Skip to content

Commit c889407

Browse files
GnoaleGnoale
committed
support localized secret internal ID
1 parent a5cfacd commit c889407

File tree

3 files changed

+62
-47
lines changed

3 files changed

+62
-47
lines changed

‎internal/services/jobs/definition.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,12 @@ func ResourceDefinition() *schema.Resource {
9595
Type: schema.TypeSet,
9696
Optional: true,
9797
Description: "A reference to a Secret Manager secret.",
98-
MaxItems: 10,
9998
Elem: &schema.Resource{
10099
Schema: map[string]*schema.Schema{
101100
"secret_id": {
102-
Type: schema.TypeString,
103-
Description: "The secret UUID.",
104-
Required: true,
105-
ValidateFunc: validation.IsUUID,
101+
Type: schema.TypeString,
102+
Description: "The secret unique identifier, it could be formatted as UUID or region/UUID. The secret must be in the same region as the job definition.",
103+
Required: true,
106104
},
107105
"secret_reference_id": {
108106
Type: schema.TypeString,
@@ -172,7 +170,7 @@ func ResourceJobDefinitionCreate(ctx context.Context, d *schema.ResourceData, m
172170
}
173171

174172
if rawSecretReference, ok := d.GetOk("secret_reference"); ok {
175-
if err := CreateJobDefinitionSecret(rawSecretReference, api, region, definition.ID); err != nil {
173+
if err := CreateJobDefinitionSecret(expandJobDefinitionSecret(rawSecretReference), api, region, definition.ID); err != nil {
176174
return diag.FromErr(err)
177175
}
178176
}
@@ -319,7 +317,7 @@ func ResourceJobDefinitionUpdate(ctx context.Context, d *schema.ResourceData, m
319317
}
320318

321319
if rawSecretReference, ok := d.GetOk("secret_reference"); ok {
322-
if err := CreateJobDefinitionSecret(rawSecretReference, api, region, id); err != nil {
320+
if err := CreateJobDefinitionSecret(expandJobDefinitionSecret(rawSecretReference), api, region, id); err != nil {
323321
return diag.FromErr(err)
324322
}
325323
}

‎internal/services/jobs/definition_test.go‎

Lines changed: 35 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@ import (
88
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
99
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
1010
jobsSDK "github.com/scaleway/scaleway-sdk-go/api/jobs/v1alpha1"
11+
"github.com/scaleway/scaleway-sdk-go/scw"
1112
"github.com/scaleway/terraform-provider-scaleway/v2/internal/acctest"
1213
"github.com/scaleway/terraform-provider-scaleway/v2/internal/httperrors"
1314
"github.com/scaleway/terraform-provider-scaleway/v2/internal/services/jobs"
15+
"github.com/stretchr/testify/assert"
1416
)
1517

