Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_nginx_deployment - support NGINX App Protect WAF #27454

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
+334 −0
Open

azurerm_nginx_deployment - support NGINX App Protect WAF #27454

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c2be86c
NGINXaaS App Protect
arpith-f5 Sep 20, 2024
9ad26b2
fix comments
arpith-f5 Sep 27, 2024
795f4cb
Merge branch 'hashicorp:main' into nginxaas_nap
arpith-f5 Sep 27, 2024
4f6d8ec
update docs
arpith-f5 Sep 27, 2024
a9c6ce8
fix test
arpith-f5 Oct 17, 2024
bd06e95
fix comments
arpith-f5 Nov 5, 2024
e39ad7f
nest status within web_application_firewall
arpith-f5 Nov 21, 2024
8f5233a
Merge remote-tracking branch 'upstream/main' into nginxaas_nap
arpith-f5 Jan 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
149 changes: 131 additions & 18 deletions internal/services/nginx/nginx_deployment_data_source.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,24 +19,26 @@ import (
)

type DeploymentDataSourceModel struct {
ResourceGroupName string `tfschema:"resource_group_name"`
Name string `tfschema:"name"`
NginxVersion string `tfschema:"nginx_version"`
Identity []identity.ModelSystemAssignedUserAssigned `tfschema:"identity"`
Sku string `tfschema:"sku"`
ManagedResourceGroup string `tfschema:"managed_resource_group"`
Location string `tfschema:"location"`
Capacity int64 `tfschema:"capacity"`
AutoScaleProfile []AutoScaleProfile `tfschema:"auto_scale_profile"`
DiagnoseSupportEnabled bool `tfschema:"diagnose_support_enabled"`
Email string `tfschema:"email"`
IpAddress string `tfschema:"ip_address"`
LoggingStorageAccount []LoggingStorageAccount `tfschema:"logging_storage_account"`
FrontendPublic []FrontendPublic `tfschema:"frontend_public"`
FrontendPrivate []FrontendPrivate `tfschema:"frontend_private"`
NetworkInterface []NetworkInterface `tfschema:"network_interface"`
UpgradeChannel string `tfschema:"automatic_upgrade_channel"`
Tags map[string]string `tfschema:"tags"`
ResourceGroupName string `tfschema:"resource_group_name"`
Name string `tfschema:"name"`
NginxVersion string `tfschema:"nginx_version"`
Identity []identity.ModelSystemAssignedUserAssigned `tfschema:"identity"`
Sku string `tfschema:"sku"`
ManagedResourceGroup string `tfschema:"managed_resource_group"`
Location string `tfschema:"location"`
Capacity int64 `tfschema:"capacity"`
AutoScaleProfile []AutoScaleProfile `tfschema:"auto_scale_profile"`
DiagnoseSupportEnabled bool `tfschema:"diagnose_support_enabled"`
Email string `tfschema:"email"`
IpAddress string `tfschema:"ip_address"`
LoggingStorageAccount []LoggingStorageAccount `tfschema:"logging_storage_account"`
FrontendPublic []FrontendPublic `tfschema:"frontend_public"`
FrontendPrivate []FrontendPrivate `tfschema:"frontend_private"`
NetworkInterface []NetworkInterface `tfschema:"network_interface"`
UpgradeChannel string `tfschema:"automatic_upgrade_channel"`
WebApplicationFirewallSettings []WebApplicationFirewallSettings `tfschema:"web_application_firewall_settings"`
WebApplicationFirewallStatus []WebApplicationFirewallStatus `tfschema:"web_application_firewall_status"`
Tags map[string]string `tfschema:"tags"`
}

type DeploymentDataSource struct{}
Expand Down Expand Up @@ -194,10 +196,74 @@ func (m DeploymentDataSource) Attributes() map[string]*pluginsdk.Schema {
Computed: true,
},

"web_application_firewall_settings": {
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
Type: pluginsdk.TypeList,
Computed: true,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"activation_state": {
Type: pluginsdk.TypeString,
Computed: true,
},
},
},
},

"web_application_firewall_status": {
Type: pluginsdk.TypeList,
Computed: true,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"attack_signatures_package": webApplicationFirewallPackageComputed(),
"bot_signatures_package": webApplicationFirewallPackageComputed(),
"threat_campaigns_package": webApplicationFirewallPackageComputed(),
"component_versions": webApplicationFirewallComponentVersionsComputed(),
},
},
},

