Merge pull request 'scaffold terraform-provider-vault-secrets-ghp' (#1) from benvin/scaffold-ghp-provider into main
ci/woodpecker/tag/release Pipeline was successful
ci/woodpecker/tag/release Pipeline was successful
Reviewed-on: #1
This commit was merged in pull request #1.
This commit is contained in:
+10
@@ -0,0 +1,10 @@
|
|||||||
|
/terraform-provider-vault-secrets-ghp
|
||||||
|
*.zip
|
||||||
|
*.out
|
||||||
|
*.test
|
||||||
|
dist/
|
||||||
|
.terraform/
|
||||||
|
.terraform.lock.hcl
|
||||||
|
*.tfstate
|
||||||
|
*.tfstate.backup
|
||||||
|
.env
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
repos:
|
||||||
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||||
|
rev: v5.0.0
|
||||||
|
hooks:
|
||||||
|
- id: trailing-whitespace
|
||||||
|
- id: end-of-file-fixer
|
||||||
|
- id: check-yaml
|
||||||
|
- id: check-added-large-files
|
||||||
|
|
||||||
|
- repo: https://github.com/dnephin/pre-commit-golang
|
||||||
|
rev: v0.5.1
|
||||||
|
hooks:
|
||||||
|
- id: go-fmt
|
||||||
|
- id: go-vet
|
||||||
|
- id: go-mod-tidy
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
when:
|
||||||
|
- event: pull_request
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: build
|
||||||
|
image: golang:1.25
|
||||||
|
commands:
|
||||||
|
- make build
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
when:
|
||||||
|
- event: pull_request
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: pre-commit
|
||||||
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
||||||
|
commands:
|
||||||
|
- uvx pre-commit run --all-files
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
@@ -0,0 +1,40 @@
|
|||||||
|
when:
|
||||||
|
- event: tag
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: package
|
||||||
|
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
||||||
|
commands:
|
||||||
|
- make package VERSION=${CI_COMMIT_TAG}
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
|
|
||||||
|
- name: upload
|
||||||
|
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||||
|
commands:
|
||||||
|
- |
|
||||||
|
VERSION=$$(echo ${CI_COMMIT_TAG} | sed 's/^v//')
|
||||||
|
FILE="terraform-provider-vault-secrets-ghp_$${VERSION}_linux_amd64.zip"
|
||||||
|
curl -f -X PUT \
|
||||||
|
"https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/vault-secrets-ghp/$${FILE}" \
|
||||||
|
-H "Content-Type: application/zip" \
|
||||||
|
--data-binary @"$${FILE}"
|
||||||
|
depends_on: [package]
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 128Mi
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 500m
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
when:
|
||||||
|
- event: pull_request
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: lint
|
||||||
|
image: golang:1.25
|
||||||
|
commands:
|
||||||
|
- make lint
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
|
|
||||||
|
- name: test
|
||||||
|
image: golang:1.25
|
||||||
|
commands:
|
||||||
|
- make test
|
||||||
|
backend_options:
|
||||||
|
kubernetes:
|
||||||
|
serviceAccountName: default
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: 512Mi
|
||||||
|
cpu: 1
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
cpu: 2
|
||||||
@@ -0,0 +1,61 @@
|
|||||||
|
.PHONY: build install test lint fmt clean tidy package patch minor major check-go
|
||||||
|
|
||||||
|
BINARY := terraform-provider-vault-secrets-ghp
|
||||||
|
VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
|
||||||
|
OS_ARCH := linux_amd64
|
||||||
|
INSTALL_VERSION := $(shell echo $(VERSION) | sed 's/^v//')
|
||||||
|
INSTALL_DIR := ~/.terraform.d/plugins/git.unkin.net/unkin/vault-secrets-ghp/$(INSTALL_VERSION)/$(OS_ARCH)
|
||||||
|
ZIP := $(BINARY)_$(INSTALL_VERSION)_$(OS_ARCH).zip
|
||||||
|
|
||||||
|
GO_VERSION_REQUIRED := 1.25
|
||||||
|
GO_VERSION_ACTUAL := $(shell go version | sed 's/go version go\([0-9]*\.[0-9]*\).*/\1/')
|
||||||
|
|
||||||
|
check-go:
|
||||||
|
@if [ "$$(printf '%s\n%s' "$(GO_VERSION_REQUIRED)" "$(GO_VERSION_ACTUAL)" | sort -V | head -1)" != "$(GO_VERSION_REQUIRED)" ]; then \
|
||||||
|
echo "ERROR: Go >= $(GO_VERSION_REQUIRED) required, found $(GO_VERSION_ACTUAL)"; exit 1; \
|
||||||
|
fi
|
||||||
|
|
||||||
|
build: check-go tidy
|
||||||
|
go build -ldflags="-s -w -X main.version=$(VERSION)" -o $(BINARY)
|
||||||
|
|
||||||
|
install: build
|
||||||
|
mkdir -p $(INSTALL_DIR)
|
||||||
|
cp $(BINARY) $(INSTALL_DIR)/
|
||||||
|
|
||||||
|
test: check-go
|
||||||
|
go test -race -count=1 ./...
|
||||||
|
|
||||||
|
lint: check-go
|
||||||
|
go vet ./...
|
||||||
|
|
||||||
|
fmt: check-go
|
||||||
|
gofmt -w .
|
||||||
|
|
||||||
|
package: build
|
||||||
|
cp $(BINARY) $(BINARY)_v$(INSTALL_VERSION)
|
||||||
|
python3 -c "import zipfile,sys; z=zipfile.ZipFile(sys.argv[1],'w',zipfile.ZIP_DEFLATED); z.write(sys.argv[2]); z.close()" $(ZIP) $(BINARY)_v$(INSTALL_VERSION)
|
||||||
|
rm $(BINARY)_v$(INSTALL_VERSION)
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f $(BINARY) *.zip
|
||||||
|
|
||||||
|
tidy:
|
||||||
|
go mod tidy
|
||||||
|
|
||||||
|
_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
|
||||||
|
_BASE := $(if $(_LATEST),$(_LATEST),v0.0.0)
|
||||||
|
_MAJ := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
|
||||||
|
_MIN := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
|
||||||
|
_PAT := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
|
||||||
|
|
||||||
|
patch:
|
||||||
|
@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
|
||||||
|
|
||||||
|
minor:
|
||||||
|
@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
|
||||||
|
|
||||||
|
major:
|
||||||
|
@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
|
||||||
|
git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
|
||||||
@@ -1,3 +1,84 @@
|
|||||||
# terraform-provider-vault-secrets-ghp
|
# terraform-provider-vault-secrets-ghp
|
||||||
|
|
||||||
Terraform provider for the Vault/OpenBao ghp token secrets engine (vault-secrets-ghp)
|
A Terraform/OpenTofu provider that manages the **ghp token secrets engine**
|
||||||
|
([`vault-plugin-secrets-ghp`](https://git.unkin.net/unkin/vault-plugin-secrets-ghp))
|
||||||
|
on HashiCorp Vault or OpenBao, so the engine's mount, config, and roles can be
|
||||||
|
driven declaratively (e.g. from `terraform-vault`).
|
||||||
|
|
||||||
|
Source address: `git.unkin.net/unkin/vault-secrets-ghp` (declare it under the
|
||||||
|
local name `ghp`, so its resources are `ghp_*`).
