CyberCoveLLC/terraform-provider-threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update token/clientKey on hmac change (#125)

Browse Source 
* Update token/clientKey on hmac change

* Update changelog

* Update docs
This commit is contained in:
Louis Ruch authored and GitHub committed 2021-06-25 13:30:23 -07:00
1 parent 4f0509c55d
commit e1f8352fc4
14 files changed
+253 -113
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+34 -6
View File
@@ -1,9 +1,37 @@
## 1.0.3 (Unreleased)
### New and Improved
* Adds credential library resource for Vault
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/114)).
* Adds credential store resource for Vault
([PR 1](https://github.com/hashicorp/terraform-provider-boundary/pull/114)),
([PR 2](https://github.com/hashicorp/terraform-provider-boundary/pull/125)).
* Adds claim scopes attribute to OIDC auth method
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/112)).
* Adds account claim maps attribute to OIDC auth method
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/111)).
### Bug Fixes
* Make OIDC account attribute for subject ForceNew
([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/119)),
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/122)).
* Update static type attribute for host catalog resource
([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/115)),
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/121)).
## 1.0.2 (May 06, 2021)
### New and Improved
* Adds OIDC account resource
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105))
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105)).
* Adds OIDC auth method resource
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105))
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105)).
### Deprecations/Changes
* Deprecates fields on `resource_auth_method` that will be replaced in the future with generic `attributes` attribute.
## 1.0.1 (February 02, 2021)
@@ -11,7 +39,7 @@
### New and Improved
* Adds worker filter to target resource
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/76))
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/76)).
## 1.0.0 (January 20, 2021)
@@ -20,14 +48,14 @@ We are bumping the version of the Boundary Terraform provider to v1.0.0 and will
### Bug Fixes
* During `terraform apply`, do not update existing user account passwords when the password field is updated in the tf file.
([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/71))
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/70))
([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/71)),
([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/70)).
## 0.1.4 (January 14, 2021)
### New and Improved
Update provider to handle new domain errors ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/63))
Update provider to handle new domain errors ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/63)).
## 0.1.0 (October 14, 2020)
docs/resources/credential_library_vault.md
+7 -7
View File
@@ -31,8 +31,8 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "foo" {
name = "foo"
description = "My first Vault credential store!"
address = "127.0.0.1"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
@@ -40,7 +40,7 @@ resource "boundary_credential_library_vault" "foo" {
name = "foo"
description = "My first Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "my/secret/foo"
path = "my/secret/foo" # change to Vault backend path
http_method = "GET"
}
@@ -48,7 +48,7 @@ resource "boundary_credential_library_vault" "bar" {
name = "bar"
description = "My second Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "my/secret/bar"
path = "my/secret/bar" # change to Vault backend path
http_method = "POST"
request_body = <<EOT
{
@@ -64,13 +64,13 @@ EOT
### Required
- **credential_store_id** (String) The ID of the credential store that this library belongs to.
- **path** (String) The Vault path to query
- **path** (String) The path in Vault to request credentials from.
### Optional
- **description** (String) The Vault credential library description.
- **http_method** (String) The HTTP method to use when contacting Vault
- **http_request_body** (String) The raw string to use in HTTP request to Vault
- **http_method** (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
- **http_request_body** (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.
- **name** (String) The Vault credential library name. Defaults to the resource name.
### Read-Only
docs/resources/credential_store_vault.md
+13 -13
View File
@@ -31,8 +31,8 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "example" {
name = "foo"
description = "My first Vault credential store!"
address = "127.0.0.1"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
```
@@ -42,26 +42,26 @@ resource "boundary_credential_store_vault" "example" {
### Required
- **address** (String) The address to Vault server
- **scope_id** (String) The scope for this credential store
- **token** (String, Sensitive) The Vault token
- **address** (String) The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'
- **scope_id** (String) The scope for this credential store.
- **token** (String, Sensitive) A token used for accessing Vault.
### Optional
- **ca_cert** (String) The Vault CA certificate to use
- **client_certificate** (String) The Vault client certificate
- **client_certificate_key** (String, Sensitive) The Vault client certificate key
- **ca_cert** (String) A PEM-encoded CA certificate to verify the Vault server's TLS certificate.
- **client_certificate** (String) A PEM-encoded client certificate to use for TLS authentication to the Vault server.
