Skip to content

Commit 0e0bd77

Browse files
ksamorayksamoray
committed
VPC E-W security policy resource
Implement the resource for east-west VPC security policy. Signed-off-by: Kobi Samoray <[email protected]>
1 parent e43e85b commit 0e0bd77

12 files changed

+539
-63
lines changed

‎nsxt/gateway_common.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,6 +436,11 @@ func policyInfraPatch(context utl.SessionContext, obj model.Infra, connector cli
436436
}
437437

438438
return infraClient.Patch(gmObj.(gm_model.Infra), &enforceRevision)
439+
} else if context.ClientType == utl.VPC {
440+
context = utl.SessionContext{
441+
ClientType: utl.Multitenancy,
442+
ProjectID: context.ProjectID,
443+
}
439444
}
440445

441446
infraClient := nsx_policy.NewInfraClient(context, connector)

‎nsxt/policy_common.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ func getSecurityPolicyAndGatewayRuleSchema(scopeRequired bool, isIds bool, nsxID
311311
}
312312

313313
func getPolicyGatewayPolicySchema() map[string]*schema.Schema {
314-
secPolicy := getPolicySecurityPolicySchema(false, true, true)
314+
secPolicy := getPolicySecurityPolicySchema(false, true, true, true)
315315
// GW Policies don't support scope
316316
delete(secPolicy, "scope")
317317
secPolicy["category"].ValidateFunc = validation.StringInSlice(gatewayPolicyCategoryWritableValues, false)
@@ -320,15 +320,15 @@ func getPolicyGatewayPolicySchema() map[string]*schema.Schema {
320320
return secPolicy
321321
}
322322

323-
func getPolicySecurityPolicySchema(isIds, withContext, withRule bool) map[string]*schema.Schema {
323+
func getPolicySecurityPolicySchema(isIds, withContext, withRule, withDomain bool) map[string]*schema.Schema {
324324
result := map[string]*schema.Schema{
325325
"nsx_id": getNsxIDSchema(),
326326
"path": getPathSchema(),
327327
"display_name": getDisplayNameSchema(),
328328
"description": getDescriptionSchema(),
329329
"revision": getRevisionSchema(),
330330
"tag": getTagsSchema(),
331-
"context": getContextSchema(false, false, false),
331+
"context": getContextSchema(!withDomain, false, !withDomain),
332332
"domain": getDomainNameSchema(),
333333
"category": {
334334
Type: schema.TypeString,
@@ -392,6 +392,9 @@ func getPolicySecurityPolicySchema(isIds, withContext, withRule bool) map[string
392392
if !withRule {
393393
delete(result, "rule")
394394
}
395+
if !withDomain {
396+
delete(result, "domain")
397+
}
395398
return result
396399
}
397400

‎nsxt/provider.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -496,6 +496,7 @@ func Provider() *schema.Provider {
496496
"nsxt_policy_gateway_flood_protection_profile_binding": resourceNsxtPolicyGatewayFloodProtectionProfileBinding(),
497497
"nsxt_policy_compute_sub_cluster": resourceNsxtPolicyComputeSubCluster(),
498498
"nsxt_policy_tier0_inter_vrf_routing": resourceNsxtPolicyTier0InterVRFRouting(),
499+
"nsxt_vpc_security_policy": resourceNsxtVPCSecurityPolicy(),
499500
},
500501

501502
ConfigureFunc: providerConfigure,

‎nsxt/resource_nsxt_policy_intrusion_service_policy.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func resourceNsxtPolicyIntrusionServicePolicy() *schema.Resource {
2929
Importer: &schema.ResourceImporter{
3030
State: nsxtDomainResourceImporter,
3131
},
32-
Schema: getPolicySecurityPolicySchema(true, true, true),
32+
Schema: getPolicySecurityPolicySchema(true, true, true, true),
3333
}
3434
}
3535

‎nsxt/resource_nsxt_policy_parent_security_policy.go‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ func resourceNsxtPolicyParentSecurityPolicy() *schema.Resource {
2121
Importer: &schema.ResourceImporter{
2222
State: nsxtDomainResourceImporter,
2323
},
24-
Schema: getPolicySecurityPolicySchema(false, true, false),
24+
Schema: getPolicySecurityPolicySchema(false, true, false, true),
2525
}
2626
}
2727