|
||||||
|
|
||||||
|
## Resources
|
||||||
|
|
||||||
|
| Resource | Manages |
|
||||||
|
|----------|---------|
|
||||||
|
| `ghp_secret_backend` | Mounts the engine at a path and writes its `config` (ghp base URL, TLS, seeded service token). |
|
||||||
|
| `ghp_secret_role` | A role: `token_type`, `installation_id`, `app_record_id`, `repositories`, `scopes`, `session_prefix`, `ttl`, `max_ttl`. |
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
ghp = {
|
||||||
|
source = "git.unkin.net/unkin/vault-secrets-ghp"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "ghp" {
|
||||||
|
# address / token fall back to VAULT_ADDR / VAULT_TOKEN.
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "ghp_secret_backend" "ghp" {
|
||||||
|
path = "ghp"
|
||||||
|
base_url = "https://ghp.unkin.net"
|
||||||
|
admin_token = var.ghp_admin_token
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "ghp_secret_role" "ci" {
|
||||||
|
backend = ghp_secret_backend.ghp.path
|
||||||
|
name = "ci"
|
||||||
|
token_type = "agent"
|
||||||
|
installation_id = 12345
|
||||||
|
repositories = ["unkin/prodenv"]
|
||||||
|
scopes = ["contents:read", "pull_requests:write"]
|
||||||
|
ttl = 3600
|
||||||
|
max_ttl = 28800
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
### Notes
|
||||||
|
|
||||||
|
- `admin_token` is write-only: Vault never returns it, so it is preserved in
|
||||||
|
Terraform state and does not show drift. `ca_cert` is likewise write-only and
|
||||||
|
preserved.
|
||||||
|
- Writing `config` makes the engine verify the service token against ghp (it must
|
||||||
|
authenticate as a ghp admin), so a bad URL or token fails the apply.
|
||||||
|
- `token_type` defaults to `agent`; agent roles require `installation_id`. Proxy
|
||||||
|
roles are OAuth-backed and ignore `installation_id` / `app_record_id`.
|
||||||
|
- `repositories` and `scopes` are optional; an empty set is open-scoped (all
|
||||||
|
repositories / all permissions the installation allows). Scope entries are
|
||||||
|
`permission:level` where level is `read` or `write`.
|
||||||
|
|
||||||
|
## Import
|
||||||
|
|
||||||
|
```sh
|
||||||
|
terraform import ghp_secret_backend.ghp ghp
|
||||||
|
terraform import ghp_secret_role.ci ghp/roles/ci
|
||||||
|
```
|
||||||
|
|
||||||
|
## Development
|
||||||
|
|
||||||
|
```sh
|
||||||
|
make build # build the provider binary
|
||||||
|
make install # install into ~/.terraform.d/plugins for local use
|
||||||
|
make test # unit tests (race)
|
||||||
|
make package # build the release zip
|
||||||
|
```
|
||||||
|
|
||||||
|
Releases are tag-driven (`make patch|minor|major`): a Woodpecker pipeline builds
|
||||||
|
`terraform-provider-vault-secrets-ghp_<version>_linux_amd64.zip` and PUTs it to
|
||||||
|
the artifactapi terraform registry
|
||||||
|
(`.../api/v2/remotes/terraform-unkin/files/unkin/vault-secrets-ghp/<file>`), which
|
||||||
|
signs it server-side. Install it via the bare `source` address above.
|
||||||
|
|||||||
@@ -0,0 +1,45 @@
|
|||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
ghp = {
|
||||||
|
source = "git.unkin.net/unkin/vault-secrets-ghp"
|
||||||
|
version = "0.0.1"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "ghp" {
|
||||||
|
# address defaults to $VAULT_ADDR, token to $VAULT_TOKEN
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ghp_admin_token" {
|
||||||
|
type = string
|
||||||
|
sensitive = true
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "ghp_secret_backend" "ghp" {
|
||||||
|
path = "ghp"
|
||||||
|
base_url = "https://ghp.unkin.net"
|
||||||
|
admin_token = var.ghp_admin_token
|
||||||
|
}
|
||||||
|
|
||||||
|
# Agent role scoped to a ghp App installation for CI.
|
||||||
|
resource "ghp_secret_role" "ci" {
|
||||||
|
backend = ghp_secret_backend.ghp.path
|
||||||
|
name = "ci"
|
||||||
|
token_type = "agent"
|
||||||
|
installation_id = 12345
|
||||||
|
repositories = ["unkin/prodenv"]
|
||||||
|
scopes = ["contents:read", "pull_requests:write"]
|
||||||
|
ttl = 3600
|
||||||
|
max_ttl = 28800
|
||||||
|
}
|
||||||
|
|
||||||
|
# Proxy (OAuth-backed) role, no installation binding.
|
||||||
|
resource "ghp_secret_role" "proxy" {
|
||||||
|
backend = ghp_secret_backend.ghp.path
|
||||||
|
name = "proxy"
|
||||||
|
token_type = "proxy"
|
||||||
|
scopes = ["contents:read"]
|
||||||
|
ttl = 1800
|
||||||
|
max_ttl = 14400
|
||||||
|
}
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
terraform {
|
||||||
|
required_providers {
|
||||||
|
ghp = {
|
||||||
|
source = "git.unkin.net/unkin/vault-secrets-ghp"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "ghp" {
|
||||||
|
# address / token fall back to VAULT_ADDR / VAULT_TOKEN.
|
||||||
|
}
|
||||||
|
|
||||||
|
# Mount the ghp secrets engine and seed it with a service token.
|
||||||
|
resource "ghp_secret_backend" "ghp" {
|
||||||
|
path = "ghp"
|
||||||
|
base_url = "https://ghp.unkin.net"
|
||||||
|
ca_cert = file("${path.module}/ghp-ca.pem")
