Skip to content

Commit 5e53759

Browse files
author
Markus Schwer
committed
feat(authorization): add custom role resource and data source
1 parent da2bb41 commit 5e53759

14 files changed

Lines changed: 1224 additions & 42 deletions

File tree

‎docs/data-sources/authorization_project_custom_role.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stackit_authorization_project_custom_role Data Source - stackit"
4+
subcategory: ""
5+
description: |-
6+
Custom Role resource schema.
7+
---
8+
9+
# stackit_authorization_project_custom_role (Data Source)
10+
11+
Custom Role resource schema.
12+
13+
## Example Usage
14+
15+
```terraform
16+
data "stackit_authorization_project_custom_role" "example" {
17+
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
18+
name = "my.custom.role"
19+
}
20+
```
21+
22+
<!-- schema generated by tfplugindocs -->
23+
## Schema
24+
25+
### Required
26+
27+
- `resource_id` (String) Resource to add the custom role to.
28+
- `role_id` (String) The ID of the role.
29+
30+
### Read-Only
31+
32+
- `description` (String)
33+
- `id` (String) Terraform's internal resource identifier. It is structured as "[resource_id],[role_id]".
34+
- `name` (String) Name of the role
35+
- `permissions` (List of String) Permissions for the role

‎docs/resources/authorization_project_custom_role.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "stackit_authorization_project_custom_role Resource - stackit"
4+
subcategory: ""
5+
description: |-
6+
Custom Role resource schema.
7+
---
8+
9+
# stackit_authorization_project_custom_role (Resource)
10+
11+
Custom Role resource schema.
12+
13+
## Example Usage
14+
15+
```terraform
16+
resource "stackit_resourcemanager_project" "example" {
17+
name = "example_project"
18+
owner_email = "foo.bar@stackit.cloud"
19+
parent_container_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
20+
}
21+
22+
resource "stackit_authorization_project_custom_role" "example" {
23+
resource_id = stackit_resourcemanager_project.example.project_id
24+
name = "my.custom.role"
25+
description = "Some description"
26+
permissions = [
27+
"iam.subject.get"
28+
]
29+
}
30+
31+
# Only use the import statement, if you want to import an existing custom role
32+
import {
33+
to = stackit_authorization_project_custom_role.import-example
34+
id = "${var.project_id},${var.custom_role_id}"
35+
}
36+
```
37+
38+
<!-- schema generated by tfplugindocs -->
39+
## Schema
40+
41+
### Required
42+
43+
- `description` (String)
44+
- `name` (String) Name of the role
45+
- `permissions` (List of String) Permissions for the role
46+
- `resource_id` (String) Resource to add the custom role to.
47+
48+
### Read-Only
49+
50+
- `id` (String) Terraform's internal resource identifier. It is structured as "[resource_id],[role_id]".
51+
- `role_id` (String) The ID of the role.

‎examples/data-sources/stackit_authorization_project_custom_role/data-source.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "stackit_authorization_project_custom_role" "example" {
2+
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
3+
name = "my.custom.role"
4+
}
5+

‎examples/resources/stackit_authorization_project_custom_role/resource.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "stackit_resourcemanager_project" "example" {
2+
name = "example_project"
3+
owner_email = "foo.bar@stackit.cloud"
4+
parent_container_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
5+
}
6+
7+
resource "stackit_authorization_project_custom_role" "example" {
8+
resource_id = stackit_resourcemanager_project.example.project_id
9+
name = "my.custom.role"
10+
description = "Some description"
11+
permissions = [
12+
"iam.subject.get"
13+
]
14+
}
15+
16+
# Only use the import statement, if you want to import an existing custom role
17+
import {
18+
to = stackit_authorization_project_custom_role.import-example
19+
id = "${var.project_id},${var.custom_role_id}"
20+
}
21+

‎stackit/internal/services/authorization/authorization_acc_test.go‎

Lines changed: 117 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
_ "embed"
1212

