Added ACL Support to the Terraform Provider #64

unasra · 2024-02-06T10:53:02Z

No description provided.

mathewab · 2024-02-06T15:03:48Z

internal/service/dns_config/api_acl_resource.go

+
+func (r *AclResource) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "",


Please add description

mathewab · 2024-02-06T15:04:26Z

internal/service/dns_config/api_acl_data_source.go

+
+func (d *AclDataSource) Schema(ctx context.Context, req datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "",


Please add description

mathewab · 2024-02-06T15:08:06Z

examples/resources/bloxone_dns_auth_zone/resource.tf

You also need to add examples/resources/bloxone_dns_acl.tf and examples/data-sources/bloxone_dns_acls.tf

Both files are added

mathewab · 2024-02-06T17:24:11Z

docs/data-sources/dns_acls.md

+
+# bloxone_dns_acls (Data Source)
+
+Retrieves information about existing Authoritative DNS ACLs.


Suggested change

Retrieves information about existing Authoritative DNS ACLs.

Retrieves information about existing named Access Control Lists.

Ahh, my comment vanished. @mathewab Please add the suggested change in the corresponding service file. Would make it easier for the addressee. Just a thought :)

Sure :) Will keep that in mind next time .

mathewab · 2024-02-06T17:24:41Z

docs/resources/dns_acl.md

+
+# bloxone_dns_acl (Resource)
+
+Manages an Access Control List (ACL).


Suggested change

Manages an Access Control List (ACL).

Manages a named Access Control List (ACL).

mathewab · 2024-02-06T17:45:19Z

docs/resources/dns_auth_zone.md

+resource "bloxone_dns_acl" "test" {
+  name = "test-acl"
+}


Even though an empty ACL is possible, it is not useful. For our examples, it would be better to have an ACL with basic list, where the transfer_acl can follow the following order

deny any
allow acl 192.168.1.0/24
deny ip 192.168.1.1
allow tsig test-tsig.

I see that you have removed the nested acl altogether. Sorry if I was not clear in my comments. We do want the nested ACL as well, but not a nested ACL that is empty. So the whole resource should look something like this

resource "bloxone_dns_auth_zone" "example" { fqdn = "domain.com." primary_type = "cloud" # Other optional fields comment = "Example of an Authoritative Zone" tags = { site = "Site A" } query_acl = [ { access = "deny" element = "ip" address = "192.168.1.1" }, { element = "acl" acl = bloxone_dns_acl.example_acl.id }, { access = "allow" element = "tsig_key" tsig_key = { key = bloxone_keys_tsig.example_tsig.id } }, { access = "deny" element = "any" }, ] update_acl = [ { access = "allow" element = "any" }, ] transfer_acl = [ { access = "allow" element = "any" }, ] } resource "bloxone_keys_tsig" "example_tsig" { name = "example_tsig.domain.com." } resource "bloxone_dns_acl" "example_acl" { name = "example_acl" elements = [ { access = "deny" element = "ip" address = "192.168.1.0/24" }, ] }

mathewab · 2024-02-06T17:45:49Z

docs/resources/dns_auth_zone.md

+resource "bloxone_dns_acl" "test" {
+  name = "test-acl"
+}
+
 resource "bloxone_dns_auth_zone" "example" {
  fqdn         = "example.com."


Suggested change

fqdn = "example.com."

fqdn = "domain.com."

I believe we should set standards for naming in the tf files. Maybe we can talk about this offline and come up with a standard.

