Skip to content

Commit 733e79f

Browse files
August ReinigjiaqchenO
August Reinig
authored and
jiaqchenO
committed
Added - Load Balancer and Waf support for Request Ids (WAF Incident ID support)
1 parent c7d142b commit 733e79f

12 files changed

+279
-44
lines changed

‎examples/load_balancer/lb_full/lb_full.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ variable "availability_domain" {
6565
}
6666

6767
provider "oci" {
68-
#version = "5.29.0"
68+
#version = "6.0.0"
6969
tenancy_ocid = var.tenancy_ocid
7070
user_ocid = var.user_ocid
7171
fingerprint = var.fingerprint
@@ -271,6 +271,8 @@ resource "oci_load_balancer" "lb1" {
271271
}
272272

273273
is_delete_protection_enabled = "false"
274+
is_request_id_enabled = "true"
275+
request_id_header = "X-MyRequest-Id"
274276
}
275277

276278
resource "oci_load_balancer" "lb2" {
@@ -374,7 +376,7 @@ resource "oci_load_balancer_backend_set" "lb-bes3" {
374376
ssl_configuration {
375377
protocols = ["TLSv1.1", "TLSv1.2"]
376378
cipher_suite_name = oci_load_balancer_ssl_cipher_suite.test_ssl_cipher_suite3.name
377-
trusted_certificate_authority_ids = var.trusted_certificate_authority_ids
379+
trusted_certificate_authority_ids = jsondecode(var.trusted_certificate_authority_ids)
378380

379381
}
380382
}
@@ -487,8 +489,8 @@ resource "oci_load_balancer_listener" "lb-listener4" {
487489
protocol = "HTTP"
488490

489491
ssl_configuration {
490-
certificate_ids = var.certificate_ids
491-
trusted_certificate_authority_ids = var.trusted_certificate_authority_ids
492+
certificate_ids = jsondecode(var.certificate_ids)
493+
trusted_certificate_authority_ids = jsondecode(var.trusted_certificate_authority_ids)
492494
verify_peer_certificate = false
493495
protocols = ["TLSv1.1", "TLSv1.2"]
494496
server_order_preference = "ENABLED"

‎examples/web_app_firewall/waf_full.tf‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,32 @@ resource "oci_waf_web_app_firewall_policy" "test_waf_web_app_firewall_policy" {
7878
}
7979
}
8080

81+
actions {
82+
#Required
83+
name = "dynamicReturn401Response"
84+
type = "RETURN_HTTP_RESPONSE"
85+
code = 401
86+
body {
87+
#Required
88+
type = "DYNAMIC"
89+
# need $${ so that terraform doesn't try to replace ${http.request.id}
90+
template = "{\n\"code\": 401,\n\"message\":\"Unauthorised: requestId: $${http.request.id}}"
91+
}
92+
93+
#Optional
94+
headers {
95+
#Required
96+
name = "Header1"
97+
value = "Value1"
98+
}
99+
100+
headers {
101+
#Required
102+
name = "Header2"
103+
value = "Value2"
104+
}
105+
}
106+
81107
request_access_control {
82108
#Required
83109
default_action_name = "defaultAction"
@@ -265,4 +291,4 @@ resource "oci_load_balancer" "lb" {
265291
display_name = "lb1"
266292
is_private = true
267293
network_security_group_ids = [oci_core_network_security_group.test_network_security_group.id]
268-
}
294+
}

‎internal/integrationtest/load_balancer_backend_set_resource_test.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,16 @@ func (s *ResourceLoadBalancerBackendSetTestSuite) SetupTest() {
6161
6262
resource "oci_load_balancer_certificate" "t" {
6363
load_balancer_id = "${oci_load_balancer.t.id}"
64-
ca_certificate = "${var.ca_certificate_value}"
64+
ca_certificate = <<-EOT
65+
${var.ca_certificate_value}
66+
EOT
6567
certificate_name = "tf_cert_name"
66-
private_key = "${var.private_key_value}"
67-
public_certificate = "${var.ca_certificate_value}"
68+
private_key = <<-EOT
69+
${var.private_key_value}
70+
EOT
71+
public_certificate = <<-EOT
72+
${var.ca_certificate_value}
73+
EOT
6874
}`
6975
s.ResourceName = "oci_load_balancer_backendset.t"
7076
s.BackendResourceName = "oci_load_balancer_backend.t"

