Skip to content

Commit 89bbbf4

Browse files
henrydehenryde
committed
fix: upstream api changed secret handling
1 parent 631be7f commit 89bbbf4

20 files changed

+418
-362
lines changed

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
1+
## v0.15.1
2+
3+
FIXES:
4+
5+
- Changes to meshPlatform API.
6+
17
## v0.15.0
8+
29
FEATURES:
310

411
- Support multi select building block inputs.

‎client/platform.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ type MeshPlatformSpec struct {
3939
QuotaDefinitions []QuotaDefinition `json:"quotaDefinitions" tfsdk:"quota_definitions"`
4040
}
4141

42+
type SecretEmbedded struct {
43+
Plaintext *string `json:"plaintext,omitempty" tfsdk:"plaintext"`
44+
// TODO: add Hash field
45+
}
46+
4247
type QuotaDefinition struct {
4348
QuotaKey string `json:"quotaKey" tfsdk:"quota_key"`
4449
MinValue int `json:"minValue" tfsdk:"min_value"`

‎client/platform_config_aks.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ type AksPlatformConfig struct {
88
}
99

1010
type AksReplicationConfig struct {
11-
AccessToken string `json:"accessToken" tfsdk:"access_token"`
11+
AccessToken SecretEmbedded `json:"accessToken" tfsdk:"access_token"`
1212
NamespaceNamePattern string `json:"namespaceNamePattern" tfsdk:"namespace_name_pattern"`
1313
GroupNamePattern string `json:"groupNamePattern" tfsdk:"group_name_pattern"`
1414
ServicePrincipal AksServicePrincipalConfig `json:"servicePrincipal" tfsdk:"service_principal"`
@@ -17,16 +17,15 @@ type AksReplicationConfig struct {
1717
AksResourceGroup string `json:"aksResourceGroup" tfsdk:"aks_resource_group"`
1818
RedirectUrl *string `json:"redirectUrl,omitempty" tfsdk:"redirect_url"`
1919
SendAzureInvitationMail bool `json:"sendAzureInvitationMail" tfsdk:"send_azure_invitation_mail"`
20-
UserLookUpStrategy string `json:"userLookUpStrategy" tfsdk:"user_look_up_strategy"`
20+
UserLookupStrategy string `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
2121
AdministrativeUnitId *string `json:"administrativeUnitId,omitempty" tfsdk:"administrative_unit_id"`
2222
}
2323

2424
type AksServicePrincipalConfig struct {
25-
ClientId string `json:"clientId" tfsdk:"client_id"`
26-
AuthType string `json:"authType" tfsdk:"auth_type"`
27-
CredentialsAuthClientSecret *string `json:"credentialsAuthClientSecret,omitempty" tfsdk:"credentials_auth_client_secret"`
28-
EntraTenant string `json:"entraTenant" tfsdk:"entra_tenant"`
29-
ObjectId string `json:"objectId" tfsdk:"object_id"`
25+
EntraTenant string `json:"entraTenant" tfsdk:"entra_tenant"`
26+
ObjectId string `json:"objectId" tfsdk:"object_id"`
27+
ClientId string `json:"clientId" tfsdk:"client_id"`
28+
Auth AzureAuthConfig `json:"auth" tfsdk:"auth"`
3029
}
3130

3231
type AksMeteringConfig struct {

‎client/platform_config_aws.go‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,26 +24,31 @@ type AwsReplicationConfig struct {
2424
}
2525

2626
type AwsAccessConfig struct {
27-
OrganizationRootAccountRole string `json:"organizationRootAccountRole" tfsdk:"organization_root_account_role"`
28-
OrganizationRootAccountExternalId *string `json:"organizationRootAccountExternalId,omitempty" tfsdk:"organization_root_account_external_id"`
29-
ServiceUserConfig *AwsServiceUserConfig `json:"serviceUserConfig,omitempty" tfsdk:"service_user_config"`
30-
WorkloadIdentityConfig *AwsWorkloadIdentityConfig `json:"workloadIdentityConfig,omitempty" tfsdk:"workload_identity_config"`
27+
OrganizationRootAccountRole string `json:"organizationRootAccountRole" tfsdk:"organization_root_account_role"`
28+
OrganizationRootAccountExternalId *string `json:"organizationRootAccountExternalId,omitempty" tfsdk:"organization_root_account_external_id"`
29+
Auth AwsAuth `json:"auth" tfsdk:"auth"`
3130
}
3231

