Skip to content

Commit fbaa78b

Browse files
LijieZhang1998LijieZhang1998
committed
Remove https_ca_pem and add method
1 parent 51abddd commit fbaa78b

File tree

9 files changed

+34
-34
lines changed

9 files changed

+34
-34
lines changed

‎docs/data-sources/stream_connection.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,14 @@ If `type` is of value `Https` the following additional attributes are defined:
4848
### Authentication
4949

5050
* `mechanism` - Style of authentication. Can be one of `PLAIN`, `SCRAM-256`, `SCRAM-512`, or `OAUTHBEARER`.
51+
* `method` - SASL OAUTHBEARER authentication method. Can only be `OIDC` currently.
5152
* `username` - Username of the account to connect to the Kafka cluster.
5253
* `password` - Password of the account to connect to the Kafka cluster.
5354
* `token_endpoint_url` - OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.
5455
* `client_id` - Public identifier for the Kafka client.
5556
* `client_secret` - Secret known only to the Kafka client and the authorization server.
5657
* `scope` - Kafka clients use this to specify the scope of the access request to the broker.
5758
* `sasl_oauthbearer_extensions` - Additional information to be provided to the Kafka broker.
58-
* `https_ca_pem` - The CA certificates as a PEM string.
5959

6060
### Security
6161

‎docs/data-sources/stream_connections.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,14 @@ If `type` is of value `Https` the following additional attributes are defined:
5959
### Authentication
6060

6161
* `mechanism` - Style of authentication. Can be one of `PLAIN`, `SCRAM-256`, `SCRAM-512`, or `OAUTHBEARER`.
62+
* `method` - SASL OAUTHBEARER authentication method. Can only be `OIDC` currently.
6263
* `username` - Username of the account to connect to the Kafka cluster.
6364
* `password` - Password of the account to connect to the Kafka cluster.
6465
* `token_endpoint_url` - OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.
6566
* `client_id` - Public identifier for the Kafka client. It must be unique across all clients that the authorization server handles.
6667
* `client_secret` - Secret known only to the Kafka client and the authorization server.
6768
* `scope` - Kafka clients use this to specify the scope of the access request to the broker.
6869
* `sasl_oauthbearer_extensions` - Additional information to be provided to the Kafka broker.
69-
* `https_ca_pem` - The CA certificates as a PEM string.
7070

7171
### Security
7272

‎docs/resources/stream_connection.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,12 +72,12 @@ resource "mongodbatlas_stream_connection" "example-kafka-oauthbearer" {
7272
type = "Kafka"
7373
authentication = {
7474
mechanism = "OAUTHBEARER"
75+
method = "OIDC"
7576
token_endpoint_url = "https://example.com/oauth/token"
7677
client_id = "auth0Client"
7778
client_secret = var.kafka_client_secret
7879
scope = "read:messages write:messages"
7980
sasl_oauthbearer_extensions = "logicalCluster=lkc-kmom,identityPoolId=pool-lAr"
80-
https_ca_pem = "pemtext"
8181
}
8282
bootstrap_servers = "localhost:9092,localhost:9092"
8383
config = {
@@ -180,12 +180,12 @@ If `type` is of value `Https` the following additional attributes are defined:
180180
* `mechanism` - Style of authentication. Can be one of `PLAIN`, `SCRAM-256`, or `SCRAM-512`.
181181
* `username` - Username of the account to connect to the Kafka cluster.
182182
* `password` - Password of the account to connect to the Kafka cluster.
183+
* `method` - SASL OAUTHBEARER authentication method. Can only be `OIDC` currently.
183184
* `token_endpoint_url` - OAUTH issuer(IdP provider) token endpoint HTTP(S) URI used to retrieve the token.
184185
* `client_id` - Public identifier for the Kafka client.
185186
* `client_secret` - Secret known only to the Kafka client and the authorization server.
186187
* `scope` - Kafka clients use this to specify the scope of the access request to the broker.
187188
* `sasl_oauthbearer_extensions` - Additional information to be provided to the Kafka broker.
188-
* `https_ca_pem` - The CA certificates as a PEM string.
189189

