Skip to content

Commit 2f8bfac

Browse files
Terraform Team Automationsagarp337
Terraform Team Automation
authored and
sagarp337
committed
Added - Support for FSS: Support Kerberos with NFSv3 in FSS
1 parent 7e0d22b commit 2f8bfac

31 files changed

+2426
-21
lines changed

‎examples/storage/fss/data_sources.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,16 @@ data "oci_file_storage_filesystem_snapshot_policies" "filesystem_snapshot_polici
119119
#id = var.filesystem_snapshot_policy_id
120120
#state = var.filesystem_snapshot_policy_state
121121
}
122+
123+
124+
# Gets a list of outbound connectors in a compartment and availability domain
125+
data "oci_file_storage_outbound_connectors" "outbound_connectors" {
126+
#Required
127+
availability_domain = data.oci_identity_availability_domain.ad.name
128+
compartment_id = var.compartment_ocid
129+
130+
#Optional
131+
#display_name = var.outbound_connector_display_name
132+
#id = var.outbound_connector_id
133+
#state = var.outbound_connector_state
134+
}

‎examples/storage/fss/export.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,25 @@ resource "oci_file_storage_export" "my_export_fs2_mt1" {
3636
path = var.export_path_fs2_mt1
3737
}
3838

39+
resource "oci_file_storage_export" "my_krb_export_krbfs_krbmt" {
40+
#Required
41+
export_set_id = oci_file_storage_export_set.my_krb_export_set.id
42+
file_system_id = oci_file_storage_file_system.my_krb_file_system.id
43+
path = var.export_path_kfs_kmt
44+
45+
#Optional
46+
export_options {
47+
#Required
48+
source = var.export_read_write_access_source
49+
#Optional
50+
access = "READ_WRITE"
51+
allowed_auth = var.krb_export_export_options_allowed_auth
52+
# anonymous_gid = var.export_export_options_anonymous_gid
53+
# anonymous_uid = var.export_export_options_anonymous_uid
54+
# identity_squash = var.export_export_options_identity_squash
55+
is_anonymous_access_allowed = var.krb_export_export_options_is_anonymous_access_allowed
56+
# require_privileged_source_port = var.export_export_options_require_privileged_source_port
57+
}
58+
is_idmap_groups_for_sys_auth = var.krb_export_is_idmap_groups_for_sys_auth
59+
}
60+

‎examples/storage/fss/export_set.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,7 @@ resource "oci_file_storage_export_set" "my_export_set_2" {
2121
max_fs_stat_files = var.max_files
2222
}
2323

24+
resource "oci_file_storage_export_set" "my_krb_export_set" {
25+
# Required
26+
mount_target_id = oci_file_storage_mount_target.my_krb_mount_target.id
27+
}

‎examples/storage/fss/file_system.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,22 @@ resource "oci_file_storage_file_system" "my_file_system_with_fs_snapshot_policy"
4545
# "example-tag-namespace-all.example-tag" = "value"
4646
# }
4747

48+
freeform_tags = {
49+
"Department" = "Accounting"
50+
}
51+
}
52+
53+
resource "oci_file_storage_file_system" "my_krb_file_system" {
54+
#Required
55+
availability_domain = data.oci_identity_availability_domain.ad.name
56+
compartment_id = var.compartment_ocid
57+
58+
#Optional
59+
display_name = var.krb_file_system
60+
# defined_tags = {
61+
# "example-tag-namespace-all.example-tag" = "value"
62+
# }
63+
4864
freeform_tags = {
4965
"Department" = "Accounting"
5066
}

‎examples/storage/fss/mount_target.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,44 @@ resource "oci_file_storage_mount_target" "my_mount_target_2" {
3939
nsg_ids = [oci_core_network_security_group.test_network_security_group.id]
4040
}
4141

