Skip to content

Commit be8980a

Browse files
jmashalkSrividyaKamakshi
jmashalk
authored and
SrividyaKamakshi
committed
Added - Support for Opensearch - ZPR security attribute support
1 parent 6fbc89b commit be8980a

File tree

7 files changed

+546
-7
lines changed

7 files changed

+546
-7
lines changed

‎examples/opensearch/opensearch_cluster/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,4 +174,9 @@ data "oci_opensearch_opensearch_clusters" "test_opensearch_clusters" {
174174
display_name = var.opensearch_cluster_display_name
175175
# id = var.opensearch_cluster_id
176176
# state = var.opensearch_cluster_state
177+
}
178+
179+
data "oci_certificates_management_certificates" "existing" {
180+
compartment_id = var.compartment_id
181+
name = "Tersi-Certificate-DND"
177182
}

‎internal/integrationtest/opensearch_opensearch_cluster_test.go‎

Lines changed: 330 additions & 7 deletions
Large diffs are not rendered by default.

‎internal/service/opensearch/opensearch_opensearch_cluster_data_source.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,12 @@ func (s *OpensearchOpensearchClusterDataSourceCrud) SetData() error {
6969

7070
s.D.Set("availability_domains", s.Res.AvailabilityDomains)
7171

72+
if s.Res.CertificateConfig != nil {
73+
s.D.Set("certificate_config", []interface{}{CertificateConfigToMap(s.Res.CertificateConfig)})
74+
} else {
75+
s.D.Set("certificate_config", nil)
76+
}
77+
7278
if s.Res.CompartmentId != nil {
7379
s.D.Set("compartment_id", *s.Res.CompartmentId)
7480
}
@@ -147,6 +153,10 @@ func (s *OpensearchOpensearchClusterDataSourceCrud) SetData() error {
147153

148154
s.D.Set("master_node_host_type", s.Res.MasterNodeHostType)
149155

156+
if s.Res.NsgId != nil {
157+
s.D.Set("nsg_id", *s.Res.NsgId)
158+
}
159+
150160
if s.Res.OpendashboardFqdn != nil {
151161
s.D.Set("opendashboard_fqdn", *s.Res.OpendashboardFqdn)
152162
}
@@ -215,6 +225,12 @@ func (s *OpensearchOpensearchClusterDataSourceCrud) SetData() error {
215225
s.D.Set("search_node_storage_gb", *s.Res.SearchNodeStorageGB)
216226
}
217227

228+
if s.Res.SecurityAttributes != nil {
229+
s.D.Set("security_attributes", tfresource.SecurityAttributesToMap(s.Res.SecurityAttributes))
230+
} else {
231+
s.D.Set("security_attributes", nil)
232+
}
233+
218234
if s.Res.SecurityMasterUserName != nil {
219235
s.D.Set("security_master_user_name", *s.Res.SecurityMasterUserName)
220236
}

‎internal/service/opensearch/opensearch_opensearch_cluster_resource.go‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,43 @@ func OpensearchOpensearchClusterResource() *schema.Resource {
120120
ForceNew: true,
121121
},
122122