‎internal/integrationtest/load_balancer_certificate_test.go‎

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,18 +38,31 @@ var (
3838
}
3939

4040
certificateRepresentation = map[string]interface{}{
41-
"certificate_name": acctest.Representation{RepType: acctest.Required, Create: `example_certificate_bundle`},
42-
"load_balancer_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_load_balancer_load_balancer.test_load_balancer.id}`},
43-
"ca_certificate": acctest.Representation{RepType: acctest.Optional, Create: caCertificate},
44-
"passphrase": acctest.Representation{RepType: acctest.Optional, Create: `Mysecretunlockingcode42!1!`},
45-
"private_key": acctest.Representation{RepType: acctest.Optional, Create: `${var.private_key_value}`},
46-
"public_certificate": acctest.Representation{RepType: acctest.Optional, Create: `${var.ca_certificate_value}`},
41+
"certificate_name": acctest.Representation{RepType: acctest.Required, Create: `example_certificate_bundle`},
42+
"load_balancer_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_load_balancer_load_balancer.test_load_balancer.id}`},
43+
"ca_certificate": acctest.Representation{RepType: acctest.Optional, Create: caCertificate},
44+
// We don't test with private keys but if we were to do so we would have to set this.
45+
// "passphrase": acctest.Representation{RepType: acctest.Optional, Create: `Mysecretunlockingcode42!1!`},
46+
"private_key": acctest.Representation{RepType: acctest.Optional, Create: privateKeyData},
47+
"public_certificate": acctest.Representation{RepType: acctest.Optional, Create: caCertificate},
4748
}
4849

49-
caCertificate = strings.ReplaceAll(utils.GetEnvSettingWithBlankDefault("ca_certificate"), `\\n`, `\n`)
50+
// The following assumes you set the TF_VAR_ca_certificate variable to something like the following:
51+
// export TF_VAR_private_key_value="$(cat ~/certificate/example_2.com.key)"
52+
// which results in
53+
// $ printenv TF_VAR_ca_certificate
54+
// -----BEGIN CERTIFICATE-----
55+
// MIIFRDCCAyygAwIBAgIUDB9s8795KLpchjLPGFI9sqdVaT4wDQYJKoZIhvcNAQEL
56+
// ...
57+
// eaiXT7X2gvU=
58+
// -----END CERTIFICATE-----
59+
// We want the string
60+
// "-----BEGIN CERTIFICATE-----\\nMIIFRDCC...\\neaiXT7X2gvU=\\n-----END CERTIFICATE-----"
61+
caCertificate = strings.ReplaceAll(utils.GetEnvSettingWithBlankDefault("ca_certificate"), "\n", "\\n")
5062
caCertificateVariableStr = fmt.Sprintf("variable \"ca_certificate_value\" { default = \"%s\" }\n", caCertificate)
51-
privateKeyData = utils.GetEnvSettingWithBlankDefault("private_key_data")
52-
privateKeyVariableStr = fmt.Sprintf("variable \"private_key_value\" { default = \"%s\" }\n", privateKeyData)
63+
64+
privateKeyData = strings.ReplaceAll(utils.GetEnvSettingWithBlankDefault("private_key_data"), "\n", "\\n")
65+
privateKeyVariableStr = fmt.Sprintf("variable \"private_key_value\" { default = \"%s\" }\n", privateKeyData)
5366

