Skip to content

Commit 22616d2

Browse files
yfodilyfodil
authored
feat(lb): add ips_edge_services field (#3178)
* feat(lb): add ips_edge_services field * fix * lint * support acl from frontend resource too * fix
1 parent a710dce commit 22616d2

File tree

10 files changed

+3401
-1351
lines changed

10 files changed

+3401
-1351
lines changed

‎docs/data-sources/lb_acls.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,4 +54,5 @@ In addition to all arguments above, the following attributes are exported:
5454
- `http_filter` - The HTTP filter to match.
5555
- `http_filter_value` - The possible values to match for a given HTTP filter.
5656
- `http_filter_option` - A list of possible values for the HTTP filter based on the HTTP header.
57-
- `invert` - The condition will be of type "unless" if invert is set to `true`
57+
- `invert` - The condition will be of type "unless" if invert is set to `true`
58+
- `ips_edge_services` - Defines whether Edge Services IPs should be matched.

‎docs/resources/lb_acl.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,11 @@ The following arguments are supported:
5353

5454
- `code` - (Optional) The HTTP redirect code to use. Valid values are `301`, `302`, `303`, `307` and `308`.
5555

56-
- `match` - (Required) The ACL match rule. At least `ip_subnet` or `http_filter` and `http_filter_value` are required.
56+
- `match` - (Required) The ACL match rule. At least `ip_subnet` or `ips_edge_services` or `http_filter` and `http_filter_value` are required.
5757

58-
- `ip_subnet` - (Optional) A list of IPs, or CIDR v4/v6 addresses of the session client, to match.
58+
- `ip_subnet` - (Optional) A list of IPs, or CIDR v4/v6 addresses of the session client, to match. Only one of `ip_subnet` and `ips_edge_services` should be specified.
59+
60+
- `ips_edge_services` - (Optional) Defines whether Edge Services IPs should be matched. Only one of `ip_subnet` and `ips_edge_services` should be specified.
5961

6062
- `http_filter` - (Optional) The HTTP filter to match. This filter is supported only if your backend protocol has an HTTP forward protocol.
6163
It extracts the request's URL path, which starts at the first slash and ends before the question mark (without the host part).

‎docs/resources/lb_frontend.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -191,9 +191,11 @@ The following arguments are supported:
191191

192192
- `code` - (Optional) The HTTP redirect code to use. Valid values are `301`, `302`, `303`, `307` and `308`.
193193

194-
- `match` - (Required) The ACL match rule. At least `ip_subnet` or `http_filter` and `http_filter_value` are required.
194+
- `match` - (Required) The ACL match rule. At least `ip_subnet` or `ips_edge_services` or `http_filter` and `http_filter_value` are required.
195195

196-
- `ip_subnet` - (Optional) A list of IPs, or CIDR v4/v6 addresses of the session client, to match.
196+
- `ip_subnet` - (Optional) A list of IPs, or CIDR v4/v6 addresses of the session client, to match. Only one of `ip_subnet` and `ips_edge_services` should be specified.
197+
198+
- `ips_edge_services` - (Optional) Defines whether Edge Services IPs should be matched. Only one of `ip_subnet` and `ips_edge_services` should be specified.
197199

198200
- `http_filter` - (Optional) The HTTP filter to match. This filter is supported only if your backend protocol has an HTTP forward protocol.
199201
It extracts the request's URL path, which starts at the first slash and ends before the question mark (without the host part).
@@ -205,7 +207,7 @@ The following arguments are supported:
205207
- `http_filter_option` - (Optional) If you have `http_filter` at `http_header_match`, you can use this field to filter on the HTTP header's value.
206208

207209
- `invert` - (Optional) If set to `true`, the condition will be of type "unless".
208-
210+
209211
- `external_acls` - (Defaults to `false`) A boolean to specify whether to use [lb_acl](../resources/lb_acl.md).
210212
If `external_acls` is set to `true`, `acl` can not be set directly in the Load Balancer frontend.
211213