123+
"certificate_config": {
124+
Type: schema.TypeList,
125+
Optional: true,
126+
Computed: true,
127+
MaxItems: 1,
128+
MinItems: 1,
129+
Elem: &schema.Resource{
130+
Schema: map[string]*schema.Schema{
131+
// Required
132+
133+
// Optional
134+
"cluster_certificate_mode": {
135+
Type: schema.TypeString,
136+
Optional: true,
137+
Computed: true,
138+
},
139+
"dashboard_certificate_mode": {
140+
Type: schema.TypeString,
141+
Optional: true,
142+
Computed: true,
143+
},
144+
"open_search_api_certificate_id": {
145+
Type: schema.TypeString,
146+
Optional: true,
147+
Computed: true,
148+
},
149+
"open_search_dashboard_certificate_id": {
150+
Type: schema.TypeString,
151+
Optional: true,
152+
Computed: true,
153+
},
154+
155+
// Computed
156+
},
157+
},
158+
},
159+
123160
// Optional
124161
"data_node_host_bare_metal_shape": {
125162
Type: schema.TypeString,
@@ -200,6 +237,12 @@ func OpensearchOpensearchClusterResource() *schema.Resource {
200237
Optional: true,
201238
Computed: true,
202239
},
240+
"nsg_id": {
241+
Type: schema.TypeString,
242+
Optional: true,
243+
Computed: true,
244+
ForceNew: true,
245+
},
203246
"opendashboard_node_host_shape": {
204247
Type: schema.TypeString,
205248
Optional: true,
@@ -300,6 +343,13 @@ func OpensearchOpensearchClusterResource() *schema.Resource {
300343
Optional: true,
301344
Computed: true,
302345
},
346+
"security_attributes": {
347+
Type: schema.TypeMap,
348+
Optional: true,
349+
Computed: true,
350+
Default: nil,
351+
Elem: schema.TypeString,
352+
},
303353
"security_master_user_name": {
304354
Type: schema.TypeString,
305355
Optional: true,
@@ -573,6 +623,17 @@ func (s *OpensearchOpensearchClusterResourceCrud) DeletedTarget() []string {
573623
func (s *OpensearchOpensearchClusterResourceCrud) Create() error {
574624
request := oci_opensearch.CreateOpensearchClusterRequest{}
575625

626+
if certificateConfig, ok := s.D.GetOkExists("certificate_config"); ok {
627+
if tmpList := certificateConfig.([]interface{}); len(tmpList) > 0 {
628+
fieldKeyFormat := fmt.Sprintf("%s.%d.%%s", "certificate_config", 0)
629+
tmp, err := s.mapToCertificateConfig(fieldKeyFormat)
630+
if err != nil {
631+
return err
632+
}
633+
request.CertificateConfig = &tmp
634+
}
635+
}
636+
576637
if compartmentId, ok := s.D.GetOkExists("compartment_id"); ok {
577638
tmp := compartmentId.(string)
578639
request.CompartmentId = &tmp
@@ -682,6 +743,11 @@ func (s *OpensearchOpensearchClusterResourceCrud) Create() error {
682743
request.MasterNodeHostType = oci_opensearch.MasterNodeHostTypeEnum(masterNodeHostType.(string))
683744
}
684745

746+
if nsgId, ok := s.D.GetOkExists("nsg_id"); ok {
747+
tmp := nsgId.(string)
748+
request.NsgId = &tmp
749+
}
750+
685751
if opendashboardNodeCount, ok := s.D.GetOkExists("opendashboard_node_count"); ok {
686752
tmp := opendashboardNodeCount.(int)
687753
request.OpendashboardNodeCount = &tmp
@@ -755,6 +821,10 @@ func (s *OpensearchOpensearchClusterResourceCrud) Create() error {
755821
request.SearchNodeStorageGB = &tmp
756822
}
757823

824+
if securityAttributes, ok := s.D.GetOkExists("security_attributes"); ok {
825+
request.SecurityAttributes = tfresource.MapToSecurityAttributes(securityAttributes.(map[string]interface{}))
826+
}
827+
758828
if securityMasterUserName, ok := s.D.GetOkExists("security_master_user_name"); ok {
759829
tmp := securityMasterUserName.(string)
760830
request.SecurityMasterUserName = &tmp
@@ -1038,6 +1108,19 @@ func (s *OpensearchOpensearchClusterResourceCrud) Update() error {
10381108

10391109
request := oci_opensearch.UpdateOpensearchClusterRequest{}
10401110

1111+
if certificateConfig, ok := s.D.GetOkExists("certificate_config"); ok {
1112+
if tmpList := certificateConfig.([]interface{}); len(tmpList) > 0 {
1113+
fieldKeyFormat := fmt.Sprintf("%s.%d.%%s", "certificate_config", 0)
1114+
tmp, err := s.mapToCertificateConfig(fieldKeyFormat)
1115+
if err != nil {
1116+
return err
1117+
}
1118+
request.CertificateConfig = &tmp
1119+
}
1120+
} else {
1121+
request.CertificateConfig = nil
1122+
}
1123+
10411124
if definedTags, ok := s.D.GetOkExists("defined_tags"); ok {
10421125
convertedDefinedTags, err := tfresource.MapToDefinedTags(definedTags.(map[string]interface{}))
10431126
if err != nil {
@@ -1093,6 +1176,12 @@ func (s *OpensearchOpensearchClusterResourceCrud) Update() error {
10931176
}
10941177
}
10951178