|
||||||
|
|
||||||
|
admin_token = var.ghp_admin_token # e.g. sourced from vault_kv_secret
|
||||||
|
|
||||||
|
request_timeout_seconds = 30
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ghp_admin_token" {
|
||||||
|
type = string
|
||||||
|
sensitive = true
|
||||||
|
}
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
# A role that mints short-lived agent tokens bound to a ghp App installation,
|
||||||
|
# scoped to contents and pull requests. Reading ghp/creds/ci returns a
|
||||||
|
# lease-bound token that ghp revokes when the lease ends.
|
||||||
|
resource "ghp_secret_role" "ci" {
|
||||||
|
backend = ghp_secret_backend.ghp.path
|
||||||
|
name = "ci"
|
||||||
|
token_type = "agent"
|
||||||
|
installation_id = 12345
|
||||||
|
repositories = ["unkin/prodenv"]
|
||||||
|
scopes = ["contents:read", "pull_requests:write"]
|
||||||
|
|
||||||
|
ttl = 3600 # 1h
|
||||||
|
max_ttl = 28800 # 8h
|
||||||
|
}
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
module git.unkin.net/unkin/terraform-provider-vault-secrets-ghp
|
||||||
|
|
||||||
|
go 1.25
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/hashicorp/terraform-plugin-framework v1.15.0
|
||||||
|
github.com/hashicorp/vault/api v1.15.0
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
|
||||||
|
github.com/fatih/color v1.16.0 // indirect
|
||||||
|
github.com/go-jose/go-jose/v4 v4.0.4 // indirect
|
||||||
|
github.com/golang/protobuf v1.5.4 // indirect
|
||||||
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
||||||
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||||
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
||||||
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
||||||
|
github.com/hashicorp/go-plugin v1.6.3 // indirect
|
||||||
|
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
|
||||||
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
||||||
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
|
||||||
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
||||||
|
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
|
||||||
|
github.com/hashicorp/go-uuid v1.0.3 // indirect
|
||||||
|
github.com/hashicorp/hcl v1.0.0 // indirect
|
||||||
|
github.com/hashicorp/terraform-plugin-go v0.27.0 // indirect
|
||||||
|
github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
|
||||||
|
github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
|
||||||
|
github.com/hashicorp/terraform-svchost v0.1.1 // indirect
|
||||||
|
github.com/hashicorp/yamux v0.1.1 // indirect
|
||||||
|
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||||
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
||||||
|
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||||
|
github.com/oklog/run v1.0.0 // indirect
|
||||||
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
||||||
|
github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
|
||||||
|
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
|
||||||
|
golang.org/x/crypto v0.37.0 // indirect
|
||||||
|
golang.org/x/net v0.39.0 // indirect
|
||||||
|
golang.org/x/sys v0.32.0 // indirect
|
||||||
|
golang.org/x/text v0.24.0 // indirect
|
||||||
|
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 // indirect
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
|
||||||
|
google.golang.org/grpc v1.72.1 // indirect
|
||||||
|
google.golang.org/protobuf v1.36.6 // indirect
|
||||||
|
)
|
||||||
@@ -0,0 +1,147 @@
|
|||||||
|
github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
|
||||||
|
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
|
||||||
|
github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
|
||||||
|
github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
|
||||||
|
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
|
||||||
|
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
|
||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
|
||||||
|
github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
|
||||||
|
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
|
||||||
|
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
|
||||||
|
github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
|
||||||
|
github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
|
||||||
|
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
|
||||||
|
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
|
||||||
|
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||||
|
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||||
|
github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
|
||||||
|
github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
|
||||||
|
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
|
||||||
|
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
|
||||||
|
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||||
|
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||||
|
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||||
|
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||||
|
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
|
||||||
|
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||||
|
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
|
||||||
|
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
|
||||||
|
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
|
||||||
|
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
|
||||||
|
github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
|
||||||
|
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
|
||||||
|
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
|
||||||
|
github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
|
||||||
|
github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
|
||||||
|
github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
|
||||||
|
github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
|
||||||
|
github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
|
||||||
|
github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
|
||||||
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
|
||||||
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
|
||||||
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
|
||||||
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
|
||||||
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
|
||||||
|
github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
|
||||||
|
github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
|
||||||
|
github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
|
||||||
|
github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
|
||||||
|
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
|
||||||
|
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
|
||||||
|
github.com/hashicorp/terraform-plugin-framework v1.15.0 h1:LQ2rsOfmDLxcn5EeIwdXFtr03FVsNktbbBci8cOKdb4=
|
||||||
|
github.com/hashicorp/terraform-plugin-framework v1.15.0/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI=
|
||||||
|
github.com/hashicorp/terraform-plugin-go v0.27.0 h1:ujykws/fWIdsi6oTUT5Or4ukvEan4aN9lY+LOxVP8EE=
|
||||||
|
github.com/hashicorp/terraform-plugin-go v0.27.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
|
||||||
|
github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
|
||||||
|
github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
|
||||||
|
github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M=
|
||||||
|
github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg=
|
||||||
|
github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
|
||||||
|
github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
|
||||||
|
github.com/hashicorp/vault/api v1.15.0 h1:O24FYQCWwhwKnF7CuSqP30S51rTV7vz1iACXE/pj5DA=
|
||||||
|
github.com/hashicorp/vault/api v1.15.0/go.mod h1:+5YTO09JGn0u+b6ySD/LLVf8WkJCPLAL2Vkmrn2+CM8=
|
||||||
|
github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
|
||||||
|
github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
|
||||||
|
github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
|
||||||
|
github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
|
||||||
|
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
|
||||||
|
github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
|
||||||
|
github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
|
||||||
|
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
|
||||||
|
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
|
||||||
|
github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
|
||||||
|
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
|
||||||
|
github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
|
||||||
|
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
|
||||||
|
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
|
||||||
|
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
|
||||||
|
github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
|
||||||
|
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||||
|
github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
|
||||||
|
github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
|
||||||
|
github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
|
||||||
|
github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
|
||||||
|
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||||
|
github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
|
||||||
|
github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
|
||||||
|
github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
|
||||||
|
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
|
||||||
|
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
|
||||||
|
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||||
|
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||||
|
github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
|
||||||
|
github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
|
||||||
|
github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
|
||||||
|
github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
|
||||||
|
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
|
||||||
|
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
|
||||||
|
go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
|
||||||
|
go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
|
||||||
|
go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
|
||||||
|
go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
|
||||||
|
go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
|
||||||
|
go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
|
||||||
|
go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
|
||||||
|
go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
|
||||||
|
go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
|
||||||
|
go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
|
||||||
|
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
|
||||||
|
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
|
||||||
|
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
|
||||||
|
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
|
||||||
|
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
|
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
|
||||||
|
golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||||
|
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
|
||||||
|
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
|
||||||
|
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
|
||||||
|
golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
|
||||||
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
|
||||||
|
google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
|
||||||
|
google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
|
||||||
|
google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
|
||||||
|
google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
@@ -0,0 +1,130 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
vault "github.com/hashicorp/vault/api"
|
||||||
|
)
|
||||||
|
|
||||||
|
// vaultClient wraps the Vault/OpenBao API client with the operations this
|
||||||
|
// provider needs to manage the ghp secrets engine.
|
||||||
|
type vaultClient struct {
|
||||||
|
api *vault.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func newVaultClient(address, token string) (*vaultClient, error) {
|
||||||
|
cfg := vault.DefaultConfig()
|
||||||
|
if cfg.Error != nil {
|
||||||
|
return nil, cfg.Error
|
||||||
|
}
|
||||||
|
if address != "" {
|
||||||
|
cfg.Address = address
|
||||||
|
}
|
||||||
|
c, err := vault.NewClient(cfg)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if token != "" {
|
||||||
|
c.SetToken(token)
|
||||||
|
}
|
||||||
|
return &vaultClient{api: c}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// mountConfig holds the tunable options applied when enabling the engine.
|
||||||
|
type mountConfig struct {
|
||||||
|
DefaultLeaseTTL string
|
||||||
|
MaxLeaseTTL string
|
||||||
|
}
|
||||||
|
|
||||||
|
// enableMount mounts the secrets engine of the given plugin type at path.
|
||||||
|
func (c *vaultClient) enableMount(ctx context.Context, path, pluginType, description string, cfg mountConfig) error {
|
||||||
|
input := &vault.MountInput{
|
||||||
|
Type: pluginType,
|
||||||
|
Description: description,
|
||||||
|
Config: vault.MountConfigInput{
|
||||||
|
DefaultLeaseTTL: cfg.DefaultLeaseTTL,
|
||||||
|
MaxLeaseTTL: cfg.MaxLeaseTTL,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
return c.api.Sys().MountWithContext(ctx, path, input)
|
||||||
|
}
|
||||||
|
|
||||||
|
// tuneMount updates tunable options of an existing mount (e.g. description).
|
||||||
|
func (c *vaultClient) tuneMount(ctx context.Context, path, description string, cfg mountConfig) error {
|
||||||
|
input := vault.MountConfigInput{
|
||||||
|
Description: &description,
|
||||||
|
DefaultLeaseTTL: cfg.DefaultLeaseTTL,
|
||||||
|
MaxLeaseTTL: cfg.MaxLeaseTTL,
|
||||||
|
}
|
||||||
|
return c.api.Sys().TuneMountWithContext(ctx, path, input)
|
||||||
|
}
|
||||||
|
|
||||||
|
// mountInfo returns the mount at the given path, or nil if it does not exist.
|
||||||
|
func (c *vaultClient) mountInfo(ctx context.Context, path string) (*vault.MountOutput, error) {
|
||||||
|
mounts, err := c.api.Sys().ListMountsWithContext(ctx)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
key := strings.TrimRight(path, "/") + "/"
|
||||||
|
if m, ok := mounts[key]; ok {
|
||||||
|
return m, nil
|
||||||
|
}
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// disableMount unmounts the secrets engine at path.
|
||||||
|
func (c *vaultClient) disableMount(ctx context.Context, path string) error {
|
||||||
|
return c.api.Sys().UnmountWithContext(ctx, path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// write writes data to an arbitrary path under the backend mount.
|
||||||
|
func (c *vaultClient) write(ctx context.Context, path string, data map[string]interface{}) error {
|
||||||
|
_, err := c.api.Logical().WriteWithContext(ctx, path, data)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// read reads an arbitrary path under the backend mount, returning nil if absent.
|
||||||
|
func (c *vaultClient) read(ctx context.Context, path string) (map[string]interface{}, error) {
|
||||||
|
secret, err := c.api.Logical().ReadWithContext(ctx, path)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if secret == nil {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
return secret.Data, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// delete removes an arbitrary path under the backend mount.