1313
"github.com/hashicorp/terraform-plugin-testing/config"
14+
"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
1415
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
1516
"github.com/hashicorp/terraform-plugin-testing/terraform"
1617
stackitSdkConfig "github.com/stackitcloud/stackit-sdk-go/core/config"
@@ -33,12 +34,33 @@ var invalidRole string
3334
//go:embed testfiles/organization-role.tf
3435
var organizationRole string
3536

37+
//go:embed testfiles/custom-role.tf
38+
var customRole string
39+
3640
var testConfigVars = config.Variables{
3741
"project_id": config.StringVariable(testutil.ProjectId),
3842
"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
3943
"organization_id": config.StringVariable(testutil.OrganizationId),
4044
}
4145

46+
var testConfigVarsCustomRole = config.Variables{
47+
"project_id": config.StringVariable(testutil.ProjectId),
48+
"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
49+
"organization_id": config.StringVariable(testutil.OrganizationId),
50+
"role_name": config.StringVariable(fmt.Sprintf("tf-acc-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlpha))),
51+
"role_description": config.StringVariable("Some description"),
52+
"role_permissions_0": config.StringVariable("iam.role.list"),
53+
}
54+
55+
var testConfigVarsCustomRoleUpdated = config.Variables{
56+
"project_id": config.StringVariable(testutil.ProjectId),
57+
"test_service_account": config.StringVariable(testutil.TestProjectServiceAccountEmail),
58+
"organization_id": config.StringVariable(testutil.OrganizationId),
59+
"role_name": config.StringVariable(fmt.Sprintf("tf-acc-%s", acctest.RandStringFromCharSet(5, acctest.CharSetAlpha))),
60+
"role_description": config.StringVariable("Updated description"),
61+
"role_permissions_0": config.StringVariable("iam.role.edit"),
62+
}
63+
4264
func TestAccProjectRoleAssignmentResource(t *testing.T) {
4365
t.Log(testutil.AuthorizationProviderConfig())
4466
resource.Test(t, resource.TestCase{
@@ -53,8 +75,7 @@ func TestAccProjectRoleAssignmentResource(t *testing.T) {
5375
return err
5476
}
5577

56-
members, err := client.ListMembers(context.TODO(), "project", testutil.ProjectId).Execute()
57-
78+
members, err := client.ListMembers(context.Background(), "project", testutil.ProjectId).Execute()
5879
if err != nil {
5980
return err
6081
}
@@ -95,16 +116,106 @@ func TestAccProjectRoleAssignmentResource(t *testing.T) {
95116
})
96117
}
97118