1179+
if securityAttributes, ok := s.D.GetOkExists("security_attributes"); ok {
1180+
request.SecurityAttributes = tfresource.MapToSecurityAttributes(securityAttributes.(map[string]interface{}))
1181+
} else {
1182+
request.SecurityAttributes = nil
1183+
}
1184+
10961185
if securityMasterUserName, ok := s.D.GetOkExists("security_master_user_name"); ok {
10971186
tmp := securityMasterUserName.(string)
10981187
request.SecurityMasterUserName = &tmp
@@ -1157,6 +1246,12 @@ func (s *OpensearchOpensearchClusterResourceCrud) Delete() error {
11571246
func (s *OpensearchOpensearchClusterResourceCrud) SetData() error {
11581247
s.D.Set("availability_domains", s.Res.AvailabilityDomains)
11591248

1249+
if s.Res.CertificateConfig != nil {
1250+
s.D.Set("certificate_config", []interface{}{CertificateConfigToMap(s.Res.CertificateConfig)})
1251+
} else {
1252+
s.D.Set("certificate_config", nil)
1253+
}
1254+
11601255
if s.Res.CompartmentId != nil {
11611256
s.D.Set("compartment_id", *s.Res.CompartmentId)
11621257
}
@@ -1235,6 +1330,10 @@ func (s *OpensearchOpensearchClusterResourceCrud) SetData() error {
12351330

12361331
s.D.Set("master_node_host_type", s.Res.MasterNodeHostType)
12371332

1333+
if s.Res.NsgId != nil {
1334+
s.D.Set("nsg_id", *s.Res.NsgId)
1335+
}
1336+
12381337
if s.Res.OpendashboardFqdn != nil {
12391338
s.D.Set("opendashboard_fqdn", *s.Res.OpendashboardFqdn)
12401339
}
@@ -1303,6 +1402,10 @@ func (s *OpensearchOpensearchClusterResourceCrud) SetData() error {
13031402
s.D.Set("search_node_storage_gb", *s.Res.SearchNodeStorageGB)
13041403
}
13051404

1405+
if s.Res.SecurityAttributes != nil {
1406+
s.D.Set("security_attributes", tfresource.SecurityAttributesToMap(s.Res.SecurityAttributes))
1407+
}
1408+
13061409
if s.Res.SecurityMasterUserName != nil {
13071410
s.D.Set("security_master_user_name", *s.Res.SecurityMasterUserName)
13081411
}
@@ -1423,6 +1526,11 @@ func (s *OpensearchOpensearchClusterResourceCrud) UpgradeOpenSearchCluster() err
14231526
tmp := originalClusterDisplayName.(string)
14241527
request.OriginalClusterDisplayName = &tmp
14251528
}
1529+
1530+
if securityAttributes, ok := s.D.GetOkExists("security_attributes"); ok {
1531+
request.SecurityAttributes = tfresource.MapToSecurityAttributes(securityAttributes.(map[string]interface{}))
1532+
}
1533+
14261534
if systemTags, ok := s.D.GetOkExists("system_tags"); ok {
14271535
convertedSystemTags, err := tfresource.MapToSystemTags(systemTags.(map[string]interface{}))
14281536
if err != nil {
@@ -1596,6 +1704,48 @@ func (s *OpensearchOpensearchClusterResourceCrud) mapToCreateMaintenanceDetails(
15961704
return result, nil
15971705
}
15981706

