Skip to content

Commit 69bdfc3

Browse files
william8siewMDarmawanstephaniegalang-ibmwsiew
authored
Kmip mgmt PR (#5352)
* initial kmip adapter stuff * provider for kmip adapter * go mod * fix adapters * certs first draft, edit adapters a bit * add code for kmip cert and objects * fix stuff * manual tests working * add tests * fixes and tests * add instance prefixes, fix registrations testing bug * undo registrations fix, suppress tests * fix policy overrides tests for real * remove unnecessary if * address PR comments * expand acceptance tests * update ibm-kms examples * add endpoint type * resource docs * first draft data source docs * add total counts * proofreading docs fixes * kmip doc metadata fixes * update the docs, change adapter internal tf ID to use instance ID * fix docs, syntax errors on adapter and cert examples, some were missing forces new resource, remove unused update function * updated adapters and certs to use internal id's that contain the full path of instance/adapter/cert(this includes adding needed fields not present, and proper logic for updating this) updated docs to use consistent var names and replaced updated docs to use new resource ids and not terraform id updated docs with terraform import examples * update go sum and also fix example syntax * fix unit tests to use adapter id and cert id instead of terraform internal id --------- Co-authored-by: Michael Darmawan <[email protected]> Co-authored-by: Michael Darmawan <[email protected]> Co-authored-by: stephaniegalang <[email protected]> Co-authored-by: wsiew <[email protected]>
1 parent 5989a6e commit 69bdfc3

File tree

48 files changed

+3164
-58
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+3164
-58
lines changed

examples/ibm-kms/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ resource "ibm_cos_bucket" "flex-us-south" {
9898
## Notes
9999

100100
1. Before doing terraform destroy if force_delete flag is introduced after provisioning keys, a terraform apply must be done before terraform destroy for force_delete flag to take effect.
101+
2. KMIP adapters with active KMIP objects cannot be deleted by Terraform.
101102

102103
## Examples
103104

examples/ibm-kms/localhost.crt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC9zCCAd+gAwIBAgIUcMeKlwdgHxftIsIWPL11JXzTEmwwDQYJKoZIhvcNAQEL
3+
BQAwADAeFw0yNDA0MjMyMDQ5NDVaFw0yNTA0MjMyMDQ5NDVaMAAwggEiMA0GCSqG
4+
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaVSSRPva2qO7OcRTcV+I70YIGfIGYI2gv
5+
kpi6jt9mHWO0NnWWRnpKME7KcU+PSLrDtSVU+0lc5wj64g5h2QGXMubA+hRWDac8
6+
3wDIbhLr8AadxBoRHrUnzMxmxogT10JclBv5198MdU7S9HQoTx1IO4ygk8p2QfYa
7+
+aHoB1zIiV5m8QdF8HGqhU9msZGScm+4Ufcbze64CC/JFOSpdc2HigStd8p/lS5B
8+
M2pfikamwqDPRjpdMF5MmGwDjCFCTxKfw1oeesPAuqdJAeWdNDB2GhnULaHBKBYa
9+
YdBlvsUk+aoptJOaq6C2I+fKI0SUjk6QfXEIj1bf6kcsoXccsu5VAgMBAAGjaTBn
10+
MB0GA1UdDgQWBBSQQW+1vmCg7if8uR0ZtmQk6EgvvTAfBgNVHSMEGDAWgBSQQW+1
11+
vmCg7if8uR0ZtmQk6EgvvTAPBgNVHRMBAf8EBTADAQH/MBQGA1UdEQQNMAuCCTEy
12+
Ny4wLjAuMTANBgkqhkiG9w0BAQsFAAOCAQEAcfA4Fy7YRf/kCTjX0K3Vf7na56te
13+
WjJuryweq/YPFRu5L1q7j71ZUHDQOe+YLhpyNrFAzIa+8zpZx9Ubnitzi43K4u3y
14+
uQGwsq67gIY8PYHDNVZgk2O989TmI3EIPSUwaf9sTfFzQf54YiGYiwJWmttg0pYt
15+
crIJLCI3oLFHPBII4XvHAysdbIFqQX/PJAXXG4fqTK6e9pjsqoRu56gyEqnF6iy9
16+
c3lforvszS3CUxKbB9GM+IJZ60pPXZwoX5Y74dgVzkcyOxKkNjHjJSCY/P2+lK6E
17+
ANdjxL3XBPu1Oorti3MJWlllQ6PzHWKb/iPx0HYhh3sXw0+nfiPocAhQbw==
18+
-----END CERTIFICATE-----

