Skip to content

Commit adf01d6

Browse files
XinruXiao-9ravinitp
XinruXiao-9
authored and
ravinitp
committed
Bug Fix - OKE terraform provider bug fix: add data source for oidc discovery endpoint, fix update issue for oidc auth and update docs
1 parent 0f9b3e0 commit adf01d6

File tree

9 files changed

+93
-90
lines changed

9 files changed

+93
-90
lines changed

‎examples/container_engine/oidc_authn_token_config/main.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,6 @@ variable "cluster_options_open_id_connect_token_authentication_config_groups_cla
8787
default = "groupsClaim"
8888
}
8989

90-
variable "cluster_options_open_id_connect_token_authentication_config_configuration_file" {
91-
default = ""
92-
}
93-
9490
variable "cluster_options_open_id_connect_token_authentication_config_groups_prefix" {
9591
default = "groupsPrefix"
9692
}
@@ -260,8 +256,6 @@ resource "oci_containerengine_cluster" "test_cluster" {
260256
ca_certificate = var.cluster_options_open_id_connect_token_authentication_config_ca_certificate
261257
groups_claim = var.cluster_options_open_id_connect_token_authentication_config_groups_claim
262258
groups_prefix = var.cluster_options_open_id_connect_token_authentication_config_groups_prefix
263-
#Optional
264-
configuration_file = var.cluster_options_open_id_connect_token_authentication_config_configuration_file
265259
required_claims {
266260

267261
#Optional

‎examples/container_engine/oidc_discovery/main.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,4 +226,13 @@ data "oci_containerengine_clusters" "test_clusters" {
226226
#Optional
227227
name = var.cluster_name
228228
state = var.cluster_state
229+
}
230+
231+
data "oci_containerengine_cluster" "test_cluster" {
232+
#Required
233+
cluster_id = oci_containerengine_cluster.test_cluster.id
234+
}
235+
236+
output "oidc_discovery_endpoint" {
237+
value = data.oci_containerengine_cluster.test_cluster.open_id_connect_discovery_endpoint
229238
}

‎internal/integrationtest/containerengine_cluster_test.go‎

Lines changed: 24 additions & 26 deletions
Large diffs are not rendered by default.

‎internal/service/containerengine/containerengine_cluster_data_source.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,10 @@ func (s *ContainerengineClusterDataSourceCrud) SetData() error {
124124
s.D.Set("name", *s.Res.Name)
125125
}
126126

127+
if s.Res.OpenIdConnectDiscoveryEndpoint != nil {
128+
s.D.Set("open_id_connect_discovery_endpoint", *s.Res.OpenIdConnectDiscoveryEndpoint)
129+
}
130+
127131
if s.Res.Options != nil {
128132
s.D.Set("options", []interface{}{ClusterCreateOptionsToMap(s.Res.Options)})
129133
} else {

‎internal/service/containerengine/containerengine_cluster_resource.go‎

Lines changed: 44 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -284,39 +284,39 @@ func ContainerengineClusterResource() *schema.Resource {
284284

285285
// Optional
286286
"ca_certificate": {
287-
Type: schema.TypeString,
288-
Optional: true,
289-
Computed: true,
287+
Type: schema.TypeString,
288+
Optional: true,
289+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
290290
},
291291
"client_id": {
292-
Type: schema.TypeString,
293-
Optional: true,
294-
Computed: true,
292+
Type: schema.TypeString,
293+
Optional: true,
294+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
295295
},
296296
"configuration_file": {
297-
Type: schema.TypeString,
298-
Optional: true,
299-
Computed: true,
297+
Type: schema.TypeString,
298+
Optional: true,
299+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.ca_certificate", "options.0.open_id_connect_token_authentication_config.0.client_id", "options.0.open_id_connect_token_authentication_config.0.groups_claim", "options.0.open_id_connect_token_authentication_config.0.groups_prefix", "options.0.open_id_connect_token_authentication_config.0.issuer_url", "options.0.open_id_connect_token_authentication_config.0.required_claims", "options.0.open_id_connect_token_authentication_config.0.signing_algorithms", "options.0.open_id_connect_token_authentication_config.0.username_claim", "options.0.open_id_connect_token_authentication_config.0.username_prefix"},
300300
},
301301
"groups_claim": {
302-
Type: schema.TypeString,
303-
Optional: true,
304-
Computed: true,
302+
Type: schema.TypeString,
303+
Optional: true,
304+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
305305
},
306306
"groups_prefix": {
307-
Type: schema.TypeString,
308-
Optional: true,
309-
Computed: true,
307+
Type: schema.TypeString,
308+
Optional: true,
309+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
310310
},
311311
"issuer_url": {
312-
Type: schema.TypeString,
313-
Optional: true,
314-
Computed: true,
312+
Type: schema.TypeString,
313+
Optional: true,
314+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
315315
},
316316
"required_claims": {
317-
Type: schema.TypeList,
318-
Optional: true,
319-
Computed: true,
317+
Type: schema.TypeList,
318+
Optional: true,
319+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
320320
Elem: &schema.Resource{
321321
Schema: map[string]*schema.Schema{
322322
// Required
@@ -325,35 +325,33 @@ func ContainerengineClusterResource() *schema.Resource {
325325
"key": {
326326
Type: schema.TypeString,
327327
Optional: true,
328-
Computed: true,
329328
},
330329
"value": {
331330
Type: schema.TypeString,
332331
Optional: true,
333-
Computed: true,
334332
},
335333

