-protect",
+        resource_group_id=rg.resource_group_id,
+        key_protect_instance_name=f"{PREFIX}-{KP_NAME}",
+        region=REGION,
+        keys=[KMS_KEYS],
+    )