|
||||||
|
func (c *vaultClient) delete(ctx context.Context, path string) error {
|
||||||
|
_, err := c.api.Logical().DeleteWithContext(ctx, path)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
func configPath(backend string) string {
|
||||||
|
return fmt.Sprintf("%s/config", strings.TrimRight(backend, "/"))
|
||||||
|
}
|
||||||
|
|
||||||
|
func rolePath(backend, name string) string {
|
||||||
|
return fmt.Sprintf("%s/roles/%s", strings.TrimRight(backend, "/"), name)
|
||||||
|
}
|
||||||
|
|
||||||
|
// isMountAlreadyExists reports whether the error is Vault's "path is already in
|
||||||
|
// use" response, so callers can surface a friendlier message.
|
||||||
|
func isMountAlreadyExists(err error) bool {
|
||||||
|
if err == nil {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
var respErr *vault.ResponseError
|
||||||
|
if errors.As(err, &respErr) {
|
||||||
|
for _, e := range respErr.Errors {
|
||||||
|
if strings.Contains(e, "path is already in use") {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
@@ -0,0 +1,66 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
// toStringSlice coerces the list shapes Vault returns (a JSON array decodes to
|
||||||
|
// []interface{}) into a []string. A nil or non-list value yields an empty slice.
|
||||||
|
func toStringSlice(v interface{}) []string {
|
||||||
|
switch xs := v.(type) {
|
||||||
|
case []string:
|
||||||
|
return xs
|
||||||
|
case []interface{}:
|
||||||
|
out := make([]string, 0, len(xs))
|
||||||
|
for _, x := range xs {
|
||||||
|
if s, ok := x.(string); ok {
|
||||||
|
out = append(out, s)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return out
|
||||||
|
default:
|
||||||
|
return []string{}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// toInt64 coerces the numeric shapes Vault returns (json.Number, float64, int)
|
||||||
|
// into an int64.
|
||||||
|
func toInt64(v interface{}) (int64, bool) {
|
||||||
|
switch n := v.(type) {
|
||||||
|
case json.Number:
|
||||||
|
i, err := n.Int64()
|
||||||
|
if err != nil {
|
||||||
|
f, ferr := n.Float64()
|
||||||
|
if ferr != nil {
|
||||||
|
return 0, false
|
||||||
|
}
|
||||||
|
return int64(f), true
|
||||||
|
}
|
||||||
|
return i, true
|
||||||
|
case float64:
|
||||||
|
return int64(n), true
|
||||||
|
case int64:
|
||||||
|
return n, true
|
||||||
|
case int:
|
||||||
|
return int64(n), true
|
||||||
|
default:
|
||||||
|
return 0, false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// splitBackendName splits an import ID of the form "<backend>/<marker>/<name>"
|
||||||
|
// (e.g. "ghp/roles/ci") into its backend and name parts.
|
||||||
|
func splitBackendName(id, marker string) (backend, name string, ok bool) {
|
||||||
|
sep := "/" + marker + "/"
|
||||||
|
idx := strings.LastIndex(id, sep)
|
||||||
|
if idx <= 0 {
|
||||||
|
return "", "", false
|
||||||
|
}
|
||||||
|
backend = id[:idx]
|
||||||
|
name = id[idx+len(sep):]
|
||||||
|
if backend == "" || name == "" {
|
||||||
|
return "", "", false
|
||||||
|
}
|
||||||
|
return backend, name, true
|
||||||
|
}
|
||||||
@@ -0,0 +1,69 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestToInt64(t *testing.T) {
|
||||||
|
cases := []struct {
|
||||||
|
in interface{}
|
||||||
|
want int64
|
||||||
|
ok bool
|
||||||
|
}{
|
||||||
|
{json.Number("42"), 42, true},
|
||||||
|
{json.Number("3.0"), 3, true},
|
||||||
|
{float64(7), 7, true},
|
||||||
|
{int(9), 9, true},
|
||||||
|
{int64(11), 11, true},
|
||||||
|
{"nope", 0, false},
|
||||||
|
{nil, 0, false},
|
||||||
|
}
|
||||||
|
for _, c := range cases {
|
||||||
|
got, ok := toInt64(c.in)
|
||||||
|
if ok != c.ok || got != c.want {
|
||||||
|
t.Errorf("toInt64(%v) = (%d,%v), want (%d,%v)", c.in, got, ok, c.want, c.ok)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestToStringSlice(t *testing.T) {
|
||||||
|
cases := []struct {
|
||||||
|
name string
|
||||||
|
in interface{}
|
||||||
|
want []string
|
||||||
|
}{
|
||||||
|
{"nil", nil, []string{}},
|
||||||
|
{"string-slice", []string{"a", "b"}, []string{"a", "b"}},
|
||||||
|
{"iface-slice", []interface{}{"contents:read", "pull_requests:write"}, []string{"contents:read", "pull_requests:write"}},
|
||||||
|
{"mixed", []interface{}{"ok", 3, "two"}, []string{"ok", "two"}},
|
||||||
|
{"wrong-type", "notalist", []string{}},
|
||||||
|
}
|
||||||
|
for _, c := range cases {
|
||||||
|
got := toStringSlice(c.in)
|
||||||
|
if strings.Join(got, ",") != strings.Join(c.want, ",") {
|
||||||
|
t.Errorf("%s: toStringSlice(%v) = %v, want %v", c.name, c.in, got, c.want)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestSplitBackendName(t *testing.T) {
|
||||||
|
cases := []struct {
|
||||||
|
id, marker, backend, name string
|
||||||
|
ok bool
|
||||||
|
}{
|
||||||
|
{"ghp/roles/ci", "roles", "ghp", "ci", true},
|
||||||
|
{"team/ghp/roles/ci", "roles", "team/ghp", "ci", true},
|
||||||
|
{"ghp/roles/", "roles", "", "", false},
|
||||||
|
{"/roles/ci", "roles", "", "", false},
|
||||||
|
{"nomarker", "roles", "", "", false},
|
||||||
|
}
|
||||||
|
for _, c := range cases {
|
||||||
|
b, n, ok := splitBackendName(c.id, c.marker)
|
||||||
|
if ok != c.ok || b != c.backend || n != c.name {
|
||||||
|
t.Errorf("splitBackendName(%q,%q) = (%q,%q,%v), want (%q,%q,%v)",
|
||||||
|
c.id, c.marker, b, n, ok, c.backend, c.name, c.ok)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,100 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"os"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/datasource"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/provider"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/provider/schema"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
||||||
|
)
|
||||||
|
|
||||||
|
var _ provider.Provider = &ghpProvider{}
|
||||||
|
|
||||||
|
type ghpProvider struct {
|
||||||
|
version string
|
||||||
|
}
|
||||||
|
|
||||||
|
type ghpProviderModel struct {
|
||||||
|
Address types.String `tfsdk:"address"`
|
||||||
|
Token types.String `tfsdk:"token"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(version string) func() provider.Provider {
|
||||||
|
return func() provider.Provider {
|
||||||
|
return &ghpProvider{version: version}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *ghpProvider) Metadata(_ context.Context, _ provider.MetadataRequest, resp *provider.MetadataResponse) {
|
||||||
|
// The provider's source address is git.unkin.net/unkin/vault-secrets-ghp,
|
||||||
|
// but its resources are prefixed "ghp_" (declare it in required_providers
|
||||||
|
// under the local name "ghp"), mirroring how google-beta ships google_*.