336334
// Computed
337335
},
338336
},
339337
},
340338
"signing_algorithms": {
341-
Type: schema.TypeList,
342-
Optional: true,
343-
Computed: true,
339+
Type: schema.TypeList,
340+
Optional: true,
341+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
344342
Elem: &schema.Schema{
345343
Type: schema.TypeString,
346344
},
347345
},
348346
"username_claim": {
349-
Type: schema.TypeString,
350-
Optional: true,
351-
Computed: true,
347+
Type: schema.TypeString,
348+
Optional: true,
349+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
352350
},
353351
"username_prefix": {
354-
Type: schema.TypeString,
355-
Optional: true,
356-
Computed: true,
352+
Type: schema.TypeString,
353+
Optional: true,
354+
ConflictsWith: []string{"options.0.open_id_connect_token_authentication_config.0.configuration_file"},
357355
},
358356

359357
// Computed
@@ -575,8 +573,7 @@ func ContainerengineClusterResource() *schema.Resource {
575573
}
576574
return false
577575
}),
578-
),
579-
}
576+
)}
580577
}
581578

582579
func createContainerengineCluster(d *schema.ResourceData, m interface{}) error {
@@ -755,6 +752,7 @@ func (s *ContainerengineClusterResourceCrud) Create() error {
755752

756753
requestGet := oci_containerengine.GetClusterRequest{}
757754
requestGet.ClusterId = clusterIDForGet
755+
758756
requestGet.RequestMetadata.RetryPolicy = tfresource.GetRetryPolicy(s.DisableNotFoundRetries, "containerengine")
759757
responseGet, getClusterErr := s.Client.GetCluster(context.Background(), requestGet)
760758
if getClusterErr != nil {
@@ -904,6 +902,7 @@ func clusterWaitForWorkRequest(wId *string, entityType string, action oci_contai
904902
},
905903
Timeout: timeout,
906904
}
905+
907906
// Set PollInterval to 1 for replay mode.
908907
if httpreplay.ShouldRetryImmediately() {
909908
stateConf.PollInterval = 1
@@ -1018,7 +1017,7 @@ func (s *ContainerengineClusterResourceCrud) Update() error {
10181017
}
10191018
}
10201019

1021-
if kubernetesVersion, ok := s.D.GetOkExists("kubernetes_version"); ok {
1020+
if kubernetesVersion, ok := s.D.GetOkExists("kubernetes_version"); ok && s.D.HasChange("kubernetes_version") {
10221021
tmp := kubernetesVersion.(string)
10231022
request.KubernetesVersion = &tmp
10241023
}
@@ -1842,27 +1841,27 @@ func KubernetesNetworkConfigToMap(obj *oci_containerengine.KubernetesNetworkConf
18421841
func (s *ContainerengineClusterResourceCrud) mapToOpenIdConnectTokenAuthenticationConfig(fieldKeyFormat string) (oci_containerengine.OpenIdConnectTokenAuthenticationConfig, error) {
18431842
result := oci_containerengine.OpenIdConnectTokenAuthenticationConfig{}
18441843

1845-
if caCertificate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "ca_certificate")); ok {
1844+
if caCertificate, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "ca_certificate")); ok {
18461845
tmp := caCertificate.(string)
18471846
result.CaCertificate = &tmp
18481847
}
18491848

1850-
if clientId, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "client_id")); ok {
1849+
if clientId, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "client_id")); ok {
18511850
tmp := clientId.(string)
18521851
result.ClientId = &tmp
18531852
}
18541853

1855-
if configurationFile, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "configuration_file")); ok {
1854+
if configurationFile, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "configuration_file")); ok {
18561855
tmp := configurationFile.(string)
18571856
result.ConfigurationFile = &tmp
18581857
}
18591858

1860-
if groupsClaim, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "groups_claim")); ok {
1859+
if groupsClaim, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "groups_claim")); ok {
18611860
tmp := groupsClaim.(string)
18621861
result.GroupsClaim = &tmp
18631862
}
18641863