5467
CertificateResourceDependencies = acctest.GenerateResourceFromRepresentationMap("oci_load_balancer_load_balancer", "test_load_balancer", acctest.Required, acctest.Create, loadBalancerRepresentation) +
5568
LoadBalancerSubnetDependencies + privateKeyVariableStr + caCertificateVariableStr
@@ -96,8 +109,10 @@ func TestLoadBalancerCertificateResource_basic(t *testing.T) {
96109
resource.TestMatchResourceAttr(resourceName, "ca_certificate", regexp.MustCompile("-----BEGIN CERT.*")),
97110
resource.TestCheckResourceAttr(resourceName, "certificate_name", "example_certificate_bundle"),
98111
resource.TestCheckResourceAttrSet(resourceName, "load_balancer_id"),
99-
resource.TestCheckResourceAttr(resourceName, "passphrase", "Mysecretunlockingcode42!1!"),
100-
resource.TestMatchResourceAttr(resourceName, "private_key", regexp.MustCompile("-----BEGIN ENCRYPTED PRIVATE KEY.*")),
112+
// We don't test with private keys but if we were to do so we would have to set
113+
// resource.TestCheckResourceAttr(resourceName, "passphrase", "Mysecretunlockingcode42!1!"),
114+
// resource.TestMatchResourceAttr(resourceName, "private_key", regexp.MustCompile("-----BEGIN PRIVATE ENCRYPTED KEY.*")),
115+
resource.TestMatchResourceAttr(resourceName, "private_key", regexp.MustCompile("-----BEGIN PRIVATE KEY.*")),
101116
resource.TestMatchResourceAttr(resourceName, "public_certificate", regexp.MustCompile("-----BEGIN CERT.*")),
102117

103118
func(s *terraform.State) (err error) {

‎internal/integrationtest/load_balancer_load_balancer_test.go‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ var (
5454

