benvin
3913b3920d
Terraform provider (plugin-framework) for the tomswall fleet control plane. Resources: zone, address_group (static/dns/asn, with computed resolved prefixes), portgroup, fabric, device, binding (device:zone), and rule. Each resource does full CRUD against the tomswallapi HTTP API with bearer-token auth and ImportState support; rules recreate on update since the rules API is create/delete only. Includes Makefile with make patch|minor|major release tags, Woodpecker pre-commit/build/test/release pipelines (release publishes to the artifactapi terraform registry), README, and a worked example.
225 lines
8.0 KiB
Go
225 lines
8.0 KiB
Go
package provider
|
|
|
|
import (
|
|
"context"
|
|
"strconv"
|
|
|
|
"github.com/hashicorp/terraform-plugin-framework/diag"
|
|
"github.com/hashicorp/terraform-plugin-framework/path"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64default"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
|
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
|
)
|
|
|
|
var (
|
|
_ resource.Resource = &ruleResource{}
|
|
_ resource.ResourceWithImportState = &ruleResource{}
|
|
)
|
|
|
|
type ruleResource struct{ client *apiClient }
|
|
|
|
type ruleModel struct {
|
|
ID types.Int64 `tfsdk:"id"`
|
|
Priority types.Int64 `tfsdk:"priority"`
|
|
Action types.String `tfsdk:"action"`
|
|
Source types.List `tfsdk:"source"`
|
|
Dest types.List `tfsdk:"dest"`
|
|
Proto types.String `tfsdk:"proto"`
|
|
PortGroup types.String `tfsdk:"portgroup"`
|
|
Ports types.List `tfsdk:"ports"`
|
|
Log types.String `tfsdk:"log"`
|
|
Comment types.String `tfsdk:"comment"`
|
|
}
|
|
|
|
type ruleAPI struct {
|
|
ID int64 `json:"id,omitempty"`
|
|
Priority int `json:"priority"`
|
|
Action string `json:"action"`
|
|
Source []string `json:"source"`
|
|
Dest []string `json:"dest"`
|
|
Proto string `json:"proto,omitempty"`
|
|
PortGroup string `json:"portgroup,omitempty"`
|
|
Ports []string `json:"ports,omitempty"`
|
|
Log string `json:"log,omitempty"`
|
|
Comment string `json:"comment,omitempty"`
|
|
}
|
|
|
|
func NewRuleResource() resource.Resource { return &ruleResource{} }
|
|
|
|
func (r *ruleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
|
|
resp.TypeName = req.ProviderTypeName + "_rule"
|
|
}
|
|
|
|
func (r *ruleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
|
|
resp.Schema = schema.Schema{
|
|
Description: "A fleet-global firewall intent. Source and dest are shorewall-style element lists (bare zone, or zone:+ipset / zone:&fqdn); a selector must always be paired with a zone.",
|
|
Attributes: map[string]schema.Attribute{
|
|
"id": schema.Int64Attribute{
|
|
Description: "Server-assigned rule id.",
|
|
Computed: true,
|
|
PlanModifiers: []planmodifier.Int64{int64planmodifier.UseStateForUnknown()},
|
|
},
|
|
"priority": schema.Int64Attribute{
|
|
Description: "Evaluation priority; lower is evaluated first.",
|
|
Optional: true,
|
|
Computed: true,
|
|
Default: int64default.StaticInt64(0),
|
|
},
|
|
"action": schema.StringAttribute{
|
|
Description: "accept, drop, reject, etc.",
|
|
Required: true,
|
|
},
|
|
"source": schema.ListAttribute{
|
|
Description: "Source element list, e.g. [\"loc\", \"net:+asn_cloudflare\"].",
|
|
Required: true,
|
|
ElementType: types.StringType,
|
|
},
|
|
"dest": schema.ListAttribute{
|
|
Description: "Dest element list.",
|
|
Required: true,
|
|
ElementType: types.StringType,
|
|
},
|
|
"proto": schema.StringAttribute{
|
|
Description: "Protocol (used when portgroup is not set).",
|
|
Optional: true,
|
|
},
|
|
"portgroup": schema.StringAttribute{
|
|
Description: "Named portgroup supplying proto+ports.",
|
|
Optional: true,
|
|
},
|
|
"ports": schema.ListAttribute{
|
|
Description: "Explicit ports (used when portgroup is not set).",
|
|
Optional: true,
|
|
ElementType: types.StringType,
|
|
},
|
|
"log": schema.StringAttribute{Optional: true},
|
|
"comment": schema.StringAttribute{Optional: true},
|
|
},
|
|
}
|
|
}
|
|
|
|
func (r *ruleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
|
|
r.client = configureClient(req, resp)
