Skip to content

Commit ab77f83

Browse files
GilTeraSkyGilTeraSky
committed
Rebase Squash - Permission Template complete
Signed-off-by: GilTS <gil@terasky.com>
1 parent f6af652 commit ab77f83

File tree

17 files changed

+877
-3
lines changed

17 files changed

+877
-3
lines changed

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- 'v*'
77

88
env:
9-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection'
9+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection permissiontemplate'
1010

1111
jobs:
1212
goreleaser:

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Test and coverage
33
on: [pull_request, push]
44

55
env:
6-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection'
6+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection permissiontemplate'
77
jobs:
88
build:
99
name: Test and coverage

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ ifeq ($(TEST_FLAGS),)
2222
endif
2323

2424
ifeq ($(BUILD_TAGS),)
25-
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection'
25+
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection permissiontemplate'
2626
endif
2727

2828
.PHONY: build clean-up test gofmt vet lint acc-test website-lint website-lint-fix

‎docs/data-sources/permission_template.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
Title: "Permission Template Data Source"
3+
Description: |-
4+
Retrieves an AWS CloudFormation permission template for creating credentials.
5+
---
6+
7+
# Permission Template Data Source
8+
9+
This data source enables users get an AWS CloudFormation template for creating the necessary assets in AWS when creating TMC credentials.
10+
11+
**NOTE**: Currently, only the 'AWS_EC2' and 'AWS_EKS' capabilities are supported in conjunction with the 'DATA_PROTECTION' and 'MANAGED_K8S_PROVIDER' providers.
12+
13+
# Data Protection Permission Template
14+
15+
## Example Usage
16+
17+
```terraform
18+
locals {
19+
credentials_name = "test-permission-template-data-protection-tf-111"
20+
tanzu_capability = "DATA_PROTECTION"
21+
tanzu_provider = "AWS_EC2"
22+
23+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
24+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
25+
}
26+
27+
28+
data "tanzu-mission-control_permission_template" "data_protection_permissions" {
29+
credentials_name = local.credentials_name
30+
tanzu_capability = local.tanzu_capability
31+
tanzu_provider = local.tanzu_provider
32+
}
33+
34+
35+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
36+
name = local.credentials_name
37+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
38+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
39+
capabilities = ["CAPABILITY_NAMED_IAM"]
40+
}
41+
42+
resource "tanzu-mission-control_credential" "data_protection_cred" {
43+
name = local.credentials_name
44+
45+
spec {
46+
capability = local.tanzu_capability
47+
provider = local.tanzu_provider
48+
49+
data {
50+
aws_credential {
51+
iam_role {
52+
arn = local.permission_arn
53+
}
54+
}
55+
}
56+
}
57+
}
58+
```
59+
60+
# EKS Permission Template
61+
62+
## Example Usage
63+
64+
```terraform
65+
locals {
66+
credentials_name = "test-permission-template-eks-tf-43"
67+
tanzu_capability = "MANAGED_K8S_PROVIDER"
68+
tanzu_provider = "AWS_EKS"
69+
70+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
71+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
72+
}
73+
74+
75+
data "tanzu-mission-control_permission_template" "eks_permissions" {
76+
credentials_name = local.credentials_name
77+
tanzu_capability = local.tanzu_capability
78+
tanzu_provider = local.tanzu_provider
79+
}
80+
81+
82+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
83+
name = local.credentials_name
84+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
85+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
86+
capabilities = ["CAPABILITY_NAMED_IAM"]
87+
}
88+
89+
resource "tanzu-mission-control_credential" "aws_eks_cred" {
90+
name = local.credentials_name
91+
92+
spec {
93+
capability = local.tanzu_capability
94+
provider = local.tanzu_provider
95+
96+
data {
97+
aws_credential {
98+
iam_role {
99+
arn = local.permission_arn
100+
}
101+
}
102+
}
103+
}
104+
}
105+
```
106+
107+
<!-- schema generated by tfplugindocs -->
108+
## Schema
109+
110+
### Required
111+
112+
- `credentials_name` (String) The name of the credentials to get permission template for.
113+
- `tanzu_capability` (String) The Tanzu capability of the credentials.
114+
When tanzu_capability is set to 'DATA_PROTECTION' tanzu_provider must be set to 'AWS_EC2'.
115+
When tanzu_capability is set to 'MANAGED_K8S_PROVIDER' tanzu_provider must be set to 'AWS_EKS'.
116+
Valid values are: [DATA_PROTECTION MANAGED_K8S_PROVIDER]
117+
- `tanzu_provider` (String) The Tanzu provider of the credentials.
118+
When tanzu_provider is set to 'AWS_EC2' tanzu_capability must be set to 'DATA_PROTECTION'.
119+
When tanzu_provider is set to 'AWS_EKS' tanzu_capability must be set to 'MANAGED_K8S_PROVIDER'.
120+
Valid values are: [AWS_EC2 AWS_EKS]
121+
122+
### Read-Only
123+
124+
- `id` (String) The ID of this resource.
125+
- `template` (String) Base64 encoded permission template.
126+
- `template_url` (String) URL for permission template.
127+
- `template_values` (Map of String) Values to be sent as parameters for the template.
128+
- `undefined_template_values` (Map of String) Values which are not defined in the template parameters definition.

