Skip to content

Commit 4461406

Browse files
modular-magicianmodular-magician
authored
Support updat on CA and Certificate (#5906) (#4207)
Signed-off-by: Modular Magician <[email protected]>
1 parent dac1222 commit 4461406

7 files changed

+513
-85
lines changed

‎.changelog/5906.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
privateca: support update on CertificateAuthority and Certificate
3+
```

‎google-beta/resource_privateca_certificate.go‎

Lines changed: 70 additions & 43 deletions
Large diffs are not rendered by default.

‎google-beta/resource_privateca_certificate_authority.go‎

Lines changed: 68 additions & 42 deletions
Large diffs are not rendered by default.

‎google-beta/resource_privateca_certificate_authority_test.go‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
package google
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
7+
)
8+
9+
func TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityUpdate(t *testing.T) {
10+
t.Parallel()
11+
12+
context := map[string]interface{}{
13+
"pool_name": BootstrapSharedCaPoolInLocation(t, "us-central1"),
14+
"pool_location": "us-central1",
15+
"deletion_protection": false,
16+
"random_suffix": randString(t, 10),
17+
}
18+
19+
vcrTest(t, resource.TestCase{
20+
PreCheck: func() { testAccPreCheck(t) },
21+
Providers: testAccProviders,
22+
CheckDestroy: testAccCheckPrivatecaCertificateAuthorityDestroyProducer(t),
23+
Steps: []resource.TestStep{
24+
{
25+
Config: testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityStart(context),
26+
},
27+
{
28+
ResourceName: "google_privateca_certificate_authority.default",
29+
ImportState: true,
30+
ImportStateVerify: true,
31+
ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool"},
32+
},
33+
{
34+
Config: testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityEnd(context),
35+
},
36+
{
37+
ResourceName: "google_privateca_certificate_authority.default",
38+
ImportState: true,
39+
ImportStateVerify: true,
40+
ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool"},
41+
},
42+
{
43+
Config: testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityStart(context),
44+
},
45+
{
46+
ResourceName: "google_privateca_certificate_authority.default",
47+
ImportState: true,
48+
ImportStateVerify: true,
49+
ImportStateVerifyIgnore: []string{"ignore_active_certificates_on_deletion", "location", "certificate_authority_id", "pool"},
50+
},
51+
},
52+
})
53+
}
54+
55+
func testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityStart(context map[string]interface{}) string {
56+
return Nprintf(`
57+
resource "google_privateca_certificate_authority" "default" {
58+
// This example assumes this pool already exists.
59+
// Pools cannot be deleted in normal test circumstances, so we depend on static pools
60+
pool = "%{pool_name}"
61+
certificate_authority_id = "tf-test-my-certificate-authority-%{random_suffix}"
62+
location = "%{pool_location}"
63+
config {
64+
subject_config {
65+
subject {
66+
organization = "HashiCorp"
67+
common_name = "my-certificate-authority"
68+
}
69+
subject_alt_name {
70+
dns_names = ["hashicorp.com"]
71+
}
72+
}
73+
x509_config {
74+
ca_options {
75+
is_ca = true
76+
max_issuer_path_length = 10
77+
}
78+
key_usage {
79+
base_key_usage {
80+
digital_signature = true
81+
content_commitment = true
82+
key_encipherment = false
83+
data_encipherment = true
84+
key_agreement = true
85+
cert_sign = true
86+
crl_sign = true
87+
decipher_only = true
88+
}
89+
extended_key_usage {
90+
server_auth = true
91+
client_auth = false
92+
email_protection = true
93+
code_signing = true
94+
time_stamping = true
95+
}
96+
}
97+
}
98+
}
99+
lifetime = "86400s"
100+
key_spec {
101+
algorithm = "RSA_PKCS1_4096_SHA256"
102+
}
103+
}
104+
`, context)
105+
}
106+
107+
func testAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityEnd(context map[string]interface{}) string {
