Skip to content

Commit 1c16837

Browse files
trentdibaccotrentdibacco
authored
VAULT-35711: Add new HCP Radar resource list as a TF data source (#1324)
* VAULT-35711: Add new HCP Radar resource list TF data source * Correct guide to use resource_name instead of resource_uri. * Edit the _testacc_vaultradar.yml. * By using a map instead of a set in the for_each, the state and output become more human friendly because it include the radar resource uri. * Rename data source, and used a nested structure to represent the uri filter and case insensitive.
1 parent cdcc665 commit 1c16837

13 files changed

Lines changed: 648 additions & 3 deletions

File tree

‎.changelog/1324.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:feature
2+
Add preview of hcp_vault_radar_resources.
3+
```

‎.github/workflows/_testacc_vaultradar.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ jobs:
7979
# RADAR_GITHUB_ENTERPRISE_TOKEN: ${{ secrets.RADAR_GITHUB_ENTERPRISE_TOKEN }}
8080
# RADAR_GITHUB_ENTERPRISE_TOKEN_2: ${{ secrets.RADAR_GITHUB_ENTERPRISE_TOKEN_2 }}
8181
# RADAR_HCP_RESOURCE_NAME ${{ secrets.RADAR_HCP_RESOURCE_NAME }}
82+
# RADAR_RESOURCES_URI_LIKE_FILTER ${{ secrets.RADAR_RESOURCES_URI_LIKE_FILTER }}
8283
run: |
8384
go test \
8485
./internal/provider/vaultradar \

‎docs/data-sources/vault_radar_resources.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
page_title: "Data Source hcp_vault_radar_resources - terraform-provider-hcp"
3+
subcategory: "HCP Vault Radar"
4+
description: |-
5+
Retrieves a list of radar resource data.
6+
---
7+
8+
# hcp_vault_radar_resources (Data Source)
9+
10+
-> **Note:** This feature is currently in private beta.
11+
12+
Retrieves a list of radar resource data.
13+
14+
## Example Usage
15+
16+
```terraform
17+
# Returns a list of Radar resources in the project with uri matching
18+
# that beginning with "git://github.com/hashicorp/" or "git://github.com/ibm/".
19+
data "hcp_vault_radar_resources" "example" {
20+
uri_like_filter = {
21+
values = [
22+
"git://github.com/hashicorp/%",
23+
"git://github.com/ibm/%"
24+
]
25+
case_insensitive = false
26+
}
27+
}
28+
```
29+
30+
<!-- schema generated by tfplugindocs -->
31+
## Schema
32+
33+
### Required
34+
35+
- `uri_like_filter` (Attributes) Applies a filter to the radar resources based on their URIs. The filter uses the SQL LIKE operator, which allows for wildcard matching. (see [below for nested schema](#nestedatt--uri_like_filter))
36+
37+
### Optional
38+
39+
- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.
40+
41+
### Read-Only
42+
43+
- `resources` (Attributes List) List of Radar resources. (see [below for nested schema](#nestedatt--resources))
44+
45+
<a id="nestedatt--uri_like_filter"></a>
46+
### Nested Schema for `uri_like_filter`
47+
48+
Required:
49+
50+
- `values` (List of String) URI like filters to apply radar resources. Each entry in the list will act like an or condition.
51+
52+
Optional:
53+
54+
- `case_insensitive` (Boolean) If true, the uri like filter will be case insensitive. Defaults to false.
55+
56+
57+
<a id="nestedatt--resources"></a>
58+
### Nested Schema for `resources`
59+
60+
Read-Only:
61+
62+
- `connection_url` (String) Radar resource connection url
63+
- `data_source_info` (String) Radar resource data source info
64+
- `data_source_name` (String) Radar resource data source name
65+
- `data_source_type` (String) Radar resource data source type
66+
- `description` (String) Radar resource description
67+
- `detector_type` (String) Radar resource detector type
68+
- `hcp_resource_id` (String) Radar resource HCP resource ID
69+
- `hcp_resource_name` (String) Radar resource HCP resource name
70+
- `hcp_resource_status` (String) Radar resource HCP resource status
71+
- `id` (String) Radar resource id
72+
- `name` (String) Radar resource name
