Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use new semantic version checking for Consul secrets backend logic #1593

Merged
merged 16 commits into from
Sep 7, 2022
Merged

Use new semantic version checking for Consul secrets backend logic #1593

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
e91f30c
Update consul secrets backend to use semver
robmonte Aug 31, 2022
79bd83b
Update code comment
robmonte Aug 31, 2022
861fd6f
Add code comment
robmonte Aug 31, 2022
9fd1536
Running make fmt again to see if that clears CI failure
robmonte Sep 1, 2022
a8f3386
Revert "Running make fmt again to see if that clears CI failure"
robmonte Sep 1, 2022
70d0e1d
Update resource_consul_secret_backend_role.go
robmonte Sep 1, 2022
a77544c
Refactor var name, add better error message when failing to get Vault…
robmonte Sep 1, 2022
2eb24f8
Update consul backend resource to use context functions and use semve…
robmonte Sep 1, 2022
e189581
Variable refactor and line-length adjustment
robmonte Sep 2, 2022
e2abe24
Add check for using old older Vault but user specifies consul_policies
robmonte Sep 2, 2022
a979fbb
Simplify write logic for policies, update role tests to handle legacy…
robmonte Sep 2, 2022
48b3fc3
Add comment, spacing
robmonte Sep 3, 2022
34db012
Add support for custom ImportStateCheck function to testutil.GetImpor…
robmonte Sep 6, 2022
a0a894f
Split Consul secret backend role tests into two separate test sets
robmonte Sep 6, 2022
cdbf279
Split TestCheckResourceAttr lists and add common values
robmonte Sep 7, 2022
83480fd
Build TestChecks from a base list to reduce code replication a bit
robmonte Sep 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 35 additions & 41 deletions vault/resource_consul_secret_backend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ package vault
import (
"context"
"fmt"
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
"github.com/hashicorp/terraform-provider-vault/internal/consts"
"github.com/hashicorp/terraform-provider-vault/internal/semver"
"log"
"strings"

Expand All @@ -14,14 +17,13 @@ import (

func consulSecretBackendResource() *schema.Resource {
return &schema.Resource{
Create: consulSecretBackendCreate,
Read: ReadWrapper(consulSecretBackendRead),
Update: consulSecretBackendUpdate,
Delete: consulSecretBackendDelete,
Exists: consulSecretBackendExists,
CreateContext: consulSecretBackendCreate,
ReadContext: ReadContextWrapper(consulSecretBackendRead),
UpdateContext: consulSecretBackendUpdate,
DeleteContext: consulSecretBackendDelete,
CustomizeDiff: consulSecretsBackendCustomizeDiff,
Importer: &schema.ResourceImporter{
State: schema.ImportStatePassthrough,
StateContext: schema.ImportStatePassthroughContext,
},

Schema: map[string]*schema.Schema{
Expand Down Expand Up @@ -110,10 +112,10 @@ func consulSecretBackendResource() *schema.Resource {
}
}

func consulSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
func consulSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
client, e := provider.GetClient(d, meta)
if e != nil {
return e
return diag.FromErr(e)
}

path := d.Get("path").(string)
Expand All @@ -140,8 +142,18 @@ func consulSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
d.Partial(true)
log.Printf("[DEBUG] Mounting Consul backend at %q", path)

// If a token isn't provided and the Vault version is less than 1.11, fail before mounting the path in Vault.
bootstrapSupport, _, err := semver.GreaterThanOrEqual(ctx, client, consts.VaultVersion11)
robmonte marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
return diag.Errorf("Failed to read Vault client version: %s", err)
}
if token == "" && !bootstrapSupport {
return diag.Errorf(`Error writing Consul configuration: no token provided and the Vault client
robmonte marked this conversation as resolved.
Show resolved Hide resolved
version does not meet the minimum requirement for this feature (Vault 1.11+)`)
}

if err := client.Sys().Mount(path, info); err != nil {
return fmt.Errorf("Error mounting to %q: %s", path, err)
return diag.Errorf("Error mounting to %q: %s", path, err)
robmonte marked this conversation as resolved.
Show resolved Hide resolved
}