examples/ibm-kms/main.tf

+51
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,55 @@ resource "ibm_cos_bucket" "flex-us-south" {
3535
region_location = "us-south"
3636
storage_class = "flex"
3737
kms_key_crn = ibm_kms_key.test.id
38+
}
39+
40+
resource "ibm_kms_kmip_adapter" "myadapter" {
41+
instance_id = "${ibm_kms_key.test.instance_id}"
42+
profile = "native_1.0"
43+
profile_data = {
44+
"crk_id" = ibm_kms_key.test.key_id
45+
}
46+
description = "adding a description"
47+
name = var.kmip_adapter_name
48+
}
49+
50+
resource "ibm_kms_kmip_client_cert" "mycert" {
51+
instance_id = "${ibm_kms_key.test.instance_id}"
52+
adapter_id = "${ibm_kms_kmip_adapter.myadapter.id}"
53+
certificate = file("${path.module}/localhost.crt")
54+
name = var.kmip_cert_name
55+
}
56+
57+
data "ibm_kms_kmip_adapter" "adapter_data" {
58+
instance_id = "${ibm_kms_key.test.instance_id}"
59+
name = "${ibm_kms_kmip_adapter.myadapter.name}"
60+
# adapter_id = "${ibm_kms_kmip_adapter.myadapter.adapter_id}"
61+
}
62+
63+
data "ibm_kms_kmip_client_cert" "cert1" {
64+
instance_id = "${ibm_kms_key.test.instance_id}"
65+
adapter_name = "${ibm_kms_kmip_adapter.myadapter.name}"
66+
cert_id = "${ibm_kms_kmip_client_cert.mycert.id}"
67+
}
68+
69+
data "ibm_kms_kmip_adapters" "adapters" {
70+
instance_id = "${ibm_kms_key.test.instance_id}"
71+
}
72+
73+
data "ibm_kms_kmip_client_certs" "cert_list" {
74+
instance_id = "${ibm_kms_key.test.instance_id}"
75+
adapter_name = "${ibm_kms_kmip_adapter.myadapter.name}"
76+
}
77+
78+
data "ibm_kms_kmip_objects" "objects_list" {
79+
instance_id = "${ibm_kms_key.test.instance_id}"
80+
adapter_id = "${ibm_kms_kmip_adapter.myadapter.id}"
81+
object_state_filter = [1,2,3,4]
82+
}
83+
84+
data "ibm_kms_kmip_object" "object1" {
85+
count = length(data.ibm_kms_kmip_objects.objects_list.objects) > 0 ? 1 : 0
86+
instance_id = "${ibm_kms_key.test.instance_id}"
87+
adapter_id = "${ibm_kms_kmip_adapter.myadapter.id}"
88+
object_id = "${data.ibm_kms_kmip_objects.objects_list.objects.0.object_id}"
3889
}

examples/ibm-kms/variables.tf

+11
Original file line numberDiff line numberDiff line change
@@ -42,4 +42,15 @@ variable "bucket_name" {
4242
description = "The cos bucket name"
4343
type = string
4444
default = "test_buck"
45+
}
46+
variable "kmip_adapter_name" {
47+
description = "The KMIP adapter name"
48+
type = string
49+
default = "myadapter"
50+
}
51+
52+
variable "kmip_cert_name" {
53+
description = "The KMIP client certificate name"
54+
type = string
55+
default = "mycert"
4556
}