- **client_certificate_key** (String, Sensitive) A PEM-encoded private key matching the client certificate from 'client_certificate'.
- **description** (String) The Vault credential store description.
- **name** (String) The Vault credential store name. Defaults to the resource name.
- **namespace** (String) The namespace within Vault to use
- **tls_server_name** (String) The Vault TLS server name
- **tls_skip_verify** (Boolean) Whether or not to skip TLS verification
- **namespace** (String) The namespace within Vault to use.
- **tls_server_name** (String) Name to use as the SNI host when connecting to Vault via TLS.
- **tls_skip_verify** (Boolean) Whether or not to skip TLS verification.
### Read-Only
- **client_certificate_key_hmac** (String) The Vault client certificate key hmac
- **client_certificate_key_hmac** (String) The Vault client certificate key hmac.
- **id** (String) The ID of the Vault credential store.
- **token_hmac** (String) The Vault token hmac
- **token_hmac** (String) The Vault token hmac.
## Import
docs/resources/target.md
+6 -6
View File
@@ -36,16 +36,16 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "foo" {
name = "vault_store"
description = "My first Vault credential store!"
address = "http://localhost:55001"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
resource "boundary_credential_library_vault" "foo" {
name = "vault_library"
name = "foo"
description = "My first Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "database/creds/opened"
path = "my/secret/foo" # change to Vault backend path
http_method = "GET"
}
@@ -88,7 +88,7 @@ resource "boundary_target" "foo" {
host_set_ids = [
boundary_host_set.foo.id
]
credential_library_ids = [
application_credential_library_ids = [
boundary_credential_library_vault.foo.id
]
}
@@ -104,7 +104,7 @@ resource "boundary_target" "foo" {
### Optional
- **credential_library_ids** (Set of String) A list of credential library ID's.
- **application_credential_library_ids** (Set of String) A list of application credential library ID's.
- **default_port** (Number) The default port for this target.
- **description** (String) The target description.
- **host_set_ids** (Set of String) A list of host set ID's.
examples/resources/boundary_credential_library_vault/resource.tf
+4 -4
View File
@@ -16,8 +16,8 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "foo" {
name = "foo"
description = "My first Vault credential store!"
address = "127.0.0.1"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
@@ -25,7 +25,7 @@ resource "boundary_credential_library_vault" "foo" {
name = "foo"
description = "My first Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "my/secret/foo"
path = "my/secret/foo" # change to Vault backend path
http_method = "GET"
}
@@ -33,7 +33,7 @@ resource "boundary_credential_library_vault" "bar" {
name = "bar"
description = "My second Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "my/secret/bar"
path = "my/secret/bar" # change to Vault backend path
http_method = "POST"
request_body = <<EOT
{
examples/resources/boundary_credential_store_vault/resource.tf
+2 -2
View File
@@ -16,7 +16,7 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "example" {
name = "foo"
description = "My first Vault credential store!"
address = "127.0.0.1"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
examples/resources/boundary_target/resource.tf
+5 -5
View File
@@ -21,16 +21,16 @@ resource "boundary_scope" "project" {
resource "boundary_credential_store_vault" "foo" {
name = "vault_store"
description = "My first Vault credential store!"
address = "http://localhost:55001"
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5"
address = "http://127.0.0.1:8200" # change to Vault address
token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
scope_id = boundary_scope.project.id
}
resource "boundary_credential_library_vault" "foo" {
name = "vault_library"
name = "foo"
description = "My first Vault credential library!"
