Update provider and tests for combined user/groups into principals in role (#15)
This commit is contained in:
Jeff Mitchell authored and 
GitHub committed
1 parent
33675ab5c7
commit
43d23f179e
5 files changed
+41
-62
No files matched your search
@@ -16,7 +16,7 @@ require (
|
||||
github.com/hashicorp/terraform-plugin-sdk v1.15.0
|
||||
github.com/hashicorp/terraform-svchost v0.0.0-20191119180714-d2e4933b9136 // indirect
|
||||
github.com/hashicorp/vault-plugin-secrets-ad v0.6.5 // indirect
|
||||
github.com/hashicorp/watchtower v0.0.0-20200712212453-26d36ec7460c
|
||||
github.com/hashicorp/watchtower v0.0.0-20200713025149-b46cdad3c52e
|
||||
github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce // indirect
|
||||
github.com/mattn/go-colorable v0.1.7 // indirect
|
||||
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
||||
|
||||
@@ -132,8 +132,11 @@ github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7l
|
||||
github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
|
||||
github.com/agl/ed25519 v0.0.0-20170116200512-5312a6153412/go.mod h1:WPjqKcmVOxf0XSf3YxCJs6N6AOSrOx3obionmG7T0y0=
|
||||
github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
|
||||
github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm+0dGI2AIUHY+w0BUc+4tn40djz7+6U=
|
||||
github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
|
||||
github.com/alecthomas/colour v0.1.0 h1:nOE9rJm6dsZ66RGWYSFrXw461ZIt9A6+nHgL7FRrDUk=
|
||||
github.com/alecthomas/colour v0.1.0/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0=
|
||||
github.com/alecthomas/repr v0.0.0-20200325044227-4184120f674c h1:MVVbswUlqicyj8P/JljoocA7AyCo62gzD0O7jfvrhtE=
|
||||
github.com/alecthomas/repr v0.0.0-20200325044227-4184120f674c/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
|
||||
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
|
||||
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
|
||||
@@ -263,6 +266,7 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsr
|
||||
github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
|
||||
github.com/danieljoos/wincred v1.0.2 h1:zf4bhty2iLuwgjgpraD2E9UbvO+fe54XXGJbOwe23fU=
|
||||
github.com/danieljoos/wincred v1.0.2/go.mod h1:SnuYRW9lp1oJrZX/dXJqr0cPK5gYXqx3EJbmjhLdK9U=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
@@ -442,6 +446,7 @@ github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/V
|
||||
github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
|
||||
github.com/gocql/gocql v0.0.0-20190301043612-f6df8288f9b4/go.mod h1:4Fw1eo5iaEhDUs8XyuhSVCVy52Jq3L+/3GJgYkwc+/0=
|
||||
github.com/gocql/gocql v0.0.0-20190402132108-0e1d5de854df/go.mod h1:4Fw1eo5iaEhDUs8XyuhSVCVy52Jq3L+/3GJgYkwc+/0=
|
||||
github.com/godbus/dbus v4.1.0+incompatible h1:WqqLRTsQic3apZUK9qC5sGNfXthmPXzUZ7nQPrNITa4=
|
||||
github.com/godbus/dbus v4.1.0+incompatible/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
|
||||
github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
|
||||
github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
|
||||
@@ -771,6 +776,8 @@ github.com/hashicorp/watchtower v0.0.0-20200712191642-8210960f2118 h1:L0Ahw70N3i
|
||||