73+
- `state` (String) Radar resource state
74+
- `uri` (String) Radar resource uri
75+
- `visibility` (String) Radar resource visibility

‎docs/guides/vault-radar-resource-rbac.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
subcategory: ""
3+
page_title: "Managing Vault Radar Resource IAM Policies"
4+
description: |-
5+
A guide to setting up and managing access to select Radar resources.
6+
---
7+
8+
# Managing Vault Radar Resource IAM Policies
9+
10+
-> **Note:** This feature is currently in private beta.
11+
12+
Administrators can limit users' access to specific Vault Radar resources by using either `hcp_vault_radar_resource_iam_binding` or `hcp_vault_radar_resource_iam_policy`.
13+
14+
Only users with no role at the organization or project level can be restricted to specific Radar resources.
15+
16+
## Pre-requisites and Constraints
17+
* An IAM group should be created with the role `roles/vault-radar.developer` at the project level. This will allow the group's members to access Radar.
18+
* It's recommended to create a group for each team that will be require access to a select set of Radar resources.
19+
* Add users without any roles to the group created above.
20+
* Use the group created above to set the policy or binding for a select set of Radar resources.
21+
* Only the roles `roles/vault-radar.resource-viewer` or `roles/vault-radar.resource-contributor` can be applied to the policy or binding for Radar resources.
22+
23+
## Sample Usage
24+
The following is an example of create a group with the role `roles/vault-radar.developer` at the project level and set the policy for a set of Radar resource that match a resource URI prefix with the role `roles/vault-radar.resource-viewer` for that group.
25+
26+
```terraform
27+
variable "project_id" {
28+
type = string
29+
}
30+
31+
32+
# Create a group for members with no roles.
33+
resource "hcp_group" "group" {
34+
display_name = "my-developer-group"
35+
description = "my developer group managed by TF"
36+
}
37+
38+
# Assign 'roles/vault-radar.developer' role on the group.
39+
# This allows the groups members access to Vault Radar.
40+
resource "hcp_project_iam_binding" "binding" {
41+
project_id = var.project_id
42+
principal_id = hcp_group.group.resource_id
43+
role = "roles/vault-radar.developer"
44+
}
45+
46+
# Create a policy that will grant Radar Resource Viewer access to the group.
47+
data "hcp_iam_policy" "policy" {
48+
bindings = [
49+
{
50+
role = "roles/vault-radar.resource-viewer"
51+
principals = [hcp_group.group.resource_id]
52+
}
53+
]
54+
}
55+
56+
# Get the list of Radar resources intended to be accessed by the group.
57+
# This example uses a URI 'LIKE' filter to only include resources that start with "git://github.com/ibm/" or "git://github.com/hashicorp/".
58+
data "hcp_vault_radar_resources" "radar_resources" {
59+
uri_like_filter = {
60+
values = [
61+
"git://github.com/ibm/%",
62+
"git://github.com/hashicorp/%",
63+
]
64+
case_insensitive = false
65+
}
66+
}
67+
68+
# Map the list of Radar resources to a map of Radar URIs to HCP resource names, and filter out any resources that are not registered.
69+
locals {
70+
resources_uri_to_resource_name = {
71+
for radar_resource in data.hcp_vault_radar_resources.radar_resources.resources : radar_resource.uri => radar_resource.hcp_resource_name
72+
# This is done as a precaution to ensure that only valid resources are processed.
73+
if radar_resource.hcp_resource_status == "registered"
74+
}
75+
76+
}
77+
78+
# Create IAM policies for each Radar resource's HCP resource name that the group should have access to.
79+
# Note this will replace any existing policies for the resources. If that is not desired, consider using `hcp_vault_radar_resource_iam_binding` instead.
80+