@@ -55,10 +55,13 @@ func parentSecurityPolicySchemaToModel(d *schema.ResourceData, id string) model.
5555
}
5656
}
5757

58-
func parentSecurityPolicyModelToSchema(d *schema.ResourceData, m interface{}) (*model.SecurityPolicy, error) {
58+
func parentSecurityPolicyModelToSchema(d *schema.ResourceData, m interface{}, withDomain bool) (*model.SecurityPolicy, error) {
5959
connector := getPolicyConnector(m)
6060
id := d.Id()
61-
domainName := d.Get("domain").(string)
61+
domainName := ""
62+
if withDomain {
63+
domainName = d.Get("domain").(string)
64+
}
6265
if id == "" {
6366
return nil, fmt.Errorf("Error obtaining Security Policy id")
6467
}
@@ -75,7 +78,9 @@ func parentSecurityPolicyModelToSchema(d *schema.ResourceData, m interface{}) (*
7578
setPolicyTagsInSchema(d, obj.Tags)
7679
d.Set("nsx_id", id)
7780
d.Set("path", obj.Path)
78-
d.Set("domain", getDomainFromResourcePath(*obj.Path))
81+
if withDomain {
82+
d.Set("domain", getDomainFromResourcePath(*obj.Path))
83+
}
7984
d.Set("category", obj.Category)
8085
d.Set("comments", obj.Comments)
8186
d.Set("locked", obj.Locked)
@@ -92,15 +97,15 @@ func parentSecurityPolicyModelToSchema(d *schema.ResourceData, m interface{}) (*
9297
}
9398

9499
func resourceNsxtPolicyParentSecurityPolicyCreate(d *schema.ResourceData, m interface{}) error {
95-
return resourceNsxtPolicySecurityPolicyGeneralCreate(d, m, false)
100+
return resourceNsxtPolicySecurityPolicyGeneralCreate(d, m, false, true)
96101
}
97102

98103
func resourceNsxtPolicyParentSecurityPolicyRead(d *schema.ResourceData, m interface{}) error {
99-
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, false)
104+
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, false, true)
100105
}
101106

102107
func resourceNsxtPolicyParentSecurityPolicyUpdate(d *schema.ResourceData, m interface{}) error {
103-
return resourceNsxtPolicySecurityPolicyGeneralUpdate(d, m, false)
108+
return resourceNsxtPolicySecurityPolicyGeneralUpdate(d, m, false, true)
104109
}
105110

106111
func resourceNsxtPolicyParentSecurityPolicyDelete(d *schema.ResourceData, m interface{}) error {

‎nsxt/resource_nsxt_policy_predefined_security_policy.go‎

Lines changed: 73 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212

1313
"github.com/vmware/vsphere-automation-sdk-go/runtime/bindings"
1414
"github.com/vmware/vsphere-automation-sdk-go/runtime/data"
15+
nsxt "github.com/vmware/vsphere-automation-sdk-go/services/nsxt"
1516
"github.com/vmware/vsphere-automation-sdk-go/services/nsxt/model"
1617

1718
"github.com/vmware/terraform-provider-nsxt/api/infra/domains"
@@ -178,6 +179,60 @@ func revertSecurityPolicyDefaultRule(rule model.Rule) model.Rule {
178179
return rule
179180
}
180181