190190
### Security
191191

‎examples/mongodbatlas_stream_connection/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,12 @@ resource "mongodbatlas_stream_connection" "example-kafka-oauthbearer" {
6363
type = "Kafka"
6464
authentication = {
6565
mechanism = "OAUTHBEARER"
66+
method = "OIDC"
6667
token_endpoint_url = "https://example.com/oauth/token"
6768
client_id = "auth0Client"
6869
client_secret = var.kafka_client_secret
6970
scope = "read:messages write:messages"
7071
sasl_oauthbearer_extensions = "logicalCluster=lkc-kmom,identityPoolId=pool-lAr"
71-
https_ca_pem = "pemtext"
7272
}
7373
bootstrap_servers = "localhost:9092,localhost:9092"
7474
config = {

‎internal/service/streamconnection/model_stream_connection.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,14 @@ func NewStreamConnectionReq(ctx context.Context, plan *TFStreamConnectionModel)
2828
}
2929
streamConnection.Authentication = &admin.StreamsKafkaAuthentication{
3030
Mechanism: authenticationModel.Mechanism.ValueStringPointer(),
31+
Method: authenticationModel.Method.ValueStringPointer(),
3132
Password: authenticationModel.Password.ValueStringPointer(),
3233
Username: authenticationModel.Username.ValueStringPointer(),
3334
TokenEndpointUrl: authenticationModel.TokenEndpointURL.ValueStringPointer(),
3435
ClientId: authenticationModel.ClientID.ValueStringPointer(),
3536
ClientSecret: authenticationModel.ClientSecret.ValueStringPointer(),
3637
Scope: authenticationModel.Scope.ValueStringPointer(),
3738
SaslOauthbearerExtensions: authenticationModel.SaslOauthbearerExtensions.ValueStringPointer(),
38-
HttpsCaPem: authenticationModel.HTTPSCaPem.ValueStringPointer(),
3939
}
4040
}
4141
if !plan.Security.IsNull() {
@@ -222,12 +222,12 @@ func newTFConnectionAuthenticationModel(ctx context.Context, currAuthConfig *typ
222222
if authResp != nil {
223223
resultAuthModel := TFConnectionAuthenticationModel{
224224
Mechanism: types.StringPointerValue(authResp.Mechanism),
225+
Method: types.StringPointerValue(authResp.Method),
225226
Username: types.StringPointerValue(authResp.Username),
226227
TokenEndpointURL: types.StringPointerValue(authResp.TokenEndpointUrl),
227228
ClientID: types.StringPointerValue(authResp.ClientId),
228229
Scope: types.StringPointerValue(authResp.Scope),
229230
SaslOauthbearerExtensions: types.StringPointerValue(authResp.SaslOauthbearerExtensions),
230-
HTTPSCaPem: types.StringPointerValue(authResp.HttpsCaPem),
231231
}
232232

233233
if currAuthConfig != nil && !currAuthConfig.IsNull() { // if config is available (create & update of resource) password value is set in new state

‎internal/service/streamconnection/model_stream_connection_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ const (
2525
tokenEndpointURL = "https://your-domain.com/oauth2/token"
2626
scope = "read:messages write:messages"
2727
saslOauthbearerExtentions = "logicalCluster=cluster-kmo17m,identityPoolId=pool-l7Arl"
28-
httpsCaPem = "MHWER3343"
28+
method = "OIDC"
2929
securityProtocol = "SASL_SSL"
3030
bootstrapServers = "localhost:9092,another.host:9092"
3131
dbRole = "customRole"
@@ -58,7 +58,7 @@ type sdkToTFModelTestCase struct {
5858

5959
func TestStreamConnectionSDKToTFModel(t *testing.T) {
6060
var authConfigWithPasswordDefined = tfAuthenticationObject(t, authMechanism, authUsername, "raw password")
61-
var authConfigWithOAuth = tfAuthenticationObjectForOAuth(t, authMechanismOAuth, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtentions, httpsCaPem)
61+
var authConfigWithOAuth = tfAuthenticationObjectForOAuth(t, authMechanismOAuth, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtentions, method)
6262

