Add IAM Groups resources

go.mod

@@ -10,7 +10,7 @@ require (
  github.com/selectel/dbaas-go v0.12.1
  github.com/selectel/domains-go v1.0.2
  github.com/selectel/go-selvpcclient/v3 v3.1.1
- github.com/selectel/iam-go v0.2.0
+ github.com/selectel/iam-go v0.3.0
  github.com/selectel/mks-go v0.14.0
  github.com/selectel/secretsmanager-go v0.2.1
  github.com/stretchr/testify v1.8.4

go.sum

@@ -170,8 +170,8 @@ github.com/selectel/domains-go v1.0.2 h1:Si6iGaMnTFJxwiJVI50DOdZnwcxc87kqaWrVQYW
 github.com/selectel/domains-go v1.0.2/go.mod h1:SugRKfq4sTpnOHquslCpzda72wV8u0cMBHx0C0l+bzA=
 github.com/selectel/go-selvpcclient/v3 v3.1.1 h1:C1q2LqqosiapoLpnGITGmysg0YCSQYDo2Gh69CioevM=
 github.com/selectel/go-selvpcclient/v3 v3.1.1/go.mod h1:NM7IXhh1IzqZ88DOw1Qc5Ez3tULLViXo95l5+rKPuyQ=
-github.com/selectel/iam-go v0.2.0 h1:c6ldpbsa/8R3b29ML5B21FU9oyJ2A2AwBNzCbE+pGN8=
-github.com/selectel/iam-go v0.2.0/go.mod h1:OIAkW7MZK97YUm+uvUgYbgDhkI9SdzTCxwd4yZoOR1o=
+github.com/selectel/iam-go v0.3.0 h1:HRoxSBXwvASE9v/A4WgeEDeMvomARIWyj2essV4LmYc=
+github.com/selectel/iam-go v0.3.0/go.mod h1:OIAkW7MZK97YUm+uvUgYbgDhkI9SdzTCxwd4yZoOR1o=
 github.com/selectel/mks-go v0.14.0 h1:huNq/oTutPc3ezB8HRqlGN9WJubTDETpNKuIVqcZOn0=
 github.com/selectel/mks-go v0.14.0/go.mod h1:VxtV3dzwgOEzZc+9VMQb9DvxfSlej2ZQ8jnT8kqIGgU=
 github.com/selectel/secretsmanager-go v0.2.1 h1:OSBrA/07lm/Ecpwg59IJHFAoUHZR29oyfwUgTpr/dos=

selectel/provider.go

@@ -27,6 +27,8 @@ const (
  objectUser = "user"
  objectServiceUser = "service user"
  objectS3Credentials = "s3 credentials"
+ objectGroup = "group"
+ objectGroupMembership = "group-membership"
  objectCluster = "cluster"
  objectKubeConfig = "kubeconfig"
  objectKubeVersions = "kube-versions"
@@ -135,6 +137,8 @@ func Provider() *schema.Provider {
  "selectel_iam_serviceuser_v1": resourceIAMServiceUserV1(),
  "selectel_iam_user_v1": resourceIAMUserV1(),
  "selectel_iam_s3_credentials_v1": resourceIAMS3CredentialsV1(),
+ "selectel_iam_group_v1": resourceIAMGroupV1(),
+ "selectel_iam_group_membership_v1": resourceIAMGroupMembershipV1(),
  "selectel_vpc_vrrp_subnet_v2": resourceVPCVRRPSubnetV2(), // DEPRECATED
  "selectel_vpc_crossregion_subnet_v2": resourceVPCCrossRegionSubnetV2(), // DEPRECATED
  "selectel_mks_cluster_v1": resourceMKSClusterV1(),