|
||||||
|
resp.TypeName = "ghp"
|
||||||
|
resp.Version = p.version
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *ghpProvider) Schema(_ context.Context, _ provider.SchemaRequest, resp *provider.SchemaResponse) {
|
||||||
|
resp.Schema = schema.Schema{
|
||||||
|
Description: "Manage the ghp token secrets engine (config and roles) on HashiCorp Vault or OpenBao.",
|
||||||
|
Attributes: map[string]schema.Attribute{
|
||||||
|
"address": schema.StringAttribute{
|
||||||
|
Description: "Address of the Vault/OpenBao server. Falls back to the VAULT_ADDR environment variable.",
|
||||||
|
Optional: true,
|
||||||
|
},
|
||||||
|
"token": schema.StringAttribute{
|
||||||
|
Description: "Token used to authenticate to Vault/OpenBao. Falls back to the VAULT_TOKEN environment variable.",
|
||||||
|
Optional: true,
|
||||||
|
Sensitive: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *ghpProvider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
|
||||||
|
var config ghpProviderModel
|
||||||
|
resp.Diagnostics.Append(req.Config.Get(ctx, &config)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
address := os.Getenv("VAULT_ADDR")
|
||||||
|
if !config.Address.IsNull() && config.Address.ValueString() != "" {
|
||||||
|
address = config.Address.ValueString()
|
||||||
|
}
|
||||||
|
|
||||||
|
token := os.Getenv("VAULT_TOKEN")
|
||||||
|
if !config.Token.IsNull() && config.Token.ValueString() != "" {
|
||||||
|
token = config.Token.ValueString()
|
||||||
|
}
|
||||||
|
|
||||||
|
if address == "" {
|
||||||
|
resp.Diagnostics.AddError(
|
||||||
|
"missing Vault address",
|
||||||
|
"Set the provider \"address\" attribute or the VAULT_ADDR environment variable.",
|
||||||
|
)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
client, err := newVaultClient(address, token)
|
||||||
|
if err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to create Vault client", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
resp.DataSourceData = client
|
||||||
|
resp.ResourceData = client
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *ghpProvider) Resources(_ context.Context) []func() resource.Resource {
|
||||||
|
return []func() resource.Resource{
|
||||||
|
NewSecretBackendResource,
|
||||||
|
NewSecretRoleResource,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *ghpProvider) DataSources(_ context.Context) []func() datasource.DataSource {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
@@ -0,0 +1,252 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/path"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64default"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
_ resource.Resource = &secretBackendResource{}
|
||||||
|
_ resource.ResourceWithImportState = &secretBackendResource{}
|
||||||
|
)
|
||||||
|
|
||||||
|
const defaultPluginType = "vault-plugin-secrets-ghp"
|
||||||
|
|
||||||
|
const defaultBaseURL = "https://ghp.unkin.net"
|
||||||
|
|
||||||
|
type secretBackendResource struct {
|
||||||
|
client *vaultClient
|
||||||
|
}
|
||||||
|
|
||||||
|
type secretBackendModel struct {
|
||||||
|
Path types.String `tfsdk:"path"`
|
||||||
|
Plugin types.String `tfsdk:"plugin"`
|
||||||
|
Description types.String `tfsdk:"description"`
|
||||||
|
BaseURL types.String `tfsdk:"base_url"`
|
||||||
|
AdminToken types.String `tfsdk:"admin_token"`
|
||||||
|
CACert types.String `tfsdk:"ca_cert"`
|
||||||
|
TLSSkipVerify types.Bool `tfsdk:"tls_skip_verify"`
|
||||||
|
RequestTimeoutSeconds types.Int64 `tfsdk:"request_timeout_seconds"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewSecretBackendResource() resource.Resource {
|
||||||
|
return &secretBackendResource{}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
|
||||||
|
resp.TypeName = req.ProviderTypeName + "_secret_backend"
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
|
||||||
|
resp.Schema = schema.Schema{
|
||||||
|
Description: "Mounts the ghp secrets engine and writes its connection config and seeded service token.",
|
||||||
|
Attributes: map[string]schema.Attribute{
|
||||||
|
"path": schema.StringAttribute{
|
||||||
|
Description: "Mount path for the ghp secrets engine (e.g. \"ghp\").",
|
||||||
|
Required: true,
|
||||||
|
PlanModifiers: []planmodifier.String{
|
||||||
|
stringplanmodifier.RequiresReplace(),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"plugin": schema.StringAttribute{
|
||||||
|
Description: "Registered plugin name/type to mount.",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
Default: stringdefault.StaticString(defaultPluginType),
|
||||||
|
PlanModifiers: []planmodifier.String{
|
||||||
|
stringplanmodifier.RequiresReplace(),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"description": schema.StringAttribute{
|
||||||
|
Description: "Human-readable description of the mount.",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
Default: stringdefault.StaticString(""),
|
||||||
|
},
|
||||||
|
"base_url": schema.StringAttribute{
|
||||||
|
Description: "Base URL of the ghp server (e.g. https://ghp.unkin.net).",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
Default: stringdefault.StaticString(defaultBaseURL),
|
||||||
|
},
|
||||||
|
"admin_token": schema.StringAttribute{
|
||||||
|
Description: "ghp service token (ghpsvc_...) the engine authenticates with. Write-only; never read back.",
|
||||||
|
Required: true,
|
||||||
|
Sensitive: true,
|
||||||
|
},
|
||||||
|
"ca_cert": schema.StringAttribute{
|
||||||
|
Description: "PEM CA certificate that signed the ghp server's TLS certificate. Write-only; never read back.",
|
||||||
|
Optional: true,
|
||||||
|
Sensitive: true,
|
||||||
|
},
|
||||||
|
"tls_skip_verify": schema.BoolAttribute{
|
||||||
|
Description: "Skip TLS verification of the ghp server (not recommended).",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
Default: booldefault.StaticBool(false),
|
||||||
|
},
|
||||||
|
"request_timeout_seconds": schema.Int64Attribute{
|
||||||
|
Description: "HTTP timeout in seconds for calls from the plugin to ghp.",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
Default: int64default.StaticInt64(30),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
|
||||||
|
if req.ProviderData == nil {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
client, ok := req.ProviderData.(*vaultClient)
|
||||||
|
if !ok {
|
||||||
|
resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
r.client = client
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
|
||||||
|
var plan secretBackendModel
|
||||||
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
mountPath := strings.Trim(plan.Path.ValueString(), "/")
|
||||||
|
|
||||||
|
err := r.client.enableMount(ctx, mountPath, plan.Plugin.ValueString(), plan.Description.ValueString(), mountConfig{})
|
||||||
|
if err != nil {
|
||||||
|
if isMountAlreadyExists(err) {
|
||||||
|
resp.Diagnostics.AddError(
|
||||||
|
"mount path already in use",
|
||||||
|
fmt.Sprintf("A secrets engine is already mounted at %q. Import it or choose another path.", mountPath),
|
||||||
|
)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.AddError("failed to enable ghp secrets engine", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := r.client.write(ctx, configPath(mountPath), r.configData(plan)); err != nil {
|
||||||
|
// Roll back the mount so we don't leave a half-configured engine.
|
||||||
|
_ = r.client.disableMount(ctx, mountPath)
|
||||||
|
resp.Diagnostics.AddError("failed to write ghp config", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
plan.Path = types.StringValue(mountPath)
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
|
||||||
|
var state secretBackendModel
|
||||||
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
mountPath := strings.Trim(state.Path.ValueString(), "/")
|
||||||
|
|
||||||
|
mount, err := r.client.mountInfo(ctx, mountPath)
|
||||||
|
if err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to read mount", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if mount == nil {
|
||||||
|
resp.State.RemoveResource(ctx)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
state.Description = types.StringValue(mount.Description)
|
||||||
|
if mount.Type != "" {
|
||||||
|
state.Plugin = types.StringValue(mount.Type)
|
||||||
|
}
|
||||||
|
|
||||||
|
cfg, err := r.client.read(ctx, configPath(mountPath))
|
||||||
|
if err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to read ghp config", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if cfg != nil {
|
||||||
|
if v, ok := cfg["base_url"].(string); ok {
|
||||||
|
state.BaseURL = types.StringValue(v)
|
||||||
|
}
|
||||||
|
if v, ok := cfg["tls_skip_verify"].(bool); ok {
|
||||||
|
state.TLSSkipVerify = types.BoolValue(v)
|
||||||
|
}
|
||||||
|
if n, ok := toInt64(cfg["request_timeout_seconds"]); ok {
|
||||||
|
state.RequestTimeoutSeconds = types.Int64Value(n)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// admin_token and ca_cert are never returned by the backend; preserve the
|
||||||
|
// state values.