go.sum

-3
Original file line numberDiff line numberDiff line change
@@ -163,9 +163,6 @@ github.com/IBM/ibm-hpcs-tke-sdk v0.0.0-20211109141421-a4b61b05f7d1 h1:T5UwRKKd+B
163163
github.com/IBM/ibm-hpcs-tke-sdk v0.0.0-20211109141421-a4b61b05f7d1/go.mod h1:M2JyuyeWHPtgGNeezr6YqVRuaav2MpY8Ha4QrEYvMoI=
164164
github.com/IBM/ibm-hpcs-uko-sdk v0.0.20-beta h1:P1fdIfKsD9xvJQ5MHIEztPS9yfNf9x+VDTamaYcmqcs=
165165
github.com/IBM/ibm-hpcs-uko-sdk v0.0.20-beta/go.mod h1:MLVNHMYoKsvovJZ4v1gQCpIYtRDHTtoIHK6XztDZGsU=
166-
github.com/IBM/keyprotect-go-client v0.5.1/go.mod h1:5TwDM/4FRJq1ZOlwQL1xFahLWQ3TveR88VmL1u3njyI=
167-
github.com/IBM/keyprotect-go-client v0.12.2 h1:Cjxcqin9Pl0xz3MnxdiVd4v/eIa79xL3hQpSbwOr/DQ=
168-
github.com/IBM/keyprotect-go-client v0.12.2/go.mod h1:yr8h2noNgU8vcbs+vhqoXp3Lmv73PI0zAc6VMgFvWwM=
169166
github.com/IBM/keyprotect-go-client v0.14.0 h1:GqgK3BdczA/w7+B1RxEPLya0w9S/ZXi5YWKAxdW8vHQ=
170167
github.com/IBM/keyprotect-go-client v0.14.0/go.mod h1:cAt714Vnwnd03mmkBHHSJlDNRVthdRmJB6RePd4/B8Q=
171168
github.com/IBM/logs-go-sdk v0.1.1 h1:aiVnKHJzYcsHvQY58vLB7QbUV/kXcWTpCPqRKC2QS0A=

ibm/provider/provider.go

+8
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,12 @@ func Provider() *schema.Provider {
568568
"ibm_kms_key_policies": kms.DataSourceIBMKMSkeyPolicies(),
569569
"ibm_kms_keys": kms.DataSourceIBMKMSkeys(),
570570
"ibm_kms_key": kms.DataSourceIBMKMSkey(),
571+
"ibm_kms_kmip_adapter": kms.DataSourceIBMKMSKmipAdapter(),
572+
"ibm_kms_kmip_adapters": kms.DataSourceIBMKMSKmipAdapters(),
573+
"ibm_kms_kmip_client_cert": kms.DataSourceIBMKmsKMIPClientCertificate(),
574+
"ibm_kms_kmip_client_certs": kms.DataSourceIBMKmsKMIPClientCertificates(),
575+
"ibm_kms_kmip_object": kms.DataSourceIBMKMSKMIPObject(),
576+
"ibm_kms_kmip_objects": kms.DataSourceIBMKMSKMIPObjects(),
571577
"ibm_pn_application_chrome": pushnotification.DataSourceIBMPNApplicationChrome(),
572578
"ibm_app_config_environment": appconfiguration.DataSourceIBMAppConfigEnvironment(),
573579
"ibm_app_config_environments": appconfiguration.DataSourceIBMAppConfigEnvironments(),
@@ -1215,6 +1221,8 @@ func Provider() *schema.Provider {
12151221
"ibm_kms_key_policies": kms.ResourceIBMKmskeyPolicies(),
12161222
"ibm_kp_key": kms.ResourceIBMkey(),
12171223
"ibm_kms_instance_policies": kms.ResourceIBMKmsInstancePolicy(),
1224+
"ibm_kms_kmip_adapter": kms.ResourceIBMKmsKMIPAdapter(),
1225+
"ibm_kms_kmip_client_cert": kms.ResourceIBMKmsKMIPClientCertificate(),
12181226
"ibm_resource_group": resourcemanager.ResourceIBMResourceGroup(),
12191227
"ibm_resource_instance": resourcecontroller.ResourceIBMResourceInstance(),
12201228
"ibm_resource_key": resourcecontroller.ResourceIBMResourceKey(),

ibm/service/kms/data_source_ibm_kms_instance_policies_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -115,5 +115,5 @@ func testAccCheckIBMKmsDataSourceInstancePolicyWithPolicyType(instanceName strin
115115
policy_type = var.policy_type
116116
117117
}
118-
`, instanceName, enablePolicy, interval_month, dadenabled)
118+
`, addPrefixToResourceName(instanceName), enablePolicy, interval_month, dadenabled)
119119
}

ibm/service/kms/data_source_ibm_kms_key_policies_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,5 +63,5 @@ func testAccCheckIBMKmsDataSourceKeyPolicyConfigNew(instanceName, keyName string
6363
instance_id = "${ibm_kms_key_policies.test2.instance_id}"
6464
key_id = "${ibm_kms_key_policies.test2.key_id}"
6565
}
66-
`, instanceName, keyName, rotationEnable, interval_month, enabled)
66+
`, addPrefixToResourceName(instanceName), keyName, rotationEnable, interval_month, enabled)
6767
}