"tags": commonschema.TagsDataSource(),
}
}

func webApplicationFirewallPackageComputed() *pluginsdk.Schema {
return &pluginsdk.Schema{
Type: pluginsdk.TypeList,
Computed: true,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"revision_datetime": {
Type: pluginsdk.TypeString,
Computed: true,
},
"version": {
Type: pluginsdk.TypeString,
Computed: true,
},
},
},
}
}

func webApplicationFirewallComponentVersionsComputed() *pluginsdk.Schema {
return &pluginsdk.Schema{
Type: pluginsdk.TypeList,
Computed: true,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"waf_engine_version": {
Type: pluginsdk.TypeString,
Computed: true,
},
"waf_nginx_version": {
Type: pluginsdk.TypeString,
Computed: true,
},
},
},
}
}

func (m DeploymentDataSource) ModelObject() interface{} {
return &DeploymentDataSourceModel{}
}
Expand Down Expand Up @@ -313,6 +379,53 @@ func (m DeploymentDataSource) Read() sdk.ResourceFunc {
if props.AutoUpgradeProfile != nil {
output.UpgradeChannel = props.AutoUpgradeProfile.UpgradeChannel
}

if props.NginxAppProtect != nil {
if props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState != nil {
output.WebApplicationFirewallSettings = []WebApplicationFirewallSettings{
{
string(*props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState),
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus != nil {
wafStatus := WebApplicationFirewallStatus{}
if props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage != nil {
wafStatus.AttackSignaturesPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage != nil {
wafStatus.BotSignaturesPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage != nil {
wafStatus.ThreatCampaignsPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions != nil {
wafStatus.ComponentVersions = []WebApplicationFirewallComponentVersions{
{
WafEngineVersion: props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions.WafEngineVersion,
WafNginxVersion: props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions.WafNginxVersion,
},
}
}
output.WebApplicationFirewallStatus = []WebApplicationFirewallStatus{wafStatus}
}
}

}
}

Expand Down
24 changes: 24 additions & 0 deletions internal/services/nginx/nginx_deployment_data_source_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,3 +69,27 @@ func TestAccNginxDeploymentDataSource_autoscaling(t *testing.T) {
},
})
}

func (d NginxDeploymentDataSource) basicNginxAppProtect(data acceptance.TestData) string {
return fmt.Sprintf(`
%s
data "azurerm_nginx_deployment" "test" {
name = azurerm_nginx_deployment.test.name
resource_group_name = azurerm_nginx_deployment.test.resource_group_name
}
`, DeploymentResource{}.basicNginxAppProtect(data))
}

func TestAccNginxDeploymentDataSource_nginxappprotect(t *testing.T) {
data := acceptance.BuildTestData(t, "data.azurerm_nginx_deployment", "test")
r := NginxDeploymentDataSource{}

data.DataSourceTest(t, []acceptance.TestStep{
{
Config: r.basicNginxAppProtect(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).Key("web_application_firewall_settings.0.activation_state").HasValue("Enabled"),
),
},
})
}
152 changes: 135 additions & 17 deletions internal/services/nginx/nginx_deployment_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,24 +62,47 @@ type AutoScaleProfile struct {
Max int64 `tfschema:"max_capacity"`
}

type WebApplicationFirewallSettings struct {
ActivationState string `tfschema:"activation_state"`
}

type WebApplicationFirewallPackage struct {
RevisionDatetime string `tfschema:"revision_datetime"`
Version string `tfschema:"version"`
}

type WebApplicationFirewallComponentVersions struct {
WafEngineVersion string `tfschema:"waf_engine_version"`
WafNginxVersion string `tfschema:"waf_nginx_version"`
}

type WebApplicationFirewallStatus struct {
AttackSignaturesPackage []WebApplicationFirewallPackage `tfschema:"attack_signatures_package"`
BotSignaturesPackage []WebApplicationFirewallPackage `tfschema:"bot_signatures_package"`
ComponentVersions []WebApplicationFirewallComponentVersions `tfschema:"component_versions"`
ThreatCampaignsPackage []WebApplicationFirewallPackage `tfschema:"threat_campaigns_package"`
}

