review changes

Signed-off-by: Mauritz Uphoff <mauritz.uphoff@stackit.cloud>

Author: h3adex

docs/ephemeral-resources/ske_kubeconfig.md

@@ -43,7 +43,7 @@ provider "kubernetes" {
 
 ### Optional
 
-- `expiration` (Number) Expiration time of the kubeconfig in seconds. Must be between `600` (10m) and `14400` (4h). Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).
+- `expiration` (Number) Expiration time of the kubeconfig in seconds. Must be between `600` (10m) and `14400` (4h). API defaults to `3600` (1h).
 - `region` (String) The resource region. If not defined, the provider region is used.
 
 ### Read-Only

stackit/internal/services/ske/kubeconfig/ephemeral_resource.go

@@ -20,10 +20,6 @@ import (
 	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/validate"
 )
 
-const (
-	defaultKubeconfigExpiration = 1800
-)
-
 // Ensure the implementation satisfies the expected interfaces.
 var (
 	_ ephemeral.EphemeralResource              = &kubeconfigEphemeralResource{}
@@ -94,7 +90,7 @@ func (e *kubeconfigEphemeralResource) Schema(_ context.Context, _ ephemeral.Sche
 			},
 			"expiration": schema.Int64Attribute{
 				Description: "Expiration time of the kubeconfig in seconds. Must be between `600` (10m) and `14400` (4h). " +
-					"Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).",
+					"API defaults to `3600` (1h).",
 				Optional: true,
 				Validators: []validator.Int64{
 					int64validator.AtLeast(600),
@@ -135,15 +131,7 @@ func (e *kubeconfigEphemeralResource) Open(ctx context.Context, req ephemeral.Op
 	clusterName := model.ClusterName.ValueString()
 	region := e.providerData.GetRegionWithOverride(model.Region)
 
-	// Kubeconfig only needs to be valid for the duration of the Terraform operation.
-	// Defaulted to 1800s (30m) for better security than the API default (3600s).
-	expiration := conversion.Int64ValueToPointer(model.Expiration)
-	if expiration == nil {
-		expiration = new(int64)
-		*expiration = defaultKubeconfigExpiration
-	}
-
-	kubeconfigResp, err := getKubeconfig(ctx, e.client, projectId, region, clusterName, expiration)
+	kubeconfigResp, err := getKubeconfig(ctx, e.client.DefaultAPI, projectId, region, clusterName, conversion.Int64ValueToPointer(model.Expiration))
 
 	ctx = core.LogResponse(ctx)
 
@@ -166,16 +154,12 @@ func (e *kubeconfigEphemeralResource) Open(ctx context.Context, req ephemeral.Op
 }
 
 // getKubeconfig initializes the API call to generate a new kubeconfig
-func getKubeconfig(ctx context.Context, client *ske.APIClient, projectId, region, clusterName string, expiration *int64) (*ske.Kubeconfig, error) {
-	var expirationStringPtr *string
+func getKubeconfig(ctx context.Context, client ske.DefaultAPI, projectId, region, clusterName string, expiration *int64) (*ske.Kubeconfig, error) {
+	payload := ske.CreateKubeconfigPayload{}
 	if expiration != nil {
-		expirationStringPtr = new(string)
-		*expirationStringPtr = strconv.FormatInt(*expiration, 10)
-	}
-
-	payload := ske.CreateKubeconfigPayload{
-		ExpirationSeconds: expirationStringPtr,
+		expirationStr := strconv.FormatInt(*expiration, 10)
+		payload.ExpirationSeconds = &expirationStr
 	}
 
-	return client.DefaultAPI.CreateKubeconfig(ctx, projectId, region, clusterName).CreateKubeconfigPayload(payload).Execute()
+	return client.CreateKubeconfig(ctx, projectId, region, clusterName).CreateKubeconfigPayload(payload).Execute()
 }

stackit/internal/services/ske/kubeconfig/ephemeral_resource_test.go

@@ -2,15 +2,11 @@ package ske
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
-	"net/http"
-	"net/http/httptest"
 	"testing"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/stackitcloud/stackit-sdk-go/core/config"
 	ske "github.com/stackitcloud/stackit-sdk-go/services/ske/v2api"
 )
 
@@ -24,22 +20,21 @@ func TestGetKubeconfig(t *testing.T) {
 	expirationTime := time.Now().Add(time.Hour).Truncate(time.Second)
 
 	tests := []struct {
-		description    string
-		expiration     *int64
-		mockResponse   *ske.Kubeconfig
-		mockStatusCode int
-		expectError    bool
+		description  string
+		expiration   *int64
+		mockResponse *ske.Kubeconfig
+		mockError    error
+		expectError  bool
 	}{
 		{
-			description: "success",
+			description: "success without expiration",
 			expiration:  nil,
 			mockResponse: &ske.Kubeconfig{
 				Kubeconfig:           &[]string{kubeconfig}[0],
 				ExpirationTimestamp:  &expirationTime,
 				AdditionalProperties: make(map[string]any),
 			},
-			mockStatusCode: http.StatusOK,
-			expectError:    false,
+			expectError: false,
 		},
 		{
 			description: "success with expiration",
@@ -49,40 +44,27 @@ func TestGetKubeconfig(t *testing.T) {
 				ExpirationTimestamp:  &expirationTime,
 				AdditionalProperties: make(map[string]any),
 			},
-			mockStatusCode: http.StatusOK,
-			expectError:    false,
+			expectError: false,
 		},
 		{
-			description:    "api error",
-			mockStatusCode: http.StatusInternalServerError,
-			expectError:    true,
+			description: "api error",
+			mockError:   fmt.Errorf("api error"),
+			expectError: true,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				expectedPath := fmt.Sprintf("/v2/projects/%s/regions/%s/clusters/%s/kubeconfig", projectId, region, clusterName)
-				if r.URL.Path != expectedPath {
-					t.Errorf("Expected path %s, got %s", expectedPath, r.URL.Path)
-				}
-				w.Header().Set("Content-Type", "application/json")
-				w.WriteHeader(tt.mockStatusCode)
-				if tt.mockResponse != nil {
-					_ = json.NewEncoder(w).Encode(tt.mockResponse)
-				}
-			}))
-			defer server.Close()
-
-			cfg, err := ske.NewAPIClient(
-				config.WithEndpoint(server.URL),
-				config.WithoutAuthentication(),
-			)
-			if err != nil {
-				t.Fatalf("Failed to create SKE client: %v", err)
+			mockResp := tt.mockResponse
+			mockErr := tt.mockError
+			createKubeconfigFn := func(_ ske.ApiCreateKubeconfigRequest) (*ske.Kubeconfig, error) {
+				return mockResp, mockErr
+			}
+			client := &ske.DefaultAPIServiceMock{
+				CreateKubeconfigExecuteMock: &createKubeconfigFn,
 			}
 
-			resp, err := getKubeconfig(context.Background(), cfg, projectId, region, clusterName, tt.expiration)
+			resp, err := getKubeconfig(context.Background(), client, projectId, region, clusterName, tt.expiration)
 
 			if (err != nil) != tt.expectError {
 				t.Fatalf("getKubeconfig() error = %v, expectError %v", err, tt.expectError)