42+
resource "oci_file_storage_mount_target" "my_krb_mount_target" {
43+
#Required
44+
availability_domain = data.oci_identity_availability_domain.ad.name
45+
compartment_id = var.compartment_ocid
46+
subnet_id = oci_core_subnet.my_subnet.id
47+
48+
#Optional
49+
# defined_tags = map(oci_identity_tag_namespace.tag-namespace1.name.oci_identity_tag.tag1.name, var.mount_target_defined_tags_value)
50+
display_name = var.krb_mount_target_display_name
51+
# freeform_tags = {
52+
# "Department" = "Accounting"
53+
# }
54+
hostname_label = var.krb_mount_target_hostname_label
55+
idmap_type = "LDAP"
56+
kerberos {
57+
#Required
58+
kerberos_realm = var.krb_mount_target_kerberos_kerberos_realm
59+
60+
#Optional
61+
backup_key_tab_secret_version = var.krb_mount_target_kerberos_backup_key_tab_secret_version
62+
current_key_tab_secret_version = var.krb_mount_target_kerberos_current_key_tab_secret_version
63+
is_kerberos_enabled = var.krb_mount_target_krb_enabled
64+
key_tab_secret_id = oci_vault_secret.krb_keytab_secret.id
65+
}
66+
ldap_idmap {
67+
#Required
68+
group_search_base = var.krb_mount_target_group_name
69+
user_search_base = var.krb_mount_target_user_name
70+
71+
#Optional
72+
cache_lifetime_seconds = var.krb_mount_target_ldap_idmap_cache_lifetime_seconds
73+
cache_refresh_interval_seconds = var.krb_mount_target_ldap_idmap_cache_refresh_interval_seconds
74+
negative_cache_lifetime_seconds = var.krb_mount_target_ldap_idmap_negative_cache_lifetime_seconds
75+
outbound_connector1id = oci_file_storage_outbound_connector.my_ldap_outbound_connector.id
76+
# outbound_connector2id = oci_file_storage_outbound_connector.test_outbound_connector2.id
77+
schema_type = "RFC2307"
78+
}
79+
nsg_ids = [oci_core_network_security_group.test_network_security_group.id]
80+
}
81+
4282
# Use export_set.tf config to update the size for a mount target

‎examples/storage/fss/outbound_connector.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright (c) 2017, 2023, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
resource "oci_file_storage_outbound_connector" "my_ldap_outbound_connector" {
5+
#Required
6+
availability_domain = data.oci_identity_availability_domain.ad.name
7+
bind_distinguished_name = var.ldap_outbound_connector_bind_distinguished_name
8+
compartment_id = var.compartment_ocid
9+
connector_type = "LDAPBIND"
10+
endpoints {
11+
#Required
12+
hostname = var.ldap_outbound_connector_endpoints_hostname
13+
port = var.ldap_outbound_connector_endpoints_port
14+
}
15+
#Optional
16+
#defined_tags = map(oci_identity_tag_namespace.tag-namespace1.name.oci_identity_tag.tag1.name, var.outbound_connector_defined_tags_value)
17+
display_name = var.ldap_outbound_connector_display_name
18+
#freeform_tags = var.outbound_connector_freeform_tags
19+
password_secret_id = oci_vault_secret.krb_ldap_pwd_secret.id
20+
password_secret_version = var.ldap_outbound_connector_password_secret_version
21+
}