credential_store_id = boundary_credential_store_vault.foo.id
path = "database/creds/opened"
path = "my/secret/foo" # change to Vault backend path
http_method = "GET"
}
@@ -73,7 +73,7 @@ resource "boundary_target" "foo" {
host_set_ids = [
boundary_host_set.foo.id
]
credential_library_ids = [
application_credential_library_ids = [
boundary_credential_library_vault.foo.id
]
}
go.mod
+5 -4
View File
@@ -16,14 +16,15 @@ require (
github.com/circonus-labs/circonusllhist v0.1.4 // indirect
github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe // indirect
github.com/golang/snappy v0.0.2 // indirect
github.com/hashicorp/boundary v0.3.1-0.20210623022626-df35699c4ef2
github.com/hashicorp/boundary/api v0.0.12-0.20210623022626-df35699c4ef2
github.com/hashicorp/boundary/sdk v0.0.5-0.20210623022626-df35699c4ef2
github.com/hashicorp/cap v0.1.0
github.com/hashicorp/boundary v0.3.1-0.20210625180631-86c9a9055484
github.com/hashicorp/boundary/api v0.0.12-0.20210625180631-86c9a9055484
github.com/hashicorp/boundary/sdk v0.0.5-0.20210625180631-86c9a9055484
github.com/hashicorp/cap v0.1.1
github.com/hashicorp/go-immutable-radix v1.3.0 // indirect
github.com/hashicorp/go-kms-wrapping v0.6.2
github.com/hashicorp/golang-lru v0.5.4 // indirect
github.com/hashicorp/hcl/v2 v2.6.0 // indirect
github.com/hashicorp/terraform-json v0.12.0 // indirect
github.com/hashicorp/terraform-plugin-docs v0.4.0
github.com/hashicorp/terraform-plugin-sdk/v2 v2.6.1
github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce // indirect
go.sum
+16 -11
View File
@@ -486,16 +486,16 @@ github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t
github.com/grpc-ecosystem/grpc-gateway/v2 v2.3.0 h1:IvO4FbbQL6n3v3M1rQNobZ61SGL0gJLdvKA5KETM7Xs=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.3.0/go.mod h1:d2gYTOTUQklu06xp0AJYYmRdTVU1VKrqhkYfYag2L08=
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
github.com/hashicorp/boundary v0.3.1-0.20210623022626-df35699c4ef2 h1:hJ8qTqevchi/REQy7JEDS1phXlAWs+2j1Kl8b3XfCiI=
github.com/hashicorp/boundary v0.3.1-0.20210623022626-df35699c4ef2/go.mod h1:wTfjDEGdal4/942BfnJ5yXDjB+LFhsrYY0aah4Q6FOk=
github.com/hashicorp/boundary v0.3.1-0.20210625180631-86c9a9055484 h1:eG6EntsIpvv8g7YhbiF57gZ3Dwdi1nvtnqQeIotUJSA=
github.com/hashicorp/boundary v0.3.1-0.20210625180631-86c9a9055484/go.mod h1:ILFpVIyO/PplMgBXsT85DtRFGYyiEkO8ob84ZSUwgfg=
github.com/hashicorp/boundary/api v0.0.11/go.mod h1:mZfLjpD0hU2YMopuobjh+ZmWMRLl9sooiPr46gi64i4=
github.com/hashicorp/boundary/api v0.0.12-0.20210623022626-df35699c4ef2 h1:UTlcgB8eCeyPX7HrsmyNmsBHTuLM9/ZNgwvEMYgrd2s=
github.com/hashicorp/boundary/api v0.0.12-0.20210623022626-df35699c4ef2/go.mod h1:mZfLjpD0hU2YMopuobjh+ZmWMRLl9sooiPr46gi64i4=
github.com/hashicorp/boundary/api v0.0.12-0.20210625180631-86c9a9055484 h1:UIHVIznDADBqCg5D5IQeI0X1vHyeKuM1DmlNRhwaI3Q=
github.com/hashicorp/boundary/api v0.0.12-0.20210625180631-86c9a9055484/go.mod h1:mZfLjpD0hU2YMopuobjh+ZmWMRLl9sooiPr46gi64i4=
github.com/hashicorp/boundary/sdk v0.0.4/go.mod h1:MQ8FJhseJrKpwvFDTn+AUAcJ1vdk1NKUxk7DxQgH7oQ=
github.com/hashicorp/boundary/sdk v0.0.5-0.20210623022626-df35699c4ef2 h1:CPkNe8ipxlewl9UJ8GABAEBzm2ira5F9B8VK7CpkBTI=
github.com/hashicorp/boundary/sdk v0.0.5-0.20210623022626-df35699c4ef2/go.mod h1:MQ8FJhseJrKpwvFDTn+AUAcJ1vdk1NKUxk7DxQgH7oQ=
github.com/hashicorp/cap v0.1.0 h1:uBDfu9NDvmotza/mJW6vtQId+VYid9ztlTnDCW6YUWU=
github.com/hashicorp/cap v0.1.0/go.mod h1:VfBvK2ULRyqsuqAnjgZl7HJ7/CGMC7ro4H5eXiZuun8=
github.com/hashicorp/boundary/sdk v0.0.5-0.20210625180631-86c9a9055484 h1:Humg736JyDFE7XW0vHP067t/QhLTAImb+d1BwvJvqjc=
