Skip to content

feat(project-acls): add support for project acl #234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
codydiehl wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

feat(project-acls): add support for project acl #234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 56 additions & 6 deletions rundeck/resource_acl_policy_framework.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
ID types.String `tfsdk:"id"`
Name types.String `tfsdk:"name"`
Policy types.String `tfsdk:"policy"`
Project types.String `tfsdk:"project"`
}

// Metadata returns the resource type name.
Expand Down Expand Up @@ -66,6 +67,13 @@
Description: "YAML formatted ACL Policy string.",
Required: true,
},
"project": schema.StringAttribute{
Description: "Project name for project-level ACL. If not specified, creates a system-level ACL.",
Optional: true,
PlanModifiers: []planmodifier.String{
stringplanmodifier.RequiresReplace(),
},
},
},
}
}
Expand Down Expand Up @@ -102,12 +110,25 @@
client := r.clients.V1
name := plan.Name.ValueString()
policy := plan.Policy.ValueString()
project := plan.Project.ValueStringPointer()

request := &rundeck.SystemACLPolicyCreateRequest{
Contents: &policy,
}

response, err := client.SystemACLPolicyCreate(ctx, name, request)
var response *rundeck.SetObject
var err error
if project != nil {
// Project-level ACL
projectResponse, projectErr := client.ProjectACLPolicyCreate(ctx, *project, name, request)

Check failure on line 123 in rundeck/resource_acl_policy_framework.go

View workflow job for this annotation

GitHub Actions / Build 

client.ProjectACLPolicyCreate undefined (type *"github.com/rundeck/go-rundeck/rundeck".BaseClient has no field or method ProjectACLPolicyCreate)
response = &projectResponse
err = projectErr
} else {
// System-level ACL
systemResponse, systemErr := client.SystemACLPolicyCreate(ctx, name, request)
response = &systemResponse
err = systemErr
}
if err != nil {
resp.Diagnostics.AddError(
"Error creating ACL policy",
Expand Down Expand Up @@ -144,8 +165,21 @@
// Get ACL policy from Rundeck
client := r.clients.V1
name := state.ID.ValueString()

response, err := client.SystemACLPolicyGet(ctx, name)
project := state.Project.ValueStringPointer()

var response *rundeck.ACLPolicyResponse
var err error
if project != nil {
// Project-level ACL
projectResponse, projectErr := client.ProjectACLPolicyGet(ctx, *project, name)

Check failure on line 174 in rundeck/resource_acl_policy_framework.go

View workflow job for this annotation

GitHub Actions / Build 

client.ProjectACLPolicyGet undefined (type *"github.com/rundeck/go-rundeck/rundeck".BaseClient has no field or method ProjectACLPolicyGet)
response = &projectResponse
err = projectErr
} else {
// System-level ACL
systemResponse, systemErr := client.SystemACLPolicyGet(ctx, name)
response = &systemResponse
err = systemErr
}
if err != nil {
resp.Diagnostics.AddError(
"Error reading ACL policy",
Expand Down Expand Up @@ -183,12 +217,20 @@
client := r.clients.V1
name := plan.Name.ValueString()
policy := plan.Policy.ValueString()
project := plan.Project.ValueStringPointer()

request := &rundeck.SystemACLPolicyUpdateRequest{
Contents: &policy,
}

_, err := client.SystemACLPolicyUpdate(ctx, name, request)
var err error
if project != nil {
// Project-level ACL
_, err = client.ProjectACLPolicyUpdate(ctx, *project, name, request)

Check failure on line 229 in rundeck/resource_acl_policy_framework.go

View workflow job for this annotation

GitHub Actions / Build 

client.ProjectACLPolicyUpdate undefined (type *"github.com/rundeck/go-rundeck/rundeck".BaseClient has no field or method ProjectACLPolicyUpdate)
} else {
// System-level ACL
_, err = client.SystemACLPolicyUpdate(ctx, name, request)
}
if err != nil {
resp.Diagnostics.AddError(
"Error updating ACL policy",
Expand Down Expand Up @@ -217,8 +259,16 @@
// Delete ACL policy
client := r.clients.V1
name := state.ID.ValueString()

_, err := client.SystemACLPolicyDelete(ctx, name)
project := state.Project.ValueStringPointer()

var err error
if project != nil {
// Project-level ACL
_, err = client.ProjectACLPolicyDelete(ctx, *project, name)

Check failure on line 267 in rundeck/resource_acl_policy_framework.go

View workflow job for this annotation

GitHub Actions / Build 

client.ProjectACLPolicyDelete undefined (type *"github.com/rundeck/go-rundeck/rundeck".BaseClient has no field or method ProjectACLPolicyDelete)
} else {
// System-level ACL
_, err = client.SystemACLPolicyDelete(ctx, name)
}
if err != nil {
resp.Diagnostics.AddError(
"Error deleting ACL policy",
Expand Down
24 changes: 18 additions & 6 deletions website/docs/r/acl_policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,23 +8,34 @@ description: |-

# rundeck\_acl_policy

Control access to your automation infrastructure. ACL policies define fine-grained permissions for users and groups across projects, jobs, nodes, and key storage. Managing policies as code ensures security is reviewed, versioned, and consistently applied.
Control access to your automation infrastructure. ACL policies define fine-grained permissions for users and groups across projects, jobs, nodes, and key storage. Managing policies as code ensures security is reviewed, versioned, and consistently applied. The resource supports both System ACLs and Project ACLs.

## Example Usage
## Example Usage (System ACL)

```hcl
data "local_file" "acl" {
filename = "${path.module}/acl.yaml"
}

resource "rundeck_acl_policy" "example" {
resource "rundeck_acl_policy" "system_acl_example" {
name = "ExampleAcl.aclpolicy"

policy = "${data.local_file.acl.content}"
}
```

Note that the above configuration assumes the existence of an ``acl.yaml`` file in the
## Example Usage (Project ACL)
```hcl
data "local_file" "acl" {
filename = "${path.module}/acl.yaml"
}
resource "rundeck_acl_policy" "project_acl_example" {
name = "ExampleAcl.aclpolicy"
project = "example-project"
policy = "${data.local_file.acl.content}"
}
```
Note that the above examples assumes the existence of an ``acl.yaml`` file in the
project directory. This resource passes the raw YAML policy string to Rundeck which stores
and returns it as-is. A future ``acl_policy_document`` data source is planned to allow defining
the policy in terraform configuration.
Expand All @@ -37,9 +48,10 @@ The following arguments are supported:

* `policy` - (Required) The name of the job, used to describe the job in the Rundeck UI.

> Note: This example uses an ACL Policy file stored at the current working directory named `acl.yaml`. Valid contents for that file are shown below.
* `project` - (Optional) The name of the project to define the project ACL under. If this is not provided the ACL will be a system level ACL policy.
> Note: These examples use an ACL Policy file stored at the current working directory named `acl.yaml`. Valid contents for that file are shown below.

```
```yaml
by:
group: terraform
description: Allow terraform Key Storage Access
Expand Down
Loading