|
||||||
|
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, state)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
|
||||||
|
var plan, state secretBackendModel
|
||||||
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
||||||
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
mountPath := strings.Trim(state.Path.ValueString(), "/")
|
||||||
|
|
||||||
|
if !plan.Description.Equal(state.Description) {
|
||||||
|
if err := r.client.tuneMount(ctx, mountPath, plan.Description.ValueString(), mountConfig{}); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to tune mount description", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := r.client.write(ctx, configPath(mountPath), r.configData(plan)); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to update ghp config", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
plan.Path = types.StringValue(mountPath)
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
|
||||||
|
var state secretBackendModel
|
||||||
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err := r.client.disableMount(ctx, strings.Trim(state.Path.ValueString(), "/")); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to disable ghp secrets engine", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
|
||||||
|
resource.ImportStatePassthroughID(ctx, path.Root("path"), req, resp)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretBackendResource) configData(m secretBackendModel) map[string]interface{} {
|
||||||
|
data := map[string]interface{}{
|
||||||
|
"base_url": m.BaseURL.ValueString(),
|
||||||
|
"admin_token": m.AdminToken.ValueString(),
|
||||||
|
"tls_skip_verify": m.TLSSkipVerify.ValueBool(),
|
||||||
|
"request_timeout_seconds": m.RequestTimeoutSeconds.ValueInt64(),
|
||||||
|
}
|
||||||
|
if !m.CACert.IsNull() && !m.CACert.IsUnknown() {
|
||||||
|
data["ca_cert"] = m.CACert.ValueString()
|
||||||
|
}
|
||||||
|
return data
|
||||||
|
}
|
||||||
@@ -0,0 +1,41 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestBackendConfigData(t *testing.T) {
|
||||||
|
r := &secretBackendResource{}
|
||||||
|
|
||||||
|
m := secretBackendModel{
|
||||||
|
BaseURL: types.StringValue("https://ghp.example.com"),
|
||||||
|
AdminToken: types.StringValue("ghpsvc_secret"),
|
||||||
|
TLSSkipVerify: types.BoolValue(true),
|
||||||
|
RequestTimeoutSeconds: types.Int64Value(15),
|
||||||
|
CACert: types.StringNull(),
|
||||||
|
}
|
||||||
|
data := r.configData(m)
|
||||||
|
if data["base_url"] != "https://ghp.example.com" {
|
||||||
|
t.Errorf("base_url = %v", data["base_url"])
|
||||||
|
}
|
||||||
|
if data["admin_token"] != "ghpsvc_secret" {
|
||||||
|
t.Errorf("admin_token = %v", data["admin_token"])
|
||||||
|
}
|
||||||
|
if data["tls_skip_verify"] != true {
|
||||||
|
t.Errorf("tls_skip_verify = %v, want true", data["tls_skip_verify"])
|
||||||
|
}
|
||||||
|
if data["request_timeout_seconds"] != int64(15) {
|
||||||
|
t.Errorf("request_timeout_seconds = %v, want 15", data["request_timeout_seconds"])
|
||||||
|
}
|
||||||
|
if _, ok := data["ca_cert"]; ok {
|
||||||
|
t.Errorf("ca_cert should be omitted when null")
|
||||||
|
}
|
||||||
|
|
||||||
|
m.CACert = types.StringValue("-----BEGIN CERTIFICATE-----")
|
||||||
|
data = r.configData(m)
|
||||||
|
if data["ca_cert"] != "-----BEGIN CERTIFICATE-----" {
|
||||||
|
t.Errorf("ca_cert = %v", data["ca_cert"])
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,319 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/diag"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/path"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
_ resource.Resource = &secretRoleResource{}
|
||||||
|
_ resource.ResourceWithImportState = &secretRoleResource{}
|
||||||
|
_ resource.ResourceWithValidateConfig = &secretRoleResource{}
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
tokenTypeAgent = "agent"
|
||||||
|
tokenTypeProxy = "proxy"
|
||||||
|
)
|
||||||
|
|
||||||
|
type secretRoleResource struct {
|
||||||
|
client *vaultClient
|
||||||
|
}
|
||||||
|
|
||||||
|
type secretRoleModel struct {
|
||||||
|
Backend types.String `tfsdk:"backend"`
|
||||||
|
Name types.String `tfsdk:"name"`
|
||||||
|
TokenType types.String `tfsdk:"token_type"`
|
||||||
|
InstallationID types.Int64 `tfsdk:"installation_id"`
|
||||||
|
AppRecordID types.String `tfsdk:"app_record_id"`
|
||||||
|
Repositories types.List `tfsdk:"repositories"`
|
||||||
|
Scopes types.List `tfsdk:"scopes"`
|
||||||
|
SessionPrefix types.String `tfsdk:"session_prefix"`
|
||||||
|
TTL types.Int64 `tfsdk:"ttl"`
|
||||||
|
MaxTTL types.Int64 `tfsdk:"max_ttl"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func NewSecretRoleResource() resource.Resource {
|
||||||
|
return &secretRoleResource{}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
|
||||||
|
resp.TypeName = req.ProviderTypeName + "_secret_role"
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
|
||||||
|
resp.Schema = schema.Schema{
|
||||||
|
Description: "Manages a role on the ghp secrets engine that mints short-lived scoped ghp tokens.",
|
||||||
|
Attributes: map[string]schema.Attribute{
|
||||||
|
"backend": schema.StringAttribute{
|
||||||
|
Description: "Mount path of the ghp secrets engine.",
|
||||||
|
Required: true,
|
||||||
|
PlanModifiers: []planmodifier.String{
|
||||||
|
stringplanmodifier.RequiresReplace(),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"name": schema.StringAttribute{
|
||||||
|
Description: "Name of the role.",
|
||||||
|
Required: true,
|
||||||
|
PlanModifiers: []planmodifier.String{
|
||||||
|
stringplanmodifier.RequiresReplace(),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"token_type": schema.StringAttribute{
|
||||||
|
Description: "ghp token type to mint: \"agent\" (default) or \"proxy\".",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
},
|
||||||
|
"installation_id": schema.Int64Attribute{
|
||||||
|
Description: "ghp App installation id the minted agent token is bound to (required when token_type is \"agent\").",
|
||||||
|
Optional: true,
|
||||||
|
},
|
||||||
|
"app_record_id": schema.StringAttribute{
|
||||||
|
Description: "Optional ghp App record id (UUID) to pin agent tokens to; empty selects ghp's default app.",
|
||||||
|
Optional: true,
|
||||||
|
},
|
||||||
|
"repositories": schema.ListAttribute{
|
||||||
|
Description: "Optional repositories the minted token is restricted to; empty is open-scoped (all repositories).",
|
||||||
|
ElementType: types.StringType,
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
},
|
||||||
|
"scopes": schema.ListAttribute{
|
||||||
|
Description: "Optional ghp permission:level scopes (e.g. [\"contents:read\", \"pull_requests:write\"]); empty is open-scoped.",
|
||||||
|
ElementType: types.StringType,
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
},
|
||||||
|
"session_prefix": schema.StringAttribute{
|
||||||
|
Description: "Prefix for the ghp session id of each minted token (default \"vault\").",
|
||||||
|
Optional: true,
|
||||||
|
Computed: true,
|
||||||
|
},
|
||||||
|
"ttl": schema.Int64Attribute{
|
||||||
|
Description: "Default lease TTL in seconds for tokens minted from this role.",
|
||||||
|
Optional: true,
|
||||||
|
},
|
||||||
|
"max_ttl": schema.Int64Attribute{
|
||||||
|
Description: "Maximum lease TTL in seconds for tokens minted from this role.",
|
||||||
|
Optional: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) ValidateConfig(ctx context.Context, req resource.ValidateConfigRequest, resp *resource.ValidateConfigResponse) {
|
||||||
|
var config secretRoleModel
|
||||||
|
resp.Diagnostics.Append(req.Config.Get(ctx, &config)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
// token_type defaults to "agent" server-side, so a null token_type is an
|
||||||
|
// agent role and still requires installation_id.