‎internal/services/lb/acl.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,11 @@ func ResourceACL() *schema.Resource {
136136
Optional: true,
137137
Description: `If set to true, the condition will be of type "unless"`,
138138
},
139+
"ips_edge_services": {
140+
Type: schema.TypeBool,
141+
Optional: true,
142+
Description: `Defines whether Edge Services IPs should be matched`,
143+
},
139144
},
140145
},
141146
},
@@ -169,7 +174,7 @@ func resourceLbACLCreate(ctx context.Context, d *schema.ResourceData, m any) dia
169174
FrontendID: frontID,
170175
Name: d.Get("name").(string),
171176
Action: expandLbACLAction(d.Get("action")),
172-
Match: expandLbACLMatch(d.Get("match")),
177+
Match: expandLbACLMatch(d, d.Get("match"), 0),
173178
Index: int32(d.Get("index").(int)),
174179
Description: d.Get("description").(string),
175180
}
@@ -231,7 +236,7 @@ func resourceLbACLUpdate(ctx context.Context, d *schema.ResourceData, m any) dia
231236
Name: d.Get("name").(string),
232237
Action: expandLbACLAction(d.Get("action")),
233238
Index: int32(d.Get("index").(int)),
234-
Match: expandLbACLMatch(d.Get("match")),
239+
Match: expandLbACLMatch(d, d.Get("match"), 0),
235240
Description: types.ExpandUpdatedStringPtr(d.Get("description")),
236241
}
237242

‎internal/services/lb/acl_test.go‎

Lines changed: 109 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func TestAccAcl_Basic(t *testing.T) {
5454
ip_subnet = ["192.168.0.1", "192.168.0.2", "192.168.10.0/24"]
5555
http_filter = "acl_http_filter_none"
5656
http_filter_value = []
57-
invert = "true"
57+
invert = true
5858
}
5959
}
6060
`,
@@ -127,6 +127,114 @@ func TestAccAcl_Basic(t *testing.T) {
127127
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter", "acl_http_filter_none"),
128128
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter_value.#", "0"),
129129
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.invert", "false"),
130+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ips_edge_services", "false"),
131+
),
132+
},
133+
{
134+
Config: `
135+
resource scaleway_lb_ip ip01 {}
136+
resource scaleway_lb lb01 {
137+
ip_id = scaleway_lb_ip.ip01.id
138+
name = "test-lb-acl"
139+
type = "lb-s"
140+
}
141+
resource scaleway_lb_backend bkd01 {
142+
lb_id = scaleway_lb.lb01.id
143+
forward_protocol = "http"
144+
forward_port = 80
145+
proxy_protocol = "none"
146+
}
147+
resource scaleway_lb_frontend frt01 {
148+
lb_id = scaleway_lb.lb01.id
149+
backend_id = scaleway_lb_backend.bkd01.id
150+
name = "tf-test"
151+
inbound_port = 80
152+
timeout_client = "30s"
153+
external_acls = true
154+
}
155+
resource scaleway_lb_acl acl01 {
156+
frontend_id = scaleway_lb_frontend.frt01.id
157+
name = "updated-test-acl-basic"
158+
description = "updated description"
159+
index = 3
160+
action {
161+
type = "deny"
162+
}
163+
match {
164+
http_filter = "acl_http_filter_none"
165+
http_filter_value = []
166+
ips_edge_services = true
167+
}
168+
}
169+
`,
170+
Check: resource.ComposeTestCheckFunc(
171+
isACLPresent(tt, "scaleway_lb_acl.acl01"),
172+
resource.TestCheckResourceAttrPair(
173+
"scaleway_lb_acl.acl01", "frontend_id",
174+
"scaleway_lb_frontend.frt01", "id"),
175+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "name", "updated-test-acl-basic"),
176+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "description", "updated description"),
177+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "index", "3"),
178+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "action.0.type", "deny"),
179+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ip_subnet.#", "1"),
180+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ip_subnet.0", "0.0.0.0/0"),
181+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter", "acl_http_filter_none"),
182+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter_value.#", "0"),
183+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.invert", "false"),
184+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ips_edge_services", "true"),
185+
),
186+
},
187+
{
188+
Config: `
189+
resource scaleway_lb_ip ip01 {}
190+
resource scaleway_lb lb01 {
191+
ip_id = scaleway_lb_ip.ip01.id
192+
name = "test-lb-acl"
193+
type = "lb-s"
194+
}
195+
resource scaleway_lb_backend bkd01 {
196+
lb_id = scaleway_lb.lb01.id
197+
forward_protocol = "http"
198+
forward_port = 80
199+
proxy_protocol = "none"
200+
}
201+
resource scaleway_lb_frontend frt01 {
202+
lb_id = scaleway_lb.lb01.id
203+
backend_id = scaleway_lb_backend.bkd01.id
204+
name = "tf-test"
205+
inbound_port = 80
206+
timeout_client = "30s"
207+
external_acls = true
208+
}
209+
resource scaleway_lb_acl acl01 {
210+
frontend_id = scaleway_lb_frontend.frt01.id
211+
name = "updated-test-acl-basic"
212+
description = "updated description"
213+
index = 3
214+
action {
215+
type = "deny"
216+
}
217+
match {
218+
http_filter = "acl_http_filter_none"
219+
http_filter_value = []
220+
}
221+
}
222+
`,
223+
Check: resource.ComposeTestCheckFunc(
224+
isACLPresent(tt, "scaleway_lb_acl.acl01"),
225+
resource.TestCheckResourceAttrPair(
226+
"scaleway_lb_acl.acl01", "frontend_id",
227+
"scaleway_lb_frontend.frt01", "id"),
228+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "name", "updated-test-acl-basic"),
229+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "description", "updated description"),
230+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "index", "3"),
231+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "action.0.type", "deny"),
232+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ip_subnet.#", "1"),
233+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ip_subnet.0", "0.0.0.0/0"),
234+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter", "acl_http_filter_none"),
235+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.http_filter_value.#", "0"),
236+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.invert", "false"),
237+
resource.TestCheckResourceAttr("scaleway_lb_acl.acl01", "match.0.ips_edge_services", "false"),
130238
),
131239
},
132240
{