33-
type AwsServiceUserConfig struct {
34-
AccessKey string `json:"accessKey" tfsdk:"access_key"`
35-
SecretKey string `json:"secretKey" tfsdk:"secret_key"`
32+
type AwsAuth struct {
33+
Type string `json:"type" tfsdk:"type"`
34+
Credential *AwsServiceUserCredential `json:"credential,omitempty" tfsdk:"credential"`
35+
WorkloadIdentity *AwsWorkloadIdentityCredential `json:"workloadIdentity,omitempty" tfsdk:"workload_identity"`
3636
}
3737

38-
type AwsWorkloadIdentityConfig struct {
38+
type AwsServiceUserCredential struct {
39+
AccessKey string `json:"accessKey" tfsdk:"access_key"`
40+
SecretKey SecretEmbedded `json:"secretKey" tfsdk:"secret_key"`
41+
}
42+
43+
type AwsWorkloadIdentityCredential struct {
3944
RoleArn string `json:"roleArn" tfsdk:"role_arn"`
4045
}
4146

4247
type AwsSsoConfig struct {
4348
ScimEndpoint string `json:"scimEndpoint" tfsdk:"scim_endpoint"`
4449
Arn string `json:"arn" tfsdk:"arn"`
4550
GroupNamePattern string `json:"groupNamePattern" tfsdk:"group_name_pattern"`
46-
SsoAccessToken string `json:"ssoAccessToken" tfsdk:"sso_access_token"`
51+
SsoAccessToken SecretEmbedded `json:"ssoAccessToken" tfsdk:"sso_access_token"`
4752
AwsRoleMappings []AwsSsoRoleMapping `json:"awsRoleMappings" tfsdk:"aws_role_mappings"`
4853
SignInUrl string `json:"signInUrl" tfsdk:"sign_in_url"`
4954
}

‎client/platform_config_azure.go‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,26 @@ type AzureReplicationConfig struct {
1616
BlueprintLocation string `json:"blueprintLocation" tfsdk:"blueprint_location"`
1717
AzureRoleMappings []AzureRoleMapping `json:"azureRoleMappings" tfsdk:"azure_role_mappings"`
1818
TenantTags *MeshTenantTags `json:"tenantTags,omitempty" tfsdk:"tenant_tags"`
19-
UserLookUpStrategy string `json:"userLookUpStrategy" tfsdk:"user_look_up_strategy"`
19+
UserLookUpStrategy string `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
2020
SkipUserGroupPermissionCleanup bool `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
2121
AdministrativeUnitId *string `json:"administrativeUnitId,omitempty" tfsdk:"administrative_unit_id"`
2222
AllowHierarchicalManagementGroupAssignment bool `json:"allowHierarchicalManagementGroupAssignment" tfsdk:"allow_hierarchical_management_group_assignment"`
2323
}
2424

2525
type AzureServicePrincipalConfig struct {
26-
ClientId string `json:"clientId" tfsdk:"client_id"`
27-
AuthType string `json:"authType" tfsdk:"auth_type"`
28-
CredentialsAuthClientSecret *string `json:"credentialsAuthClientSecret,omitempty" tfsdk:"credentials_auth_client_secret"`
29-
ObjectId string `json:"objectId" tfsdk:"object_id"`
26+
ClientId string `json:"clientId" tfsdk:"client_id"`
27+
ObjectId string `json:"objectId" tfsdk:"object_id"`
28+
Auth AzureAuthConfig `json:"auth" tfsdk:"auth"`
29+
}
30+
31+
type AzureAuthConfig struct {
32+
Type string `json:"type" tfsdk:"type"`
33+
Credential *SecretEmbedded `json:"credential,omitempty" tfsdk:"credential"`
3034
}
3135

3236
type AzureGraphApiCredentials struct {
33-
ClientId string `json:"clientId" tfsdk:"client_id"`
34-
AuthType string `json:"authType" tfsdk:"auth_type"`
35-
CredentialsAuthClientSecret *string `json:"credentialsAuthClientSecret,omitempty" tfsdk:"credentials_auth_client_secret"`
37+
ClientId string `json:"clientId" tfsdk:"client_id"`
38+
Auth AzureAuthConfig `json:"auth" tfsdk:"auth"`
3639
}
3740

