-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #342 from vmware/feat/permission-template
Feat/Permission Template
- Loading branch information
Showing
17 changed files
with
875 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| --- | ||
| Title: "Permission Template Data Source" | ||
| Description: |- | ||
| Retrieves an AWS CloudFormation permission template for creating credentials. | ||
| --- | ||
|
|
||
| # Permission Template Data Source | ||
|
|
||
| This data source enables users get an AWS CloudFormation template for creating the necessary assets in AWS when creating TMC credentials. | ||
|
|
||
| **NOTE**: Currently, only the 'AWS_EC2' and 'AWS_EKS' capabilities are supported in conjunction with the 'DATA_PROTECTION' and 'MANAGED_K8S_PROVIDER' providers. | ||
|
|
||
| # Data Protection Permission Template | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| locals { | ||
| credentials_name = "test-permission-template-data-protection-tf-111" | ||
| tanzu_capability = "DATA_PROTECTION" | ||
| tanzu_provider = "AWS_EC2" | ||
| stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message) | ||
| permission_arn = element(local.stack_message, length(local.stack_message) - 1) | ||
| } | ||
| data "tanzu-mission-control_permission_template" "data_protection_permissions" { | ||
| credentials_name = local.credentials_name | ||
| tanzu_capability = local.tanzu_capability | ||
| tanzu_provider = local.tanzu_provider | ||
| } | ||
| resource "aws_cloudformation_stack" "crendetials_permission_template" { | ||
| name = local.credentials_name | ||
| parameters = data.tanzu-mission-control_permission_template.data_protection_permissions.template_values != null ? data.tanzu-mission-control_permission_template.data_protection_permissions.template_values : {} | ||
| template_body = base64decode(data.tanzu-mission-control_permission_template.data_protection_permissions.template) | ||
| capabilities = ["CAPABILITY_NAMED_IAM"] | ||
| } | ||
| resource "tanzu-mission-control_credential" "data_protection_cred" { | ||
| name = local.credentials_name | ||
| spec { | ||
| capability = local.tanzu_capability | ||
| provider = local.tanzu_provider | ||
| data { | ||
| aws_credential { | ||
| iam_role { | ||
| arn = local.permission_arn | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| # EKS Permission Template | ||
|
|
||
| ## Example Usage | ||
|
|
||
| ```terraform | ||
| locals { | ||
| credentials_name = "test-permission-template-eks-tf-43" | ||
| tanzu_capability = "MANAGED_K8S_PROVIDER" | ||
| tanzu_provider = "AWS_EKS" | ||
| stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message) | ||
| permission_arn = element(local.stack_message, length(local.stack_message) - 1) | ||
| } | ||
| data "tanzu-mission-control_permission_template" "eks_permissions" { | ||
| credentials_name = local.credentials_name | ||
| tanzu_capability = local.tanzu_capability | ||
| tanzu_provider = local.tanzu_provider | ||
| } | ||
| resource "aws_cloudformation_stack" "crendetials_permission_template" { | ||
| name = local.credentials_name | ||
| parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {} | ||
| template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template) | ||
| capabilities = ["CAPABILITY_NAMED_IAM"] | ||
| } | ||
| resource "tanzu-mission-control_credential" "aws_eks_cred" { | ||
| name = local.credentials_name | ||
| spec { | ||
| capability = local.tanzu_capability | ||
| provider = local.tanzu_provider | ||
| data { | ||
| aws_credential { | ||
| iam_role { | ||
| arn = local.permission_arn | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| <!-- schema generated by tfplugindocs --> | ||
| ## Schema | ||
|
|
||
| ### Required | ||
|
|
||
| - `credentials_name` (String) The name of the credentials to get permission template for. | ||
| - `tanzu_capability` (String) The Tanzu capability of the credentials. | ||
| When tanzu_capability is set to 'DATA_PROTECTION' tanzu_provider must be set to 'AWS_EC2'. | ||
| When tanzu_capability is set to 'MANAGED_K8S_PROVIDER' tanzu_provider must be set to 'AWS_EKS'. | ||
| Valid values are: [DATA_PROTECTION MANAGED_K8S_PROVIDER] | ||
| - `tanzu_provider` (String) The Tanzu provider of the credentials. | ||
| When tanzu_provider is set to 'AWS_EC2' tanzu_capability must be set to 'DATA_PROTECTION'. | ||
| When tanzu_provider is set to 'AWS_EKS' tanzu_capability must be set to 'MANAGED_K8S_PROVIDER'. | ||
| Valid values are: [AWS_EC2 AWS_EKS] | ||
|
|
||
| ### Read-Only | ||
|
|
||
| - `id` (String) The ID of this resource. | ||
| - `template` (String) Base64 encoded permission template. | ||
| - `template_url` (String) URL for permission template. | ||
| - `template_values` (Map of String) Values to be sent as parameters for the template. | ||
| - `undefined_template_values` (Map of String) Values which are not defined in the template parameters definition. |
40 changes: 40 additions & 0 deletions
40
examples/data-sources/permissiontemplate/example_usage_data_protection.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| locals { | ||
| credentials_name = "test-permission-template-data-protection-tf-111" | ||
| tanzu_capability = "DATA_PROTECTION" | ||
| tanzu_provider = "AWS_EC2" | ||
|
|
||
| stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message) | ||
| permission_arn = element(local.stack_message, length(local.stack_message) - 1) | ||
| } | ||
|
|
||
|
|
||
| data "tanzu-mission-control_permission_template" "data_protection_permissions" { | ||
| credentials_name = local.credentials_name | ||
| tanzu_capability = local.tanzu_capability | ||