‎internal/services/lb/acls_data_source.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,10 @@ func DataSourceACLs() *schema.Resource {
8282
Computed: true,
8383
Type: schema.TypeBool,
8484
},
85+
"ips_edge_services": {
86+
Computed: true,
87+
Type: schema.TypeBool,
88+
},
8589
},
8690
},
8791
},

‎internal/services/lb/frontend.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,11 @@ func ResourceFrontend() *schema.Resource {
189189
Optional: true,
190190
Description: `If set to true, the condition will be of type "unless"`,
191191
},
192+
"ips_edge_services": {
193+
Type: schema.TypeBool,
194+
Optional: true,
195+
Description: `Defines whether Edge Services IPs should be matched`,
196+
},
192197
},
193198
},
194199
},
@@ -382,7 +387,7 @@ func resourceLbFrontendUpdateACL(ctx context.Context, d *schema.ResourceData, lb
382387
}
383388

384389
// convert state acl and sanitize them a bit
385-
newACL := expandsLBACLs(d.Get("acl"))
390+
newACL := expandsLBACLs(d, d.Get("acl"))
386391

387392
// loop
388393
for index, stateACL := range newACL {
@@ -441,12 +446,12 @@ func resourceLbFrontendUpdateACL(ctx context.Context, d *schema.ResourceData, lb
441446
return nil
442447
}
443448

444-
func expandsLBACLs(raw any) []*lbSDK.ACL {
445-
d := raw.([]any)
449+
func expandsLBACLs(d *schema.ResourceData, raw any) []*lbSDK.ACL {
450+
r := raw.([]any)
446451
newACL := make([]*lbSDK.ACL, 0)
447452

448-
for _, rawACL := range d {
449-
newACL = append(newACL, expandLbACL(rawACL))
453+
for index, rawACL := range r {
454+
newACL = append(newACL, expandLbACL(d, rawACL, index))
450455
}
451456

452457
return newACL

0 commit comments

Comments
 (0)