1707+
func (s *OpensearchOpensearchClusterResourceCrud) mapToCertificateConfig(fieldKeyFormat string) (oci_opensearch.CertificateConfig, error) {
1708+
result := oci_opensearch.CertificateConfig{}
1709+
1710+
if clusterCertificateMode, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "cluster_certificate_mode")); ok {
1711+
result.ClusterCertificateMode = oci_opensearch.CertificateModeEnum(clusterCertificateMode.(string))
1712+
}
1713+
1714+
if dashboardCertificateMode, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "dashboard_certificate_mode")); ok {
1715+
result.DashboardCertificateMode = oci_opensearch.CertificateModeEnum(dashboardCertificateMode.(string))
1716+
}
1717+
1718+
if openSearchApiCertificateId, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "open_search_api_certificate_id")); ok {
1719+
tmp := openSearchApiCertificateId.(string)
1720+
result.OpenSearchApiCertificateId = &tmp
1721+
}
1722+
1723+
if openSearchDashboardCertificateId, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "open_search_dashboard_certificate_id")); ok {
1724+
tmp := openSearchDashboardCertificateId.(string)
1725+
result.OpenSearchDashboardCertificateId = &tmp
1726+
}
1727+
1728+
return result, nil
1729+
}
1730+
1731+
func CertificateConfigToMap(obj *oci_opensearch.CertificateConfig) map[string]interface{} {
1732+
result := map[string]interface{}{}
1733+
1734+
result["cluster_certificate_mode"] = string(obj.ClusterCertificateMode)
1735+
1736+
result["dashboard_certificate_mode"] = string(obj.DashboardCertificateMode)
1737+
1738+
if obj.OpenSearchApiCertificateId != nil {
1739+
result["open_search_api_certificate_id"] = string(*obj.OpenSearchApiCertificateId)
1740+
}
1741+
1742+
if obj.OpenSearchDashboardCertificateId != nil {
1743+
result["open_search_dashboard_certificate_id"] = string(*obj.OpenSearchDashboardCertificateId)
1744+
}
1745+
1746+
return result
1747+
}
1748+
15991749
func (s *OpensearchOpensearchClusterResourceCrud) mapToUpdateMaintenanceDetails(fieldKeyFormat string) (oci_opensearch.UpdateMaintenanceDetails, error) {
16001750
result := oci_opensearch.UpdateMaintenanceDetails{}
16011751

@@ -1664,6 +1814,12 @@ func OpensearchClusterSummaryToMap(obj oci_opensearch.OpensearchClusterSummary)
16641814
result["outbound_cluster_config"] = []interface{}{OutboundClusterConfigToMap(obj.OutboundClusterConfig)}
16651815
}
16661816

1817+
if obj.SecurityAttributes != nil {
1818+
result["security_attributes"] = tfresource.SecurityAttributesToMap(obj.SecurityAttributes)
1819+
} else {
1820+
result["security_attributes"] = nil
1821+
}
1822+
16671823
result["security_mode"] = string(obj.SecurityMode)
16681824

16691825
if obj.SoftwareVersion != nil {

‎website/docs/d/opensearch_opensearch_cluster.html.markdown‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,12 @@ The following arguments are supported:
4747
The following attributes are exported:
4848