| tanzu_provider = local.tanzu_provider | ||
| } | ||
|
|
||
|
|
||
| resource "aws_cloudformation_stack" "crendetials_permission_template" { | ||
| name = local.credentials_name | ||
| parameters = data.tanzu-mission-control_permission_template.data_protection_permissions.template_values != null ? data.tanzu-mission-control_permission_template.data_protection_permissions.template_values : {} | ||
| template_body = base64decode(data.tanzu-mission-control_permission_template.data_protection_permissions.template) | ||
| capabilities = ["CAPABILITY_NAMED_IAM"] | ||
| } | ||
|
|
||
| resource "tanzu-mission-control_credential" "data_protection_cred" { | ||
| name = local.credentials_name | ||
|
|
||
| spec { | ||
| capability = local.tanzu_capability | ||
| provider = local.tanzu_provider | ||
|
|
||
| data { | ||
| aws_credential { | ||
| iam_role { | ||
| arn = local.permission_arn | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
40 changes: 40 additions & 0 deletions
40
examples/data-sources/permissiontemplate/example_usage_eks.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| locals { | ||
| credentials_name = "test-permission-template-eks-tf-43" | ||
| tanzu_capability = "MANAGED_K8S_PROVIDER" | ||
| tanzu_provider = "AWS_EKS" | ||
|
|
||
| stack_message = split("\n", aws_cloudformation_stack.crendetials_permission_template.outputs.Message) | ||
| permission_arn = element(local.stack_message, length(local.stack_message) - 1) | ||
| } | ||
|
|
||
|
|
||
| data "tanzu-mission-control_permission_template" "eks_permissions" { | ||
| credentials_name = local.credentials_name | ||
| tanzu_capability = local.tanzu_capability | ||
| tanzu_provider = local.tanzu_provider | ||
| } | ||
|
|
||
|
|
||
| resource "aws_cloudformation_stack" "crendetials_permission_template" { | ||
| name = local.credentials_name | ||
| parameters = data.tanzu-mission-control_permission_template.eks_permissions.template_values != null ? data.tanzu-mission-control_permission_template.eks_permissions.template_values : {} | ||
| template_body = base64decode(data.tanzu-mission-control_permission_template.eks_permissions.template) | ||
| capabilities = ["CAPABILITY_NAMED_IAM"] | ||
| } | ||
|
|
||
| resource "tanzu-mission-control_credential" "aws_eks_cred" { | ||
| name = local.credentials_name | ||
|
|
||
| spec { | ||
| capability = local.tanzu_capability | ||
| provider = local.tanzu_provider | ||
|
|
||
| data { | ||
| aws_credential { | ||
| iam_role { | ||
| arn = local.permission_arn | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79 changes: 79 additions & 0 deletions
79
internal/client/permissiontemplate/permission_template_resource.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| /* | ||
| Copyright © 2024 VMware, Inc. All Rights Reserved. | ||
| SPDX-License-Identifier: MPL-2.0 | ||
| */ | ||
|
|
||
| package permissiontemplateclient | ||
|
|
||
| import ( | ||
| "net/url" | ||
|
|
||
| "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/transport" | ||
| "github.com/vmware/terraform-provider-tanzu-mission-control/internal/helper" | ||
| credentialsmodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/credential" | ||
| permissiontemplatemodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/permissiontemplate" | ||
| ) | ||
|
|
||
| const ( | ||
| // API Paths. | ||
| apiPath = "v1alpha1/account/credentials:permissiontemplate" | ||
|
|
||
| // Query Params. | ||
| capabilityQueryParam = "capability" | ||
| providerQueryParam = "provider" | ||
| ) | ||
|
|
||
| // New creates a new permission template resource service API client. | ||
| func New(transport *transport.Client) ClientService { | ||
| return &Client{Client: transport} | ||
| } | ||
|
|
||
| /* | ||
| Client for permission template resource service API. | ||
| */ | ||
| type Client struct { | ||
| *transport.Client | ||
| } | ||
|
|
||
| // ClientService is the interface for Client methods. | ||
| type ClientService interface { | ||
| PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) | ||
|
|
||
| PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) | ||
| } | ||
|
|
||
| /* | ||
| PermissionTemplateResourceServiceGenerate generates a permission template. | ||
| */ | ||
| func (c *Client) PermissionTemplateResourceServiceGenerate(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) { | ||
| response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{} | ||
| err := c.Create(apiPath, request, response) | ||
|
|
||
| return response, err | ||
| } | ||
|
|
||
| /* | ||
| PermissionTemplateResourceServiceGet gets an existing permission template. | ||
| */ | ||
| func (c *Client) PermissionTemplateResourceServiceGet(request *permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateRequest) (*permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse, error) { | ||
| response := &permissiontemplatemodels.VmwareTanzuManageV1alpha1AccountCredentialPermissionTemplateResponse{} | ||
| requestURL := helper.ConstructRequestURL(apiPath, request.FullName.Name) | ||
|
|
||
| queryParams := url.Values{} | ||
|
|
||
| if request.Capability != "" { | ||
| queryParams.Add(capabilityQueryParam, request.Capability) | ||
| } | ||
|
|
||
| if *request.Provider != credentialsmodels.VmwareTanzuManageV1alpha1AccountCredentialProviderPROVIDERUNSPECIFIED { | ||
| queryParams.Add(providerQueryParam, string(*request.Provider)) | ||
| } | ||
|
|
||
| if len(queryParams) > 0 { | ||
| requestURL = requestURL.AppendQueryParams(queryParams) | ||
| } | ||
|
|
||
| err := c.Get(requestURL.String(), response) | ||
|
|
||
| return response, err | ||
| } |
Oops, something went wrong.