Skip to content

Commit dbccb47

Browse files
harshiagsagarp337
harshiag
authored and
sagarp337
committed
Added - Support for secret generation in SiV
1 parent 579a275 commit dbccb47

11 files changed

+319
-38
lines changed

‎examples/vault_secret/main.tf‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,14 @@ resource "oci_vault_secret" "test_secret" {
5454
stage = "CURRENT"
5555
}
5656
key_id = var.kms_key_ocid
57-
secret_name = "TFsample1e13"
57+
secret_name = "testSecretSample1"
5858
vault_id = var.kms_vault_ocid
5959
}
6060

6161
resource "oci_vault_secret" "test_secret_with_auto_rotation" {
6262
compartment_id = var.compartment_ocid
6363
key_id = var.kms_key_ocid
64-
secret_name = "TFSecretAutoRotation211"
64+
secret_name = "testSecretSample2"
6565
vault_id = var.kms_vault_ocid
6666

6767
secret_content {
@@ -84,10 +84,23 @@ resource "oci_vault_secret" "test_secret_with_auto_rotation" {
8484
}
8585
}
8686

87+
resource "oci_vault_secret" "test_secret_with_auto_generation" {
88+
compartment_id = var.compartment_ocid
89+
key_id = var.kms_key_ocid
90+
secret_name = "testSecretSample3"
91+
vault_id = var.kms_vault_ocid
92+
93+
enable_auto_generation = true
94+
secret_generation_context {
95+
generation_type = "PASSPHRASE"
96+
generation_template = "SECRETS_DEFAULT_PASSWORD"
97+
}
98+
}
99+
87100
resource "oci_vault_secret" "test_secret_with_target_system" {
88101
compartment_id = var.compartment_ocid
89102
key_id = var.kms_key_ocid
90-
secret_name = "TFSecretWithTargetSyste2121m"
103+
secret_name = "testSecretSample4"
91104
vault_id = var.kms_vault_ocid
92105

93106
secret_content {
@@ -120,7 +133,7 @@ resource "oci_vault_secret" "test_secret_without_version_name" {
120133
stage = "CURRENT"
121134
}
122135
key_id = var.kms_key_ocid
123-
secret_name = "TFsampleWithoutVersionName212"
136+
secret_name = "testSecretSample5"
124137
vault_id = var.kms_vault_ocid
125138
}
126139

‎internal/integrationtest/vault_secret_test.go‎

Lines changed: 40 additions & 14 deletions
Large diffs are not rendered by default.

‎internal/integrationtest/vault_secret_version_test.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ func TestVaultSecretVersionResource_basic(t *testing.T) {
5151
Check: acctest.ComposeAggregateTestCheckFuncWrapper(
5252
resource.TestCheckResourceAttrSet(singularDatasourceName, "secret_id"),
5353
resource.TestCheckResourceAttr(singularDatasourceName, "secret_version_number", "1"),
54-
5554
resource.TestCheckResourceAttr(singularDatasourceName, "stages.#", "2"),
5655
resource.TestCheckResourceAttrSet(singularDatasourceName, "time_created"),
5756
resource.TestCheckResourceAttrSet(singularDatasourceName, "version_number"),

‎internal/service/vault/vault_secret_data_source.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ func (s *VaultSecretDataSourceCrud) SetData() error {
8585

8686
s.D.Set("freeform_tags", s.Res.FreeformTags)
8787

88+
if s.Res.IsAutoGenerationEnabled != nil {
89+
s.D.Set("is_auto_generation_enabled", *s.Res.IsAutoGenerationEnabled)
90+
}
91+
8892
if s.Res.KeyId != nil {
8993
s.D.Set("key_id", *s.Res.KeyId)
9094
}
@@ -111,6 +115,16 @@ func (s *VaultSecretDataSourceCrud) SetData() error {
111115