6363
testCases := []sdkToTFModelTestCase{
6464
{
@@ -162,11 +162,11 @@ func TestStreamConnectionSDKToTFModel(t *testing.T) {
162162
Type: admin.PtrString("Kafka"),
163163
Authentication: &admin.StreamsKafkaAuthentication{
164164
Mechanism: admin.PtrString(authMechanismOAuth),
165+
Method: admin.PtrString(method),
165166
ClientId: admin.PtrString(clientID),
166167
TokenEndpointUrl: admin.PtrString(tokenEndpointURL),
167168
Scope: admin.PtrString(scope),
168169
SaslOauthbearerExtensions: admin.PtrString(saslOauthbearerExtentions),
169-
HttpsCaPem: admin.PtrString(httpsCaPem),
170170
},
171171
BootstrapServers: admin.PtrString(bootstrapServers),
172172
Config: &configMap,
@@ -183,7 +183,7 @@ func TestStreamConnectionSDKToTFModel(t *testing.T) {
183183
InstanceName: types.StringValue(instanceName),
184184
ConnectionName: types.StringValue(connectionName),
185185
Type: types.StringValue("Kafka"),
186-
Authentication: tfAuthenticationObjectForOAuth(t, authMechanismOAuth, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtentions, httpsCaPem), // password value is obtained from config, not api resp.
186+
Authentication: tfAuthenticationObjectForOAuth(t, authMechanismOAuth, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtentions, method), // password value is obtained from config, not api resp.
187187
BootstrapServers: types.StringValue(bootstrapServers),
188188
Config: tfConfigMap(t, configMap),
189189
Security: tfSecurityObject(t, DummyCACert, securityProtocol),
@@ -643,16 +643,16 @@ func tfAuthenticationObject(t *testing.T, mechanism, username, password string)
643643
return auth
644644
}
645645

646-
func tfAuthenticationObjectForOAuth(t *testing.T, mechanism, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtensions, httpsCaPem string) types.Object {
646+
func tfAuthenticationObjectForOAuth(t *testing.T, mechanism, clientID, clientSecret, tokenEndpointURL, scope, saslOauthbearerExtensions, method string) types.Object {
647647
t.Helper()
648648
auth, diags := types.ObjectValueFrom(t.Context(), streamconnection.ConnectionAuthenticationObjectType.AttrTypes, streamconnection.TFConnectionAuthenticationModel{
649649
Mechanism: types.StringValue(mechanism),
650+
Method: types.StringValue(method),
650651
ClientID: types.StringValue(clientID),
651652
ClientSecret: types.StringValue(clientSecret),
652653
TokenEndpointURL: types.StringValue(tokenEndpointURL),
653654
Scope: types.StringValue(scope),
654655
SaslOauthbearerExtensions: types.StringValue(saslOauthbearerExtensions),
655-
HTTPSCaPem: types.StringValue(httpsCaPem),
656656
})
657657
if diags.HasError() {
658658
t.Errorf("failed to create terraform data model: %s", diags.Errors()[0].Summary())

‎internal/service/streamconnection/resource_schema.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@ func ResourceSchema(ctx context.Context) schema.Schema {
7575
"mechanism": schema.StringAttribute{
7676
Optional: true,
7777
},
78+
"method": schema.StringAttribute{
79+
Optional: true,
80+
},
7881
"password": schema.StringAttribute{
7982
Optional: true,
8083
Sensitive: true,
@@ -98,9 +101,6 @@ func ResourceSchema(ctx context.Context) schema.Schema {
98101
"sasl_oauthbearer_extensions": schema.StringAttribute{
99102
Optional: true,
100103
},
101-
"https_ca_pem": schema.StringAttribute{
102-
Optional: true,
103-
},
104104
},
105105
},
106106
"bootstrap_servers": schema.StringAttribute{

