Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GCP auth: support nested backend mount paths #1050

Merged
merged 4 commits into from
May 17, 2021
Merged

GCP auth: support nested backend mount paths #1050

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c3a1e36
Updated gcp_auth_backend_role to fix the provider issue 880.
vsharma-ampion Feb 3, 2021
779c1b2
Merge remote-tracking branch 'origin/master' into issue_880/gcp_auth_…
tvoran May 11, 2021
f932879
Adding test with nested backend path
tvoran May 11, 2021
1db2297
stricter matching for role name
tvoran May 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 20 additions & 8 deletions vault/resource_gcp_auth_backend_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,19 @@ package vault
import (
"fmt"
"log"
"regexp"
"strings"

"github.com/hashicorp/terraform-plugin-sdk/helper/schema"

"github.com/hashicorp/vault/api"
)

var (
gcpAuthBackendFromPathRegex = regexp.MustCompile("^auth/(.+)/role/[^/]+$")
gcpAuthRoleNameFromPathRegex = regexp.MustCompile("^auth/.+/role/([^/]+)$")
jasonodonnell marked this conversation as resolved.
Show resolved Hide resolved
)

func gcpAuthBackendRoleResource() *schema.Resource {
fields := map[string]*schema.Schema{
"role": {
Expand Down Expand Up @@ -409,17 +415,23 @@ func gcpAuthResourceExists(d *schema.ResourceData, meta interface{}) (bool, erro
}

func gcpAuthResourceBackendFromPath(path string) (string, error) {
var parts = strings.Split(path, "/")
if len(parts) != 4 {
return "", fmt.Errorf("Expected 4 parts in path '%s'", path)
if !gcpAuthBackendFromPathRegex.MatchString(path) {
return "", fmt.Errorf("no backend found")
}
return parts[1], nil
res := gcpAuthBackendFromPathRegex.FindStringSubmatch(path)
if len(res) != 2 {
return "", fmt.Errorf("unexpected number of matches (%d) for backend", len(res))
}
return res[1], nil
}

func gcpAuthResourceRoleFromPath(path string) (string, error) {
var parts = strings.Split(path, "/")
if len(parts) != 4 {
return "", fmt.Errorf("Expected 4 parts in path '%s'", path)
if !gcpAuthRoleNameFromPathRegex.MatchString(path) {
return "", fmt.Errorf("no role found")
}
res := gcpAuthRoleNameFromPathRegex.FindStringSubmatch(path)
if len(res) != 2 {
return "", fmt.Errorf("unexpected number of matches (%d) for role", len(res))
}
return parts[3], nil
return res[1], nil
}
55 changes: 54 additions & 1 deletion vault/resource_gcp_auth_backend_role_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,61 @@ import (
"github.com/hashicorp/vault/api"
)

func TestGCPAuthBackend_pathRegex(t *testing.T) {
tests := map[string]struct {
path string
wantMount string
wantRole string
}{
"no nesting": {
path: "auth/gcp/role/carrot",
wantMount: "gcp",
wantRole: "carrot",
},
"nested": {
path: "auth/test/usc1/gpc/role/usc1-test-master",
wantMount: "test/usc1/gpc",
wantRole: "usc1-test-master",
},
"nested with double 'role'": {
path: "auth/gcp/role/role/foo",
wantMount: "gcp/role",
wantRole: "foo",
},
}
for name, tc := range tests {
t.Run(name, func(t *testing.T) {
mount, err := gcpAuthResourceBackendFromPath(tc.path)
if err != nil {
t.Fatalf("unexpected error: %s", err)
}
if mount != tc.wantMount {
t.Fatalf("expected mount %q, got %q", tc.wantMount, mount)
}

role, err := gcpAuthResourceRoleFromPath(tc.path)
if err != nil {
t.Fatalf("unexpected error: %s", err)
}
if role != tc.wantRole {
t.Fatalf("expected role %q, got %q", tc.wantRole, role)
}
})
}
}

func TestGCPAuthBackendRole_basic(t *testing.T) {
backend := acctest.RandomWithPrefix("tf-test-gcp-backend")
t.Run("simple backend path", func(t *testing.T) {
backend := acctest.RandomWithPrefix("tf-test-gcp-backend")
testGCPAuthBackendRole_basic(t, backend)
})
t.Run("nested backend path", func(t *testing.T) {
backend := acctest.RandomWithPrefix("tf-test-gcp-backend") + "/nested"
testGCPAuthBackendRole_basic(t, backend)
})
}

func testGCPAuthBackendRole_basic(t *testing.T, backend string) {
name := acctest.RandomWithPrefix("tf-test-gcp-role")
serviceAccount := acctest.RandomWithPrefix("tf-test-gcp-service-account")
projectId := acctest.RandomWithPrefix("tf-test-gcp-project-id")
Expand Down