Skip to content

Commit ac16875

Browse files
GilTeraSkyshobha2626
GilTeraSky
authored and
shobha2626
committed
Add support for Custom Policy Assignment
Signed-off-by: GilTS <gil@terasky.com>
1 parent 8c08715 commit ac16875

File tree

18 files changed

+1100
-28
lines changed

18 files changed

+1100
-28
lines changed

‎docs/resources/custom_policy.md‎

Lines changed: 239 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ In the Tanzu Mission Control custom policy resource, there are six system define
1818
- **tmc-external-ips**
1919
- **tmc-https-ingress**
2020
- **tmc-require-labels**
21+
- **Any custom template defined in TMC**
2122

2223
## Policy Scope and Inheritance
2324

@@ -407,6 +408,79 @@ resource "tanzu-mission-control_custom_policy" "cluster_scoped_tmc-require-label
407408
}
408409
```
409410

411+
## Cluster scoped Custom Policy
412+
413+
### Example Usage
414+
415+
```terraform
416+
resource "tanzu-mission-control_custom_policy" "custom" {
417+
name = "test-custom-template-tf"
418+
419+
scope {
420+
cluster {
421+
management_cluster_name = "attached"
422+
provisioner_name = "attached"
423+
name = "tf-create-test"
424+
}
425+
}
426+
427+
428+
spec {
429+
input {
430+
custom {
431+
template_name = "replica-count-range-enforcement"
432+
audit = false
433+
434+
parameters = jsonencode({
435+
ranges = [
436+
{
437+
minReplicas = 3
438+
maxReplicas = 7
439+
}
440+
]
441+
})
442+
443+
444+
445+
target_kubernetes_resources {
446+
api_groups = [
447+
"apps",
448+
]
449+
kinds = [
450+
"Deployment"
451+
]
452+
}
453+
454+
target_kubernetes_resources {
455+
api_groups = [
456+
"apps",
457+
]
458+
kinds = [
459+
"StatefulSet",
460+
]
461+
}
462+
}
463+
}
464+
465+
namespace_selector {
466+
match_expressions {
467+
key = "<label-selector-requirement-key-1>"
468+
operator = "<label-selector-requirement-operator>"
469+
values = [
470+
"<label-selector-requirement-value-1>",
471+
"<label-selector-requirement-value-2>"
472+
]
473+
}
474+
match_expressions {
475+
key = "<label-selector-requirement-key-2>"
476+
operator = "<label-selector-requirement-operator>"
477+
values = []
478+
}
479+
}
480+
}
481+
}
482+
```
483+
410484
## Cluster group scoped TMC-block-nodeport-service Custom Policy
411485

412486
### Example Usage
@@ -742,6 +816,77 @@ resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_tmc-require
742816
}
743817
```
744818

819+
## Cluster group scoped Custom Policy
820+
821+
### Example Usage
822+
823+
```terraform
824+
resource "tanzu-mission-control_custom_policy" "custom" {
825+
name = "test-custom-template-tf"
826+
827+
scope {
828+
cluster_group {
829+
cluster_group = "tf-create-test"
830+
}
831+
}
832+
833+
834+
spec {
835+
input {
836+
custom {
837+
template_name = "replica-count-range-enforcement"
838+
audit = false
839+
840+
parameters = jsonencode({
841+
ranges = [
842+
{
843+
minReplicas = 3
844+
maxReplicas = 7
845+
}
846+
]
847+
})
848+
849+
850+
851+
target_kubernetes_resources {
852+
api_groups = [
853+
"apps",
854+
]
855+
kinds = [
856+
"Deployment"
857+
]
858+
}
859+
860+
target_kubernetes_resources {
861+
api_groups = [
862+
"apps",
863+
]
864+
kinds = [
865+
"StatefulSet",
866+
]
867+
}
868+
}
869+
}
870+
871+
namespace_selector {
872+
match_expressions {
873+
key = "<label-selector-requirement-key-1>"
874+
operator = "<label-selector-requirement-operator>"
875+
values = [
876+
"<label-selector-requirement-value-1>",
877+
"<label-selector-requirement-value-2>"
878+
]
879+
}
880+
match_expressions {
881+
key = "<label-selector-requirement-key-2>"
882+
operator = "<label-selector-requirement-operator>"
883+
values = []
884+
}
885+
}
886+
}
887+
}
888+
```
889+
745890
## Organization scoped TMC-block-nodeport-service Custom Policy
746891

