[Feature] new resource "consul_node_token"

consul/resource_consul_agent_token.go

@@ -0,0 +1,91 @@
+package consul
+
+import (
+	"fmt"
+
+	consulapi "github.com/hashicorp/consul/api"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+)
+
+func resourceConsulAgentToken() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceConsulAgentTokenCreate,
+		Update: nil,
+		Read:   resourceConsulAgentTokenRead,
+		Delete: resourceConsulAgentTokenDelete,
+
+		Schema: map[string]*schema.Schema{
+			"address": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"type": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"accessor_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceConsulAgentTokenCreate(d *schema.ResourceData, meta interface{}) error {
+	config := *meta.(*Config)
+	config.Address = d.Get("address").(string)
+
+	client, err := config.Client()
+	if err != nil {
+		return err
+	}
+
+	tokenType := d.Get("type").(string)
+	accessorID := d.Get("accessor_id").(string)
+
+	aclToken, _, err := client.ACL().TokenRead(accessorID, nil)
+	if err != nil {
+		return err
+	}
+
+	wOpts := &consulapi.WriteOptions{Token: config.Token}
+
+	agent := client.Agent()
+	switch tokenType {
+	case "default":
+		_, err = agent.UpdateDefaultACLToken(aclToken.SecretID, wOpts)
+	case "agent":
+		_, err = agent.UpdateAgentACLToken(aclToken.SecretID, wOpts)
+	case "master":
+		_, err = agent.UpdateAgentMasterACLToken(aclToken.SecretID, wOpts)
+	case "replication":
+		_, err = agent.UpdateReplicationACLToken(aclToken.SecretID, wOpts)
+	default:
+		return fmt.Errorf("Unknown token type '%s'", tokenType)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	d.SetId(fmt.Sprintf("%s-%s", config.Address, tokenType))
+	return nil
+}
+
+func resourceConsulAgentTokenRead(d *schema.ResourceData, meta interface{}) error {
+	// Not implemented. Consul doesn't provide an api to read agent tokens
+	return nil
+}
+
+func resourceConsulAgentTokenDelete(d *schema.ResourceData, meta interface{}) error {
+	// Delete is not implemented. We can call the api with an empty token, but if the
+	// node doesn't exists anymore, the provider will always fail.
+
+	d.SetId("")
+	return nil
+}

consul/resource_provider.go

@@ -121,6 +121,7 @@ func Provider() terraform.ResourceProvider {
 			"consul_acl_token":                   resourceConsulACLToken(),
 			"consul_acl_token_policy_attachment": resourceConsulACLTokenPolicyAttachment(),
 			"consul_agent_service":               resourceConsulAgentService(),
+			"consul_agent_token":                 resourceConsulAgentToken(),
 			"consul_catalog_entry":               resourceConsulCatalogEntry(),
 			"consul_config_entry":                resourceConsulConfigEntry(),
 			"consul_keys":                        resourceConsulKeys(),

website/consul.erb

@@ -115,6 +115,10 @@
               <a href="/docs/providers/consul/r/agent_service.html">consul_agent_service</a>
             </li>
 
+            <li<%= sidebar_current("docs-consul-resource-agent-token") %>>
+              <a href="/docs/providers/consul/r/agent_token.html">consul_agent_token</a>
+            </li>
+
             <li<%= sidebar_current("docs-consul-resource-autopilot-config") %>>
               <a href="/docs/providers/consul/r/autopilot_config.html">consul_autopilot_config</a>
             </li>

website/docs/r/agent_token.html.markdown

@@ -0,0 +1,95 @@
+---
+layout: "consul"
+page_title: "Consul: consul_agent_token"
+sidebar_current: "docs-consul-resource-agent-token"
+description: |-
+  Provides access to Consul Agent Tokens. This can be used to set the [acl_tokens](https://www.consul.io/docs/agent/options#acl_tokens).
+---
+
+# consul_agent_service
+
+Provides access to Consul Agent Tokens. This can be used to set the [acl_tokens](https://www.consul.io/docs/agent/options#acl_tokens).
+
+!> To use this resource, Terraform must have access to the Consul HTTP API.
+!> Read and delete are not implemented. Changes outside of terraform are therefore not detected.
+
+## Example Usage
+
+Creates a token and sets it to `node-1`:
+
+```hcl
+resource "consul_acl_token" "node_1" {
+  description = "node-1 agent token"
+  policies    = ...
+}
+
+resource "consul_agent_token" "node_1" {
+  address     = "node-1:8500"
+  type        = "agent"
+  accessor_id = consul_acl_token.node_1.accessor_id
+}
+
+```
+
+Creates individual agent tokens for all nodes and sets them:
+
+```hcl
+provider "consul" {
+  address = "localhost:8500"
+}
+
+data "consul_nodes" "all" {}
+
+output "test" {
+  value = data.consul_nodes.all
+}
+
+resource "consul_acl_policy" "agent_policies" {
+  count = length(data.consul_nodes.all.nodes)
+
+  name  = "node-policy-${data.consul_nodes.all.nodes[count.index].name}"
+  rules = <<-RULE
+    node "${data.consul_nodes.all.nodes[count.index].name}" {
+      policy = "write"
+    }
+  RULE
+}
+
+resource "consul_acl_token" "agent_tokens" {
+  count = length(data.consul_nodes.all.nodes)
+
+  description = "node token for ${data.consul_nodes.all.nodes[count.index].name}"
+  policies    = [consul_acl_policy.agent_policies[count.index].name]
+}
+
+resource "consul_agent_token" "agent_tokens" {
+  count = length(data.consul_nodes.all.nodes)
+
+  address     = "${data.consul_nodes.all.nodes[count.index].address}:8500"
+  type        = "agent"
+  accessor_id = consul_acl_token.agent_tokens[count.index].accessor_id
+}
+
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `address` - (Required) The address of the service.
+
+* `type` - (Required) The type of the token. (default|agent|master|replication)
+
+* `accessor_id` - (Optional) The token accessor ID.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - An ID generated based on the `address` and `type`
+
+* `address` - The address of the agent.
+
+* `type` - The type of the token.
+
+* `accessor_id` - The token accessor ID.