|
||||||
|
isAgent := config.TokenType.IsNull() || config.TokenType.ValueString() == tokenTypeAgent
|
||||||
|
if isAgent && config.InstallationID.IsNull() {
|
||||||
|
resp.Diagnostics.AddAttributeError(
|
||||||
|
path.Root("installation_id"),
|
||||||
|
"installation_id required for agent tokens",
|
||||||
|
"token_type is \"agent\" (the default), which requires installation_id to be set.",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
|
||||||
|
if req.ProviderData == nil {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
client, ok := req.ProviderData.(*vaultClient)
|
||||||
|
if !ok {
|
||||||
|
resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
r.client = client
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
|
||||||
|
var plan secretRoleModel
|
||||||
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
data, diags := roleData(ctx, plan)
|
||||||
|
resp.Diagnostics.Append(diags...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err := r.client.write(ctx, rolePath(plan.Backend.ValueString(), plan.Name.ValueString()), data); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to create ghp role", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(r.readInto(ctx, &plan)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
|
||||||
|
var state secretRoleModel
|
||||||
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
role, err := r.client.read(ctx, rolePath(state.Backend.ValueString(), state.Name.ValueString()))
|
||||||
|
if err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to read ghp role", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if role == nil {
|
||||||
|
resp.State.RemoveResource(ctx)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(applyRoleData(&state, role)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, state)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
|
||||||
|
var plan secretRoleModel
|
||||||
|
resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
data, diags := roleData(ctx, plan)
|
||||||
|
resp.Diagnostics.Append(diags...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err := r.client.write(ctx, rolePath(plan.Backend.ValueString(), plan.Name.ValueString()), data); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to update ghp role", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(r.readInto(ctx, &plan)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(resp.State.Set(ctx, plan)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
|
||||||
|
var state secretRoleModel
|
||||||
|
resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
|
||||||
|
if resp.Diagnostics.HasError() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err := r.client.delete(ctx, rolePath(state.Backend.ValueString(), state.Name.ValueString())); err != nil {
|
||||||
|
resp.Diagnostics.AddError("failed to delete ghp role", err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
|
||||||
|
backend, name, ok := splitBackendName(req.ID, "roles")
|
||||||
|
if !ok {
|
||||||
|
resp.Diagnostics.AddError(
|
||||||
|
"invalid import ID",
|
||||||
|
fmt.Sprintf("expected \"<backend>/roles/<name>\", got %q", req.ID),
|
||||||
|
)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("backend"), backend)...)
|
||||||
|
resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("name"), name)...)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *secretRoleResource) readInto(ctx context.Context, m *secretRoleModel) diag.Diagnostics {
|
||||||
|
var diags diag.Diagnostics
|
||||||
|
role, err := r.client.read(ctx, rolePath(m.Backend.ValueString(), m.Name.ValueString()))
|
||||||
|
if err != nil {
|
||||||
|
diags.AddError("failed to read back ghp role", err.Error())
|
||||||
|
return diags
|
||||||
|
}
|
||||||
|
if role == nil {
|
||||||
|
diags.AddError("role missing after write", "the role was not found immediately after being written")
|
||||||
|
return diags
|
||||||
|
}
|
||||||
|
return applyRoleData(m, role)
|
||||||
|
}
|
||||||
|
|
||||||
|
func roleData(ctx context.Context, m secretRoleModel) (map[string]interface{}, diag.Diagnostics) {
|
||||||
|
var diags diag.Diagnostics
|
||||||
|
data := map[string]interface{}{}
|
||||||
|
|
||||||
|
if !m.TokenType.IsNull() && !m.TokenType.IsUnknown() {
|
||||||
|
data["token_type"] = m.TokenType.ValueString()
|
||||||
|
}
|
||||||
|
if !m.InstallationID.IsNull() && !m.InstallationID.IsUnknown() {
|
||||||
|
data["installation_id"] = m.InstallationID.ValueInt64()
|
||||||
|
}
|
||||||
|
if !m.AppRecordID.IsNull() && !m.AppRecordID.IsUnknown() {
|
||||||
|
data["app_record_id"] = m.AppRecordID.ValueString()
|
||||||
|
}
|
||||||
|
if !m.Repositories.IsNull() && !m.Repositories.IsUnknown() {
|
||||||
|
var repos []string
|
||||||
|
diags.Append(m.Repositories.ElementsAs(ctx, &repos, false)...)
|
||||||
|
data["repositories"] = repos
|
||||||
|
}
|
||||||
|
if !m.Scopes.IsNull() && !m.Scopes.IsUnknown() {
|
||||||
|
var scopes []string
|
||||||
|
diags.Append(m.Scopes.ElementsAs(ctx, &scopes, false)...)
|
||||||
|
data["scopes"] = scopes
|
||||||
|
}
|
||||||
|
if !m.SessionPrefix.IsNull() && !m.SessionPrefix.IsUnknown() {
|
||||||
|
data["session_prefix"] = m.SessionPrefix.ValueString()
|
||||||
|
}
|
||||||
|
if !m.TTL.IsNull() && !m.TTL.IsUnknown() {
|
||||||
|
data["ttl"] = m.TTL.ValueInt64()
|
||||||
|
}
|
||||||
|
if !m.MaxTTL.IsNull() && !m.MaxTTL.IsUnknown() {
|
||||||
|
data["max_ttl"] = m.MaxTTL.ValueInt64()
|
||||||
|
}
|
||||||
|
return data, diags
|
||||||
|
}
|
||||||
|
|
||||||
|
func applyRoleData(m *secretRoleModel, role map[string]interface{}) diag.Diagnostics {
|
||||||
|
var diags diag.Diagnostics
|
||||||
|
|
||||||
|
if v, ok := role["token_type"].(string); ok && v != "" {
|
||||||
|
m.TokenType = types.StringValue(v)
|
||||||
|
}
|
||||||
|
if n, ok := toInt64(role["installation_id"]); ok && n != 0 {
|
||||||
|
m.InstallationID = types.Int64Value(n)
|
||||||
|
}
|
||||||
|
if v, ok := role["app_record_id"].(string); ok && v != "" {
|
||||||
|
m.AppRecordID = types.StringValue(v)
|
||||||
|
}
|
||||||
|
|
||||||
|
repos := toStringSlice(role["repositories"])
|
||||||
|
repoList, repoDiags := types.ListValueFrom(context.Background(), types.StringType, repos)
|
||||||
|
diags.Append(repoDiags...)
|
||||||
|
m.Repositories = repoList
|
||||||
|
|
||||||
|
scopeVals := toStringSlice(role["scopes"])
|
||||||
|
scopeList, scopeDiags := types.ListValueFrom(context.Background(), types.StringType, scopeVals)
|
||||||
|
diags.Append(scopeDiags...)
|
||||||
|
m.Scopes = scopeList
|
||||||
|
|
||||||
|
if v, ok := role["session_prefix"].(string); ok && v != "" {
|
||||||
|
m.SessionPrefix = types.StringValue(v)
|
||||||
|
}
|
||||||
|
if n, ok := toInt64(role["ttl"]); ok && n != 0 {
|
||||||
|
m.TTL = types.Int64Value(n)
|
||||||
|
} else if m.TTL.IsUnknown() {
|
||||||
|
m.TTL = types.Int64Null()
|
||||||
|
}
|
||||||
|
if n, ok := toInt64(role["max_ttl"]); ok && n != 0 {
|
||||||
|
m.MaxTTL = types.Int64Value(n)
|
||||||
|
} else if m.MaxTTL.IsUnknown() {
|
||||||
|
m.MaxTTL = types.Int64Null()
|
||||||
|
}
|
||||||
|
return diags
|
||||||
|
}
|
||||||
@@ -0,0 +1,128 @@
|
|||||||
|
package provider
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
||||||
|
)
|
||||||
|
|
||||||
|
func listOf(t *testing.T, vals ...string) types.List {
|
||||||
|
t.Helper()
|
||||||
|
l, diags := types.ListValueFrom(context.Background(), types.StringType, vals)
|
||||||
|
if diags.HasError() {
|
||||||
|
t.Fatalf("building list: %v", diags)
|
||||||
|
}
|
||||||
|
return l
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRoleDataOmitsUnsetFields(t *testing.T) {
|
||||||
|
m := secretRoleModel{
|
||||||
|
TokenType: types.StringValue("agent"),
|
||||||
|
InstallationID: types.Int64Value(42),
|
||||||
|
Scopes: listOf(t, "contents:read", "pull_requests:write"),
|
||||||
|
// AppRecordID, Repositories, SessionPrefix, TTL, MaxTTL left null.