108+
return Nprintf(`
109+
resource "google_privateca_certificate_authority" "default" {
110+
// This example assumes this pool already exists.
111+
// Pools cannot be deleted in normal test circumstances, so we depend on static pools
112+
pool = "%{pool_name}"
113+
certificate_authority_id = "tf-test-my-certificate-authority-%{random_suffix}"
114+
location = "%{pool_location}"
115+
config {
116+
subject_config {
117+
subject {
118+
organization = "HashiCorp"
119+
common_name = "my-certificate-authority"
120+
}
121+
subject_alt_name {
122+
dns_names = ["hashicorp.com"]
123+
}
124+
}
125+
x509_config {
126+
ca_options {
127+
is_ca = true
128+
max_issuer_path_length = 10
129+
}
130+
key_usage {
131+
base_key_usage {
132+
digital_signature = true
133+
content_commitment = true
134+
key_encipherment = false
135+
data_encipherment = true
136+
key_agreement = true
137+
cert_sign = true
138+
crl_sign = true
139+
decipher_only = true
140+
}
141+
extended_key_usage {
142+
server_auth = true
143+
client_auth = false
144+
email_protection = true
145+
code_signing = true
146+
time_stamping = true
147+
}
148+
}
149+
}
150+
}
151+
lifetime = "86400s"
152+
key_spec {
153+
algorithm = "RSA_PKCS1_4096_SHA256"
154+
}
155+
labels = {
156+
foo = "bar"
157+
}
158+
}
159+
`, context)
160+
}

‎google-beta/resource_privateca_certificate_test.go‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
package google
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
7+
)
8+
9+
func TestAccPrivatecaCertificate_privatecaCertificateUpdate(t *testing.T) {
10+
t.Parallel()
11+
12+
context := map[string]interface{}{
13+
"pool_name": BootstrapSharedCaPoolInLocation(t, "us-central1"),
14+
"pool_location": "us-central1",
15+
"deletion_protection": false,
16+
"random_suffix": randString(t, 10),
17+
}
18+
19+
vcrTest(t, resource.TestCase{
20+
PreCheck: func() { testAccPreCheck(t) },
21+
Providers: testAccProviders,
22+
CheckDestroy: testAccCheckPrivatecaCertificateDestroyProducer(t),
23+
Steps: []resource.TestStep{
24+
{
25+
Config: testAccPrivatecaCertificate_privatecaCertificateStart(context),
26+
},
27+
{
28+
ResourceName: "google_privateca_certificate.default",
29+
ImportState: true,
30+
ImportStateVerify: true,
31+
ImportStateVerifyIgnore: []string{"pool", "name", "location", "certificate_authority"},
32+
},
33+
{
34+
Config: testAccPrivatecaCertificate_privatecaCertificateEnd(context),
35+
},
36+
{
37+
ResourceName: "google_privateca_certificate.default",
38+
ImportState: true,
39+
ImportStateVerify: true,
40+
ImportStateVerifyIgnore: []string{"pool", "name", "location", "certificate_authority"},
41+
},
42+
{
43+
Config: testAccPrivatecaCertificate_privatecaCertificateStart(context),
44+
},
45+
{
46+
ResourceName: "google_privateca_certificate.default",
47+
ImportState: true,
48+
ImportStateVerify: true,
49+
ImportStateVerifyIgnore: []string{"pool", "name", "location", "certificate_authority"},
50+
},
51+
},
52+
})
53+
}
54+
55+
func testAccPrivatecaCertificate_privatecaCertificateStart(context map[string]interface{}) string {
56+
return Nprintf(`
57+
resource "google_privateca_certificate_authority" "default" {
58+
// This example assumes this pool already exists.
59+
// Pools cannot be deleted in normal test circumstances, so we depend on static pools
60+
pool = "%{pool_name}"
61+
certificate_authority_id = "tf-test-my-certificate-authority-%{random_suffix}"
62+
location = "%{pool_location}"
63+
config {
64+
subject_config {
65+
subject {
66+
organization = "HashiCorp"
67+
common_name = "my-certificate-authority"
68+
}
69+
subject_alt_name {
70+
dns_names = ["hashicorp.com"]
71+
}
72+
}
73+
x509_config {
74+
ca_options {
75+
is_ca = true
76+
max_issuer_path_length = 10
77+
}
78+
key_usage {
79+
base_key_usage {
80+
cert_sign = true