|
|
}
|
|
|
|
func (r *ruleResource) body(ctx context.Context, plan ruleModel, diags *diag.Diagnostics) ruleAPI {
|
|
return ruleAPI{
|
|
Priority: int(plan.Priority.ValueInt64()),
|
|
Action: plan.Action.ValueString(),
|
|
Source: listToStrings(ctx, plan.Source, diags),
|
|
Dest: listToStrings(ctx, plan.Dest, diags),
|
|
Proto: plan.Proto.ValueString(),
|
|
PortGroup: plan.PortGroup.ValueString(),
|
|
Ports: listToStrings(ctx, plan.Ports, diags),
|
|
Log: plan.Log.ValueString(),
|
|
Comment: plan.Comment.ValueString(),
|
|
}
|
|
}
|
|
|
|
func (r *ruleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
|
|
var plan ruleModel
|
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
body := r.body(ctx, plan, &resp.Diagnostics)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
var out ruleAPI
|
|
if err := r.client.post(ctx, "/api/v1/rules", body, &out); err != nil {
|
|
resp.Diagnostics.AddError("create rule failed", err.Error())
|
|
return
|
|
}
|
|
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
|
|
}
|
|
|
|
// Update: the rules API is create/delete only (no in-place PUT), so replace by
|
|
// deleting the old id and creating the new definition, keeping it in one apply.
|
|
func (r *ruleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
|
|
var plan, state ruleModel
|
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
body := r.body(ctx, plan, &resp.Diagnostics)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
var out ruleAPI
|
|
if err := r.client.post(ctx, "/api/v1/rules", body, &out); err != nil {
|
|
resp.Diagnostics.AddError("recreate rule failed", err.Error())
|
|
return
|
|
}
|
|
if id := state.ID.ValueInt64(); id != 0 {
|
|
if err := r.client.del(ctx, "/api/v1/rules/"+strconv.FormatInt(id, 10)); err != nil && !isNotFound(err) {
|
|
resp.Diagnostics.AddError("delete old rule failed", err.Error())
|
|
return
|
|
}
|
|
}
|
|
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, plan, &resp.Diagnostics))...)
|
|
}
|
|
|
|
func (r *ruleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
|
|
var state ruleModel
|
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
var out ruleAPI
|
|
if err := r.client.get(ctx, "/api/v1/rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10), &out); err != nil {
|
|
if isNotFound(err) {
|
|
resp.State.RemoveResource(ctx)
|
|
return
|
|
}
|
|
resp.Diagnostics.AddError("read rule failed", err.Error())
|
|
return
|
|
}
|
|
resp.Diagnostics.Append(resp.State.Set(ctx, r.toModel(ctx, out, state, &resp.Diagnostics))...)
|
|
}
|
|
|
|
func (r *ruleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
|
|
var state ruleModel
|
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
if err := r.client.del(ctx, "/api/v1/rules/"+strconv.FormatInt(state.ID.ValueInt64(), 10)); err != nil && !isNotFound(err) {
|
|
resp.Diagnostics.AddError("delete rule failed", err.Error())
|
|
}
|
|
}
|
|
|
|
func (r *ruleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
|
|
id, err := strconv.ParseInt(req.ID, 10, 64)
|
|
if err != nil {
|
|
resp.Diagnostics.AddError("invalid import ID", "rule id must be an integer")
|
|
return
|
|
}
|
|
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), id)...)
|
|
}
|
|
|
|
func (r *ruleResource) toModel(ctx context.Context, api ruleAPI, prior ruleModel, diags *diag.Diagnostics) ruleModel {
|
|
m := ruleModel{
|
|
ID: types.Int64Value(api.ID),
|
|
Priority: types.Int64Value(int64(api.Priority)),
|
|
Action: types.StringValue(api.Action),
|
|
Source: stringsToList(ctx, api.Source, diags),
|
|
Dest: stringsToList(ctx, api.Dest, diags),
|
|
Proto: optionalString(api.Proto, prior.Proto),
|
|
PortGroup: optionalString(api.PortGroup, prior.PortGroup),
|
|
Log: optionalString(api.Log, prior.Log),
|
|
Comment: optionalString(api.Comment, prior.Comment),
|
|
}
|
|
// ports is optional; preserve null when unset and the API returns none.
|
|
if prior.Ports.IsNull() && len(api.Ports) == 0 {
|
|
m.Ports = types.ListNull(types.StringType)
|
|
} else {
|
|
m.Ports = stringsToList(ctx, api.Ports, diags)
|
|
}
|
|
return m
|
|
}
|