Skip to content

Commit 518460d

Browse files
ankitsnyankitsny
committed
Resolved merge conflict
1 parent 50bbbf8 commit 518460d

File tree

17 files changed

+875
-3
lines changed

17 files changed

+875
-3
lines changed

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- 'v*'
77

88
env:
9-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate'
9+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate permissiontemplate'
1010

1111
jobs:
1212
goreleaser:

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Test and coverage
33
on: [pull_request, push]
44

55
env:
6-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate'
6+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate permissiontemplate'
77
jobs:
88
build:
99
name: Test and coverage

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ ifeq ($(TEST_FLAGS),)
2222
endif
2323

2424
ifeq ($(BUILD_TAGS),)
25-
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate'
25+
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner inspections custompolicytemplate permissiontemplate'
2626
endif
2727

2828
.PHONY: build clean-up test gofmt vet lint acc-test website-lint website-lint-fix

‎docs/data-sources/permission_template.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
Title: "Permission Template Data Source"
3+
Description: |-
4+
Retrieves an AWS CloudFormation permission template for creating credentials.
5+
---
6+
7+
# Permission Template Data Source
8+
9+
This data source enables users get an AWS CloudFormation template for creating the necessary assets in AWS when creating TMC credentials.
10+
11+
**NOTE**: Currently, only the 'AWS_EC2' and 'AWS_EKS' capabilities are supported in conjunction with the 'DATA_PROTECTION' and 'MANAGED_K8S_PROVIDER' providers.
12+
13+
# Data Protection Permission Template
14+
15+
## Example Usage
16+
17+
```terraform
18+
locals {
19+
credentials_name = "test-permission-template-data-protection-tf-111"
20+
tanzu_capability = "DATA_PROTECTION"
21+
tanzu_provider = "AWS_EC2"
22+
23+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
24+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
25+
}
26+
27+
28+
data "tanzu-mission-control_permission_template" "data_protection_permissions" {
29+
credentials_name = local.credentials_name
30+
tanzu_capability = local.tanzu_capability
31+
tanzu_provider = local.tanzu_provider
32+
}
33+
34+
35+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
36+
name = local.credentials_name
37+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
38+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
39+
capabilities = ["CAPABILITY_NAMED_IAM"]
40+
}
41+
42+
resource "tanzu-mission-control_credential" "data_protection_cred" {
43+
name = local.credentials_name
44+
45+
spec {
46+
capability = local.tanzu_capability
47+
provider = local.tanzu_provider
48+
49+
data {
50+
aws_credential {
51+
iam_role {
52+
arn = local.permission_arn
53+
}
54+
}
55+
}
56+
}
57+
}
58+
```
59+
60+
# EKS Permission Template
61+
62+
## Example Usage
63+
64+
```terraform
65+
locals {
66+
credentials_name = "test-permission-template-eks-tf-43"
67+
tanzu_capability = "MANAGED_K8S_PROVIDER"
68+
tanzu_provider = "AWS_EKS"
69+
70+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
71+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
72+
}
73+
74+
75+
data "tanzu-mission-control_permission_template" "eks_permissions" {
76+
credentials_name = local.credentials_name
77+
tanzu_capability = local.tanzu_capability
78+
tanzu_provider = local.tanzu_provider
79+
}
80+
81+
82+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
83+
name = local.credentials_name
84+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
85+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
86+
capabilities = ["CAPABILITY_NAMED_IAM"]
87+
}
88+
89+
resource "tanzu-mission-control_credential" "aws_eks_cred" {
90+
name = local.credentials_name
91+
92+
spec {
93+
capability = local.tanzu_capability
94+
provider = local.tanzu_provider
95+
96+
data {
97+
aws_credential {
98+
iam_role {
99+
arn = local.permission_arn
100+
}
101+
}
102+
}
103+
}
104+
}
105+
```
106+
107+
<!-- schema generated by tfplugindocs -->
108+
## Schema
109+
110+
### Required
111+
112+
- `credentials_name` (String) The name of the credentials to get permission template for.
113+
- `tanzu_capability` (String) The Tanzu capability of the credentials.
114+
When tanzu_capability is set to 'DATA_PROTECTION' tanzu_provider must be set to 'AWS_EC2'.
115+
When tanzu_capability is set to 'MANAGED_K8S_PROVIDER' tanzu_provider must be set to 'AWS_EKS'.
116+
Valid values are: [DATA_PROTECTION MANAGED_K8S_PROVIDER]
117+
- `tanzu_provider` (String) The Tanzu provider of the credentials.
118+
When tanzu_provider is set to 'AWS_EC2' tanzu_capability must be set to 'DATA_PROTECTION'.
119+
When tanzu_provider is set to 'AWS_EKS' tanzu_capability must be set to 'MANAGED_K8S_PROVIDER'.
120+
Valid values are: [AWS_EC2 AWS_EKS]
121+
122+
### Read-Only
123+
124+
- `id` (String) The ID of this resource.
125+
- `template` (String) Base64 encoded permission template.
126+
- `template_url` (String) URL for permission template.
127+
- `template_values` (Map of String) Values to be sent as parameters for the template.
128+
- `undefined_template_values` (Map of String) Values which are not defined in the template parameters definition.