log.Printf("[DEBUG] Mounted Consul backend at %q", path)
Expand All @@ -160,18 +172,18 @@ func consulSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
}

if _, err := client.Logical().Write(configPath, data); err != nil {
return fmt.Errorf("Error writing Consul configuration for %q: %s", path, err)
return diag.Errorf("Error writing Consul configuration for %q: %s", path, err)
robmonte marked this conversation as resolved.
Show resolved Hide resolved
}
log.Printf("[DEBUG] Wrote Consul configuration to %q", configPath)
d.Partial(false)

return consulSecretBackendRead(d, meta)
return consulSecretBackendRead(ctx, d, meta)
}

func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
func consulSecretBackendRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
client, e := provider.GetClient(d, meta)
if e != nil {
return e
return diag.FromErr(e)
}

path := d.Id()
Expand All @@ -181,7 +193,7 @@ func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error {

mounts, err := client.Sys().ListMounts()
if err != nil {
return fmt.Errorf("Error reading mount %q: %s", path, err)
return diag.Errorf("Error reading mount %q: %s", path, err)
robmonte marked this conversation as resolved.
Show resolved Hide resolved
}

// path can have a trailing slash, but doesn't need to have one
Expand All @@ -203,7 +215,7 @@ func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
log.Printf("[DEBUG] Reading %s from Vault", configPath)
secret, err := client.Logical().Read(configPath)
if err != nil {
return fmt.Errorf("error reading from Vault: %s", err)
return diag.Errorf("error reading from Vault: %s", err)
}

// token, sadly, we can't read out
Expand All @@ -215,10 +227,10 @@ func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
return nil
}

func consulSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
func consulSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
client, e := provider.GetClient(d, meta)
if e != nil {
return e
return diag.FromErr(e)
}

path := d.Id()
Expand All @@ -234,7 +246,7 @@ func consulSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {

log.Printf("[DEBUG] Updating lease TTLs for %q", path)
if err := client.Sys().TuneMount(path, config); err != nil {
return fmt.Errorf("Error updating mount TTLs for %q: %s", path, err)
return diag.Errorf("Error updating mount TTLs for %q: %s", path, err)
}

}
Expand All @@ -250,49 +262,31 @@ func consulSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
"client_key": d.Get("client_key").(string),
}
if _, err := client.Logical().Write(configPath, data); err != nil {
return fmt.Errorf("Error configuring Consul configuration for %q: %s", path, err)
return diag.Errorf("Error configuring Consul configuration for %q: %s", path, err)
}
log.Printf("[DEBUG] Updated Consul configuration at %q", configPath)
}
d.Partial(false)
return consulSecretBackendRead(d, meta)
return consulSecretBackendRead(ctx, d, meta)
}

func consulSecretBackendDelete(d *schema.ResourceData, meta interface{}) error {
func consulSecretBackendDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
client, e := provider.GetClient(d, meta)
if e != nil {
return e
return diag.FromErr(e)
}

path := d.Id()

log.Printf("[DEBUG] Unmounting Consul backend %q", path)
err := client.Sys().Unmount(path)
if err != nil {
return fmt.Errorf("Error unmounting Consul backend from %q: %s", path, err)
return diag.Errorf("Error unmounting Consul backend from %q: %s", path, err)
}
log.Printf("[DEBUG] Unmounted Consul backend %q", path)
return nil
}

func consulSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) {
client, e := provider.GetClient(d, meta)
if e != nil {
return false, e
}

path := d.Id()

log.Printf("[DEBUG] Checking if Consul backend exists at %q", path)
mounts, err := client.Sys().ListMounts()
if err != nil {
return true, fmt.Errorf("Error retrieving list of mounts: %s", err)
}
log.Printf("[DEBUG] Checked if Consul backend exists at %q", path)
_, ok := mounts[strings.Trim(path, "/")+"/"]
return ok, nil
}

func consulSecretBackendConfigPath(backend string) string {
return strings.Trim(backend, "/") + "/config/access"
}
Expand Down
Loading