diff --git a/Makefile b/Makefile index 5e36128f..b364fae4 100644 --- a/Makefile +++ b/Makefile @@ -2,6 +2,8 @@ default: update-deps testacc GOOS=$(shell go env GOOS) GOARCH=$(shell go env GOARCH) INSTALL_PATH=~/.local/share/terraform/plugins/localhost/providers/boundary/0.0.1/linux_$(GOARCH) +BUILD_ALL_PATH=${PWD}/bin + ifeq ($(GOOS), darwin) INSTALL_PATH=~/Library/Application\ Support/io.terraform/plugins/localhost/providers/boundary/0.0.1/darwin_$(GOARCH) endif @@ -27,3 +29,9 @@ update-deps: dev: mkdir -p $(INSTALL_PATH) go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go + +all: + mkdir -p $(BUILD_ALL_PATH) + GOOS=darwin go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_darwin-amd64 main.go + GOOS=windows go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_windows-amd64 main.go + GOOS=linux go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_linux-amd64 main.go diff --git a/README.md b/README.md index d0d4317e..22717fa3 100644 --- a/README.md +++ b/README.md @@ -44,302 +44,6 @@ go mod tidy Then commit the changes to `go.mod` and `go.sum`. - -Using the provider ----------------------- -Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available: - -```hcl -provider "boundary" { - addr = "http://127.0.0.1:9200" - auth_method_id = "ampw_1234567890" # changeme - password_auth_method_login_name = "myuser" # changeme - password_auth_method_password = "passpass" # changeme -} - -variable "backend_team" { - type = set(string) - default = [ - "Jim Lambert", - "Mike Gaffney", - "Todd Knight", - ] -} - -variable "frontend_team" { - type = set(string) - default = [ - "Randall Morey", - "Susmitha Girumala", - ] -} - -variable "leadership_team" { - type = set(string) - default = [ - "Jeff Mitchell", - "Pete Pacent", - "Jonathan Thomas (JT)", - "Jeff Malnick" - ] -} - -variable "web_server_ips" { - type = set(string) - default = [ - "10.0.0.1", - "10.0.0.2", - ] -} - -variable "backend_server_ips" { - type = set(string) - default = [ - "10.1.0.1", - "10.1.0.2", - ] -} - -variable "frontend_server_ips" { - type = set(string) - default = [ - "10.2.0.1", - "10.2.0.2", - ] -} - -resource "boundary_scope" "global" { - global_scope = true - scope_id = "global" -} - -resource "boundary_scope" "corp" { - scope_id = boundary_scope.global.id - auto_create_role = true -} - -resource "boundary_user" "backend" { - for_each = var.backend_team - name = each.key - description = "Backend user: ${each.key}" - scope_id = boundary_scope.corp.id -} - -resource "boundary_user" "frontend" { - for_each = var.frontend_team - name = each.key - description = "Frontend user: ${each.key}" - scope_id = boundary_scope.corp.id -} - -resource "boundary_user" "leadership" { - for_each = var.leadership_team - name = each.key - description = "WARNING: Managers should be read-only" - scope_id = boundary_scope.corp.id -} - -// organiation level group for the leadership team -resource "boundary_group" "leadership" { - name = "leadership_team" - description = "Organization group for leadership team" - member_ids = [for user in boundary_user.leadership : user.id] - scope_id = boundary_scope.corp.id -} - -// add org-level role for readonly access -resource "boundary_role" "organization_readonly" { - name = "readonly" - description = "Read-only role" - principal_ids = [boundary_group.leadership.id] - grant_strings = ["id=*;type=*;actions=read"] - scope_id = boundary_scope.corp.id -} - -// add org-level role for administration access -resource "boundary_role" "organization_admin" { - name = "admin" - description = "Administrator role" - principal_ids = concat( - [for user in boundary_user.backend : user.id], - [for user in boundary_user.frontend : user.id] - ) - grant_strings = ["id=*;type=*;actions=create,read,update,delete"] - scope_id = boundary_scope.corp.id -} - -// create a project for core infrastructure -resource "boundary_scope" "core_infra" { - description = "Core infrastrcture" - scope_id = boundary_scope.corp.id - auto_create_role = true -} - -resource "boundary_group" "backend_core_infra" { - name = "backend" - description = "Backend team group" - member_ids = [for user in boundary_user.backend : user.id] - scope_id = boundary_scope.core_infra.id -} - -resource "boundary_group" "frontend_core_infra" { - name = "frontend" - description = "Frontend team group" - member_ids = [for