ibm/service/kms/data_source_ibm_kms_key_rings_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,5 @@ func testAccCheckIBMKmsKeyRingDataSourceConfig(instanceName, keyRing string) str
4747
data "ibm_kms_key_rings" "test2" {
4848
instance_id = "${ibm_kms_key_rings.test.instance_id}"
4949
}
50-
`, instanceName, keyRing)
50+
`, addPrefixToResourceName(instanceName), keyRing)
5151
}

ibm/service/kms/data_source_ibm_kms_key_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ func testAccCheckIBMKmsKeyDataSourceKeyConfig(instanceName, keyName string) stri
149149
limit = 2
150150
key_name = "${ibm_kms_key.test.key_name}"
151151
}
152-
`, instanceName, keyName)
152+
`, addPrefixToResourceName(instanceName), keyName)
153153
}
154154

155155
func testAccCheckIBMKmsKeyDataSourceConfig(instanceName, keyName string) string {
@@ -170,7 +170,7 @@ func testAccCheckIBMKmsKeyDataSourceConfig(instanceName, keyName string) string
170170
instance_id = "${ibm_kms_key.test.instance_id}"
171171
key_name = "${ibm_kms_key.test.key_name}"
172172
}
173-
`, instanceName, keyName)
173+
`, addPrefixToResourceName(instanceName), keyName)
174174
}
175175

176176
func testAccCheckIBMKmsKeyDataSourceConfigAndDescription(instanceName, keyName string, description string) string {
@@ -192,7 +192,7 @@ func testAccCheckIBMKmsKeyDataSourceConfigAndDescription(instanceName, keyName s
192192
instance_id = "${ibm_kms_key.test.instance_id}"
193193
key_name = "${ibm_kms_key.test.key_name}"
194194
}
195-
`, instanceName, keyName, description)
195+
`, addPrefixToResourceName(instanceName), keyName, description)
196196
}
197197

198198
func testAccCheckIBMKmsKeyDataSourceHpcsConfig(hpcsInstanceID string, KeyName string) string {
@@ -239,5 +239,5 @@ func testAccCheckIBMKmsDataSourceKeyPolicyConfig(instanceName, keyName string, i
239239
instance_id = "${ibm_kms_key_policies.testPolicy.instance_id}"
240240
key_id = "${ibm_kms_key.test.key_id}"
241241
}
242-
`, instanceName, keyName, interval_month, enabled)
242+
`, addPrefixToResourceName(instanceName), keyName, interval_month, enabled)
243243
}

ibm/service/kms/data_source_ibm_kms_keys_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ func testAccCheckIBMKmsKeyDataSourceKeysConfig(instanceName, keyName string) str
129129
limit = 2
130130
key_name = "${ibm_kms_key.test.key_name}"
131131
}
132-
`, instanceName, keyName)
132+
`, addPrefixToResourceName(instanceName), keyName)
133133
}
134134

135135
func testAccCheckIBMKmsDataSourceConfig(instanceName, keyName string) string {
@@ -149,7 +149,7 @@ func testAccCheckIBMKmsDataSourceConfig(instanceName, keyName string) string {
149149
data "ibm_kms_keys" "test" {
150150
instance_id = "${ibm_kms_key.test.instance_id}"
151151
}
152-
`, instanceName, keyName)
152+
`, addPrefixToResourceName(instanceName), keyName)
153153
}
154154