112116
s.D.Set("rotation_status", s.Res.RotationStatus)
113117

118+
if s.Res.SecretGenerationContext != nil {
119+
secretGenerationContextArray := []interface{}{}
120+
if secretGenerationContextMap := SecretGenerationContextToMap(&s.Res.SecretGenerationContext); secretGenerationContextMap != nil {
121+
secretGenerationContextArray = append(secretGenerationContextArray, secretGenerationContextMap)
122+
}
123+
s.D.Set("secret_generation_context", secretGenerationContextArray)
124+
} else {
125+
s.D.Set("secret_generation_context", nil)
126+
}
127+
114128
if s.Res.SecretName != nil {
115129
s.D.Set("secret_name", *s.Res.SecretName)
116130
}

‎internal/service/vault/vault_secret_resource.go‎

Lines changed: 188 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ func VaultSecretResource() *schema.Resource {
3939
Type: schema.TypeString,
4040
Required: true,
4141
},
42+
"key_id": {
43+
Type: schema.TypeString,
44+
Required: true,
45+
ForceNew: true,
46+
},
4247
"secret_name": {
4348
Type: schema.TypeString,
4449
Required: true,
@@ -63,19 +68,17 @@ func VaultSecretResource() *schema.Resource {
6368
Optional: true,
6469
Computed: true,
6570
},
71+
"enable_auto_generation": {
72+
Type: schema.TypeBool,
73+
Optional: true,
74+
Default: false,
75+
},
6676
"freeform_tags": {
6777
Type: schema.TypeMap,
6878
Optional: true,
6979
Computed: true,
7080
Elem: schema.TypeString,
7181
},
72-
"key_id": {
73-
Type: schema.TypeString,
74-
//Optional: true,
75-
//Computed: true,
76-
Required: true,
77-
ForceNew: true,
78-
},
7982
"metadata": {
8083
Type: schema.TypeMap,
8184
Optional: true,
@@ -179,6 +182,44 @@ func VaultSecretResource() *schema.Resource {
179182
},
180183
},
181184
},
185+
"secret_generation_context": {
186+
Type: schema.TypeList,
187+
Optional: true,
188+
Computed: true,
189+
MaxItems: 1,
190+
MinItems: 1,
191+
Elem: &schema.Resource{
192+
Schema: map[string]*schema.Schema{
193+
// Required
194+
"generation_template": {
195+
Type: schema.TypeString,
196+
Required: true,
197+
},
198+
"generation_type": {
199+
Type: schema.TypeString,
200+
Required: true,
201+
DiffSuppressFunc: tfresource.EqualIgnoreCaseSuppressDiff,
202+
ValidateFunc: validation.StringInSlice([]string{
203+
"BYTES",
204+
"PASSPHRASE",
205+
"SSH_KEY",
206+
}, true),
207+
},
208+
209+
// Optional
210+
"passphrase_length": {
211+
Type: schema.TypeInt,
212+
Optional: true,
213+
},
214+
"secret_template": {
215+
Type: schema.TypeString,
216+
Optional: true,
217+
},
218+
219+
// Computed
220+
},
221+
},
222+
},
182223
"secret_rules": {
183224
Type: schema.TypeList,
184225
Optional: true,
@@ -229,6 +270,10 @@ func VaultSecretResource() *schema.Resource {
229270
Type: schema.TypeString,
230271
Computed: true,
231272
},
273+
"is_auto_generation_enabled": {
274+
Type: schema.TypeBool,
275+
Computed: true,
276+
},
232277
"last_rotation_time": {
233278
Type: schema.TypeString,
234279
Computed: true,
@@ -360,6 +405,11 @@ func (s *VaultSecretResourceCrud) Create() error {
360405
request.Description = &tmp
361406
}
362407

408+
if enableAutoGeneration, ok := s.D.GetOkExists("enable_auto_generation"); ok {
409+
tmp := enableAutoGeneration.(bool)
410+
request.EnableAutoGeneration = &tmp
411+
}
412+
363413
if freeformTags, ok := s.D.GetOkExists("freeform_tags"); ok {
364414
request.FreeformTags = tfresource.ObjectMapToStringMap(freeformTags.(map[string]interface{}))
365415
}
@@ -395,6 +445,17 @@ func (s *VaultSecretResourceCrud) Create() error {
395445
}
396446
}
397447