‎examples/storage/fss/variables.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,3 +174,116 @@ variable "filesystem_snapshot_policy_schedules_time_zone" {
174174
variable "filesystem_snapshot_policy_state" {
175175
default = "ACTIVE"
176176
}
177+
178+
179+
variable "krb_mount_target_display_name" {
180+
default = "my_krb_mount_target"
181+
}
182+
183+
variable "krb_mount_target_hostname_label" {
184+
default = "hostnamelabel"
185+
}
186+
187+
variable "krb_mount_target_kerberos_kerberos_realm" {
188+
default = "kerberos.realm.com"
189+
}
190+
191+
variable "krb_mount_target_kerberos_backup_key_tab_secret_version" {
192+
default = 0
193+
}
194+
195+
variable "krb_mount_target_kerberos_current_key_tab_secret_version" {
196+
default = 1
197+
}
198+
199+
variable "krb_mount_target_krb_enabled" {
200+
default = "true"
201+
}
202+
203+
variable "krb_mount_target_group_name" {
204+
default = "group_name"
205+
}
206+
207+
variable "krb_mount_target_user_name" {
208+
default = "user_name"
209+
}
210+
211+
variable "krb_mount_target_ldap_idmap_cache_lifetime_seconds" {
212+
default = 300
213+
}
214+
215+
variable "krb_mount_target_ldap_idmap_cache_refresh_interval_seconds" {
216+
default = 300
217+
}
218+
219+
variable "krb_mount_target_ldap_idmap_negative_cache_lifetime_seconds" {
220+
default = 300
221+
}
222+
223+
variable "ldap_outbound_connector_display_name" {
224+
default = "my_ldap_outbound_connector"
225+
}
226+
227+
variable "ldap_outbound_connector_bind_distinguished_name" {
228+
default = "bindDistinguishedName"
229+
}
230+
231+
variable "ldap_outbound_connector_endpoints_hostname" {
232+
default = "hostname"
233+
}
234+
235+
variable "ldap_outbound_connector_endpoints_port" {
236+
default = 1080
237+
}
238+
239+
variable "ldap_outbound_connector_password_secret_version" {
240+
default = 1
241+
}
242+
243+
variable "krb_vault_display_name" {
244+
default = "my_krb_vault"
245+
}
246+
247+
variable "krb_vault_type" {
248+
default = "DEFAULT"
249+
}
250+
251+
variable "krb_key_display_name" {
252+
default = "my_krb_key"
253+
}
254+
255+
variable "krb_key_shape_algorithm" {
256+
default = "AES"
257+
}
258+
259+
variable "krb_key_shape_length" {
260+
default = "16"
261+
}
262+
263+
variable "krb_keytab_content" {
264+
default = "BQIAAAClAAIAI0FEMkNBTkFSWS5QSFhERVZQQ0FOUy5PUkFDTEVWQ04uQ09NAANuZnMARmtlcmJlcm9zLWFwaS1jYW5hcnktbW91bnQtdGFyZ2V0LTEuYWQyY2FuYXJ5LnBoeGRldnBjYW5zLm9yYWNsZXZjbi5jb20AAAABYgMUPgIAEgAgIvKmyzN+v/xsEQpwSzwxfFCEwtbV5ozYkk8VAmx9NhQAAAAC"
265+
}
266+
267+
variable "krb_ldap_pwd_content" {
268+
default = "dGVzdHB3ZAo="
269+
}
270+
271+
variable "export_path_kfs_kmt" {
272+
default = "/myfsspaths/kfs/path1"
273+
}
274+
275+
variable "krb_file_system" {
276+
default = "my_krb_file_system"
277+
}
278+
279+
variable "krb_export_export_options_allowed_auth" {
280+
default = ["KRB5"]
281+
}
282+
283+
variable "krb_export_export_options_is_anonymous_access_allowed" {
284+
default = "true"
285+
}
286+
287+
variable "krb_export_is_idmap_groups_for_sys_auth" {
288+
default = "false"
289+
}