1865-
if groupsPrefix, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "groups_prefix")); ok {
1864+
if groupsPrefix, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "groups_prefix")); ok {
18661865
tmp := groupsPrefix.(string)
18671866
result.GroupsPrefix = &tmp
18681867
}
@@ -1872,12 +1871,12 @@ func (s *ContainerengineClusterResourceCrud) mapToOpenIdConnectTokenAuthenticati
18721871
result.IsOpenIdConnectAuthEnabled = &tmp
18731872
}
18741873

1875-
if issuerUrl, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "issuer_url")); ok {
1874+
if issuerUrl, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "issuer_url")); ok {
18761875
tmp := issuerUrl.(string)
18771876
result.IssuerUrl = &tmp
18781877
}
18791878

1880-
if requiredClaims, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "required_claims")); ok {
1879+
if requiredClaims, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "required_claims")); ok {
18811880
interfaces := requiredClaims.([]interface{})
18821881
tmp := make([]oci_containerengine.KeyValue, len(interfaces))
18831882
for i := range interfaces {
@@ -1894,7 +1893,7 @@ func (s *ContainerengineClusterResourceCrud) mapToOpenIdConnectTokenAuthenticati
18941893
}
18951894
}
18961895

1897-
if signingAlgorithms, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "signing_algorithms")); ok {
1896+
if signingAlgorithms, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "signing_algorithms")); ok {
18981897
interfaces := signingAlgorithms.([]interface{})
18991898
tmp := make([]string, len(interfaces))
19001899
for i := range interfaces {
@@ -1907,12 +1906,12 @@ func (s *ContainerengineClusterResourceCrud) mapToOpenIdConnectTokenAuthenticati
19071906
}
19081907
}
19091908

1910-
if usernameClaim, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "username_claim")); ok {
1909+
if usernameClaim, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "username_claim")); ok {
19111910
tmp := usernameClaim.(string)
19121911
result.UsernameClaim = &tmp
19131912
}
19141913

1915-
if usernamePrefix, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "username_prefix")); ok {
1914+
if usernamePrefix, ok := s.D.GetOk(fmt.Sprintf(fieldKeyFormat, "username_prefix")); ok {
19161915
tmp := usernamePrefix.(string)
19171916
result.UsernamePrefix = &tmp
19181917
}

‎website/docs/d/containerengine_cluster.html.markdown‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ The following attributes are exported:
7474
* `is_tiller_enabled` - Whether or not to enable the Tiller add-on.
7575
* `admission_controller_options` - Configurable cluster admission controllers
7676
* `is_pod_security_policy_enabled` - Whether or not to enable the Pod Security Policy admission controller.
77-
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack
77+
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack. Available values are [] (defaults to IPv4), [IPv4] (IPv4), [IPv4, IPv6] (IPv4 preferred dual stack).
7878
* `kubernetes_network_config` - Network configuration for Kubernetes.
79-
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional, defaults to 10.244.0.0/16.
80-
* `services_cidr` - The CIDR block for Kubernetes services. Optional, defaults to 10.96.0.0/16.
79+
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional. For ipv4, defaults to 10.244.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0000::/96.
80+
* `services_cidr` - The CIDR block for Kubernetes services. Optional. For ipv4, defaults to 10.96.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0001::/108.
8181
* `open_id_connect_discovery` - The property that define the status of the OIDC Discovery feature for a cluster.
8282
* `is_open_id_connect_discovery_enabled` - Whether the cluster has OIDC Discovery enabled. Defaults to false. If set to true, the cluster will be assigned a public OIDC Discovery endpoint.
8383
* `open_id_connect_token_authentication_config` - The properties that configure OIDC token authentication in kube-apiserver. For more information, see [Configuring the API Server](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-flags).

‎website/docs/d/containerengine_clusters.html.markdown‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,10 @@ The following attributes are exported:
8787
* `is_tiller_enabled` - Whether or not to enable the Tiller add-on.
8888
* `admission_controller_options` - Configurable cluster admission controllers
8989
* `is_pod_security_policy_enabled` - Whether or not to enable the Pod Security Policy admission controller.
90-
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack
90+
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack. Available values are [] (defaults to IPv4), [IPv4] (IPv4), [IPv4, IPv6] (IPv4 preferred dual stack).
9191
* `kubernetes_network_config` - Network configuration for Kubernetes.
92-
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional, defaults to 10.244.0.0/16.
93-
* `services_cidr` - The CIDR block for Kubernetes services. Optional, defaults to 10.96.0.0/16.
92+
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional. For ipv4, defaults to 10.244.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0000::/96.
93+
* `services_cidr` - The CIDR block for Kubernetes services. Optional. For ipv4, defaults to 10.96.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0001::/108.
9494
* `open_id_connect_token_authentication_config` - The properties that configure OIDC token authentication in kube-apiserver. For more information, see [Configuring the API Server](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-flags).
9595
* `ca_certificate` - A Base64 encoded public RSA or ECDSA certificates used to signed your identity provider's web certificate.
9696
* `client_id` - A client id that all tokens must be issued for.