selectel/resource_selectel_iam_group_membership_v1.go

@@ -0,0 +1,178 @@
+package selectel
+
+import (
+ "context"
+ "fmt"
+ "log"
+
+ "github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+ "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func resourceIAMGroupMembershipV1() *schema.Resource {
+ return &schema.Resource{
+ CreateContext: resourceIAMGroupMembershipV1Create,
+ ReadContext: resourceIAMGroupMembershipV1Read,
+ UpdateContext: resourceIAMGroupMembershipV1Update,
+ DeleteContext: resourceIAMGroupMembershipV1Delete,
+ Schema: map[string]*schema.Schema{
+ "group_id": {
+ Type: schema.TypeString,
+ Required: true,
+ },
+ "user_ids": {
+ Type: schema.TypeList,
+ Required: true,
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ }
+}
+
+func resourceIAMGroupMembershipV1Create(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+ iamClient, diagErr := getIAMClient(meta)
+ if diagErr != nil {
+ return diagErr
+ }
+
+ userIDsInterface := d.Get("user_ids").([]interface{})
+ userIDs := make([]string, len(userIDsInterface))
+ for i, v := range userIDsInterface {
+ userIDs[i] = v.(string)
+ }
+ log.Print(msgCreate(objectGroupMembership, userIDs))
+
+ if len(userIDs) == 0 {
+ createErr := fmt.Errorf("error creating group membership: no user ids specified")
+ return diag.FromErr(errCreatingObject(objectGroupMembership, createErr))
+ }
+ err := iamClient.Groups.AddUsers(ctx, d.Get("group_id").(string), userIDs)
+ if err != nil {
+ return diag.FromErr(errCreatingObject(objectGroupMembership, err))
+ }
+
+ d.SetId(d.Get("group_id").(string))
+
+ return resourceIAMGroupMembershipV1Read(ctx, d, meta)
+}
+
+func resourceIAMGroupMembershipV1Read(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+ iamClient, diagErr := getIAMClient(meta)
+ if diagErr != nil {
+ return diagErr
+ }
+
+ groupID := d.Id()
+
+ userIDsInterface := d.Get("user_ids").([]interface{})
+ userIDs := make([]string, len(userIDsInterface))
+ for i, v := range userIDsInterface {
+ userIDs[i] = v.(string)
+ }
+
+ response, err := iamClient.Groups.Get(ctx, groupID)
+ if err != nil {
+ return diag.FromErr(errGettingObject(objectGroupMembership, d.Id(), err))
+ }
+
+ responseUserIDs := make([]string, 0)
+ for _, user := range response.Users {
+ responseUserIDs = append(responseUserIDs, user.KeystoneID)
+ }
+
+ responseServiceUserIDs := make([]string, 0)
+ for _, serviceUser := range response.ServiceUsers {
+ responseServiceUserIDs = append(responseServiceUserIDs, serviceUser.ID)
+ }
+
+ d.Set("group_id", groupID)
+ d.Set("user_ids", append(responseUserIDs, responseServiceUserIDs...))
+
+ return nil
+}
+
+func resourceIAMGroupMembershipV1Update(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+ iamClient, diagErr := getIAMClient(meta)
+ if diagErr != nil {
+ return diagErr
+ }
+
+ groupID := d.Id()
+
+ oldValue, newValue := d.GetChange("user_ids")
+
+ oldUserIDs := make(map[string]struct{})
+ for _, v := range oldValue.([]interface{}) {
+ oldUserIDs[v.(string)] = struct{}{}
+ }
+
+ newUserIDs := make(map[string]struct{})
+ for _, v := range newValue.([]interface{}) {
+ newUserIDs[v.(string)] = struct{}{}
+ }
+
+ usersToAdd, usersToRemove := diffUsers(oldUserIDs, newUserIDs)
+
+ if len(usersToAdd) > 0 {
+ err := iamClient.Groups.AddUsers(ctx, groupID, usersToAdd)
+ if err != nil {
+ return diag.FromErr(err)
+ }
+ }
+
+ if len(usersToRemove) > 0 {
+ err := iamClient.Groups.DeleteUsers(ctx, groupID, usersToRemove)
+ if err != nil {
+ return diag.FromErr(err)
+ }
+ }
+
+ d.SetId(groupID)
+
+ return resourceIAMGroupMembershipV1Read(ctx, d, meta)
+}
+
+func resourceIAMGroupMembershipV1Delete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+ iamClient, diagErr := getIAMClient(meta)
+ if diagErr != nil {
+ return diagErr
+ }
+
+ groupID := d.Id()
+
+ userIDsInterface := d.Get("user_ids").([]interface{})
+ userIDs := make([]string, len(userIDsInterface))
+ for i, v := range userIDsInterface {
+ userIDs[i] = v.(string)
+ }
+
+ err := iamClient.Groups.DeleteUsers(ctx, groupID, userIDs)
+ if err != nil {
+ return diag.FromErr(errDeletingObject(objectGroupMembership, d.Id(), err))
+ }
+
+ d.SetId("")
+
+ return nil
+}
+
+func diffUsers(oldUsers, newUsers map[string]struct{}) ([]string, []string) {
+ usersToAdd := make([]string, 0)
+ usersToRemove := make([]string, 0)
+
+ for id := range newUsers {
+ if _, ok := oldUsers[id]; !ok {
+ usersToAdd = append(usersToAdd, id)
+ }
+ }
+
+ for id := range oldUsers {
+ if _, ok := newUsers[id]; !ok {
+ usersToRemove = append(usersToRemove, id)
+ }
+ }
+
+ return usersToAdd, usersToRemove
+}