resource "hcp_vault_radar_resource_iam_policy" "policy" {
81+
for_each = local.resources_uri_to_resource_name
82+
resource_name = each.value
83+
policy_data = data.hcp_iam_policy.policy.policy_data
84+
}
85+
```

‎examples/data-sources/hcp_vault_radar_resources/data-source.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Returns a list of Radar resources in the project with uri matching
2+
# that beginning with "git://github.com/hashicorp/" or "git://github.com/ibm/".
3+
data "hcp_vault_radar_resources" "example" {
4+
uri_like_filter = {
5+
values = [
6+
"git://github.com/hashicorp/%",
7+
"git://github.com/ibm/%"
8+
]
9+
case_insensitive = false
10+
}
11+
}

‎examples/guides/vault_radar_resource_rbac/main.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
variable "project_id" {
2+
type = string
3+
}
4+
5+
6+
# Create a group for members with no roles.
7+
resource "hcp_group" "group" {
8+
display_name = "my-developer-group"
9+
description = "my developer group managed by TF"
10+
}
11+
12+
# Assign 'roles/vault-radar.developer' role on the group.
13+
# This allows the groups members access to Vault Radar.
14+
resource "hcp_project_iam_binding" "binding" {
15+
project_id = var.project_id
16+
principal_id = hcp_group.group.resource_id
17+
role = "roles/vault-radar.developer"
18+
}
19+
20+
# Create a policy that will grant Radar Resource Viewer access to the group.
21+
data "hcp_iam_policy" "policy" {
22+
bindings = [
23+
{
24+
role = "roles/vault-radar.resource-viewer"
25+
principals = [hcp_group.group.resource_id]
26+
}
27+
]
28+
}
29+
30+
# Get the list of Radar resources intended to be accessed by the group.
31+
# This example uses a URI 'LIKE' filter to only include resources that start with "git://github.com/ibm/" or "git://github.com/hashicorp/".
32+
data "hcp_vault_radar_resources" "radar_resources" {
33+
uri_like_filter = {
34+
values = [
35+
"git://github.com/ibm/%",
36+
"git://github.com/hashicorp/%",
37+
]
38+
case_insensitive = false
39+
}
40+
}
41+
42+
# Map the list of Radar resources to a map of Radar URIs to HCP resource names, and filter out any resources that are not registered.
43+
locals {
44+
resources_uri_to_resource_name = {
45+
for radar_resource in data.hcp_vault_radar_resources.radar_resources.resources : radar_resource.uri => radar_resource.hcp_resource_name
46+
# This is done as a precaution to ensure that only valid resources are processed.
47+
if radar_resource.hcp_resource_status == "registered"
48+
}
49+
50+
}
51+
52+
# Create IAM policies for each Radar resource's HCP resource name that the group should have access to.
53+
# Note this will replace any existing policies for the resources. If that is not desired, consider using `hcp_vault_radar_resource_iam_binding` instead.
54+
resource "hcp_vault_radar_resource_iam_policy" "policy" {
55+
for_each = local.resources_uri_to_resource_name
56+
resource_name = each.value
57+
policy_data = data.hcp_iam_policy.policy.policy_data
58+
}

‎internal/clients/vault_radar.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,6 @@ func ListRadarResources(ctx context.Context, client *Client, projectID string, b
285285

286286
res, err := client.RadarResourceService.ListResources(params, nil)
287287
if err != nil {
288-
tflog.Error(ctx, "Failed to list radar resources", map[string]interface{}{"error": err.Error()})
289288
return nil, err
290289
}
291290

‎internal/provider/provider.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,8 @@ func (p *ProviderFramework) DataSources(ctx context.Context) []func() datasource
219219
waypoint.NewTemplateDataSource,
220220
waypoint.NewAddOnDataSource,
221221
waypoint.NewAddOnDefinitionDataSource,
222+
// Radar
223+
vaultradar.NewRadarResourcesDataSource,
222224
}, packer.DataSourceSchemaBuilders...)
223225
}
224226

0 commit comments

Comments
 (0)