|
||||||
|
AppRecordID: types.StringNull(),
|
||||||
|
Repositories: types.ListNull(types.StringType),
|
||||||
|
SessionPrefix: types.StringNull(),
|
||||||
|
TTL: types.Int64Null(),
|
||||||
|
MaxTTL: types.Int64Null(),
|
||||||
|
}
|
||||||
|
data, diags := roleData(context.Background(), m)
|
||||||
|
if diags.HasError() {
|
||||||
|
t.Fatalf("roleData: %v", diags)
|
||||||
|
}
|
||||||
|
if data["token_type"] != "agent" {
|
||||||
|
t.Errorf("token_type = %v, want agent", data["token_type"])
|
||||||
|
}
|
||||||
|
if data["installation_id"] != int64(42) {
|
||||||
|
t.Errorf("installation_id = %v, want 42", data["installation_id"])
|
||||||
|
}
|
||||||
|
if _, ok := data["app_record_id"]; ok {
|
||||||
|
t.Errorf("app_record_id should be omitted when null, got %v", data["app_record_id"])
|
||||||
|
}
|
||||||
|
if _, ok := data["repositories"]; ok {
|
||||||
|
t.Errorf("repositories should be omitted when null")
|
||||||
|
}
|
||||||
|
if _, ok := data["ttl"]; ok {
|
||||||
|
t.Errorf("ttl should be omitted when null")
|
||||||
|
}
|
||||||
|
scopes, ok := data["scopes"].([]string)
|
||||||
|
if !ok || len(scopes) != 2 || scopes[0] != "contents:read" {
|
||||||
|
t.Errorf("scopes = %v, want [contents:read pull_requests:write]", data["scopes"])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestApplyRoleDataMapsEngineResponse(t *testing.T) {
|
||||||
|
// Shape mirrors what the engine's pathRoleRead returns via the Vault API.
|
||||||
|
role := map[string]interface{}{
|
||||||
|
"token_type": "agent",
|
||||||
|
"installation_id": json.Number("77"),
|
||||||
|
"app_record_id": "3c2d1e00-0000-4000-8000-000000000000",
|
||||||
|
"repositories": []interface{}{"org/repo"},
|
||||||
|
"scopes": []interface{}{"contents:read"},
|
||||||
|
"session_prefix": "vault",
|
||||||
|
"ttl": json.Number("3600"),
|
||||||
|
"max_ttl": json.Number("86400"),
|
||||||
|
}
|
||||||
|
var m secretRoleModel
|
||||||
|
m.TTL = types.Int64Null()
|
||||||
|
m.MaxTTL = types.Int64Null()
|
||||||
|
if diags := applyRoleData(&m, role); diags.HasError() {
|
||||||
|
t.Fatalf("applyRoleData: %v", diags)
|
||||||
|
}
|
||||||
|
if m.TokenType.ValueString() != "agent" {
|
||||||
|
t.Errorf("token_type = %q, want agent", m.TokenType.ValueString())
|
||||||
|
}
|
||||||
|
if m.InstallationID.ValueInt64() != 77 {
|
||||||
|
t.Errorf("installation_id = %d, want 77", m.InstallationID.ValueInt64())
|
||||||
|
}
|
||||||
|
if m.AppRecordID.ValueString() != "3c2d1e00-0000-4000-8000-000000000000" {
|
||||||
|
t.Errorf("app_record_id = %q", m.AppRecordID.ValueString())
|
||||||
|
}
|
||||||
|
if m.SessionPrefix.ValueString() != "vault" {
|
||||||
|
t.Errorf("session_prefix = %q, want vault", m.SessionPrefix.ValueString())
|
||||||
|
}
|
||||||
|
if m.TTL.ValueInt64() != 3600 || m.MaxTTL.ValueInt64() != 86400 {
|
||||||
|
t.Errorf("ttl/max_ttl = %d/%d, want 3600/86400", m.TTL.ValueInt64(), m.MaxTTL.ValueInt64())
|
||||||
|
}
|
||||||
|
var scopes []string
|
||||||
|
m.Scopes.ElementsAs(context.Background(), &scopes, false)
|
||||||
|
if len(scopes) != 1 || scopes[0] != "contents:read" {
|
||||||
|
t.Errorf("scopes = %v, want [contents:read]", scopes)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestApplyRoleDataProxyLeavesInstallationNull(t *testing.T) {
|
||||||
|
// A proxy role has no installation; the engine returns 0, which must not
|
||||||
|
// clobber the null model value into a spurious 0.
|
||||||
|
role := map[string]interface{}{
|
||||||
|
"token_type": "proxy",
|
||||||
|
"installation_id": json.Number("0"),
|
||||||
|
"app_record_id": "",
|
||||||
|
"repositories": []interface{}{},
|
||||||
|
"scopes": []interface{}{},
|
||||||
|
"session_prefix": "vault",
|
||||||
|
"ttl": json.Number("0"),
|
||||||
|
"max_ttl": json.Number("0"),
|
||||||
|
}
|
||||||
|
m := secretRoleModel{
|
||||||
|
InstallationID: types.Int64Null(),
|
||||||
|
AppRecordID: types.StringNull(),
|
||||||
|
TTL: types.Int64Null(),
|
||||||
|
MaxTTL: types.Int64Null(),
|
||||||
|
}
|
||||||
|
if diags := applyRoleData(&m, role); diags.HasError() {
|
||||||
|
t.Fatalf("applyRoleData: %v", diags)
|
||||||
|
}
|
||||||
|
if !m.InstallationID.IsNull() {
|
||||||
|
t.Errorf("installation_id = %v, want null for proxy", m.InstallationID)
|
||||||
|
}
|
||||||
|
if !m.AppRecordID.IsNull() {
|
||||||
|
t.Errorf("app_record_id = %v, want null", m.AppRecordID)
|
||||||
|
}
|
||||||
|
if m.TokenType.ValueString() != "proxy" {
|
||||||
|
t.Errorf("token_type = %q, want proxy", m.TokenType.ValueString())
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
// Command terraform-provider-vault-secrets-ghp is the Terraform/OpenTofu
|
||||||
|
// provider for the vault-plugin-secrets-ghp secrets engine: it manages the
|
||||||
|
// engine's mount + connection config and its token-minting roles on HashiCorp
|
||||||
|
// Vault or OpenBao.
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"flag"
|
||||||
|
"log"
|
||||||
|
|
||||||
|
"github.com/hashicorp/terraform-plugin-framework/providerserver"
|
||||||
|
|
||||||
|
"git.unkin.net/unkin/terraform-provider-vault-secrets-ghp/internal/provider"
|
||||||
|
)
|
||||||
|
|
||||||
|
var version = "0.0.1"
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
var debug bool
|
||||||
|
flag.BoolVar(&debug, "debug", false, "enable debug mode")
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
opts := providerserver.ServeOpts{
|
||||||
|
Address: "git.unkin.net/unkin/vault-secrets-ghp",
|
||||||
|
Debug: debug,
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := providerserver.Serve(context.Background(), provider.New(version), opts); err != nil {
|
||||||
|
log.Fatal(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user