github.com/hashicorp/boundary/sdk v0.0.5-0.20210625180631-86c9a9055484/go.mod h1:MQ8FJhseJrKpwvFDTn+AUAcJ1vdk1NKUxk7DxQgH7oQ=
github.com/hashicorp/cap v0.1.1 h1:GjO4+9+H0wv/89YoEsxeVc2jIizL19r5v5l2lpaH8Kg=
github.com/hashicorp/cap v0.1.1/go.mod h1:VfBvK2ULRyqsuqAnjgZl7HJ7/CGMC7ro4H5eXiZuun8=
github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
@@ -595,8 +595,9 @@ github.com/hashicorp/terraform-exec v0.12.0/go.mod h1:SGhto91bVRlgXQWcJ5znSz+29U
github.com/hashicorp/terraform-exec v0.13.3 h1:R6L2mNpDGSEqtLrSONN8Xth0xYwNrnEVzDz6LF/oJPk=
github.com/hashicorp/terraform-exec v0.13.3/go.mod h1:SSg6lbUsVB3DmFyCPjBPklqf6EYGX0TlQ6QTxOlikDU=
github.com/hashicorp/terraform-json v0.8.0/go.mod h1:3defM4kkMfttwiE7VakJDwCd4R+umhSQnvJwORXbprE=
github.com/hashicorp/terraform-json v0.10.0 h1:9syPD/Y5t+3uFjG8AiWVPu1bklJD8QB8iTCaJASc8oQ=
github.com/hashicorp/terraform-json v0.10.0/go.mod h1:3defM4kkMfttwiE7VakJDwCd4R+umhSQnvJwORXbprE=
github.com/hashicorp/terraform-json v0.12.0 h1:8czPgEEWWPROStjkWPUnTQDXmpmZPlkQAwYYLETaTvw=
github.com/hashicorp/terraform-json v0.12.0/go.mod h1:pmbq9o4EuL43db5+0ogX10Yofv1nozM+wskr/bGFJpI=
github.com/hashicorp/terraform-plugin-docs v0.4.0 h1:xJIXsMzBFwBvC1zcjoNz743GL2tNEfYFFU9+Hjp4Uek=
github.com/hashicorp/terraform-plugin-docs v0.4.0/go.mod h1:fKj/V3t45tiXpSlUms/0G4OrBayyWpbUJ4WtLjBkINU=
github.com/hashicorp/terraform-plugin-go v0.3.0 h1:AJqYzP52JFYl9NABRI7smXI1pNjgR5Q/y2WyVJ/BOZA=
@@ -794,8 +795,9 @@ github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceT
github.com/mitchellh/cli v1.1.1/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
github.com/mitchellh/cli v1.1.2 h1:PvH+lL2B7IQ101xQL63Of8yFS2y+aDlsFcsqNc+u/Kw=
github.com/mitchellh/cli v1.1.2/go.mod h1:6iaV0fGdElS6dPBx0EApTxHrcWvmJphyh2n8YBLPPZ4=
github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -821,8 +823,9 @@ github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
github.com/mitchellh/pointerstructure v1.2.0 h1:O+i9nHnXS3l/9Wu7r4NrEdwA2VFTicjUEN1uBnDo34A=
github.com/mitchellh/pointerstructure v1.2.0/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 h1:rzf0wL0CHVc8CEsgyygG0Mn9CNCCPZqOPaz8RiiHYQk=
github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -981,6 +984,7 @@ github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIH
github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
@@ -1621,6 +1625,7 @@ modernc.org/sortutil v1.1.0/go.mod h1:ZyL98OQHJgH9IEfN71VsamvJgrtRX9Dj2gX+vH86L1
modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
modernc.org/zappy v1.0.0/go.mod h1:hHe+oGahLVII/aTTyWK/b53VDHMAGCBYYeZ9sn83HC4=
mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
internal/provider/resource_credential_library_vault.go
+3 -3
View File
@@ -59,17 +59,17 @@ func resourceCredentialLibraryVault() *schema.Resource {
ForceNew: true,
},
credentialLibraryVaultHttpMethodKey: {
Description: "The HTTP method to use when contacting Vault",
Description: "The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'",
Type: schema.TypeString,
Optional: true,
},
credentialLibraryVaultHttpRequestBodyKey: {
Description: "The raw string to use in HTTP request to Vault",
Description: "The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.",
Type: schema.TypeString,
Optional: true,
},
credentialLibraryVaultPathKey: {
Description: "The Vault path to query",
Description: "The path in Vault to request credentials from.",
Type: schema.TypeString,
Required: true,
},
internal/provider/resource_credential_store_vault.go
+44 -17
View File
@@ -30,9 +30,7 @@ var storeVaultAttrs = []string{
credentialStoreVaultCaCertKey,
credentialStoreVaultTlsServerNameKey,
credentialStoreVaultTlsSkipVerifyKey,
credentialStoreVaultTokenHmacKey,