5555
"freeform_tags": acctest.Representation{RepType: acctest.Optional, Create: map[string]string{"Department": "Finance"}, Update: map[string]string{"Department": "Accounting"}},
5656
"is_private": acctest.Representation{RepType: acctest.Optional, Create: `false`},
57+
"is_request_id_enabled": acctest.Representation{RepType: acctest.Optional, Create: `true`, Update: `true`},
58+
"request_id_header": acctest.Representation{RepType: acctest.Optional, Create: ``, Update: `X-MyRequestB-Id`},
5759
"is_delete_protection_enabled": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `true`},
5860
"reserved_ips": acctest.RepresentationGroup{RepType: acctest.Optional, Group: loadBalancerReservedIpsRepresentation},
5961
"network_security_group_ids": acctest.Representation{RepType: acctest.Optional, Create: []string{`${oci_core_network_security_group.test_network_security_group1.id}`}, Update: []string{}},
@@ -193,12 +195,13 @@ func TestLoadBalancerLoadBalancerResource_basic(t *testing.T) {
193195
acctest.GenerateResourceFromRepresentationMap("oci_load_balancer_load_balancer", "test_load_balancer", acctest.Optional, acctest.Create, loadBalancerRepresentation),
194196
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
195197
resource.TestCheckResourceAttr(resourceName, "compartment_id", compartmentId),
196-
//Commenting this out as we are ignoring the changes to the tags in the resource representation.
197198
resource.TestCheckResourceAttr(resourceName, "display_name", "example_load_balancer"),
198199
resource.TestCheckResourceAttr(resourceName, "freeform_tags.%", "1"),
199200
resource.TestCheckResourceAttrSet(resourceName, "id"),
200201
resource.TestCheckResourceAttr(resourceName, "is_delete_protection_enabled", "false"),
201202
resource.TestCheckResourceAttr(resourceName, "is_private", "false"),
203+
resource.TestCheckResourceAttr(resourceName, "is_request_id_enabled", "true"),
204+
resource.TestCheckResourceAttr(resourceName, "request_id_header", "X-Request-Id"),
202205
resource.TestCheckResourceAttr(resourceName, "reserved_ips.#", "1"),
203206
resource.TestCheckResourceAttrSet(resourceName, "reserved_ips.0.id"),
204207
resource.TestCheckResourceAttr(resourceName, "network_security_group_ids.#", "1"),
@@ -228,12 +231,13 @@ func TestLoadBalancerLoadBalancerResource_basic(t *testing.T) {
228231
})),
229232
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
230233
resource.TestCheckResourceAttr(resourceName, "compartment_id", compartmentIdU),
231-
//Commenting this out as we are ignoring the changes to the tags in the resource representation.
232234
resource.TestCheckResourceAttr(resourceName, "display_name", "example_load_balancer"),
233235
resource.TestCheckResourceAttr(resourceName, "freeform_tags.%", "1"),
234236
resource.TestCheckResourceAttrSet(resourceName, "id"),
235237
resource.TestCheckResourceAttr(resourceName, "is_delete_protection_enabled", "false"),
236238
resource.TestCheckResourceAttr(resourceName, "is_private", "false"),
239+
resource.TestCheckResourceAttr(resourceName, "is_request_id_enabled", "true"),
240+
resource.TestCheckResourceAttr(resourceName, "request_id_header", "X-Request-Id"),
237241
resource.TestCheckResourceAttr(resourceName, "reserved_ips.#", "1"),
238242
resource.TestCheckResourceAttrSet(resourceName, "reserved_ips.0.id"),
239243
resource.TestCheckResourceAttr(resourceName, "shape", "100Mbps"),
@@ -257,12 +261,13 @@ func TestLoadBalancerLoadBalancerResource_basic(t *testing.T) {
257261
acctest.GenerateResourceFromRepresentationMap("oci_load_balancer_load_balancer", "test_load_balancer", acctest.Optional, acctest.Update, loadBalancerRepresentation),
258262
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
259263
resource.TestCheckResourceAttr(resourceName, "compartment_id", compartmentId),
260-
//Commenting this out as we are ignoring the changes to the tags in the resource representation.
261264
resource.TestCheckResourceAttr(resourceName, "display_name", "displayName2"),
262265
resource.TestCheckResourceAttr(resourceName, "freeform_tags.%", "1"),
263266
resource.TestCheckResourceAttrSet(resourceName, "id"),
264267
resource.TestCheckResourceAttr(resourceName, "is_delete_protection_enabled", "true"),
265268
resource.TestCheckResourceAttr(resourceName, "is_private", "false"),
269+
resource.TestCheckResourceAttr(resourceName, "is_request_id_enabled", "true"),
270+
resource.TestCheckResourceAttr(resourceName, "request_id_header", "X-MyRequestB-Id"),
266271
resource.TestCheckResourceAttr(resourceName, "reserved_ips.#", "1"),
267272
resource.TestCheckResourceAttr(resourceName, "shape", "400Mbps"),
268273
resource.TestCheckResourceAttrSet(resourceName, "reserved_ips.0.id"),
@@ -294,14 +299,15 @@ func TestLoadBalancerLoadBalancerResource_basic(t *testing.T) {
294299

295300
resource.TestCheckResourceAttr(datasourceName, "load_balancers.#", "1"),
296301
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.compartment_id", compartmentId),
297-
//Commenting this out as we are ignoring the changes to the tags in the resource representation.
298302
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.display_name", "displayName2"),
299303
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.freeform_tags.%", "1"),
300304
resource.TestCheckResourceAttrSet(datasourceName, "load_balancers.0.id"),
301305
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.ip_address_details.#", "1"),
302306
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.is_delete_protection_enabled", "true"),
303307
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.is_private", "false"),
304308
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.network_security_group_ids.#", "0"),
309+
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.is_request_id_enabled", "true"),
310+
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.request_id_header", "X-MyRequestB-Id"),
305311
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.shape", "400Mbps"),
306312
resource.TestCheckResourceAttrSet(datasourceName, "load_balancers.0.state"),
307313
resource.TestCheckResourceAttr(datasourceName, "load_balancers.0.subnet_ids.#", "2"),

0 commit comments

Comments
 (0)