‎examples/storage/fss/vault_secret.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Copyright (c) 2017, 2023, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
resource "oci_kms_vault" "krb_test_vault" {
5+
compartment_id = var.compartment_ocid
6+
display_name = var.krb_vault_display_name
7+
vault_type = var.krb_vault_type
8+
}
9+
10+
resource "oci_kms_key" "krb_test_key" {
11+
#Required
12+
compartment_id = var.compartment_ocid
13+
display_name = var.krb_key_display_name
14+
management_endpoint = oci_kms_vault.krb_test_vault.management_endpoint
15+
key_shape {
16+
#Required
17+
algorithm = var.krb_key_shape_algorithm
18+
length = var.krb_key_shape_length
19+
}
20+
}
21+
22+
resource "random_string" "random_keytab_name" {
23+
length = 10
24+
special = false
25+
upper = false
26+
keepers = {
27+
kms_key_id = oci_kms_key.krb_test_key.id
28+
}
29+
}
30+
31+
resource "random_string" "random_ldap_pwd_name" {
32+
length = 10
33+
special = false
34+
upper = false
35+
keepers = {
36+
kms_key_id = oci_kms_key.krb_test_key.id
37+
}
38+
}
39+
40+
resource "oci_vault_secret" "krb_keytab_secret" {
41+
#Required
42+
compartment_id = var.compartment_ocid
43+
secret_content {
44+
#Required
45+
content_type = "BASE64"
46+
#Optional
47+
content = var.krb_keytab_content
48+
stage = "CURRENT"
49+
}
50+
key_id = oci_kms_key.krb_test_key.id
51+
secret_name = "my_keytab_${random_string.random_keytab_name.result}"
52+
vault_id = oci_kms_vault.krb_test_vault.id
53+
}
54+
55+
resource "oci_vault_secret" "krb_ldap_pwd_secret" {
56+
#Required
57+
compartment_id = var.compartment_ocid
58+
secret_content {
59+
#Required
60+
content_type = "BASE64"
61+
#Optional
62+
content = var.krb_ldap_pwd_content
63+
stage = "CURRENT"
64+
}
65+
key_id = oci_kms_key.krb_test_key.id
66+
secret_name = "my_ldap_pwd_${random_string.random_ldap_pwd_name.result}"
67+
vault_id = oci_kms_vault.krb_test_vault.id
68+
}

‎internal/integrationtest/file_storage_export_test.go‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,17 +42,20 @@ var (
4242
}
4343

4444
FileStorageExportRepresentation = map[string]interface{}{
45-
"export_set_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_file_storage_export_set.test_export_set.id}`},
46-
"file_system_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_file_storage_file_system.test_file_system.id}`},
47-
"path": acctest.Representation{RepType: acctest.Required, Create: `/files-5`},
48-
"export_options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: FileStorageExportExportOptionsRepresentation},
45+
"export_set_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_file_storage_export_set.test_export_set.id}`},
46+
"file_system_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_file_storage_file_system.test_file_system.id}`},
47+
"path": acctest.Representation{RepType: acctest.Required, Create: `/files-5`},
48+
"export_options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: FileStorageExportExportOptionsRepresentation},
49+
"is_idmap_groups_for_sys_auth": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `true`},
4950
}
5051
FileStorageExportExportOptionsRepresentation = map[string]interface{}{
5152
"source": acctest.Representation{RepType: acctest.Required, Create: `0.0.0.0/0`},
5253
"access": acctest.Representation{RepType: acctest.Optional, Create: `READ_WRITE`, Update: `READ_ONLY`},
54+
"allowed_auth": acctest.Representation{RepType: acctest.Optional, Create: []string{`SYS`}, Update: []string{`KRB5`}},
5355
"anonymous_gid": acctest.Representation{RepType: acctest.Optional, Create: `10`, Update: `11`},
5456
"anonymous_uid": acctest.Representation{RepType: acctest.Optional, Create: `10`, Update: `11`},
5557
"identity_squash": acctest.Representation{RepType: acctest.Optional, Create: `NONE`, Update: `ALL`},
58+
"is_anonymous_access_allowed": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `true`},
5659
"require_privileged_source_port": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `true`},
5760
}
5861