4949
* `availability_domains` - The availability domains to distribute the cluser nodes across.
50+
* `retention_in_days` - Specifies how long backup copy should remain on Storage in days
51+
* `certificate_config` - Custom certificate config for customer provided certs.
52+
* `cluster_certificate_mode` - Specifies whether the certificate to be used in cluster is managed by OpenSearch or Oracle Cloud Infrastructure Certificates service.
53+
* `dashboard_certificate_mode` - Specifies whether the certificate to be used in dashboard is managed by OpenSearch or Oracle Cloud Infrastructure Certificates service.
54+
* `open_search_api_certificate_id` - certificate to be used for OpenSearch cluster api communication
55+
* `open_search_dashboard_certificate_id` - certificate to be used for OpenSearch dashboard api communication
5056
* `compartment_id` - The OCID of the compartment where the cluster is located.
5157
* `data_node_count` - The number of data nodes configured for the cluster.
5258
* `data_node_host_bare_metal_shape` - The bare metal shape for the cluster's data nodes.
@@ -73,6 +79,7 @@ The following attributes are exported:
7379
* `master_node_host_ocpu_count` - The number of OCPUs configured for cluster's master nodes.
7480
* `master_node_host_shape` - The node shape for the cluster's master nodes.
7581
* `master_node_host_type` - The instance type for the cluster's master nodes.
82+
* `nsg_id` - The OCID of the NSG where the private endpoint vnic will be attached.
7683
* `opendashboard_fqdn` - The fully qualified domain name (FQDN) for the cluster's OpenSearch Dashboard API endpoint.
7784
* `opendashboard_node_count` - The number of OpenSearch Dashboard nodes configured for the cluster.
7885
* `opendashboard_node_host_memory_gb` - The amount of memory in GB, for the cluster's OpenSearch Dashboard nodes.
@@ -99,6 +106,7 @@ The following attributes are exported:
99106
* `search_node_host_shape` - The node shape for the cluster's search nodes.
100107
* `search_node_host_type` - The instance type for the cluster's search nodes.
101108
* `search_node_storage_gb` - The amount of storage in GB, to configure per node for the cluster's search nodes.
109+
* `security_attributes` - Security attributes for this resource. Each key is predefined and scoped to a namespace. For more information, see [Resource Tags](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: `{"Oracle-ZPR": {"MaxEgressCount": {"value": "42", "mode": "enforce"}}}`
102110
* `security_master_user_name` - The name of the master user that are used to manage security config
103111
* `security_master_user_password_hash` - The password hash of the master user that are used to manage security config
104112
* `security_mode` - The security mode of the cluster.

‎website/docs/d/opensearch_opensearch_clusters.html.markdown‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@ The following attributes are exported:
6161
The following attributes are exported:
6262

6363
* `availability_domains` - The availability domains to distribute the cluser nodes across.
64+
* `certificate_config` - Custom certificate config for customer provided certs.
65+
* `cluster_certificate_mode` - Specifies whether the certificate to be used in cluster is managed by OpenSearch or Oracle Cloud Infrastructure Certificates service.
66+
* `dashboard_certificate_mode` - Specifies whether the certificate to be used in dashboard is managed by OpenSearch or Oracle Cloud Infrastructure Certificates service.
67+
* `open_search_api_certificate_id` - certificate to be used for OpenSearch cluster api communication
68+
* `open_search_dashboard_certificate_id` - certificate to be used for OpenSearch dashboard api communication
6469
* `compartment_id` - The OCID of the compartment where the cluster is located.
6570
* `data_node_count` - The number of data nodes configured for the cluster.
6671
* `data_node_host_bare_metal_shape` - The bare metal shape for the cluster's data nodes.
@@ -87,6 +92,7 @@ The following attributes are exported:
8792
* `master_node_host_ocpu_count` - The number of OCPUs configured for cluster's master nodes.
8893
* `master_node_host_shape` - The node shape for the cluster's master nodes.
8994
* `master_node_host_type` - The instance type for the cluster's master nodes.
95+
* `nsg_id` - The OCID of the NSG where the private endpoint vnic will be attached.
9096
* `opendashboard_fqdn` - The fully qualified domain name (FQDN) for the cluster's OpenSearch Dashboard API endpoint.
9197
* `opendashboard_node_count` - The number of OpenSearch Dashboard nodes configured for the cluster.
9298
* `opendashboard_node_host_memory_gb` - The amount of memory in GB, for the cluster's OpenSearch Dashboard nodes.
@@ -113,6 +119,7 @@ The following attributes are exported:
113119
* `search_node_host_shape` - The node shape for the cluster's search nodes.
114120
* `search_node_host_type` - The instance type for the cluster's search nodes.
115121
* `search_node_storage_gb` - The amount of storage in GB, to configure per node for the cluster's search nodes.
122+
* `security_attributes` - Security attributes for this resource. Each key is predefined and scoped to a namespace. For more information, see [Resource Tags](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: `{"Oracle-ZPR": {"MaxEgressCount": {"value": "42", "mode": "enforce"}}}`
116123
* `security_master_user_name` - The name of the master user that are used to manage security config
117124
* `security_master_user_password_hash` - The password hash of the master user that are used to manage security config
118125
* `security_mode` - The security mode of the cluster.

0 commit comments

Comments
 (0)