credentialStoreVaultClientCertificateKey,
credentialStoreVaultClientCertificateKeyHmacKey,
}
func resourceCredentialStoreVault() *schema.Resource {
@@ -64,60 +62,60 @@ func resourceCredentialStoreVault() *schema.Resource {
Optional: true,
},
ScopeIdKey: {
Description: "The scope for this credential store",
Description: "The scope for this credential store.",
Type: schema.TypeString,
ForceNew: true,
Required: true,
},
credentialStoreVaultAddressKey: {
Description: "The address to Vault server",
Description: "The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'",
Type: schema.TypeString,
Required: true,
},
credentialStoreVaultNamespaceKey: {
Description: "The namespace within Vault to use",
Description: "The namespace within Vault to use.",
Type: schema.TypeString,
Optional: true,
},
credentialStoreVaultCaCertKey: {
Description: "The Vault CA certificate to use",
Description: "A PEM-encoded CA certificate to verify the Vault server's TLS certificate.",
Type: schema.TypeString,
Optional: true,
},
credentialStoreVaultTlsServerNameKey: {
Description: "The Vault TLS server name",
Description: "Name to use as the SNI host when connecting to Vault via TLS.",
Type: schema.TypeString,
Optional: true,
},
credentialStoreVaultTlsSkipVerifyKey: {
Description: "Whether or not to skip TLS verification",
Description: "Whether or not to skip TLS verification.",
Type: schema.TypeBool,
Optional: true,
},
credentialStoreVaultTokenKey: {
Description: "The Vault token",
Description: "A token used for accessing Vault.",
Type: schema.TypeString,
Required: true,
Sensitive: true,
},
credentialStoreVaultTokenHmacKey: {
Description: "The Vault token hmac",
Description: "The Vault token hmac.",
Type: schema.TypeString,
Computed: true,
},
credentialStoreVaultClientCertificateKey: {
Description: "The Vault client certificate",
Description: "A PEM-encoded client certificate to use for TLS authentication to the Vault server.",
Type: schema.TypeString,
Optional: true,
},
credentialStoreVaultClientCertificateKeyKey: {
Description: "The Vault client certificate key",
Description: "A PEM-encoded private key matching the client certificate from 'client_certificate'.",
Type: schema.TypeString,
Optional: true,
Sensitive: true,
},
credentialStoreVaultClientCertificateKeyHmacKey: {
Description: "The Vault client certificate key hmac",
Description: "The Vault client certificate key hmac.",
Type: schema.TypeString,
Computed: true,
},
@@ -125,7 +123,7 @@ func resourceCredentialStoreVault() *schema.Resource {
}
}
func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
if err := d.Set(NameKey, raw[NameKey]); err != nil {
return err
}
@@ -143,6 +141,35 @@ func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[stri
return err
}
}
stateTokenHmac := d.Get(credentialStoreVaultTokenHmacKey)
boundaryTokenHmac := attrs[credentialStoreVaultTokenHmacKey].(string)
if stateTokenHmac.(string) != boundaryTokenHmac && fromRead {
// TokenHmac has changed in Boundary, therefore the token has changed.
// Update token value to force tf to attempt update.
if err := d.Set(credentialStoreVaultTokenKey, "(changed in Boundary)"); err != nil {
return err
}
}
if err := d.Set(credentialStoreVaultTokenHmacKey, boundaryTokenHmac); err != nil {
return err
}
stateClientKeyHmac := d.Get(credentialStoreVaultClientCertificateKeyHmacKey)
var boundaryClientKeyHmac string
if v, ok := attrs[credentialStoreVaultClientCertificateKeyHmacKey]; ok {
boundaryClientKeyHmac = v.(string)
}
if stateClientKeyHmac.(string) != boundaryClientKeyHmac && fromRead {
// ClientKeyHmac has changed in Boundary, therefore the ClientKey has changed.