type DeploymentModel struct {
ResourceGroupName string `tfschema:"resource_group_name"`
Name string `tfschema:"name"`
NginxVersion string `tfschema:"nginx_version"`
Identity []identity.ModelSystemAssignedUserAssigned `tfschema:"identity"`
Sku string `tfschema:"sku"`
ManagedResourceGroup string `tfschema:"managed_resource_group"`
Location string `tfschema:"location"`
Capacity int64 `tfschema:"capacity"`
AutoScaleProfile []AutoScaleProfile `tfschema:"auto_scale_profile"`
DiagnoseSupportEnabled bool `tfschema:"diagnose_support_enabled"`
Email string `tfschema:"email"`
IpAddress string `tfschema:"ip_address"`
LoggingStorageAccount []LoggingStorageAccount `tfschema:"logging_storage_account"`
FrontendPublic []FrontendPublic `tfschema:"frontend_public"`
FrontendPrivate []FrontendPrivate `tfschema:"frontend_private"`
NetworkInterface []NetworkInterface `tfschema:"network_interface"`
UpgradeChannel string `tfschema:"automatic_upgrade_channel"`
ResourceGroupName string `tfschema:"resource_group_name"`
Name string `tfschema:"name"`
NginxVersion string `tfschema:"nginx_version"`
Identity []identity.ModelSystemAssignedUserAssigned `tfschema:"identity"`
Sku string `tfschema:"sku"`
ManagedResourceGroup string `tfschema:"managed_resource_group"`
Location string `tfschema:"location"`
Capacity int64 `tfschema:"capacity"`
AutoScaleProfile []AutoScaleProfile `tfschema:"auto_scale_profile"`
DiagnoseSupportEnabled bool `tfschema:"diagnose_support_enabled"`
Email string `tfschema:"email"`
IpAddress string `tfschema:"ip_address"`
LoggingStorageAccount []LoggingStorageAccount `tfschema:"logging_storage_account"`
FrontendPublic []FrontendPublic `tfschema:"frontend_public"`
FrontendPrivate []FrontendPrivate `tfschema:"frontend_private"`
NetworkInterface []NetworkInterface `tfschema:"network_interface"`
UpgradeChannel string `tfschema:"automatic_upgrade_channel"`
WebApplicationFirewallSettings []WebApplicationFirewallSettings `tfschema:"web_application_firewall_settings"`
WebApplicationFirewallStatus []WebApplicationFirewallStatus `tfschema:"web_application_firewall_status"`
// Deprecated: remove in next major version
Configuration []Configuration `tfschema:"configuration,removedInNextMajorVersion"`
Tags map[string]string `tfschema:"tags"`
Expand Down Expand Up @@ -262,6 +285,24 @@ func (m DeploymentResource) Arguments() map[string]*pluginsdk.Schema {
}, false),
},

"web_application_firewall_settings": {
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
Type: pluginsdk.TypeList,
Optional: true,
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"activation_state": {
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
Type: pluginsdk.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice(
[]string{
"Enabled",
"Disabled",
}, false),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a bool? so we should

Suggested change
Type: pluginsdk.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice(
[]string{
"Enabled",
"Disabled",
}, false),
Type: pluginsdk.TypeBool,
Required: true,

and then in the provider code translate true/false to Enabled Disabled, unless there is going to be a 3rd state here?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The state is an enum.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unless there is going to be a 3rd setting there in the future? this is a bool just represented as an enum and should be as such in the schema

Copy link
Contributor Author

@arpith-f5 arpith-f5 Nov 20, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we initially designed the activation_state to be a bool in the schema but later changed to enum after recommendation from microsoft ARM team. Here is their reasoning

ARM recommends enums over booleans for future proof APIs. Standard guidance is: replace boolean/switch properties with a more meaningful enum whenever possible.

A boolean will forever have two valid values (true or false). A string enum type is always preferred. Also, properties should always provide better values just than True and False. For example two switches "isTypeA" and "isTypeB" should be replaced with one enum "type": [A, B, DefaultType]. Enums are always a more flexible and future proof option because they allow additional values to be added in the future in a non-breaking way, e.g. [Enabled, Disabled, Suspended, Deallocated].