github.com/hashicorp/watchtower v0.0.0-20200712191642-8210960f2118/go.mod h1:QqWMjDaiUBRW9AafTTqb1HFXZEK4wCqOkeYMvlx1CaM=
|
||||
github.com/hashicorp/watchtower v0.0.0-20200712212453-26d36ec7460c h1:ZlGmrFEcPWruehrI5Hl1IyTCv3jnvkxgbGtKrF4IAk0=
|
||||
github.com/hashicorp/watchtower v0.0.0-20200712212453-26d36ec7460c/go.mod h1:QqWMjDaiUBRW9AafTTqb1HFXZEK4wCqOkeYMvlx1CaM=
|
||||
github.com/hashicorp/watchtower v0.0.0-20200713025149-b46cdad3c52e h1:3SXFlSQm7d2EuL0tBCbnRoelKZN7cT3+BZJdwIJzIC8=
|
||||
github.com/hashicorp/watchtower v0.0.0-20200713025149-b46cdad3c52e/go.mod h1:i9wJ1Q4eQ0ES4NWpc57eDfZBpKLlji2m1x4pJJtNb44=
|
||||
github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
|
||||
github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d h1:kJCB4vdITiW1eC1vq2e6IsrXKrZit1bv/TDYFGMp4BQ=
|
||||
github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
|
||||
@@ -853,6 +860,7 @@ github.com/jefferai/jsonx v1.0.0/go.mod h1:OGmqmi2tTeI/PS+qQfBDToLHHJIy/RMp24fPo
|
||||
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
|
||||
github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
|
||||
github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
|
||||
github.com/jhump/protoreflect v1.6.2-0.20200602154950-9a9113f80b57 h1:DDbkVWVTpzxHbD80e2zpbczB+gkTWI1w2gSeL+viRhc=
|
||||
github.com/jhump/protoreflect v1.6.2-0.20200602154950-9a9113f80b57/go.mod h1:RZkzh7Hi9J7qT/sPlWnJ/UwZqCJvciFxKDA0UCeltSM=
|
||||
github.com/jinzhu/gorm v1.9.12 h1:Drgk1clyWT9t9ERbzHza6Mj/8FY/CqMyVzOiHviMo6Q=
|
||||
github.com/jinzhu/gorm v1.9.12/go.mod h1:vhTjlKSJUTWNtcbQtrMBFCxy7eXTzeCAzfL5fBZT/Qs=
|
||||
@@ -900,6 +908,7 @@ github.com/klauspost/pgzip v1.2.4/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQ
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
|
||||
github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
|
||||
github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
|
||||
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
|
||||
|
||||
@@ -11,8 +11,7 @@ import (
|
||||
const (
|
||||
roleNameKey = "name"
|
||||
roleDescriptionKey = "description"
|
||||
roleUsersKey = "users"
|
||||
roleGroupsKey = "groups"
|
||||
rolePrincipalsKey = "principals"
|
||||
roleGrantsKey = "grants"
|
||||
)
|
||||
|
||||
@@ -31,12 +30,7 @@ func resourceRole() *schema.Resource {
|
||||
Type: schema.TypeString,
|
||||
Optional: true,
|
||||
},
|
||||
roleUsersKey: {
|
||||
Type: schema.TypeSet,
|
||||
Optional: true,
|
||||
Elem: &schema.Schema{Type: schema.TypeString},
|
||||
},
|
||||
roleGroupsKey: {
|
||||
rolePrincipalsKey: {
|
||||
Type: schema.TypeSet,
|
||||
Optional: true,
|
||||
Elem: &schema.Schema{Type: schema.TypeString},
|
||||
@@ -48,7 +42,6 @@ func resourceRole() *schema.Resource {
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// convertRoleToResourceData creates a ResourceData type from a Role
|
||||
@@ -65,14 +58,8 @@ func convertRoleToResourceData(u *roles.Role, d *schema.ResourceData) error {
|
||||
}
|
||||
}
|
||||
|
||||
if u.UserIds != nil {
|
||||
if err := d.Set(roleUsersKey, u.UserIds); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if u.GroupIds != nil {
|
||||
if err := d.Set(roleGroupsKey, u.GroupIds); err != nil {
|