81+
crl_sign = true
82+
}
83+
extended_key_usage {}
84+
}
85+
}
86+
}
87+
lifetime = "86400s"
88+
key_spec {
89+
algorithm = "RSA_PKCS1_4096_SHA256"
90+
}
91+
}
92+
93+
resource "google_privateca_certificate" "default" {
94+
pool = "%{pool_name}"
95+
location = "%{pool_location}"
96+
certificate_authority = google_privateca_certificate_authority.default.certificate_authority_id
97+
lifetime = "860s"
98+
name = "my-certificate-%{random_suffix}"
99+
config {
100+
subject_config {
101+
subject {
102+
common_name = "san1.example.com"
103+
organization = "HashiCorp"
104+
}
105+
subject_alt_name {
106+
email_addresses = ["[email protected]"]
107+
}
108+
}
109+
x509_config {
110+
ca_options {
111+
is_ca = false
112+
}
113+
key_usage {
114+
base_key_usage {
115+
crl_sign = false
116+
decipher_only = false
117+
}
118+
extended_key_usage {
119+
server_auth = false
120+
}
121+
}
122+
}
123+
public_key {
124+
format = "PEM"
125+
key = filebase64("test-fixtures/rsa_public.pem")
126+
}
127+
}
128+
}
129+
`, context)
130+
}
131+
132+
func testAccPrivatecaCertificate_privatecaCertificateEnd(context map[string]interface{}) string {
133+
return Nprintf(`
134+
resource "google_privateca_certificate_authority" "default" {
135+
// This example assumes this pool already exists.
136+
// Pools cannot be deleted in normal test circumstances, so we depend on static pools
137+
pool = "%{pool_name}"
138+
certificate_authority_id = "tf-test-my-certificate-authority-%{random_suffix}"
139+
location = "%{pool_location}"
140+
config {
141+
subject_config {
142+
subject {
143+
organization = "HashiCorp"
144+
common_name = "my-certificate-authority"
145+
}
146+
subject_alt_name {
147+
dns_names = ["hashicorp.com"]
148+
}
149+
}
150+
x509_config {
151+
ca_options {
152+
is_ca = true
153+
max_issuer_path_length = 10
154+
}
155+
key_usage {
156+
base_key_usage {
157+
cert_sign = true
158+
crl_sign = true
159+
}
160+
extended_key_usage {}
161+
}
162+
}
163+
}
164+
lifetime = "86400s"
165+
key_spec {
166+
algorithm = "RSA_PKCS1_4096_SHA256"
167+
}
168+
}
169+
170+
resource "google_privateca_certificate" "default" {
171+
pool = "%{pool_name}"
172+
location = "%{pool_location}"
173+
certificate_authority = google_privateca_certificate_authority.default.certificate_authority_id
174+
lifetime = "860s"
175+
name = "my-certificate-%{random_suffix}"
176+
config {
177+
subject_config {
178+
subject {
179+
common_name = "san1.example.com"
180+
organization = "HashiCorp"
181+
}
182+
subject_alt_name {
183+
email_addresses = ["[email protected]"]
184+
}
185+
}
186+
x509_config {
187+
ca_options {
188+
is_ca = false
189+
}
190+
key_usage {
191+
base_key_usage {
192+
crl_sign = false
193+
decipher_only = false
194+
}
195+
extended_key_usage {
196+
server_auth = false
197+
}
198+
}
199+
}
200+
public_key {
201+
format = "PEM"
202+
key = filebase64("test-fixtures/rsa_public.pem")
203+
}
204+
}
205+
labels = {
206+
foo = "bar"
207+
}
208+
}
209+
`, context)
210+
}

‎website/docs/r/privateca_certificate.html.markdown‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -968,6 +968,7 @@ This resource provides the following
968968
[Timeouts](/docs/configuration/resources.html#timeouts) configuration options:
969969

970970
- `create` - Default is 20 minutes.
971+
- `update` - Default is 20 minutes.
971972
- `delete` - Default is 20 minutes.
972973

973974
## Import

‎website/docs/r/privateca_certificate_authority.html.markdown‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -596,6 +596,7 @@ This resource provides the following
596596
[Timeouts](/docs/configuration/resources.html#timeouts) configuration options:
597597

598598
- `create` - Default is 20 minutes.
599+
- `update` - Default is 20 minutes.
599600
- `delete` - Default is 20 minutes.
600601

601602
## Import

0 commit comments

Comments
 (0)