3841
type AzureSubscriptionProvisioningConfig struct {

‎client/platform_config_azurerg.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ type AzureRgReplicationConfig struct {
1111
ResourceGroupNamePattern string `json:"resourceGroupNamePattern" tfsdk:"resource_group_name_pattern"`
1212
UserGroupNamePattern string `json:"userGroupNamePattern" tfsdk:"user_group_name_pattern"`
1313
B2bUserInvitation *AzureInviteB2BUserConfig `json:"b2bUserInvitation,omitempty" tfsdk:"b2b_user_invitation"`
14-
UserLookUpStrategy string `json:"userLookUpStrategy" tfsdk:"user_look_up_strategy"`
14+
UserLookUpStrategy string `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
1515
TenantTags *MeshTenantTags `json:"tenantTags,omitempty" tfsdk:"tenant_tags"`
1616
SkipUserGroupPermissionCleanup bool `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
1717
AdministrativeUnitId *string `json:"administrativeUnitId,omitempty" tfsdk:"administrative_unit_id"`

‎client/platform_config_gcp.go‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ type GcpPlatformConfig struct {
66
}
77

88
type GcpReplicationConfig struct {
9-
ServiceAccountConfig GcpServiceAccountConfig `json:"serviceAccountConfig" tfsdk:"service_account_config"`
9+
ServiceAccount GcpServiceAccountConfig `json:"serviceAccount" tfsdk:"service_account"`
1010
Domain string `json:"domain" tfsdk:"domain"`
1111
CustomerId string `json:"customerId" tfsdk:"customer_id"`
1212
GroupNamePattern string `json:"groupNamePattern" tfsdk:"group_name_pattern"`
@@ -22,12 +22,9 @@ type GcpReplicationConfig struct {
2222
}
2323

2424
type GcpServiceAccountConfig struct {
25-
ServiceAccountCredentialsConfig *GcpServiceAccountCredentialsConfig `json:"serviceAccountCredentialsConfig,omitempty" tfsdk:"service_account_credentials_config"`
26-
ServiceAccountWorkloadIdentityConfig *GcpServiceAccountWorkloadIdentityConfig `json:"serviceAccountWorkloadIdentityConfig,omitempty" tfsdk:"service_account_workload_identity_config"`
27-
}
28-
29-
type GcpServiceAccountCredentialsConfig struct {
30-
ServiceAccountCredentialsB64 string `json:"serviceAccountCredentialsB64" tfsdk:"service_account_credentials_b64"`
25+
Type string `json:"type" tfsdk:"type"`
26+
Credential *SecretEmbedded `json:"credential,omitempty" tfsdk:"credential"`
27+
WorkloadIdentity *GcpServiceAccountWorkloadIdentityConfig `json:"workloadIdentity,omitempty" tfsdk:"workload_identity"`
3128
}
3229

3330
type GcpServiceAccountWorkloadIdentityConfig struct {
@@ -41,7 +38,7 @@ type GcpPlatformRoleMapping struct {
4138
}
4239

4340
type GcpMeteringConfig struct {
44-
ServiceAccountConfig GcpServiceAccountConfig `json:"serviceAccountConfig" tfsdk:"service_account_config"`
41+
ServiceAccount GcpServiceAccountConfig `json:"serviceAccount" tfsdk:"service_account"`
4542
BigqueryTable string `json:"bigqueryTable" tfsdk:"bigquery_table"`
4643
BigqueryTableForCarbonFootprint *string `json:"bigqueryTableForCarbonFootprint,omitempty" tfsdk:"bigquery_table_for_carbon_footprint"`
4744
CarbonFootprintDataCollectionStartMonth *string `json:"carbonFootprintDataCollectionStartMonth,omitempty" tfsdk:"carbon_footprint_data_collection_start_month"`

‎client/platform_config_kubernetes.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type KubernetesReplicationConfig struct {
1313
}
1414

1515
type KubernetesClientConfig struct {
16-
AccessToken string `json:"accessToken" tfsdk:"access_token"`
16+
AccessToken SecretEmbedded `json:"accessToken" tfsdk:"access_token"`
1717
}
1818

1919
type KubernetesMeteringConfig struct {

‎client/platform_config_openshift.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ type OpenShiftReplicationConfig struct {
1212
WebConsoleUrl *string `json:"webConsoleUrl,omitempty" tfsdk:"web_console_url"`
1313
ProjectNamePattern string `json:"projectNamePattern" tfsdk:"project_name_pattern"`
1414
EnableTemplateInstantiation bool `json:"enableTemplateInstantiation" tfsdk:"enable_template_instantiation"`
15-
OpenShiftRoleMappings []OpenShiftPlatformRoleMapping `json:"openshiftRoleMappings" tfsdk:"openshift_role_mappings"`
15+
OpenshiftRoleMappings []OpenShiftPlatformRoleMapping `json:"openshiftRoleMappings" tfsdk:"openshift_role_mappings"`
1616
IdentityProviderName string `json:"identityProviderName" tfsdk:"identity_provider_name"`
1717
TenantTags *MeshTenantTags `json:"tenantTags,omitempty" tfsdk:"tenant_tags"`
1818
}
@@ -24,5 +24,5 @@ type OpenShiftMeteringConfig struct {
2424