||||
if u.PrincipalIds != nil {
|
||||
if err := d.Set(rolePrincipalsKey, u.PrincipalIds); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
@@ -99,16 +86,10 @@ func convertResourceDataToRole(d *schema.ResourceData) *roles.Role {
|
||||
name := nameVal.(string)
|
||||
u.Name = &name
|
||||
}
|
||||
if val, ok := d.GetOk(roleGroupsKey); ok {
|
||||
groupIds := val.(*schema.Set).List()
|
||||
for _, i := range groupIds {
|
||||
u.GroupIds = append(u.GroupIds, i.(string))
|
||||
}
|
||||
}
|
||||
if val, ok := d.GetOk(roleUsersKey); ok {
|
||||
userIds := val.(*schema.Set).List()
|
||||
for _, i := range userIds {
|
||||
u.UserIds = append(u.UserIds, i.(string))
|
||||
if val, ok := d.GetOk(rolePrincipalsKey); ok {
|
||||
principalIds := val.(*schema.Set).List()
|
||||
for _, i := range principalIds {
|
||||
u.PrincipalIds = append(u.PrincipalIds, i.(string))
|
||||
}
|
||||
}
|
||||
if val, ok := d.GetOk(roleGrantsKey); ok {
|
||||
@@ -135,8 +116,7 @@ func resourceRoleCreate(d *schema.ResourceData, meta interface{}) error {
|
||||
}
|
||||
|
||||
r := convertResourceDataToRole(d)
|
||||
users := r.UserIds
|
||||
groups := r.GroupIds
|
||||
principals := r.PrincipalIds
|
||||
grants := r.Grants
|
||||
|
||||
newRole, apiErr, err := o.CreateRole(ctx, r)
|
||||
@@ -160,13 +140,13 @@ func resourceRoleCreate(d *schema.ResourceData, meta interface{}) error {
|
||||
}
|
||||
}
|
||||
|
||||
if len(users) > 0 || len(groups) > 0 {
|
||||
r, apiErr, err = r.SetPrincipals(ctx, groups, users)
|
||||
if len(principals) > 0 {
|
||||
r, apiErr, err = r.SetPrincipals(ctx, principals)
|
||||
if apiErr != nil {
|
||||
return fmt.Errorf("error setting principle on role: %s\n", apiErr.Message)
|
||||
return fmt.Errorf("error setting principals on role: %s\n", apiErr.Message)
|
||||
}
|
||||
if err != nil {
|
||||
return fmt.Errorf("error setting principle on role: %s\n", err)
|
||||
return fmt.Errorf("error setting principals on role: %s\n", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -218,8 +198,7 @@ func resourceRoleUpdate(d *schema.ResourceData, meta interface{}) error {
|
||||
r.Description = &d
|
||||
}
|
||||
|
||||
r.GroupIds = nil
|
||||
r.UserIds = nil
|
||||
r.PrincipalIds = nil
|
||||
r.Grants = nil
|
||||
|
||||
r, apiErr, err := o.UpdateRole(ctx, r)
|
||||
@@ -242,26 +221,18 @@ func resourceRoleUpdate(d *schema.ResourceData, meta interface{}) error {
|
||||
}
|
||||
}
|
||||
|
||||
userIDs := []string{}
|
||||
if d.HasChange(roleUsersKey) {
|
||||
users := d.Get(roleUsersKey).(*schema.Set).List()
|
||||
for _, user := range users {
|
||||
userIDs = append(userIDs, user.(string))
|
||||
principalIds := []string{}
|
||||
if d.HasChange(rolePrincipalsKey) {
|
||||
principals := d.Get(rolePrincipalsKey).(*schema.Set).List()
|
||||
for _, principal := range principals {
|
||||
principalIds = append(principalIds, principal.(string))
|
||||
}
|
||||
}
|
||||
|
||||
groupIDs := []string{}
|
||||
if d.HasChange(roleGroupsKey) {
|
||||
groups := d.Get(roleGroupsKey).(*schema.Set).List()
|
||||
for _, group := range groups {
|
||||
groupIDs = append(groupIDs, group.(string))
|
||||
}
|
||||
}
|
||||
|
||||