// Update ClientKey value to force tf to attempt update.
if err := d.Set(credentialStoreVaultClientCertificateKeyKey, "(changed in Boundary)"); err != nil {
return err
}
}
if err := d.Set(credentialStoreVaultClientCertificateKeyHmacKey, boundaryClientKeyHmac); err != nil {
return err
}
}
d.SetId(raw["id"].(string))
@@ -202,7 +229,7 @@ func resourceCredentialStoreVaultCreate(ctx context.Context, d *schema.ResourceD
return diag.Errorf("nil credential store after create")
}
if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map); err != nil {
if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, false); err != nil {
return diag.Errorf("error generating credential store from response map: %v", err)
}
@@ -225,7 +252,7 @@ func resourceCredentialStoreVaultRead(ctx context.Context, d *schema.ResourceDat
return diag.Errorf("credential store nil after read")
}
if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map); err != nil {
if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, true); err != nil {
return diag.Errorf("error generating credential store from response map: %v", err)
}
@@ -325,7 +352,7 @@ func resourceCredentialStoreVaultUpdate(ctx context.Context, d *schema.ResourceD
return diag.Errorf("credential store nil after update")
}
if err = setFromVaultCredentialStoreResponseMap(d, crUpdate.GetResponse().Map); err != nil {
if err = setFromVaultCredentialStoreResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
return diag.Errorf("error generating credential store from response map: %v", err)
}
}
internal/provider/resource_credential_store_vault_test.go
+49
View File
@@ -139,10 +139,58 @@ func TestAccCredentialStoreVault(t *testing.T) {
),
},
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
{
// Run a plan only update and verify no changes
PlanOnly: true,
Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
},
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
{
// update again but apply a preConfig to externally update resource
// TODO: Boundary currently causes an error on moving back to a previously
// used token, for now verify that a plan only step had changes
PreConfig: func() { externalUpdate(t, provider) },
PlanOnly: true,
ExpectNonEmptyPlan: true,
Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
},
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
},
})
}
var storeId string
// externalUpdate uses the global storeId, therefore this function cannot be called until
// a previous test step that calls testAccCheckCredentialStoreVaultResourceExists has completed.
func externalUpdate(t *testing.T, testProvider *schema.Provider) {
if storeId == "" {
t.Fatal("storeId must be set before testing an external update")
}
vs := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
_, token := vs.CreateToken(t)
md := testProvider.Meta().(*metaData)
c := credentialstores.NewClient(md.client)
cr, err := c.Read(context.Background(), storeId)
if err != nil {
t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
}
// update Vault server to existing store
var opts []credentialstores.Option
opts = append(opts, credentialstores.WithVaultCredentialStoreToken(token))
opts = append(opts, credentialstores.WithVaultCredentialStoreAddress(vs.Addr))
opts = append(opts, credentialstores.WithVaultCredentialStoreCaCert(string(vs.CaCert)))
opts = append(opts, credentialstores.WithVaultCredentialStoreClientCertificate(string(vs.ClientCert)))
opts = append(opts, credentialstores.WithVaultCredentialStoreClientCertificateKey(string(vs.ClientKey)))
_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
if err != nil {
t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
}
}
func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[name]
@@ -154,6 +202,7 @@ func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provide
if id == "" {
return fmt.Errorf("no ID is set")
}
storeId = id
md := testProvider.Meta().(*metaData)
c := credentialstores.NewClient(md.client)