user in boundary_user.frontend : user.id] - scope_id = boundary_scope.core_infra.id -} - -resource "boundary_host" "backend_servers_service" { - for_each = var.backend_server_ips - type = "static" - name = "backend_server_service_${each.value}" - description = "Backend server host for service port" - address = "${each.key}:9200" - host_catalog_id = boundary_host_catalog.backend_servers.id -} - -resource "boundary_host" "backend_servers_ssh" { - for_each = var.backend_server_ips - type = "static" - name = "backend_server_ssh_${each.value}" - description = "Backend server host for SSH port" - address = "${each.key}:22" - host_catalog_id = boundary_host_catalog.backend_servers.id -} - -resource "boundary_host" "frontend_servers_console" { - for_each = var.frontend_server_ips - type = "static" - name = "frontend_server_console_${each.value}" - description = "Frontend server host for console port" - address = "${each.key}:443" - host_catalog_id = boundary_host_catalog.frontend_servers.id -} - -resource "boundary_host" "frontend_servers_ssh" { - for_each = var.frontend_server_ips - type = "static" - name = "frontend_server_ssh_${each.value}" - description = "Frontend server host for SSH port" - address = "${each.key}:22" - host_catalog_id = boundary_host_catalog.frontend_servers.id -} - -resource "boundary_host_catalog" "web_servers" { - name = "web_servers" - description = "Web servers for frontend team" - type = "static" - scope_id = boundary_scope.core_infra.id -} - -resource "boundary_host_catalog" "backend_servers" { - name = "backend_servers" - description = "Web servers for backend team" - type = "static" - scope_id = boundary_scope.core_infra.id -} - -resource "boundary_host_catalog" "frontend_servers" { - name = "frontend_servers" - description = "Web servers for backend team" - type = "static" - scope_id = boundary_scope.core_infra.id -} - -resource "boundary_host_set" "backend_servers_service" { - type = "static" - name = "backend_servers_service" - description = "Host set for services servers" - host_catalog_id = boundary_host_catalog.backend_servers.id - host_ids = [for host in boundary_host.backend_servers_service : host.id] -} - -resource "boundary_host_set" "backend_servers_ssh" { - type = "static" - name = "backend_servers_ssh" - description = "Host set for backend servers SSH access" - host_catalog_id = boundary_host_catalog.backend_servers.id - host_ids = [for host in boundary_host.backend_servers_ssh : host.id] -} - -resource "boundary_host_set" "frontend_servers_console" { - type = "static" - name = "frontend_servers_console" - description = "Host set for frontend servers console access" - host_catalog_id = boundary_host_catalog.frontend_servers.id - host_ids = [for host in boundary_host.frontend_servers_console : host.id] -} - -resource "boundary_host_set" "frontend_servers_ssh" { - type = "static" - name = "frontend_servers_ssh" - description = "Host set for frontend servers SSH access" - host_catalog_id = boundary_host_catalog.frontend_servers.id - host_ids = [for host in boundary_host.frontend_servers_ssh : host.id] -} - -resource "boundary_target" "frontend_servers_console" { - type = "tcp" - name = "frontend_servers_console" - description = "Frontend console target" - scope_id = boundary_scope.core_infra.id - - host_set_ids = [ - boundary_host_set.frontend_servers_console.id - ] -} - -resource "boundary_target" "frontend_servers_ssh" { - type = "tcp" - name = "frontend_servers_ssh" - description = "Frontend SSH target" - scope_id = boundary_scope.core_infra.id - - host_set_ids = [ - boundary_host_set.frontend_servers_ssh.id - ] -} - -resource "boundary_target" "backend_servers_service" { - type = "tcp" - name = "backend_servers_service" - description = "Backend service target" - scope_id = boundary_scope.core_infra.id - - host_set_ids = [ - boundary_host_set.backend_servers_service.id - ] -} - -resource "boundary_target" "backend_servers_ssh" { - type = "tcp" - name = "backend_servers_ssh" - description = "Backend SSH target" - scope_id = boundary_scope.core_infra.id - - host_set_ids = [ - boundary_host_set.backend_servers_ssh.id - ] -} - -// only allow the backend team access to the backend web servers host catalog -resource "boundary_role" "admin_backend_core_infra" { - description = "Administrator role for backend core infrastructure" - principal_ids = [boundary_group.backend_core_infra.id] - grant_strings = ["id=${boundary_host_catalog.backend_servers.id};actions=create,read,update,delete"] - scope_id = boundary_scope.core_infra.id -} - -// only allow the frontend team access to the frontend web servers host catalog -resource "boundary_role" "admin_frontend_core_infra" { - description = "Administrator role for frontend core infrastructure" - principal_ids = [boundary_group.frontend_core_infra.id] - grant_strings = ["id=${boundary_host_catalog.web_servers.id};actions=create,read,update,delete"] - scope_id = boundary_scope.core_infra.id -} - -``` - Developing the Provider --------------------------- @@ -354,3 +58,147 @@ In order to run the full suite of Acceptance tests, run `make testacc`. ```sh $ make testacc ``` + +Using the provider +---------------------- +Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available: + +```hcl +provider "boundary" { + addr = "http://127.0.0.1:9200" + auth_method_id = "ampw_1234567890" # changeme + password_auth_method_login_name = "myuser" # changeme + password_auth_method_password = "passpass" # changeme +} + +variable "users" { + type = set(string) + default = [ + "Jim", + "Mike", + "Todd", + "Jeff", + "Randy", + "Susmitha" + ] +} + +variable "readonly_users" { + type = set(string) + default = [ + "Jeff", + "Pete", + "JT" + ] +} + +variable "backend_server_ips" { + type = set(string) + default = [ + "10.1.0.1", + "10.1.0.2", + ] +} + +resource "boundary_scope" "global" { + global_scope = true + scope_id = "global" +} + +resource "boundary_scope" "corp" { + scope_id = boundary_scope.global.id + auto_create_role = true +} + +resource "boundary_user" "users" { + for_each = var.users + name = each.key + description = "User resource for ${each.key}" + scope_id = boundary_scope.corp.id +} + +// organiation level group for readonly users +resource "boundary_group" "readonly" { + name = "readonly" + description = "Organization group for readonly users" + member_ids = [for user in boundary_user.readonly_users : user.id] + scope_id = boundary_scope.corp.id +} + +// add org-level role for readonly access +resource "boundary_role" "organization_readonly" { + name = "readonly" + description = "Read-only role" + principal_ids = [boundary_group.readonly_users.id] + grant_strings = ["id=*;type=*;actions=read"] + scope_id = boundary_scope.corp.id +} + +// add org-level role for administration access +resource "boundary_role" "organization_admin" { + name = "admin" + description = "Administrator role" + principal_ids = concat( + [for user in boundary_user.user: user.id] + ) + grant_strings = ["id=*;type=*;actions=create,read,update,delete"] + scope_id = boundary_scope.corp.id +} + +// create a project for core infrastructure +resource "boundary_scope" "core_infra" { + description = "Core infrastrcture" + scope_id = boundary_scope.corp.id + auto_create_role = true +} + +resource "boundary_host_catalog" "backend_servers" { + name = "backend_servers" + description = "Backend servers host catalog" + type = "static" + scope_id = boundary_scope.core_infra.id +} + +resource "boundary_host" "backend_servers" { + for_each = var.backend_server_ips + type = "static" + name = "backend_server_service_${each.value}" + description = "Backend server host" + address = "${each.key}" + host_catalog_id = boundary_host_catalog.backend_servers.id +} + +resource "boundary_host_set" "backend_servers_ssh" { + type = "static" + name = "backend_servers_ssh" + description = "Host set for backend servers" + host_catalog_id = boundary_host_catalog.backend_servers.id + host_ids = [for host in boundary_host.backend_servers : host.id] +} + +// create target for accessing backend servers on port :8000 +resource "boundary_target" "backend_servers_service" { + type = "tcp" + name = "backend_servers_service" + description = "Backend service target" + scope_id = boundary_scope.core_infra.id + default_port = "8080" + + host_set_ids = [ + boundary_host_set.backend_servers.id + ] +} + +// create target for accessing backend servers on port :22 +resource "boundary_target" "backend_servers_ssh" { + type = "tcp" + name = "backend_servers_ssh" + description = "Backend SSH target" + scope_id = boundary_scope.core_infra.id + default_port = "22" + + host_set_ids = [ + boundary_host_set.backend_servers_ssh.id + ] +} +```