selectel/resource_selectel_iam_group_membership_v1_test.go

@@ -0,0 +1,136 @@
+package selectel
+
+import (
+ "testing"
+
+ "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccIAMV1GroupMembershipBasic(t *testing.T) {
+ resource.Test(t, resource.TestCase{
+ PreCheck: func() { testAccSelectelPreCheck(t) },
+ ProviderFactories: testAccProviders,
+ Steps: []resource.TestStep{
+ {
+ Config: testAccIAMV1GroupMembershipBasic(),
+ Check: resource.ComposeTestCheckFunc(
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+ ),
+ },
+ },
+ })
+}
+
+func TestAccIAMV1GroupUpdate(t *testing.T) {
+ resource.Test(t, resource.TestCase{
+ PreCheck: func() { testAccSelectelPreCheck(t) },
+ ProviderFactories: testAccProviders,
+ Steps: []resource.TestStep{
+ {
+ Config: testAccIAMV1GroupMembershipBasic(),
+ Check: resource.ComposeTestCheckFunc(
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+ ),
+ },
+ {
+ Config: testAccIAMV1GroupMembershipUpdate(),
+ Check: resource.ComposeTestCheckFunc(
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.1"),
+ ),
+ },
+ {
+ Config: testAccIAMV1GroupMembershipBasic(),
+ Check: resource.ComposeTestCheckFunc(
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "group_id"),
+ resource.TestCheckResourceAttrSet("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.0"),
+ resource.TestCheckNoResourceAttr("selectel_iam_group_membership_v1.membership_tf_acc_test_1", "user_ids.1"),
+ ),
+ },
+ },
+ })
+}
+
+func testAccIAMV1GroupMembershipBasic() string {
+ return `
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_1" {
+ name = "test-service-user-1"
+ password = "Qazwsxedc123"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_2" {
+ name = "test-service-user-2"
+ password = "Qazwsxedc123"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_group_v1" "group_tf_acc_test_1" {
+ name = "test-group"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_group_membership_v1" "membership_tf_acc_test_1" {
+ group_id = selectel_iam_group_v1.group_tf_acc_test_1.id
+
+ user_ids = [
+ selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_1.id
+ ]
+}
+`
+}
+
+func testAccIAMV1GroupMembershipUpdate() string {
+ return `
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_1" {
+ name = "test-service-user-1"
+ password = "Qazwsxedc123"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_serviceuser_v1" "serviceuser_tf_acc_test_2" {
+ name = "test-service-user-2"
+ password = "Qazwsxedc123"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_group_v1" "group_tf_acc_test_1" {
+ name = "test-group"
+ role {
+ role_name = "reader"
+ scope = "account"
+ }
+}
+
+resource "selectel_iam_group_membership_v1" "membership_tf_acc_test_1" {
+ group_id = selectel_iam_group_v1.group_tf_acc_test_1.id
+
+ user_ids = [
+ selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_1.id,
+ selectel_iam_serviceuser_v1.serviceuser_tf_acc_test_2.id
+ ]
+}
+`
+}