182+
func strPtr(s string) *string {
183+
v := s
184+
return &v
185+
}
186+
187+
func createChildVPCWithSecurityPolicy(context utl.SessionContext, policyID string, policy model.SecurityPolicy) (*data.StructValue, error) {
188+
converter := bindings.NewTypeConverter()
189+
190+
childPolicy := model.ChildSecurityPolicy{
191+
ResourceType: "ChildSecurityPolicy",
192+
SecurityPolicy: &policy,
193+
}
194+
195+
dataValue, errors := converter.ConvertToVapi(childPolicy, model.ChildSecurityPolicyBindingType())
196+
if len(errors) > 0 {
197+
return nil, errors[0]
198+
}
199+
200+
childVPC := model.ChildResourceReference{
201+
Id: &context.VPCID,
202+
ResourceType: "ChildResourceReference",
203+
TargetType: strPtr("Vpc"),
204+
Children: []*data.StructValue{dataValue.(*data.StructValue)},
205+
}
206+
207+
dataValue, errors = converter.ConvertToVapi(childVPC, model.ChildResourceReferenceBindingType())
208+
if len(errors) > 0 {
209+
return nil, errors[0]
210+
}
211+
childProject := model.ChildResourceReference{
212+
Id: &context.ProjectID,
213+
ResourceType: "ChildResourceReference",
214+
TargetType: strPtr("Project"),
215+
Children: []*data.StructValue{dataValue.(*data.StructValue)},
216+
}
217+
dataValue, errors = converter.ConvertToVapi(childProject, model.ChildResourceReferenceBindingType())
218+
if len(errors) > 0 {
219+
return nil, errors[0]
220+
}
221+
222+
childOrg := model.ChildResourceReference{
223+
Id: strPtr(defaultOrgID),
224+
ResourceType: "ChildResourceReference",
225+
TargetType: strPtr("Org"),
226+
Children: []*data.StructValue{dataValue.(*data.StructValue)},
227+
}
228+
dataValue, errors = converter.ConvertToVapi(childOrg, model.ChildResourceReferenceBindingType())
229+
if len(errors) > 0 {
230+
return nil, errors[0]
231+
}
232+
233+
return dataValue.(*data.StructValue), nil
234+
}
235+
181236
func createChildDomainWithSecurityPolicy(domain string, policyID string, policy model.SecurityPolicy) (*data.StructValue, error) {
182237
converter := bindings.NewTypeConverter()
183238

@@ -409,20 +464,29 @@ func resourceNsxtPolicyPredefinedSecurityPolicyDelete(d *schema.ResourceData, m
409464
}
410465

411466
func securityPolicyInfraPatch(context utl.SessionContext, policy model.SecurityPolicy, domain string, m interface{}) error {
467+
connector := getPolicyConnector(m)
468+
if context.ClientType == utl.VPC {
469+
childVPC, err := createChildVPCWithSecurityPolicy(context, *policy.Id, policy)
470+
if err != nil {
471+
return fmt.Errorf("Failed to create H-API for VPC Security Policy: %s", err)
472+
}
473+
orgRoot := model.OrgRoot{
474+
ResourceType: strPtr("OrgRoot"),
475+
Children: []*data.StructValue{childVPC},
476+
}
477+
478+
client := nsxt.NewOrgRootClient(connector)
479+
return client.Patch(orgRoot, nil)
480+
}
481+
412482
childDomain, err := createChildDomainWithSecurityPolicy(domain, *policy.Id, policy)
413483
if err != nil {
414484
return fmt.Errorf("Failed to create H-API for Predefined Security Policy: %s", err)
415485
}
416-
417-
var infraChildren []*data.StructValue
418-
infraChildren = append(infraChildren, childDomain)
419-
420-
infraType := "Infra"
421486
infraObj := model.Infra{
422-
Children: infraChildren,
423-
ResourceType: &infraType,
487+
Children: []*data.StructValue{childDomain},
488+
ResourceType: strPtr("Infra"),
424489
}
425490

426-
return policyInfraPatch(context, infraObj, getPolicyConnector(m), false)
427-
491+
return policyInfraPatch(context, infraObj, connector, false)
428492
}

‎nsxt/resource_nsxt_policy_security_policy.go‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ func resourceNsxtPolicySecurityPolicy() *schema.Resource {
2424
Importer: &schema.ResourceImporter{
2525
State: nsxtDomainResourceImporter,
2626
},
27-
Schema: getPolicySecurityPolicySchema(false, true, true),
27+
Schema: getPolicySecurityPolicySchema(false, true, true, true),
2828
}
2929
}
3030

@@ -61,9 +61,12 @@ func resourceNsxtPolicySecurityPolicyExistsPartial(domainName string) func(sessi
6161
}
6262
}
6363

64-
func policySecurityPolicyBuildAndPatch(d *schema.ResourceData, m interface{}, id string, createFlow, withRule bool) error {
64+
func policySecurityPolicyBuildAndPatch(d *schema.ResourceData, m interface{}, id string, createFlow, withRule, withDomain bool) error {
6565
obj := parentSecurityPolicySchemaToModel(d, id)
66-
domain := d.Get("domain").(string)
66+
domain := ""
67+
if withDomain {
68+
domain = d.Get("domain").(string)
69+
}
6770
revision := int64(d.Get("revision").(int))
6871
log.Printf("[INFO] Creating Security Policy with ID %s", id)
6972