119+
func TestAccProjectCustomRoleResource(t *testing.T) {
120+
t.Log(testutil.AuthorizationProviderConfig())
121+
resource.Test(t, resource.TestCase{
122+
ProtoV6ProviderFactories: testutil.TestAccProtoV6ProviderFactories,
123+
Steps: []resource.TestStep{
124+
{
125+
ConfigVariables: testConfigVarsCustomRole,
126+
Config: testutil.AuthorizationProviderConfig() + customRole,
127+
Check: resource.ComposeAggregateTestCheckFunc(
128+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRole["project_id"])),
129+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "name", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_name"])),
130+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "description", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_description"])),
131+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "permissions.#", "1"),
132+
resource.TestCheckTypeSetElemAttr("stackit_authorization_project_custom_role.custom-role", "permissions.*", testutil.ConvertConfigVariable(testConfigVarsCustomRole["role_permissions_0"])),
133+
resource.TestCheckResourceAttrSet("stackit_authorization_project_custom_role.custom-role", "role_id"),
134+
),
135+
},
136+
// Data source
137+
{
138+
ConfigVariables: testConfigVarsCustomRole,
139+
Config: fmt.Sprintf(`
140+
%s
141+
142+
data "stackit_authorization_project_custom_role" "custom-role" {
143+
resource_id = stackit_authorization_project_custom_role.custom-role.resource_id
144+
role_id = stackit_authorization_project_custom_role.custom-role.role_id
145+
}
146+
`,
147+
testutil.AuthorizationProviderConfig()+customRole,
148+
),
149+
Check: resource.ComposeAggregateTestCheckFunc(
150+
resource.TestCheckResourceAttr("data.stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRole["project_id"])),
151+
resource.TestCheckResourceAttrPair(
152+
"stackit_authorization_project_custom_role.custom-role", "resource_id",
153+
"data.stackit_authorization_project_custom_role.custom-role", "resource_id",
154+
),
155+
resource.TestCheckResourceAttrPair(
156+
"stackit_authorization_project_custom_role.custom-role", "role_id",
157+
"data.stackit_authorization_project_custom_role.custom-role", "role_id",
158+
),
159+
resource.TestCheckResourceAttrPair(
160+
"stackit_authorization_project_custom_role.custom-role", "name",
161+
"data.stackit_authorization_project_custom_role.custom-role", "name",
162+
),
163+
resource.TestCheckResourceAttrPair(
164+
"stackit_authorization_project_custom_role.custom-role", "description",
165+
"data.stackit_authorization_project_custom_role.custom-role", "description",
166+
),
167+
resource.TestCheckResourceAttrPair(
168+
"stackit_authorization_project_custom_role.custom-role", "permissions",
169+
"data.stackit_authorization_project_custom_role.custom-role", "permissions",
170+
),
171+
),
172+
},
173+
// Import
174+
{
175+
ConfigVariables: testConfigVarsCustomRole,
176+
ResourceName: "stackit_authorization_project_custom_role.custom-role",
177+
ImportStateIdFunc: func(s *terraform.State) (string, error) {
178+
r, ok := s.RootModule().Resources["stackit_authorization_project_custom_role.custom-role"]
179+
if !ok {
180+
return "", fmt.Errorf("couldn't find resource stackit_authorization_project_custom_role.custom-role")
181+
}
182+
roleId, ok := r.Primary.Attributes["role_id"]
183+
if !ok {
184+
return "", fmt.Errorf("couldn't find attribute role_id")
185+
}
186+
187+
return fmt.Sprintf("%s,%s", testutil.ProjectId, roleId), nil
188+
},
189+
ImportState: true,
190+
ImportStateVerify: true,
191+
},
192+
// Update
193+
{
194+
ConfigVariables: testConfigVarsCustomRoleUpdated,
195+
Config: testutil.AuthorizationProviderConfig() + customRole,
196+
Check: resource.ComposeAggregateTestCheckFunc(
197+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "resource_id", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["project_id"])),
198+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "name", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_name"])),
199+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "description", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_description"])),
200+
resource.TestCheckResourceAttr("stackit_authorization_project_custom_role.custom-role", "permissions.#", "1"),
201+
resource.TestCheckTypeSetElemAttr("stackit_authorization_project_custom_role.custom-role", "permissions.*", testutil.ConvertConfigVariable(testConfigVarsCustomRoleUpdated["role_permissions_0"])),
202+
resource.TestCheckResourceAttrSet("stackit_authorization_project_custom_role.custom-role", "role_id"),
203+
),
204+
},
205+
// Deletion is done by the framework implicitly
206+
},
207+
})
208+
}
209+
98210
func authApiClient() (*authorization.APIClient, error) {
99211
var client *authorization.APIClient
100212
var err error
101-
if testutil.AuthorizationCustomEndpoint == "" {
102-
client, err = authorization.NewAPIClient(
103-
stackitSdkConfig.WithRegion("eu01"),
104-
)
213+
if testutil.AuthorizationCustomEndpoint == "" || testutil.TokenCustomEndpoint == "" {
214+
client, err = authorization.NewAPIClient()
105215
} else {
106216
client, err = authorization.NewAPIClient(
107217
stackitSdkConfig.WithEndpoint(testutil.AuthorizationCustomEndpoint),
218+
stackitSdkConfig.WithTokenEndpoint(testutil.TokenCustomEndpoint),
108219
)
109220
}
110221
if err != nil {

0 commit comments

Comments
 (0)