Add Fleet API Client

.github/workflows/test.yml

@@ -78,6 +78,7 @@ jobs:
           ELASTICSEARCH_USERNAME: ${{ env.KIBANA_SYSTEM_USERNAME }}
           ELASTICSEARCH_PASSWORD: ${{ env.KIBANA_SYSTEM_PASSWORD }}
           XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY: a7a6311933d3503b89bc2dbc36572c33a6c10925682e591bffcab6911c06786d
+          xpack.fleet.enabled: true
         ports:
           - 5601:5601
 
@@ -128,3 +129,6 @@ jobs:
           ELASTICSEARCH_USERNAME: "elastic"
           ELASTICSEARCH_PASSWORD: ${{ env.ELASTIC_PASSWORD }}
           KIBANA_ENDPOINT: "http://localhost:5601"
+          FLEET_ENDPOINT: "http://localhost:5601"
+          FLEET_USERNAME: "elastic"
+          FLEET_PASSWORD: ${{ env.ELASTIC_PASSWORD }}

CHANGELOG.md

@@ -23,6 +23,7 @@
 - Add `elasticstack_elasticsearch_transform` for managing Elasticsearch transforms ([#284](https://github.com/elastic/terraform-provider-elasticstack/pull/284))
 - Add `elasticstack_elasticsearch_watch` for managing Elasticsearch Watches ([#155](https://github.com/elastic/terraform-provider-elasticstack/pull/155))
 - Add `elasticstack_kibana_alerting_rule` for managing Kibana alerting rules ([#292](https://github.com/elastic/terraform-provider-elasticstack/pull/292))
+- Add client for communicating with the Fleet APIs ([#311](https://github.com/elastic/terraform-provider-elasticstack/pull/311)])
 
 ### Fixed
 - Updated unsupported queue_max_bytes_number and queue_max_bytes_units with queue.max_bytes ([#266](https://github.com/elastic/terraform-provider-elasticstack/issues/266))

docs/index.md

@@ -86,6 +86,7 @@ provider "elasticstack" {
 ### Optional
 
 - `elasticsearch` (Block List, Max: 1) Elasticsearch connection configuration block. (see [below for nested schema](#nestedblock--elasticsearch))
+- `fleet` (Block List, Max: 1) Fleet connection configuration block. (see [below for nested schema](#nestedblock--fleet))
 - `kibana` (Block List, Max: 1) Kibana connection configuration block. (see [below for nested schema](#nestedblock--kibana))
 
 <a id="nestedblock--elasticsearch"></a>
@@ -106,6 +107,19 @@ Optional:
 - `username` (String) Username to use for API authentication to Elasticsearch.
 
 
+<a id="nestedblock--fleet"></a>
+### Nested Schema for `fleet`
+
+Optional:
+
+- `api_key` (String, Sensitive) API key to use for API authentication to Fleet.
+- `ca_certs` (List of String) A list of paths to CA certificates to validate the certificate presented by the Fleet server.
+- `endpoint` (String, Sensitive) The Fleet server where the terraform provider will point to, this must include the http(s) schema and port number.
+- `insecure` (Boolean) Disable TLS certificate validation
+- `password` (String, Sensitive) Password to use for API authentication to Fleet.
+- `username` (String) Username to use for API authentication to Fleet.
+
+
 <a id="nestedblock--kibana"></a>
 ### Nested Schema for `kibana`
 

go.mod

@@ -3,6 +3,7 @@ module github.com/elastic/terraform-provider-elasticstack
 go 1.19
 
 require (
+	github.com/deepmap/oapi-codegen v1.12.4
 	github.com/disaster37/go-kibana-rest/v8 v8.5.0
 	github.com/elastic/go-elasticsearch/v7 v7.17.7
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
@@ -16,12 +17,14 @@ require (
 
 require (
 	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/go-resty/resty/v2 v2.7.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/uuid v1.3.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect

go.sum

@@ -6,21 +6,27 @@ github.com/Microsoft/go-winio v0.4.16 h1:FtSW/jqD+l4ba5iPBj9CODVtgfYAD8w2wS923g/
 github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
+github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
 github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
 github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
+github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
+github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/deepmap/oapi-codegen v1.12.4 h1:pPmn6qI9MuOtCz82WY2Xaw46EQjgvxednXXrP7g5Q2s=
+github.com/deepmap/oapi-codegen v1.12.4/go.mod h1:3lgHGMu6myQ2vqbbTXH2H1o4eXFTGnFiDaOaKKl5yas=
 github.com/disaster37/go-kibana-rest/v8 v8.5.0 h1:Wr2CMopHj0wAh7kq3p355jXctISL1LdAZ9kYN/v6abw=
 github.com/disaster37/go-kibana-rest/v8 v8.5.0/go.mod h1:wVGm1b93CSmsHYoxzqhDszv347xr+fELdigS8XLO+bg=
 github.com/elastic/go-elasticsearch/v7 v7.17.7 h1:pcYNfITNPusl+cLwLN6OLmVT+F73Els0nbaWOmYachs=
@@ -55,6 +61,8 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -110,6 +118,7 @@ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOl
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
 github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
 github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351 h1:DowS9hvgyYSX4TO5NpyC606/Z4SxnNYbT+WX27or6Ck=
 github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -163,11 +172,13 @@ github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMB
 github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

internal/clients/api_client.go

@@ -8,11 +8,13 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 
 	"github.com/disaster37/go-kibana-rest/v8"
 	"github.com/elastic/go-elasticsearch/v7"
 	"github.com/elastic/terraform-provider-elasticstack/generated/alerting"
+	"github.com/elastic/terraform-provider-elasticstack/internal/clients/fleet"
 	"github.com/elastic/terraform-provider-elasticstack/internal/models"
 	"github.com/elastic/terraform-provider-elasticstack/internal/utils"
 	"github.com/hashicorp/go-version"
@@ -63,6 +65,7 @@ type ApiClient struct {
 	kibana                   *kibana.Client
 	alerting                 alerting.AlertingApi
 	kibanaConfig             kibana.Config
+	fleet                    *fleet.Client
 	version                  string
 }
 
@@ -120,11 +123,38 @@ func NewAcceptanceTestingClient() (*ApiClient, error) {
 		return nil, err
 	}
 
+	fleetCfg := fleet.Config{
+		URL:      kibanaConfig.Address,
+		Username: kibanaConfig.Username,
+		Password: kibanaConfig.Password,
+		APIKey:   os.Getenv("FLEET_API_KEY"),
+	}
+	if v := os.Getenv("FLEET_CA_CERTS"); v != "" {
+		fleetCfg.CACerts = strings.Split(os.Getenv("FLEET_CA_CERTS"), ",")
+	}
+	if v := os.Getenv("FLEET_USERNAME"); v != "" {
+		fleetCfg.Username = v
+	}
+	if v := os.Getenv("FLEET_PASSWORD"); v != "" {
+		fleetCfg.Password = v
+	}
+	if v := os.Getenv("FLEET_INSECURE"); v != "" {
+		if val, err := strconv.ParseBool(v); err == nil {
+			fleetCfg.Insecure = val
+		}
+	}
+
+	fleetClient, err := fleet.NewClient(fleetCfg)
+	if err != nil {
+		return nil, err
+	}
+
 	return &ApiClient{
 			elasticsearch: es,
 			kibana:        kib,
 			alerting:      buildAlertingClient(baseConfig, kibanaConfig).AlertingApi,
 			kibanaConfig:  kibanaConfig,
+			fleet:         fleetClient,
 			version:       "acceptance-testing",
 		},
 		nil
@@ -151,6 +181,7 @@ func NewApiClient(d *schema.ResourceData, meta interface{}) (*ApiClient, diag.Di
 		elasticsearch:            esClient,
 		elasticsearchClusterInfo: defaultClient.elasticsearchClusterInfo,
 		kibana:                   defaultClient.kibana,
+		fleet:                    defaultClient.fleet,
 		version:                  version,
 	}, diags
 }
@@ -189,6 +220,14 @@ func (a *ApiClient) GetAlertingClient() (alerting.AlertingApi, error) {
 	return a.alerting, nil
 }
 