mathewab · 2024-02-06T17:46:23Z

docs/resources/dns_auth_zone.md

@@ -13,6 +13,14 @@ Manages an authoritative zone.
 ## Example Usage

 ```terraform
+resource "bloxone_keys_tsig" "test" {


Don't use "test" as name in the examples

mathewab · 2024-02-06T17:49:58Z

internal/service/dns_config/api_auth_zone_resource_test.go

+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAuthZoneExists(context.Background(), resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "transfer_acl.0.access", "deny"),
+					resource.TestCheckResourceAttr(resourceName, "transfer_acl.0.element", "tsig_key"),


Please add check to verify Tsig key ID as well.

Applies to all UTs

Verification added

mathewab · 2024-02-06T17:50:20Z

internal/service/dns_config/api_auth_zone_resource_test.go

+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAuthZoneExists(context.Background(), resourceName, &v),
+					resource.TestCheckResourceAttr(resourceName, "transfer_acl.0.element", "acl"),
+				),


Please add check to verify ACL ID as well.

Applies to all UTs

mathewab · 2024-02-08T05:57:11Z

examples/resources/bloxone_dns_auth_zone/resource.tf

@@ -1,5 +1,9 @@
+resource "bloxone_keys_tsig" "example_tsig" {
+  name = "test-tsig."


Suggested change

name = "test-tsig."

name = "example_tsig.domain.com."

Modified as instructed !

mathewab · 2024-02-08T06:26:53Z

docs/resources/dns_auth_zone.md

+resource "bloxone_dns_acl" "test" {
+  name = "test-acl"
+}


I see that you have removed the nested acl altogether. Sorry if I was not clear in my comments. We do want the nested ACL as well, but not a nested ACL that is empty. So the whole resource should look something like this

resource "bloxone_dns_auth_zone" "example" { fqdn = "domain.com." primary_type = "cloud" # Other optional fields comment = "Example of an Authoritative Zone" tags = { site = "Site A" } query_acl = [ { access = "deny" element = "ip" address = "192.168.1.1" }, { element = "acl" acl = bloxone_dns_acl.example_acl.id }, { access = "allow" element = "tsig_key" tsig_key = { key = bloxone_keys_tsig.example_tsig.id } }, { access = "deny" element = "any" }, ] update_acl = [ { access = "allow" element = "any" }, ] transfer_acl = [ { access = "allow" element = "any" }, ] } resource "bloxone_keys_tsig" "example_tsig" { name = "example_tsig.domain.com." } resource "bloxone_dns_acl" "example_acl" { name = "example_acl" elements = [ { access = "deny" element = "ip" address = "192.168.1.0/24" }, ] }

…r-bloxone into update_acl_type

unasra added 2 commits February 6, 2024 16:18

Added ACl Support

8c28868

Updated Docs

54af888

unasra requested a review from mathewab February 6, 2024 11:26

mathewab reviewed Feb 6, 2024

View reviewed changes

Resolved Review comments

a796748

mathewab reviewed Feb 6, 2024

View reviewed changes

Addressed Review comments

2a9ced4

mathewab reviewed Feb 6, 2024

View reviewed changes

Fixed Example files and added checks to UTs

73023ee

unasra requested a review from mathewab February 7, 2024 17:53

mathewab and others added 2 commits February 7, 2024 18:04

Update dns_auth_zone.md

312c902

update authz_zone resource

9234f4a

mathewab reviewed Feb 8, 2024

View reviewed changes

unasra added 3 commits February 8, 2024 12:06

Update resource file as instructed

4516e51

Merge branch 'update_acl_type' of github.com:unasra/terraform-provide…

8434075

…r-bloxone into update_acl_type

Updated docs

42d79ce

mathewab approved these changes Feb 8, 2024

View reviewed changes

mathewab merged commit ed1fbde into infobloxopen:master Feb 8, 2024
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added ACL Support to the Terraform Provider #64

Added ACL Support to the Terraform Provider #64

unasra commented Feb 6, 2024

mathewab Feb 6, 2024

unasra Feb 6, 2024

mathewab Feb 6, 2024

unasra Feb 6, 2024

mathewab Feb 6, 2024

unasra Feb 6, 2024

mathewab Feb 6, 2024

venkat-iblox Feb 6, 2024

mathewab Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 6, 2024 •

edited

Loading

unasra Feb 7, 2024

mathewab Feb 8, 2024

mathewab Feb 6, 2024

venkat-iblox Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 6, 2024

unasra Feb 7, 2024

mathewab Feb 8, 2024

unasra Feb 8, 2024

mathewab Feb 8, 2024


		# bloxone_dns_acls (Data Source)

		Retrieves information about existing Authoritative DNS ACLs.

	Retrieves information about existing Authoritative DNS ACLs.
	Retrieves information about existing named Access Control Lists.


		# bloxone_dns_acl (Resource)

		Manages an Access Control List (ACL).

	Manages an Access Control List (ACL).
	Manages a named Access Control List (ACL).

		@@ -1,5 +1,9 @@
		resource "bloxone_keys_tsig" "example_tsig" {
		name = "test-tsig."

Added ACL Support to the Terraform Provider #64

Added ACL Support to the Terraform Provider #64

Conversation

unasra commented Feb 6, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mathewab Feb 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mathewab Feb 6, 2024 •

edited

Loading