448+
if secretGenerationContext, ok := s.D.GetOkExists("secret_generation_context"); ok {
449+
if tmpList := secretGenerationContext.([]interface{}); len(tmpList) > 0 {
450+
fieldKeyFormat := fmt.Sprintf("%s.%d.%%s", "secret_generation_context", 0)
451+
tmp, err := s.mapToSecretGenerationContext(fieldKeyFormat)
452+
if err != nil {
453+
return err
454+
}
455+
request.SecretGenerationContext = tmp
456+
}
457+
}
458+
398459
if secretName, ok := s.D.GetOkExists("secret_name"); ok {
399460
tmp := secretName.(string)
400461
request.SecretName = &tmp
@@ -484,6 +545,11 @@ func (s *VaultSecretResourceCrud) Update() error {
484545
request.Description = &tmp
485546
}
486547

548+
if enableAutoGeneration, ok := s.D.GetOkExists("enable_auto_generation"); ok {
549+
tmp := enableAutoGeneration.(bool)
550+
request.EnableAutoGeneration = &tmp
551+
}
552+
487553
if freeformTags, ok := s.D.GetOkExists("freeform_tags"); ok {
488554
request.FreeformTags = tfresource.ObjectMapToStringMap(freeformTags.(map[string]interface{}))
489555
}
@@ -514,6 +580,17 @@ func (s *VaultSecretResourceCrud) Update() error {
514580
}
515581
}
516582

583+
if secretGenerationContext, ok := s.D.GetOkExists("secret_generation_context"); ok {
584+
if tmpList := secretGenerationContext.([]interface{}); len(tmpList) > 0 {
585+
fieldKeyFormat := fmt.Sprintf("%s.%d.%%s", "secret_generation_context", 0)
586+
tmp, err := s.mapToSecretGenerationContext(fieldKeyFormat)
587+
if err != nil {
588+
return err
589+
}
590+
request.SecretGenerationContext = tmp
591+
}
592+
}
593+
517594
tmp := s.D.Id()
518595
request.SecretId = &tmp
519596

@@ -576,6 +653,10 @@ func (s *VaultSecretResourceCrud) SetData() error {
576653

577654
s.D.Set("freeform_tags", s.Res.FreeformTags)
578655

656+
if s.Res.IsAutoGenerationEnabled != nil {
657+
s.D.Set("is_auto_generation_enabled", *s.Res.IsAutoGenerationEnabled)
658+
}
659+
579660
if s.Res.KeyId != nil {
580661
s.D.Set("key_id", *s.Res.KeyId)
581662
}
@@ -602,6 +683,16 @@ func (s *VaultSecretResourceCrud) SetData() error {
602683

603684
s.D.Set("rotation_status", s.Res.RotationStatus)
604685

686+
if s.Res.SecretGenerationContext != nil {
687+
secretGenerationContextArray := []interface{}{}
688+
if secretGenerationContextMap := SecretGenerationContextToMap(&s.Res.SecretGenerationContext); secretGenerationContextMap != nil {
689+
secretGenerationContextArray = append(secretGenerationContextArray, secretGenerationContextMap)
690+
}
691+
s.D.Set("secret_generation_context", secretGenerationContextArray)
692+
} else {
693+
s.D.Set("secret_generation_context", nil)
694+
}
695+
605696
if s.Res.SecretName != nil {
606697
s.D.Set("secret_name", *s.Res.SecretName)
607698
}
@@ -734,6 +825,96 @@ func SecretContentDetailsToMap(obj *oci_vault.SecretContentDetails) map[string]i
734825
return result
735826
}
736827