Note: do NOT define a 'boolean enum' with two values 'True and False'. This might be easier to 'extend' in terms of types, but semantically its confusing, and no better than a boolean.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per our guidelines enums that are actually just booleans with different names should be booleans in schema with the correct name to telegraph what the boolean does https://github.com/hashicorp/terraform-provider-azurerm/blob/main/contributing/topics/reference-naming.md

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@katbyte updated the PR to use a bool instead of the enum

},
},
},
},

"tags": commonschema.Tags(),
}

Expand Down Expand Up @@ -351,6 +392,19 @@ func (m DeploymentResource) Attributes() map[string]*pluginsdk.Schema {
Type: pluginsdk.TypeString,
Computed: true,
},

"web_application_firewall_status": {
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
Type: pluginsdk.TypeList,
Computed: true,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
"attack_signatures_package": webApplicationFirewallPackageComputed(),
"bot_signatures_package": webApplicationFirewallPackageComputed(),
"threat_campaigns_package": webApplicationFirewallPackageComputed(),
"component_versions": webApplicationFirewallComponentVersionsComputed(),
},
},
},
}
}

Expand Down Expand Up @@ -496,6 +550,15 @@ func (m DeploymentResource) Create() sdk.ResourceFunc {
}
}

if len(model.WebApplicationFirewallSettings) > 0 {
activationState := nginxdeployment.ActivationState(model.WebApplicationFirewallSettings[0].ActivationState)
prop.NginxAppProtect = &nginxdeployment.NginxDeploymentPropertiesNginxAppProtect{
WebApplicationFirewallSettings: nginxdeployment.WebApplicationFirewallSettings{
ActivationState: &activationState,
},
}
}

req.Properties = prop

req.Identity, err = identity.ExpandSystemAndUserAssignedMapFromModel(model.Identity)
Expand Down Expand Up @@ -627,6 +690,52 @@ func (m DeploymentResource) Read() sdk.ResourceFunc {
output.UpgradeChannel = props.AutoUpgradeProfile.UpgradeChannel
}

if props.NginxAppProtect != nil {
if props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState != nil {
output.WebApplicationFirewallSettings = []WebApplicationFirewallSettings{
{
string(*props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState),
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus != nil {
wafStatus := WebApplicationFirewallStatus{}
if props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage != nil {
arpith-f5 marked this conversation as resolved.
Show resolved Hide resolved
wafStatus.AttackSignaturesPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.AttackSignaturesPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage != nil {
wafStatus.BotSignaturesPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.BotSignaturesPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage != nil {
wafStatus.ThreatCampaignsPackage = []WebApplicationFirewallPackage{
{
RevisionDatetime: props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage.RevisionDatetime,
Version: props.NginxAppProtect.WebApplicationFirewallStatus.ThreatCampaignsPackage.Version,
},
}
}
if props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions != nil {
wafStatus.ComponentVersions = []WebApplicationFirewallComponentVersions{
{
WafEngineVersion: props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions.WafEngineVersion,
WafNginxVersion: props.NginxAppProtect.WebApplicationFirewallStatus.ComponentVersions.WafNginxVersion,
},
}
}
output.WebApplicationFirewallStatus = []WebApplicationFirewallStatus{wafStatus}
}
}

flattenedIdentity, err := identity.FlattenSystemAndUserAssignedMapToModel(model.Identity)
if err != nil {
return fmt.Errorf("flattening `identity`: %v", err)
Expand Down Expand Up @@ -766,6 +875,15 @@ func (m DeploymentResource) Update() sdk.ResourceFunc {
return fmt.Errorf("basic SKUs are incompatible with `capacity` or `auto_scale_profiles`")
}

if meta.ResourceData.HasChange("web_application_firewall_settings") {
activationState := nginxdeployment.ActivationState(model.WebApplicationFirewallSettings[0].ActivationState)
req.Properties.NginxAppProtect = &nginxdeployment.NginxDeploymentUpdatePropertiesNginxAppProtect{
WebApplicationFirewallSettings: &nginxdeployment.WebApplicationFirewallSettings{
ActivationState: &activationState,
},
}
}

if err := client.DeploymentsUpdateThenPoll(ctx, *id, req); err != nil {
return fmt.Errorf("updating %s: %v", id, err)
}
Expand Down
Loading
Loading