internal/provider/resource_target.go
+28 -18
View File
@@ -12,12 +12,12 @@ import (
)
const (
targetHostSetIdsKey = "host_set_ids"
targetCredentialLibraryIdsKey = "credential_library_ids"
targetDefaultPortKey = "default_port"
targetSessionMaxSecondsKey = "session_max_seconds"
targetSessionConnectionLimitKey = "session_connection_limit"
targetWorkerFilterKey = "worker_filter"
targetHostSetIdsKey = "host_set_ids"
targetApplicationCredentialLibraryIdsKey = "application_credential_library_ids"
targetDefaultPortKey = "default_port"
targetSessionMaxSecondsKey = "session_max_seconds"
targetSessionConnectionLimitKey = "session_connection_limit"
targetWorkerFilterKey = "worker_filter"
targetTypeTcp = "tcp"
)
@@ -73,8 +73,8 @@ func resourceTarget() *schema.Resource {
Optional: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
targetCredentialLibraryIdsKey: {
Description: "A list of credential library ID's.",
targetApplicationCredentialLibraryIdsKey: {
Description: "A list of application credential library ID's.",
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Schema{Type: schema.TypeString},
@@ -114,7 +114,7 @@ func setFromTargetResponseMap(d *schema.ResourceData, raw map[string]interface{}
if err := d.Set(targetHostSetIdsKey, raw["host_set_ids"]); err != nil {
return err
}
if err := d.Set(targetCredentialLibraryIdsKey, raw["credential_library_ids"]); err != nil {
if err := d.Set(targetApplicationCredentialLibraryIdsKey, raw["application_credential_library_ids"]); err != nil {
return err
}
if err := d.Set(targetSessionMaxSecondsKey, raw["session_max_seconds"]); err != nil {
@@ -166,8 +166,7 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
return diag.Errorf("invalid type provided")
}
opts := []targets.Option{}
var opts []targets.Option
nameVal, ok := d.GetOk(NameKey)
if ok {
nameStr := nameVal.(string)
@@ -217,7 +216,7 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
}
var credentialLibraryIds []string
if credentialLibraryIdsVal, ok := d.GetOk(targetCredentialLibraryIdsKey); ok {
if credentialLibraryIdsVal, ok := d.GetOk(targetApplicationCredentialLibraryIdsKey); ok {
list := credentialLibraryIdsVal.(*schema.Set).List()
credentialLibraryIds = make([]string, 0, len(list))
for _, i := range list {
@@ -253,7 +252,7 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
}
if credentialLibraryIds != nil {
tur, err := tc.SetCredentialLibraries(ctx, tcr.Item.Id, version, credentialLibraryIds)
tur, err := tc.SetCredentialLibraries(ctx, tcr.Item.Id, version, targets.WithApplicationCredentialLibraryIds(credentialLibraryIds))
if err != nil {
return diag.Errorf("error setting credential libraries on target: %v", err)
}
@@ -294,7 +293,7 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
md := meta.(*metaData)
tc := targets.NewClient(md.client)
opts := []targets.Option{}
var opts []targets.Option
var name *string
if d.HasChange(NameKey) {
@@ -429,19 +428,30 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
}
}
if d.HasChange(targetCredentialLibraryIdsKey) {
// The above calls may not actually happen, so we use d.Id() and automatic
// versioning here
if d.HasChange(targetApplicationCredentialLibraryIdsKey) {
var credentialLibraryIds []string
if credentialLibraryIdsVal, ok := d.GetOk(targetCredentialLibraryIdsKey); ok {
if credentialLibraryIdsVal, ok := d.GetOk(targetApplicationCredentialLibraryIdsKey); ok {
credLibsIds := credentialLibraryIdsVal.(*schema.Set).List()
for _, credLibId := range credLibsIds {
credentialLibraryIds = append(credentialLibraryIds, credLibId.(string))
}
}
_, err := tc.SetCredentialLibraries(ctx, d.Id(), 0, credentialLibraryIds, targets.WithAutomaticVersioning(true))
opts := []targets.Option{
targets.WithAutomaticVersioning(true),
targets.DefaultApplicationCredentialLibraryIds(),
}
if len(credentialLibraryIds) > 0 {
opts = append(opts, targets.WithApplicationCredentialLibraryIds(credentialLibraryIds))
}
_, err := tc.SetCredentialLibraries(ctx, d.Id(), 0, opts...)