@@ -92,15 +95,15 @@ func policySecurityPolicyBuildAndPatch(d *schema.ResourceData, m interface{}, id
9295
}
9396

9497
func resourceNsxtPolicySecurityPolicyCreate(d *schema.ResourceData, m interface{}) error {
95-
return resourceNsxtPolicySecurityPolicyGeneralCreate(d, m, true)
98+
return resourceNsxtPolicySecurityPolicyGeneralCreate(d, m, true, true)
9699
}
97100

98101
func resourceNsxtPolicySecurityPolicyRead(d *schema.ResourceData, m interface{}) error {
99-
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, true)
102+
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, true, true)
100103
}
101104

102105
func resourceNsxtPolicySecurityPolicyUpdate(d *schema.ResourceData, m interface{}) error {
103-
return resourceNsxtPolicySecurityPolicyGeneralUpdate(d, m, true)
106+
return resourceNsxtPolicySecurityPolicyGeneralUpdate(d, m, true, true)
104107
}
105108

106109
func resourceNsxtPolicySecurityPolicyDelete(d *schema.ResourceData, m interface{}) error {
@@ -124,14 +127,18 @@ func resourceNsxtPolicySecurityPolicyDelete(d *schema.ResourceData, m interface{
124127
return nil
125128
}
126129

127-
func resourceNsxtPolicySecurityPolicyGeneralCreate(d *schema.ResourceData, m interface{}, withRule bool) error {
130+
func resourceNsxtPolicySecurityPolicyGeneralCreate(d *schema.ResourceData, m interface{}, withRule, withDomain bool) error {
128131
// Initialize resource Id and verify this ID is not yet used
129-
id, err := getOrGenerateID2(d, m, resourceNsxtPolicySecurityPolicyExistsPartial(d.Get("domain").(string)))
132+
domain := ""
133+
if withDomain {
134+
domain = d.Get("domain").(string)
135+
}
136+
id, err := getOrGenerateID2(d, m, resourceNsxtPolicySecurityPolicyExistsPartial(domain))
130137
if err != nil {
131138
return err
132139
}
133140

134-
err = policySecurityPolicyBuildAndPatch(d, m, id, true, withRule)
141+
err = policySecurityPolicyBuildAndPatch(d, m, id, true, withRule, withDomain)
135142

136143
if err != nil {
137144
return handleCreateError("Security Policy", id, err)
@@ -140,11 +147,11 @@ func resourceNsxtPolicySecurityPolicyGeneralCreate(d *schema.ResourceData, m int
140147
d.SetId(id)
141148
d.Set("nsx_id", id)
142149

143-
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, withRule)
150+
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, withRule, withDomain)
144151
}
145152

146-
func resourceNsxtPolicySecurityPolicyGeneralRead(d *schema.ResourceData, m interface{}, withRule bool) error {
147-
obj, err := parentSecurityPolicyModelToSchema(d, m)
153+
func resourceNsxtPolicySecurityPolicyGeneralRead(d *schema.ResourceData, m interface{}, withRule, withDomain bool) error {
154+
obj, err := parentSecurityPolicyModelToSchema(d, m, withDomain)
148155
if err != nil {
149156
return handleReadError(d, "SecurityPolicy", d.Id(), err)
150157
}
@@ -154,15 +161,15 @@ func resourceNsxtPolicySecurityPolicyGeneralRead(d *schema.ResourceData, m inter
154161
return nil
155162
}
156163

157-
func resourceNsxtPolicySecurityPolicyGeneralUpdate(d *schema.ResourceData, m interface{}, withRule bool) error {
164+
func resourceNsxtPolicySecurityPolicyGeneralUpdate(d *schema.ResourceData, m interface{}, withRule, withDomain bool) error {
158165
id := d.Id()
159166
if id == "" {
160167
return fmt.Errorf("Error obtaining Security Policy id")
161168
}
162-
err := policySecurityPolicyBuildAndPatch(d, m, id, false, withRule)
169+
err := policySecurityPolicyBuildAndPatch(d, m, id, false, withRule, withDomain)
163170
if err != nil {
164171
return handleUpdateError("Security Policy", id, err)
165172
}
166173

167-
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, withRule)
174+
return resourceNsxtPolicySecurityPolicyGeneralRead(d, m, withRule, withDomain)
168175
}

0 commit comments

Comments
 (0)