2525
type OpenShiftPlatformRoleMapping struct {
2626
MeshProjectRoleRef MeshProjectRoleRefV2 `json:"projectRoleRef" tfsdk:"project_role_ref"`
27-
OpenShiftRole string `json:"openshiftRole" tfsdk:"openshift_role"`
27+
OpenshiftRole string `json:"openshiftRole" tfsdk:"openshift_role"`
2828
}

‎docs/data-sources/platform.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ Read-Only:
139139
- `redirect_url` (String) This is the URL that Azure’s consent experience redirects users to after they accept their invitation.
140140
- `send_azure_invitation_mail` (Boolean) Flag to send Azure invitation emails. When true, meshStack instructs Azure to send out Invitation mails to invited users.
141141
- `service_principal` (Attributes) Service principal configuration for AKS (see [below for nested schema](#nestedatt--spec--config--aks--replication--service_principal))
142-
- `user_look_up_strategy` (String) Strategy for user lookup in Azure (`userPrincipalName` or `email`)
142+
- `user_lookup_strategy` (String) Strategy for user lookup in Azure (`userPrincipalName` or `email`)
143143

144144
<a id="nestedatt--spec--config--aks--replication--service_principal"></a>
145145
### Nested Schema for `spec.config.aks.replication.service_principal`
@@ -380,7 +380,7 @@ Read-Only:
380380
- `skip_user_group_permission_cleanup` (Boolean) Flag to skip user group permission cleanup. For certain use cases you might want to preserve user groups and replicated permission after a tenant was deleted on the Azure platform. Checking this option preserves those permissions. Please keep in mind that the platform operator is then responsible for cleaning them up later.
381381
- `subscription_name_pattern` (String) Configures the pattern that defines the desired name of Azure Subscriptions managed by meshStack.
382382
- `tenant_tags` (Attributes) Tenant tagging configuration. (see [below for nested schema](#nestedatt--spec--config--azure--replication--tenant_tags))
383-
- `user_look_up_strategy` (String) User lookup strategy (`userPrincipalName` or `email`). Users can either be looked up in cloud platforms by email or UPN (User Principal Name). In most cases email is the matching way as it is the only identifier that is consistently used throughout all cloud platforms and meshStack.
383+
- `user_lookup_strategy` (String) User lookup strategy (`userPrincipalName` or `email`). Users can either be looked up in cloud platforms by email or UPN (User Principal Name). In most cases email is the matching way as it is the only identifier that is consistently used throughout all cloud platforms and meshStack.
384384

385385
<a id="nestedatt--spec--config--azure--replication--azure_role_mappings"></a>
386386
### Nested Schema for `spec.config.azure.replication.azure_role_mappings`
@@ -526,7 +526,7 @@ Read-Only:
526526
- `subscription` (String) The Subscription that will contain all the created Resource Groups. Once you set the Subscription, you must not change it.
527527
- `tenant_tags` (Attributes) Tenant tags configuration (see [below for nested schema](#nestedatt--spec--config--azurerg--replication--tenant_tags))
528528
- `user_group_name_pattern` (String) Configures the pattern that defines the desired name of AAD groups managed by meshStack. It follows the usual replicator string pattern features and provides the additional replacement 'platformGroupAlias', which contains the role name suffix. This suffix is configurable via Role Mappings in this platform config.
529-
- `user_look_up_strategy` (String) User lookup strategy (`userPrincipalName` or `email`). Users can either be looked up in cloud platforms by email or UPN (User Principal Name). In most cases email is the matching way as it is the only identifier that is consistently used throughout all cloud platforms and meshStack.
529+
- `user_lookup_strategy` (String) User lookup strategy (`userPrincipalName` or `email`). Users can either be looked up in cloud platforms by email or UPN (User Principal Name). In most cases email is the matching way as it is the only identifier that is consistently used throughout all cloud platforms and meshStack.
530530

531531
<a id="nestedatt--spec--config--azurerg--replication--b2b_user_invitation"></a>
532532
### Nested Schema for `spec.config.azurerg.replication.b2b_user_invitation`

0 commit comments

Comments
 (0)