‎internal/service/streamconnection/resource_stream_connection.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,24 +57,24 @@ type TFConnectionAuthenticationModel struct {
5757
Mechanism types.String `tfsdk:"mechanism"`
5858
Password types.String `tfsdk:"password"`
5959
Username types.String `tfsdk:"username"`
60+
Method types.String `tfsdk:"method"`
6061
TokenEndpointURL types.String `tfsdk:"token_endpoint_url"`
6162
ClientID types.String `tfsdk:"client_id"`
6263
ClientSecret types.String `tfsdk:"client_secret"`
6364
Scope types.String `tfsdk:"scope"`
6465
SaslOauthbearerExtensions types.String `tfsdk:"sasl_oauthbearer_extensions"`
65-
HTTPSCaPem types.String `tfsdk:"https_ca_pem"`
6666
}
6767

6868
var ConnectionAuthenticationObjectType = types.ObjectType{AttrTypes: map[string]attr.Type{
6969
"mechanism": types.StringType,
70+
"method": types.StringType,
7071
"password": types.StringType,
7172
"username": types.StringType,
7273
"token_endpoint_url": types.StringType,
7374
"client_id": types.StringType,
7475
"client_secret": types.StringType,
7576
"scope": types.StringType,
7677
"sasl_oauthbearer_extensions": types.StringType,
77-
"https_ca_pem": types.StringType,
7878
}}
7979

8080
type TFConnectionSecurityModel struct {

‎internal/service/streamconnection/resource_stream_connection_test.go‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -120,18 +120,18 @@ func TestAccStreamRSStreamConnection_kafkaOAuthBearer(t *testing.T) {
120120
CheckDestroy: CheckDestroyStreamConnection,
121121
Steps: []resource.TestStep{
122122
{
123-
Config: dataSourcesConfig + configureKafka(projectID, instanceName, connectionName, getKafkaAuthenticationConfig("OAUTHBEARER", "", "", tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, httpsCaPem), "localhost:9092,localhost:9092", "earliest", "", false),
123+
Config: dataSourcesConfig + configureKafka(projectID, instanceName, connectionName, getKafkaAuthenticationConfig("OAUTHBEARER", "", "", tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, method), "localhost:9092,localhost:9092", "earliest", "", false),
124124
Check: resource.ComposeAggregateTestCheckFunc(
125-
checkKafkaOAuthAttributes(resourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, httpsCaPem, "localhost:9092,localhost:9092", "earliest", networkingTypePublic, false, true),
126-
checkKafkaOAuthAttributes(dataSourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, httpsCaPem, "localhost:9092,localhost:9092", "earliest", networkingTypePublic, false, false),
125+
checkKafkaOAuthAttributes(resourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, method, "localhost:9092,localhost:9092", "earliest", networkingTypePublic, false, true),
126+
checkKafkaOAuthAttributes(dataSourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtentions, method, "localhost:9092,localhost:9092", "earliest", networkingTypePublic, false, false),
127127
streamConnectionsAttributeChecks(pluralDataSourceName, nil, nil),
128128
),
129129
},
130130
{
131-
Config: dataSourcesWithPagination + configureKafka(projectID, instanceName, connectionName, getKafkaAuthenticationConfig("OAUTHBEARER", "", "", tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, httpsCaPem), "localhost:9093", "latest", kafkaNetworkingPublic, false),
131+
Config: dataSourcesWithPagination + configureKafka(projectID, instanceName, connectionName, getKafkaAuthenticationConfig("OAUTHBEARER", "", "", tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, method), "localhost:9093", "latest", kafkaNetworkingPublic, false),
132132
Check: resource.ComposeAggregateTestCheckFunc(
133-
checkKafkaOAuthAttributes(resourceName, instanceName, connectionName, tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, httpsCaPem, "localhost:9093", "latest", networkingTypePublic, false, true),
134-
checkKafkaOAuthAttributes(dataSourceName, instanceName, connectionName, tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, httpsCaPem, "localhost:9093", "latest", networkingTypePublic, false, false),
133+
checkKafkaOAuthAttributes(resourceName, instanceName, connectionName, tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, method, "localhost:9093", "latest", networkingTypePublic, false, true),
134+
checkKafkaOAuthAttributes(dataSourceName, instanceName, connectionName, tokenEndpointURL, "clientId2", "clientSecret", scope, saslOauthbearerExtentions, method, "localhost:9093", "latest", networkingTypePublic, false, false),
135135
streamConnectionsAttributeChecks(pluralDataSourceName, conversion.Pointer(2), conversion.Pointer(1)),
136136
),
137137
},
@@ -400,7 +400,7 @@ func TestAccStreamRSStreamConnection_AWSLambda(t *testing.T) {
400400
})
401401
}
402402