+func (a *ApiClient) GetFleetClient() (*fleet.Client, error) {
+	if a.fleet == nil {
+		return nil, errors.New("fleet client not found")
+	}
+
+	return a.fleet, nil
+}
+
 func (a *ApiClient) SetAlertingAuthContext(ctx context.Context) context.Context {
 	return context.WithValue(ctx, alerting.ContextBasicAuth, alerting.BasicAuth{
 		UserName: a.kibanaConfig.Username,
@@ -503,6 +542,92 @@ func buildAlertingClient(baseConfig BaseConfig, config kibana.Config) *alerting.
 	return alerting.NewAPIClient(&alertingConfig)
 }
 
+func buildFleetClient(d *schema.ResourceData, baseConfig BaseConfig) (*fleet.Client, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	// Order of precedence for config options:
+	// 1 (highest): environment variables
+	// 2: resource config
+	// 3: base config
+
+	// Set variables from base config.
+	config := fleet.Config{
+		Username: baseConfig.Username,
+		Password: baseConfig.Password,
+	}
+
+	// Set variables from resource config.
+	fleetDataRaw, ok := d.GetOk("fleet")
+	if !ok {
+		return nil, diags
+	}
+	fleetData := fleetDataRaw.([]interface{})[0].(map[string]any)
+	if !ok {
+		diags = append(diags, diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  "Unable to parse Fleet configuration",
+			Detail:   "Fleet configuration data has not been configured correctly or is empty",
+		})
+		return nil, diags
+	}
+	if v, ok := fleetData["endpoint"].(string); ok && v != "" {
+		config.URL = v
+	}
+	if v, ok := fleetData["username"].(string); ok && v != "" {
+		config.Username = v
+	}
+	if v, ok := fleetData["password"].(string); ok && v != "" {
+		config.Password = v
+	}
+	if v, ok := fleetData["api_key"].(string); ok && v != "" {
+		config.APIKey = v
+	}
+	if v, ok := fleetData["ca_certs"].([]interface{}); ok && len(v) > 0 {
+		for _, elem := range v {
+			if vStr, elemOk := elem.(string); elemOk {
+				config.CACerts = append(config.CACerts, vStr)
+			}
+		}
+	}
+	if v, ok := fleetData["insecure"].(bool); ok {
+		config.Insecure = v
+	}
+
+	// Set variables from environment variables.
+	if v := os.Getenv("FLEET_ENDPOINT"); v != "" {
+		config.URL = v
+	}
+	if v := os.Getenv("FLEET_USERNAME"); v != "" {
+		config.Username = v
+	}
+	if v := os.Getenv("FLEET_PASSWORD"); v != "" {
+		config.Password = v
+	}
+	if v := os.Getenv("FLEET_API_KEY"); v != "" {
+		config.APIKey = v
+	}
+	if v := os.Getenv("FLEET_CA_CERTS"); v != "" {
+		config.CACerts = strings.Split(v, ",")
+	}
+	if v := os.Getenv("FLEET_INSECURE"); v != "" {
+		if val, err := strconv.ParseBool(v); err == nil {
+			config.Insecure = val
+		}
+	}
+
+	client, err := fleet.NewClient(config)
+	if err != nil {
+		diags = append(diags, diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  "Unable to create Fleet client",
+			Detail:   err.Error(),
+		})
+		return nil, diags
+	}
+
+	return client, diags
+}
+
 const esKey string = "elasticsearch"
 
 func newApiClient(d *schema.ResourceData, version string) (*ApiClient, diag.Diagnostics) {
@@ -525,12 +650,18 @@ func newApiClient(d *schema.ResourceData, version string) (*ApiClient, diag.Diag
 
 	alertingClient := buildAlertingClient(baseConfig, kibanaConfig)
 
+	fleetClient, diags := buildFleetClient(d, baseConfig)
+	if diags.HasError() {
+		return nil, diags
+	}
+
 	return &ApiClient{
 		elasticsearch:            esClient,
 		elasticsearchClusterInfo: nil,
 		kibana:                   kibanaClient,
 		kibanaConfig:             kibanaConfig,
 		alerting:                 alertingClient.AlertingApi,
+		fleet:                    fleetClient,
 		version:                  version,
 	}, diags
 }