‎website/docs/d/containerengine_node_pools.html.markdown‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,6 @@ The following attributes are exported:
8585
* `is_force_delete_after_grace_duration` - If the underlying compute instance should be deleted if you cannot evict all the pods in grace period
8686
* `node_image_id` - Deprecated. see `nodeSource`. The OCID of the image running on the nodes in the node pool.
8787
* `node_image_name` - Deprecated. see `nodeSource`. The name of the image running on the nodes in the node pool.
88-
* `node_metadata` - A list of key/value pairs to add to each underlying Oracle Cloud Infrastructure instance in the node pool on launch.
8988
* `node_pool_cycling_details` - Node Pool Cycling Details
9089
* `is_node_cycling_enabled` - If nodes in the nodepool will be cycled to have new changes.
9190
* `maximum_surge` - Maximum additional new compute instances that would be temporarily created and added to nodepool during the cycling nodepool process. OKE supports both integer and percentage input. Defaults to 1, Ranges from 0 to Nodepool size or 0% to 100%

‎website/docs/r/containerengine_cluster.html.markdown‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,10 @@ The following arguments are supported:
138138
* `is_tiller_enabled` - (Optional) Whether or not to enable the Tiller add-on.
139139
* `admission_controller_options` - (Optional) (Updatable) Configurable cluster admission controllers
140140
* `is_pod_security_policy_enabled` - (Optional) (Updatable) Whether or not to enable the Pod Security Policy admission controller.
141-
* `ip_families` - (Optional) IP family to use for single stack or define the order of IP families for dual-stack
141+
* `ip_families` - (Optional) IP family to use for single stack or define the order of IP families for dual-stack. Available values are [] (defaults to IPv4), [IPv4] (IPv4), [IPv4, IPv6] (IPv4 preferred dual stack).
142142
* `kubernetes_network_config` - (Optional) Network configuration for Kubernetes.
143-
* `pods_cidr` - (Optional) The CIDR block for Kubernetes pods. Optional, defaults to 10.244.0.0/16.
144-
* `services_cidr` - (Optional) The CIDR block for Kubernetes services. Optional, defaults to 10.96.0.0/16.
143+
* `pods_cidr` - (Optional) The CIDR block for Kubernetes pods. Optional. For ipv4, defaults to 10.244.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0000::/96.
144+
* `services_cidr` - (Optional) The CIDR block for Kubernetes services. Optional. For ipv4, defaults to 10.96.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0001::/108.
145145
* `open_id_connect_token_authentication_config` - (Optional) (Updatable) The properties that configure OIDC token authentication in kube-apiserver. For more information, see [Configuring the API Server](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-flags).
146146
* `ca_certificate` - (Optional) (Updatable) A Base64 encoded public RSA or ECDSA certificates used to signed your identity provider's web certificate.
147147
* `client_id` - (Optional) (Updatable) A client id that all tokens must be issued for.
@@ -219,10 +219,10 @@ The following attributes are exported:
219219
* `is_tiller_enabled` - Whether or not to enable the Tiller add-on.
220220
* `admission_controller_options` - Configurable cluster admission controllers
221221
* `is_pod_security_policy_enabled` - Whether or not to enable the Pod Security Policy admission controller.
222-
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack
222+
* `ip_families` - IP family to use for single stack or define the order of IP families for dual-stack. Available values are [] (defaults to IPv4), [IPv4] (IPv4), [IPv4, IPv6] (IPv4 preferred dual stack).
223223
* `kubernetes_network_config` - Network configuration for Kubernetes.
224-
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional, defaults to 10.244.0.0/16.
225-
* `services_cidr` - The CIDR block for Kubernetes services. Optional, defaults to 10.96.0.0/16.
224+
* `pods_cidr` - The CIDR block for Kubernetes pods. Optional. For ipv4, defaults to 10.244.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0000::/96.
225+
* `services_cidr` - The CIDR block for Kubernetes services. Optional. For ipv4, defaults to 10.96.0.0/16. For ipv6, defaults to fd00:eeee:eeee:0001::/108.
226226
* `open_id_connect_token_authentication_config` - The properties that configure OIDC token authentication in kube-apiserver. For more information, see [Configuring the API Server](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-flags).
227227
* `ca_certificate` - A Base64 encoded public RSA or ECDSA certificates used to signed your identity provider's web certificate.
228228
* `client_id` - A client id that all tokens must be issued for.

0 commit comments

Comments
 (0)