‎examples/data-sources/permissiontemplate/example_usage_data_protection.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
credentials_name = "test-permission-template-data-protection-tf-111"
3+
tanzu_capability = "DATA_PROTECTION"
4+
tanzu_provider = "AWS_EC2"
5+
6+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
7+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
8+
}
9+
10+
11+
data "tanzu-mission-control_permission_template" "data_protection_permissions" {
12+
credentials_name = local.credentials_name
13+
tanzu_capability = local.tanzu_capability
14+
tanzu_provider = local.tanzu_provider
15+
}
16+
17+
18+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
19+
name = local.credentials_name
20+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
21+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
22+
capabilities = ["CAPABILITY_NAMED_IAM"]
23+
}
24+
25+
resource "tanzu-mission-control_credential" "data_protection_cred" {
26+
name = local.credentials_name
27+
28+
spec {
29+
capability = local.tanzu_capability
30+
provider = local.tanzu_provider
31+
32+
data {
33+
aws_credential {
34+
iam_role {
35+
arn = local.permission_arn
36+
}
37+
}
38+
}
39+
}
40+
}

‎examples/data-sources/permissiontemplate/example_usage_eks.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
locals {
2+
credentials_name = "test-permission-template-eks-tf-43"
3+
tanzu_capability = "MANAGED_K8S_PROVIDER"
4+
tanzu_provider = "AWS_EKS"
5+
6+
stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message)
7+
permission_arn = element(local.stack_message, length(local.stack_message) - 1)
8+
}
9+
10+
11+
data "tanzu-mission-control_permission_template" "eks_permissions" {
12+
credentials_name = local.credentials_name
13+
tanzu_capability = local.tanzu_capability
14+
tanzu_provider = local.tanzu_provider
15+
}
16+
17+
18+
resource "aws_cloudformation_stack" "crendetials_permission_template" {
19+
name = local.credentials_name
20+
parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {}
21+
template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template)
22+
capabilities = ["CAPABILITY_NAMED_IAM"]
23+
}
24+
25+
resource "tanzu-mission-control_credential" "aws_eks_cred" {
26+
name = local.credentials_name
27+
28+
spec {
29+
capability = local.tanzu_capability
30+
provider = local.tanzu_provider
31+
32+
data {
33+
aws_credential {
34+
iam_role {
35+
arn = local.permission_arn
36+
}
37+
}
38+
}
39+
}
40+
}

‎internal/client/http_client.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ import (
4949
helmchartsorgclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/helmcharts"
5050
iamorganizationclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/iam_policy"
5151
policyorganizationclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/organization/policy"
52+
permissiontemplateclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/permissiontemplate"
5253
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/proxy"
5354
tanzupackageclusterclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/tanzupackage"
5455
pkginstallclusterclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/tanzupackageinstall"
@@ -136,6 +137,7 @@ func newHTTPClient(httpClient *transport.Client) *TanzuMissionControl {
136137
BackupScheduleService: backupscheduleclient.New(httpClient),
137138
DataProtectionService: dataprotectionclient.New(httpClient),
138139
TargetLocationService: targetlocationclient.New(httpClient),
140+
PermissionTemplateService: permissiontemplateclient.New(httpClient),
139141
}
140142
}
141143

@@ -190,4 +192,5 @@ type TanzuMissionControl struct {
190192
BackupScheduleService backupscheduleclient.ClientService
191193
DataProtectionService dataprotectionclient.ClientService
192194
TargetLocationService targetlocationclient.ClientService
195+
PermissionTemplateService permissiontemplateclient.ClientService
193196
}

‎internal/client/permissiontemplate/permission_template_resource.go‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright © 2023 VMware, Inc. All Rights Reserved.
3+
SPDX-License-Identifier: MPL-2.0
4+
*/
5+
6+
package permissiontemplateclient
7+
8+
import (
9+
"net/url"
10+
11+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/transport"
12+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/helper"
13+
credentialsmodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/credential"
14+
permissiontemplatemodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/permissiontemplate"
15+
)
16+
17+
const (
18+
// API Paths.
19+
apiPath = "v1alpha1/account/credentials:permissiontemplate"
20+
21+
// Query Params.
22+
capabilityQueryParam = "capability"
23+
providerQueryParam = "provider"
24+
)
25+
26+
// New creates a new permission template resource service API client.
27+
func New(transport *transport.Client) ClientService {
28+
return &Client{Client: transport}
29+
}
30+
31+
/*
32+
Client for permission template resource service API.
33+
*/
34+
type Client struct {
35+
*transport.Client
36+
}
37+
38+
// ClientService is the interface for Client methods.
39+
type ClientService interface {
40+
PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error)
41+
42+
PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error)
43+
}
44+
45+
/*
46+
PermissionTemplateResourceServiceGenerate generates a permission template.
47+
*/
48+
func (c *Client) PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) {
49+
response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{}
50+
err := c.Create(apiPath, request, response)
51+
52+
return response, err
53+
}
54+
55+
/*
56+
PermissionTemplateResourceServiceGet gets an existing permission template.
57+
*/
58+
func (c *Client) PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) {
59+
response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{}
60+
requestURL := helper.ConstructRequestURL(apiPath, request.FullName.Name)
61+
62+
queryParams := url.Values{}
63+
64+
if request.Capability != "" {
65+
queryParams.Add(capabilityQueryParam, request.Capability)
66+
}
67+
68+
if *request.Provider != credentialsmodels.VmwareTanzuManageV1alpha1AccountCredentialProviderPROVIDERUNSPECIFIED {
69+
queryParams.Add(providerQueryParam, string(*request.Provider))
70+
}
71+
72+
if len(queryParams) > 0 {
73+
requestURL = requestURL.AppendQueryParams(queryParams)
74+
}
75+
76+
err := c.Get(requestURL.String(), response)
77+
78+
return response, err
79+
}

0 commit comments

Comments
 (0)