if err != nil {
return diag.Errorf("error updating credential libraries in target: %v", err)
}
if err := d.Set(targetCredentialLibraryIdsKey, credentialLibraryIds); err != nil {
if err := d.Set(targetApplicationCredentialLibraryIdsKey, credentialLibraryIds); err != nil {
return diag.FromErr(err)
}
}
internal/provider/resource_target_test.go
+37 -17
View File
@@ -90,7 +90,7 @@ resource "boundary_target" "foo" {
host_set_ids = [
boundary_host_set.foo.id
]
credential_library_ids = [
application_credential_library_ids = [
boundary_credential_library_vault.foo.id
]
default_port = 22
@@ -109,7 +109,7 @@ resource "boundary_target" "foo" {
host_set_ids = [
boundary_host_set.bar.id
]
credential_library_ids = [
application_credential_library_ids = [
boundary_credential_library_vault.bar.id
]
default_port = 80
@@ -118,6 +118,19 @@ resource "boundary_target" "foo" {
session_connection_limit = 7
worker_filter = "type == \"bar\""
}`, fooTargetDescriptionUpdate)
fooTargetUpdateUnsetHostAndCredLibs = fmt.Sprintf(`
resource "boundary_target" "foo" {
name = "test"
description = "%s"
type = "tcp"
scope_id = boundary_scope.proj1.id
default_port = 80
depends_on = [boundary_role.proj1_admin]
session_max_seconds = 7000
session_connection_limit = 7
worker_filter = "type == \"bar\""
}`, fooTargetDescriptionUpdate)
)
func TestAccTarget(t *testing.T) {
@@ -153,7 +166,7 @@ func TestAccTarget(t *testing.T) {
resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "6"),
resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "foo"`),
testAccCheckTargetResourceHostSet(provider, "boundary_target.foo", []string{"boundary_host_set.foo"}),
testAccCheckTargetResourceCredLibs(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.foo"}),
testAccCheckTargetResourceAppCredLibs(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.foo"}),
),
},
importStep("boundary_target.foo"),
@@ -168,7 +181,22 @@ func TestAccTarget(t *testing.T) {
resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "bar"`),
testAccCheckTargetResourceHostSet(provider, "boundary_target.foo", []string{"boundary_host_set.bar"}),
testAccCheckTargetResourceCredLibs(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.bar"}),
testAccCheckTargetResourceAppCredLibs(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.bar"}),
),
},
importStep("boundary_target.foo"),
{
// test unset hosts and cred libs
Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTargetUpdateUnsetHostAndCredLibs),
Check: resource.ComposeTestCheckFunc(
testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "bar"`),
testAccCheckTargetResourceHostSet(provider, "boundary_target.foo", nil),
testAccCheckTargetResourceAppCredLibs(provider, "boundary_target.foo", nil),
),
},
importStep("boundary_target.foo"),
@@ -213,10 +241,6 @@ func testAccCheckTargetResourceHostSet(testProvider *schema.Provider, name strin
return fmt.Errorf("Got an error when reading target %q: %v", id, err)
}
if len(t.Item.HostSetIds) == 0 {
return fmt.Errorf("no hostSets found on target")
}
if len(t.Item.HostSetIds) != len(hostSetIDs) {
return fmt.Errorf("tf state and boundary have different number of host sets")
}
@@ -237,7 +261,7 @@ func testAccCheckTargetResourceHostSet(testProvider *schema.Provider, name strin
}
}
func testAccCheckTargetResourceCredLibs(testProvider *schema.Provider, name string, credLibs []string) resource.TestCheckFunc {
func testAccCheckTargetResourceAppCredLibs(testProvider *schema.Provider, name string, credLibs []string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[name]
if !ok {
@@ -274,15 +298,11 @@ func testAccCheckTargetResourceCredLibs(testProvider *schema.Provider, name stri
return fmt.Errorf("Got an error when reading target %q: %v", id, err)
}
if len(t.Item.CredentialLibraries) == 0 {
return fmt.Errorf("no credential libraries found on target")
if len(t.Item.ApplicationCredentialLibraryIds) != len(credLibIDs) {
return fmt.Errorf("tf state and boundary have different number of application credential libraries")
}
if len(t.Item.CredentialLibraries) != len(credLibIDs) {
return fmt.Errorf("tf state and boundary have different number of credential libraries")
}
for _, stateCredLibId := range t.Item.CredentialLibraryIds {
for _, stateCredLibId := range t.Item.ApplicationCredentialLibraryIds {
ok := false
for _, gotCredLibID := range credLibIDs {
if gotCredLibID == stateCredLibId {
@@ -290,7 +310,7 @@ func testAccCheckTargetResourceCredLibs(testProvider *schema.Provider, name stri
}
}
if !ok {
return fmt.Errorf("credential library id in state not set in boundary: %s", stateCredLibId)
return fmt.Errorf("application credential library id in state not set in boundary: %s", stateCredLibId)
}
}