403-
func getKafkaAuthenticationConfig(mechanism, username, password, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions, httpsCaPem string) string {
403+
func getKafkaAuthenticationConfig(mechanism, username, password, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions, method string) string {
404404
if mechanism == "PLAIN" {
405405
return fmt.Sprintf(`authentication = {
406406
mechanism = %[1]q
@@ -410,13 +410,13 @@ func getKafkaAuthenticationConfig(mechanism, username, password, tokenEndpointUR
410410
}
411411
return fmt.Sprintf(`authentication = {
412412
mechanism = %[1]q
413-
token_endpoint_url = %[2]q
414-
client_id = %[3]q
415-
client_secret = %[4]q
416-
scope = %[5]q
417-
sasl_oauthbearer_extensions = %[6]q
418-
https_ca_pem = %[7]q
419-
}`, mechanism, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions, httpsCaPem)
413+
method = %[2]q
414+
token_endpoint_url = %[3]q
415+
client_id = %[4]q
416+
client_secret = %[5]q
417+
scope = %[6]q
418+
sasl_oauthbearer_extensions = %[7]q
419+
}`, mechanism, method, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions)
420420
}
421421

422422
func configureKafka(projectID, instanceName, connectionName, authenticationConfig, bootstrapServers, configValue, networkingConfig string, useSSL bool) string {
@@ -519,19 +519,19 @@ func checkKafkaAttributes(
519519
}
520520

521521
func checkKafkaOAuthAttributes(
522-
resourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions, httpsCaPem, bootstrapServers, configValue, networkingType string, usesSSL, checkClientSecret bool) resource.TestCheckFunc {
522+
resourceName, instanceName, connectionName, tokenEndpointURL, clientID, clientSecret, scope, saslOauthbearerExtensions, method, bootstrapServers, configValue, networkingType string, usesSSL, checkClientSecret bool) resource.TestCheckFunc {
523523
resourceChecks := []resource.TestCheckFunc{
524524
checkStreamConnectionExists(),
525525
resource.TestCheckResourceAttrSet(resourceName, "project_id"),
526526
resource.TestCheckResourceAttr(resourceName, "connection_name", connectionName),
527527
resource.TestCheckResourceAttr(resourceName, "type", "Kafka"),
528528
resource.TestCheckResourceAttr(resourceName, "instance_name", instanceName),
529529
resource.TestCheckResourceAttr(resourceName, "authentication.mechanism", "OAUTHBEARER"),
530+
resource.TestCheckResourceAttr(resourceName, "authentication.method", method),
530531
resource.TestCheckResourceAttr(resourceName, "authentication.token_endpoint_url", tokenEndpointURL),
531532
resource.TestCheckResourceAttr(resourceName, "authentication.client_id", clientID),
532533
resource.TestCheckResourceAttr(resourceName, "authentication.scope", scope),
533534
resource.TestCheckResourceAttr(resourceName, "authentication.sasl_oauthbearer_extensions", saslOauthbearerExtensions),
534-
resource.TestCheckResourceAttr(resourceName, "authentication.https_ca_pem", httpsCaPem),
535535
resource.TestCheckResourceAttr(resourceName, "bootstrap_servers", bootstrapServers),
536536
resource.TestCheckResourceAttr(resourceName, "config.auto.offset.reset", configValue),
537537
}

0 commit comments

Comments
 (0)