if d.HasChange(roleGroupsKey) || d.HasChange(roleUsersKey) {
|
||||
r, apiErr, err = r.SetPrincipals(ctx, groupIDs, userIDs)
|
||||
if d.HasChange(rolePrincipalsKey) {
|
||||
r, apiErr, err = r.SetPrincipals(ctx, principalIds)
|
||||
if apiErr != nil || err != nil {
|
||||
return fmt.Errorf("error updating principle on role:\n API Err: %+v\n Err: %+v\n", *apiErr, err)
|
||||
return fmt.Errorf("error updating principal on role:\n API Err: %+v\n Err: %+v\n", *apiErr, err)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -349,13 +349,13 @@ func testAccCheckRoleResourceUsersSet(name string, users []string) resource.Test
|
||||
return fmt.Errorf("Got an error when reading role %q: %v", id, err)
|
||||
}
|
||||
|
||||
// for every user set as a principle on the role in the state, ensure
|
||||
// for every user set as a principal on the role in the state, ensure
|
||||
// each role in watchtower has the same setings
|
||||
if len(r.UserIds) == 0 {
|
||||
if len(r.PrincipalIds) == 0 {
|
||||
return fmt.Errorf("no users found in watchtower")
|
||||
}
|
||||
|
||||
for _, stateUser := range r.UserIds {
|
||||
for _, stateUser := range r.PrincipalIds {
|
||||
ok := false
|
||||
for _, gotUser := range userIDs {
|
||||
if gotUser == stateUser {
|
||||
@@ -411,13 +411,13 @@ func testAccCheckRoleResourceGroupsSet(name string, groups []string) resource.Te
|
||||
return fmt.Errorf("Got an error when reading role %q: %v", id, err)
|
||||
}
|
||||
|
||||
// for every user set as a principle on the role in the state, ensure
|
||||
// for every user set as a principal on the role in the state, ensure
|
||||
// each role in watchtower has the same setings
|
||||
if len(r.GroupIds) == 0 {
|
||||
if len(r.PrincipalIds) == 0 {
|
||||
return fmt.Errorf("no groups found in watchtower")
|
||||
}
|
||||
|
||||
for _, stateGroup := range r.GroupIds {
|
||||
for _, stateGroup := range r.PrincipalIds {
|
||||
ok := false
|
||||
for _, gotGroup := range groupIDs {
|
||||
if gotGroup == stateGroup {
|
||||
|
||||
@@ -33,7 +33,7 @@ resource "watchtower_user" "bar" {
|
||||
resource "watchtower_role" "example" {
|
||||
name = "My role"
|
||||
description = "My first role!"
|
||||
users = [watchtower_user.foo.id, watchtower_user.bar.id]
|
||||
principals = [watchtower_user.foo.id, watchtower_user.bar.id]
|
||||
}
|
||||
|
||||
```
|
||||
@@ -49,7 +49,7 @@ resource "watchtower_user" "readonly" {
|
||||
resource "watchtower_role" "readonly" {
|
||||
name = "readonly"
|
||||
description = "A readonly role"
|
||||
users = [watchtower_user.readonly.id]
|
||||
principals = [watchtower_user.readonly.id]
|
||||
grants = ["id=*;action=read"]
|
||||
}
|
||||
```
|
||||
@@ -59,5 +59,4 @@ resource "watchtower_role" "readonly" {
|
||||
The following arguments are optional:
|
||||
* `name` - The role name. Defaults to the resource name.
|
||||
* `description` - The role description.
|
||||
* `users` - A list of user resource ID's to add as principles on the role.
|
||||
* `groups` - A list of group resource ID's to add as principles on the role.
|
||||
* `principals` - A list of principal (user or group) IDs to add as principals on the role.
|
||||
Reference in new issue
Block a user