‎examples/data-sources/permissiontemplate/example_usage_data_protection.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
credentials_name = "test-permission-template-data-protection-tf-111"
3+
tanzu_capability = "DATA_PROTECTION"
4+
tanzu_provider = "AWS_EC2"
5+
6+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
7+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
8+
}
9+
10+
11+
data "tanzu-mission-control_permission_template" "data_protection_permissions" {
12+
credentials_name = local.credentials_name
13+
tanzu_capability = local.tanzu_capability
14+
tanzu_provider = local.tanzu_provider
15+
}
16+
17+
18+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
19+
name = local.credentials_name
20+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
21+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
22+
capabilities = ["CAPABILITY_NAMED_IAM"]
23+
}
24+
25+
resource "tanzu-mission-control_credential" "data_protection_cred" {
26+
name = local.credentials_name
27+
28+
spec {
29+
capability = local.tanzu_capability
30+
provider = local.tanzu_provider
31+
32+
data {
33+
aws_credential {
34+
iam_role {
35+
arn = local.permission_arn
36+
}
37+
}
38+
}
39+
}
40+
}

‎examples/data-sources/permissiontemplate/example_usage_eks.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
credentials_name = "test-permission-template-eks-tf-43"
3+
tanzu_capability = "MANAGED_K8S_PROVIDER"
4+
tanzu_provider = "AWS_EKS"
5+
6+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
7+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
8+
}
9+
10+
11+
data "tanzu-mission-control_permission_template" "eks_permissions" {
12+
credentials_name = local.credentials_name
13+
tanzu_capability = local.tanzu_capability
14+
tanzu_provider = local.tanzu_provider
15+
}
16+
17+
18+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
19+
name = local.credentials_name
20+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
21+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
22+
capabilities = ["CAPABILITY_NAMED_IAM"]
23+
}
24+
25+
resource "tanzu-mission-control_credential" "aws_eks_cred" {
26+
name = local.credentials_name
27+
28+
spec {
29+
capability = local.tanzu_capability
30+
provider = local.tanzu_provider
31+
32+
data {
33+
aws_credential {
34+
iam_role {
35+
arn = local.permission_arn
36+
}
37+
}
38+
}
39+
}
40+
}

‎internal/client/http_client.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ import (
5353
helmchartsorgclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/helmcharts"
5454
iamorganizationclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/iam_policy"
5555
policyorganizationclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/policy"
56+
permissiontemplateclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/permissiontemplate"
5657
provisionerclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/provisioner"
5758
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/proxy"
5859
recipeclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/recipe"
@@ -150,6 +151,7 @@ func newHTTPClient(httpClient *transport.Client) *TanzuMissionControl {
150151
ProvisionerResourceService: provisionerclient.New(httpClient),
151152
CustomPolicyTemplateResourceService: custompolicytemplateclient.New(httpClient),
152153
RecipeResourceService: recipeclient.New(httpClient),
154+
PermissionTemplateService: permissiontemplateclient.New(httpClient),
153155
}
154156
}
155157

@@ -211,4 +213,5 @@ type TanzuMissionControl struct {
211213
InspectionsResourceService inspectionsclient.ClientService
212214
CustomPolicyTemplateResourceService custompolicytemplateclient.ClientService
213215
RecipeResourceService recipeclient.ClientService
216+
PermissionTemplateService permissiontemplateclient.ClientService
214217
}

‎internal/client/permissiontemplate/permission_template_resource.go‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright © 2023 VMware, Inc. All Rights Reserved.
3+
SPDX-License-Identifier: MPL-2.0
4+
*/
5+
6+
package permissiontemplateclient
7+
8+
import (
9+
"net/url"
10+
11+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/transport"
12+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/helper"
13+
credentialsmodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/credential"
14+
permissiontemplatemodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/permissiontemplate"
15+
)
16+
17+
const (
18+
// API Paths.
19+
apiPath = "v1alpha1/account/credentials:permissiontemplate"
20+
21+
// Query Params.
22+
capabilityQueryParam = "capability"
23+
providerQueryParam = "provider"
24+
)
25+
26+
// New creates a new permission template resource service API client.
27+
func New(transport *transport.Client) ClientService {
28+
return &Client{Client: transport}
29+
}
30+
31+
/*
32+
Client for permission template resource service API.
33+
*/
34+
type Client struct {
35+
*transport.Client
36+
}
37+
38+
// ClientService is the interface for Client methods.
39+
type ClientService interface {
40+
PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error)
41+
42+
PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error)
43+
}
44+
45+
/*
46+
PermissionTemplateResourceServiceGenerate generates a permission template.
47+
*/
48+
func (c *Client) PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) {
49+
response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{}
50+
err := c.Create(apiPath, request, response)
51+
52+
return response, err
53+
}
54+
55+
/*
56+
PermissionTemplateResourceServiceGet gets an existing permission template.
57+
*/
58+
func (c *Client) PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) {
59+
response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{}
60+
requestURL := helper.ConstructRequestURL(apiPath, request.FullName.Name)
61+
62+
queryParams := url.Values{}
63+
64+
if request.Capability != "" {
65+
queryParams.Add(capabilityQueryParam, request.Capability)
66+
}
67+
68+
if *request.Provider != credentialsmodels.VmwareTanzuManageV1alpha1AccountCredentialProviderPROVIDERUNSPECIFIED {
69+
queryParams.Add(providerQueryParam, string(*request.Provider))
70+
}
71+
72+
if len(queryParams) > 0 {
73+
requestURL = requestURL.AppendQueryParams(queryParams)
74+
}
75+
76+
err := c.Get(requestURL.String(), response)
77+
78+
return response, err
79+
}

0 commit comments

Comments
 (0)