828+
func (s *VaultSecretResourceCrud) mapToSecretGenerationContext(fieldKeyFormat string) (oci_vault.SecretGenerationContext, error) {
829+
var baseObject oci_vault.SecretGenerationContext
830+
//discriminator
831+
generationTypeRaw, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "generation_type"))
832+
var generationType string
833+
if ok {
834+
generationType = generationTypeRaw.(string)
835+
} else {
836+
generationType = "" // default value
837+
}
838+
switch strings.ToLower(generationType) {
839+
case strings.ToLower("BYTES"):
840+
details := oci_vault.BytesGenerationContext{}
841+
if generationTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "generation_template")); ok {
842+
details.GenerationTemplate = oci_vault.BytesGenerationContextGenerationTemplateEnum(generationTemplate.(string))
843+
}
844+
if secretTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "secret_template")); ok {
845+
tmp := secretTemplate.(string)
846+
details.SecretTemplate = &tmp
847+
}
848+
baseObject = details
849+
case strings.ToLower("PASSPHRASE"):
850+
details := oci_vault.PassphraseGenerationContext{}
851+
if generationTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "generation_template")); ok {
852+
details.GenerationTemplate = oci_vault.PassphraseGenerationContextGenerationTemplateEnum(generationTemplate.(string))
853+
}
854+
if passphraseLength, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "passphrase_length")); ok {
855+
tmp := passphraseLength.(int)
856+
details.PassphraseLength = &tmp
857+
}
858+
if secretTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "secret_template")); ok {
859+
tmp := secretTemplate.(string)
860+
details.SecretTemplate = &tmp
861+
}
862+
baseObject = details
863+
case strings.ToLower("SSH_KEY"):
864+
details := oci_vault.SshKeyGenerationContext{}
865+
if generationTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "generation_template")); ok {
866+
details.GenerationTemplate = oci_vault.SshKeyGenerationContextGenerationTemplateEnum(generationTemplate.(string))
867+
}
868+
if secretTemplate, ok := s.D.GetOkExists(fmt.Sprintf(fieldKeyFormat, "secret_template")); ok {
869+
tmp := secretTemplate.(string)
870+
details.SecretTemplate = &tmp
871+
}
872+
baseObject = details
873+
default:
874+
return nil, fmt.Errorf("unknown generation_type '%v' was specified", generationType)
875+
}
876+
return baseObject, nil
877+
}
878+
879+
func SecretGenerationContextToMap(obj *oci_vault.SecretGenerationContext) map[string]interface{} {
880+
result := map[string]interface{}{}
881+
switch v := (*obj).(type) {
882+
case oci_vault.BytesGenerationContext:
883+
result["generation_type"] = "BYTES"
884+
885+
result["generation_template"] = string(v.GenerationTemplate)
886+
887+
if v.SecretTemplate != nil {
888+
result["secret_template"] = string(*v.SecretTemplate)
889+
}
890+
case oci_vault.PassphraseGenerationContext:
891+
result["generation_type"] = "PASSPHRASE"
892+
893+
result["generation_template"] = string(v.GenerationTemplate)
894+
895+
if v.PassphraseLength != nil {
896+
result["passphrase_length"] = int(*v.PassphraseLength)
897+
}
898+
899+
if v.SecretTemplate != nil {
900+
result["secret_template"] = string(*v.SecretTemplate)
901+
}
902+
case oci_vault.SshKeyGenerationContext:
903+
result["generation_type"] = "SSH_KEY"
904+
905+
result["generation_template"] = string(v.GenerationTemplate)
906+
907+
if v.SecretTemplate != nil {
908+
result["secret_template"] = string(*v.SecretTemplate)
909+
}
910+
default:
911+
log.Printf("[WARN] Received 'generation_type' of unknown type %v", *obj)
912+
return nil
913+
}
914+
915+
return result
916+
}
917+
737918
func (s *VaultSecretResourceCrud) mapToSecretRule(fieldKeyFormat string) (oci_vault.SecretRule, error) {
738919
var baseObject oci_vault.SecretRule
739920
//discriminator

‎internal/service/vault/vault_secret_version_data_source.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ func VaultSecretVersionDataSource() *schema.Resource {
3232
Type: schema.TypeString,
3333
Computed: true,
3434
},
35+
"is_content_auto_generated": {
36+
Type: schema.TypeBool,
37+
Computed: true,
38+
},
3539
"name": {
3640
Type: schema.TypeString,
3741
Computed: true,
@@ -118,6 +122,10 @@ func (s *VaultSecretVersionDataSourceCrud) SetData() error {
118122

119123
s.D.Set("content_type", s.Res.ContentType)
120124

125+
if s.Res.IsContentAutoGenerated != nil {
126+
s.D.Set("is_content_auto_generated", *s.Res.IsContentAutoGenerated)
127+
}
128+
121129
if s.Res.Name != nil {
122130
s.D.Set("name", *s.Res.Name)
123131
}

0 commit comments

Comments
 (0)