747892
### Example Usage
@@ -1077,6 +1222,75 @@ resource "tanzu-mission-control_custom_policy" "organization_scoped_tmc-require-
10771222
}
10781223
```
10791224

1225+
## Organization scoped Custom Policy
1226+
1227+
### Example Usage
1228+
1229+
```terraform
1230+
resource "tanzu-mission-control_custom_policy" "custom" {
1231+
name = "test-custom-template-tf"
1232+
1233+
scope {
1234+
organization {
1235+
organization = "dummy-id"
1236+
}
1237+
}
1238+
1239+
spec {
1240+
input {
1241+
custom {
1242+
template_name = "replica-count-range-enforcement"
1243+
audit = false
1244+
1245+
parameters = jsonencode({
1246+
ranges = [
1247+
{
1248+
minReplicas = 3
1249+
maxReplicas = 7
1250+
}
1251+
]
1252+
})
1253+
1254+
1255+
target_kubernetes_resources {
1256+
api_groups = [
1257+
"apps",
1258+
]
1259+
kinds = [
1260+
"Deployment"
1261+
]
1262+
}
1263+
1264+
target_kubernetes_resources {
1265+
api_groups = [
1266+
"apps",
1267+
]
1268+
kinds = [
1269+
"StatefulSet",
1270+
]
1271+
}
1272+
}
1273+
}
1274+
1275+
namespace_selector {
1276+
match_expressions {
1277+
key = "<label-selector-requirement-key-1>"
1278+
operator = "<label-selector-requirement-operator>"
1279+
values = [
1280+
"<label-selector-requirement-value-1>",
1281+
"<label-selector-requirement-value-2>"
1282+
]
1283+
}
1284+
match_expressions {
1285+
key = "<label-selector-requirement-key-2>"
1286+
operator = "<label-selector-requirement-operator>"
1287+
values = []
1288+
}
1289+
}
1290+
}
1291+
}
1292+
```
1293+
10801294
<!-- schema generated by tfplugindocs -->
10811295
## Schema
10821296

@@ -1147,7 +1361,7 @@ Required:
11471361

11481362
Required:
11491363

1150-
- `input` (Block List, Min: 1, Max: 1) Input for the custom policy, having one of the valid recipes: tmc_block_nodeport_service, tmc_block_resources, tmc_block_rolebinding_subjects, tmc_external_ips, tmc_https_ingress or tmc_require_labels. (see [below for nested schema](#nestedblock--spec--input))
1364+
- `input` (Block List, Min: 1, Max: 1) Input for the custom policy, having one of the valid recipes: [tmc_block_nodeport_service tmc_block_resources tmc_block_rolebinding_subjects tmc_external_ips tmc_https_ingress tmc_require_labels custom]. (see [below for nested schema](#nestedblock--spec--input))
11511365

11521366
Optional:
11531367

@@ -1158,13 +1372,37 @@ Optional:
11581372

11591373
Optional:
11601374

1375+
- `custom` (Block List, Max: 1) The input schema for custom policy tmc_external_ips recipe version v1 (see [below for nested schema](#nestedblock--spec--input--custom))
11611376
- `tmc_block_nodeport_service` (Block List, Max: 1) The input schema for custom policy tmc_block_nodeport_service recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_block_nodeport_service))
11621377
- `tmc_block_resources` (Block List, Max: 1) The input schema for custom policy tmc_block_resources recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_block_resources))
11631378
- `tmc_block_rolebinding_subjects` (Block List, Max: 1) The input schema for custom policy tmc_block_rolebinding_subjects recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_block_rolebinding_subjects))
11641379
- `tmc_external_ips` (Block List, Max: 1) The input schema for custom policy tmc_external_ips recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_external_ips))
11651380
- `tmc_https_ingress` (Block List, Max: 1) The input schema for custom policy tmc_https_ingress recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_https_ingress))
11661381
- `tmc_require_labels` (Block List, Max: 1) The input schema for custom policy tmc_require_labels recipe version v1 (see [below for nested schema](#nestedblock--spec--input--tmc_require_labels))
11671382

1383+
<a id="nestedblock--spec--input--custom"></a>
1384+
### Nested Schema for `spec.input.custom`
1385+
1386+
Required:
1387+
1388+
- `target_kubernetes_resources` (Block List, Min: 1) A list of kubernetes api resources on which the policy will be enforced, identified using apiGroups and kinds. (see [below for nested schema](#nestedblock--spec--input--custom--target_kubernetes_resources))
1389+
- `template_name` (String) Name of custom template.
1390+
1391+
Optional:
1392+
1393+
- `audit` (Boolean) Audit (dry-run).
1394+
- `parameters` (String) JSON encoded template parameters.
1395+
1396+
<a id="nestedblock--spec--input--custom--target_kubernetes_resources"></a>
1397+
### Nested Schema for `spec.input.custom.target_kubernetes_resources`
1398+
1399+
Required:
1400+
1401+
- `api_groups` (List of String) APIGroup is a group containing the resource type.
1402+
- `kinds` (List of String) Kind is the name of the object schema (resource type).
1403+
1404+
1405+
11681406
<a id="nestedblock--spec--input--tmc_block_nodeport_service"></a>
11691407
### Nested Schema for `spec.input.tmc_block_nodeport_service`
11701408

‎examples/resources/custom_policy/resource_cluster_group_tmc_custom.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
resource "tanzu-mission-control_custom_policy" "custom" {
2+
name = "test-custom-template-tf"
3+
4+
scope {
5+
cluster_group {
6+
cluster_group = "tf-create-test"
7+
}
8+
}
9+
10+
11+
spec {
12+
input {
13+
custom {
14+
template_name = "replica-count-range-enforcement"
15+
audit = false
16+
17+
parameters = jsonencode({
18+
ranges = [
19+
{
20+
minReplicas = 3
21+
maxReplicas = 7
22+
}
23+
]
24+
})
25+
26+
27+
28+
target_kubernetes_resources {
29+
api_groups = [
30+
"apps",
31+
]
32+
kinds = [
33+
"Deployment"
34+
]
35+
}
36+
37+
target_kubernetes_resources {
38+
api_groups = [
39+
"apps",
40+
]
41+
kinds = [
42+
"StatefulSet",
43+
]
44+
}
45+
}
46+
}
47+
48+
namespace_selector {
49+
match_expressions {
50+
key = "<label-selector-requirement-key-1>"
51+
operator = "<label-selector-requirement-operator>"
52+
values = [
53+
"<label-selector-requirement-value-1>",
54+
"<label-selector-requirement-value-2>"
55+
]
56+
}
57+
match_expressions {
58+
key = "<label-selector-requirement-key-2>"
59+
operator = "<label-selector-requirement-operator>"
60+
values = []
61+
}
62+
}
63+
}
64+
}

0 commit comments

Comments
 (0)