@@ -110,14 +113,18 @@ func TestFileStorageExportResource_basic(t *testing.T) {
110113
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
111114
resource.TestCheckResourceAttr(resourceName, "export_options.#", "1"),
112115
resource.TestCheckResourceAttr(resourceName, "export_options.0.access", "READ_WRITE"),
116+
resource.TestCheckResourceAttr(resourceName, "export_options.0.allowed_auth.#", "1"),
117+
resource.TestCheckResourceAttr(resourceName, "export_options.0.allowed_auth.0", "SYS"),
113118
resource.TestCheckResourceAttr(resourceName, "export_options.0.anonymous_gid", "10"),
114119
resource.TestCheckResourceAttr(resourceName, "export_options.0.anonymous_uid", "10"),
115120
resource.TestCheckResourceAttr(resourceName, "export_options.0.identity_squash", "NONE"),
121+
resource.TestCheckResourceAttr(resourceName, "export_options.0.is_anonymous_access_allowed", "false"),
116122
resource.TestCheckResourceAttr(resourceName, "export_options.0.require_privileged_source_port", "false"),
117123
resource.TestCheckResourceAttr(resourceName, "export_options.0.source", "0.0.0.0/0"),
118124
resource.TestCheckResourceAttrSet(resourceName, "export_set_id"),
119125
resource.TestCheckResourceAttrSet(resourceName, "file_system_id"),
120126
resource.TestCheckResourceAttrSet(resourceName, "id"),
127+
resource.TestCheckResourceAttr(resourceName, "is_idmap_groups_for_sys_auth", "false"),
121128
resource.TestCheckResourceAttr(resourceName, "path", "/files-5"),
122129
resource.TestCheckResourceAttrSet(resourceName, "state"),
123130
resource.TestCheckResourceAttrSet(resourceName, "time_created"),
@@ -141,14 +148,18 @@ func TestFileStorageExportResource_basic(t *testing.T) {
141148
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
142149
resource.TestCheckResourceAttr(resourceName, "export_options.#", "1"),
143150
resource.TestCheckResourceAttr(resourceName, "export_options.0.access", "READ_ONLY"),
151+
resource.TestCheckResourceAttr(resourceName, "export_options.0.allowed_auth.#", "1"),
152+
resource.TestCheckResourceAttr(resourceName, "export_options.0.allowed_auth.0", "KRB5"),
144153
resource.TestCheckResourceAttr(resourceName, "export_options.0.anonymous_gid", "11"),
145154
resource.TestCheckResourceAttr(resourceName, "export_options.0.anonymous_uid", "11"),
146155
resource.TestCheckResourceAttr(resourceName, "export_options.0.identity_squash", "ALL"),
156+
resource.TestCheckResourceAttr(resourceName, "export_options.0.is_anonymous_access_allowed", "true"),
147157
resource.TestCheckResourceAttr(resourceName, "export_options.0.require_privileged_source_port", "true"),
148158
resource.TestCheckResourceAttr(resourceName, "export_options.0.source", "0.0.0.0/0"),
149159
resource.TestCheckResourceAttrSet(resourceName, "export_set_id"),
150160
resource.TestCheckResourceAttrSet(resourceName, "file_system_id"),
151161
resource.TestCheckResourceAttrSet(resourceName, "id"),
162+
resource.TestCheckResourceAttr(resourceName, "is_idmap_groups_for_sys_auth", "true"),
152163
resource.TestCheckResourceAttr(resourceName, "path", "/files-5"),
153164
resource.TestCheckResourceAttrSet(resourceName, "state"),
154165
resource.TestCheckResourceAttrSet(resourceName, "time_created"),
@@ -175,6 +186,7 @@ func TestFileStorageExportResource_basic(t *testing.T) {
175186
resource.TestCheckResourceAttrSet(datasourceName, "exports.0.export_set_id"),
176187
resource.TestCheckResourceAttrSet(datasourceName, "exports.0.file_system_id"),
177188
resource.TestCheckResourceAttrSet(datasourceName, "exports.0.id"),
189+
resource.TestCheckResourceAttr(datasourceName, "exports.0.is_idmap_groups_for_sys_auth", "true"),
178190
resource.TestCheckResourceAttr(datasourceName, "exports.0.path", "/files-5"),
179191
resource.TestCheckResourceAttr(datasourceName, "exports.0.state", "ACTIVE"),
180192
resource.TestCheckResourceAttrSet(datasourceName, "exports.0.time_created"),

0 commit comments

Comments
 (0)