155155
func testAccCheckIBMKmsDataSourceHpcsConfig(hpcsInstanceID, KeyName string) string {
@@ -196,5 +196,5 @@ func testAccCheckIBMKmsDataSourceKeysPolicyConfig(instanceName, keyName string,
196196
instance_id = "${ibm_kms_key_policies.testPolicy.instance_id}"
197197
key_id = ibm_kms_key.test.key_id
198198
}
199-
`, instanceName, keyName, interval_month, enabled)
199+
`, addPrefixToResourceName(instanceName), keyName, interval_month, enabled)
200200
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
// Copyright IBM Corp. 2017, 2021 All Rights Reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
package kms
5+
6+
import (
7+
"context"
8+
9+
"github.com/IBM-Cloud/terraform-provider-ibm/ibm/validate"
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
11+
)
12+
13+
func dataSourceIBMKMSKmipAdapterBaseSchema() map[string]*schema.Schema {
14+
return map[string]*schema.Schema{
15+
"adapter_id": {
16+
Type: schema.TypeString,
17+
Computed: true,
18+
Description: "The UUID of the KMIP adapter to be fetched",
19+
},
20+
"name": {
21+
Type: schema.TypeString,
22+
Computed: true,
23+
Description: "The name of the KMIP adapter to be fetched",
24+
},
25+
"description": {
26+
Type: schema.TypeString,
27+
Computed: true,
28+
Description: "The description of the KMIP adapter to be fetched",
29+
},
30+
"profile": {
31+
Type: schema.TypeString,
32+
Computed: true,
33+
Description: "The profile of the KMIP adapter to be fetched",
34+
},
35+
"profile_data": {
36+
Type: schema.TypeMap,
37+
Computed: true,
38+
Description: "The data specific to the KMIP Adapter profile",
39+
},
40+
"created_by": &schema.Schema{
41+
Type: schema.TypeString,
42+
Computed: true,
43+
Description: "The unique identifier that is associated with the entity that created the adapter.",
44+
},
45+
"created_at": &schema.Schema{
46+
Type: schema.TypeString,
47+
Computed: true,
48+
Description: "The date when a resource was created. The date format follows RFC 3339.",
49+
},
50+
"updated_by": &schema.Schema{
51+
Type: schema.TypeString,
52+
Computed: true,
53+
Description: "The unique identifier that is associated with the entity that updated the adapter.",
54+
},
55+
"updated_at": &schema.Schema{
56+
Type: schema.TypeString,
57+
Computed: true,
58+
Description: "The date when a resource was updated. The date format follows RFC 3339.",
59+
},
60+
}
61+
}
62+
63+
func DataSourceIBMKMSKmipAdapter() *schema.Resource {
64+
baseMap := dataSourceIBMKMSKmipAdapterBaseSchema()
65+
66+
baseMap["endpoint_type"] = &schema.Schema{
67+
Type: schema.TypeString,
68+
Optional: true,
69+
Computed: true,
70+
ValidateFunc: validate.ValidateAllowedStringValues([]string{"public", "private"}),
71+
Description: "public or private",
72+
}
73+
74+
baseMap["instance_id"] = &schema.Schema{
75+
Type: schema.TypeString,
76+
Required: true,
77+
Description: "Key protect or hpcs instance GUID",
78+
DiffSuppressFunc: suppressKMSInstanceIDDiff,
79+
}
80+
adapterIDSchema := baseMap["adapter_id"]
81+
adapterIDSchema.Optional = true
82+
adapterIDSchema.ExactlyOneOf = []string{"adapter_id", "name"}
83+
baseMap["adapter_id"] = adapterIDSchema
84+
85+
adapterNameSchema := baseMap["name"]
86+
adapterNameSchema.Optional = true
87+
adapterNameSchema.ExactlyOneOf = []string{"adapter_id", "name"}
88+
baseMap["name"] = adapterNameSchema
89+
90+
return &schema.Resource{
91+
Read: dataSourceIBMKMSKmipAdapterRead,
92+
Schema: baseMap,
93+
}
94+
}
95+
96+
func dataSourceIBMKMSKmipAdapterRead(d *schema.ResourceData, meta interface{}) error {
97+
// initialize API
98+
instanceID := getInstanceIDFromResourceData(d, "instance_id")
99+
kpAPI, _, err := populateKPClient(d, meta, instanceID)
100+
if err != nil {
101+
return err
102+
}
103+
104+
nameOrID, hasID := d.GetOk("adapter_id")
105+
if !hasID {
106+
nameOrID = d.Get("name")
107+
}
108+
adapterNameOrID := nameOrID.(string)
109+
// call GetKMIPAdapter api
110+
adapter, err := kpAPI.GetKMIPAdapter(context.Background(), adapterNameOrID)
111+
if err != nil {
112+
return err
113+
}
114+
115+
// set computed values
116+
return populateKMIPAdapterSchemaDataFromStruct(d, *adapter, instanceID)
117+
}

0 commit comments

Comments
 (0)