1618
func TestAccJobDefinition_Basic(t *testing.T) {
@@ -179,23 +181,19 @@ func TestAccJobDefinition_SecretReference(t *testing.T) {
179181
secret_id = scaleway_secret.main.id
180182
data = "your_secret"
181183
}
182-
locals {
183-
parts = split("/", scaleway_secret.main.id)
184-
secret_uuid = local.parts[1]
185-
}
186184
187185
resource scaleway_job_definition main {
188186
name = "test-jobs-job-definition-secret"
189187
cpu_limit = 120
190188
memory_limit = 256
191189
image_uri = "docker.io/alpine:latest"
192190
secret_reference {
193-
secret_id = local.secret_uuid
191+
secret_id = scaleway_secret.main.id
194192
secret_version = "latest"
195193
file = "/home/dev/env"
196194
}
197195
secret_reference {
198-
secret_id = local.secret_uuid
196+
secret_id = scaleway_secret.main.id
199197
secret_version = "latest"
200198
environment = "SOME_ENV"
201199
}
@@ -220,23 +218,19 @@ func TestAccJobDefinition_SecretReference(t *testing.T) {
220218
secret_id = scaleway_secret.main.id
221219
data = "your_secret"
222220
}
223-
locals {
224-
parts = split("/", scaleway_secret.main.id)
225-
secret_uuid = local.parts[1]
226-
}
227221
228222
resource scaleway_job_definition main {
229223
name = "test-jobs-job-definition-secret"
230224
cpu_limit = 120
231225
memory_limit = 256
232226
image_uri = "docker.io/alpine:latest"
233227
secret_reference {
234-
secret_id = local.secret_uuid
228+
secret_id = scaleway_secret.main.id
235229
secret_version = "latest"
236230
file = "/home/dev/new_env"
237231
}
238232
secret_reference {
239-
secret_id = local.secret_uuid
233+
secret_id = scaleway_secret.main.id
240234
secret_version = "latest"
241235
environment = "SOME_ENV"
242236
}
@@ -273,18 +267,14 @@ func TestAccJobDefinition_WrongSecretReference(t *testing.T) {
273267
secret_id = scaleway_secret.main.id
274268
data = "your_secret"
275269
}
276-
locals {
277-
parts = split("/", scaleway_secret.main.id)
278-
secret_uuid = local.parts[1]
279-
}
280270
281271
resource scaleway_job_definition main {
282272
name = "test-jobs-job-definition-secret"
283273
cpu_limit = 120
284274
memory_limit = 256
285275
image_uri = "docker.io/alpine:latest"
286276
secret_reference {
287-
secret_id = local.secret_uuid
277+
secret_id = scaleway_secret.main.id
288278
secret_version = "1"
289279
}
290280
}
@@ -300,18 +290,14 @@ func TestAccJobDefinition_WrongSecretReference(t *testing.T) {
300290
secret_id = scaleway_secret.main.id
301291
data = "your_secret"
302292
}
303-
locals {
304-
parts = split("/", scaleway_secret.main.id)
305-
secret_uuid = local.parts[1]
306-
}
307293
308294
resource scaleway_job_definition main {
309295
name = "test-jobs-job-definition-secret"
310296
cpu_limit = 120
311297
memory_limit = 256
312298
image_uri = "docker.io/alpine:latest"
313299
secret_reference {
314-
secret_id = local.secret_uuid
300+
secret_id = scaleway_secret.main.id
315301
secret_version = "1"
316302
environment = "SOME_ENV"
317303
file = "/home/dev/env"
@@ -377,3 +363,30 @@ func testAccCheckJobDefinitionDestroy(tt *acctest.TestTools) resource.TestCheckF
377363
return nil
378364
}
379365
}
366+
367+
func TestCreateJobDefinitionSecret(t *testing.T) {
368+
jobSecrets := []jobs.JobDefinitionSecret{
369+
{
370+
SecretID: "fr-par/11111111-1111-1111-1111-111111111111",
371+
SecretVersion: "1",
372+
Environment: "SOME_ENV",
373+
},
374+
{
375+
SecretID: "11111111-1111-1111-1111-111111111111",
376+
SecretVersion: "1",
377+
File: "/home/dev/env",
378+
},
379+
{
380+
SecretID: "nl-ams/11111111-1111-1111-1111-111111111111",
381+
SecretVersion: "1",
382+
File: "/home/dev/env",
383+
},
384+
}
385+
386+
api := jobsSDK.NewAPI(&scw.Client{})
387+
region := scw.RegionFrPar
388+
jobID := "22222222-2222-2222-2222-222222222222"
389+
390+
err := jobs.CreateJobDefinitionSecret(jobSecrets, api, region, jobID)
391+
assert.ErrorContains(t, err, fmt.Sprintf("the secret id %s does not appear to be in the same region as the job definition id %s", jobSecrets[2].SecretID, jobID))
392+
}

‎internal/services/jobs/helpers.go‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -134,27 +134,33 @@ func expandJobDefinitionSecret(i any) []JobDefinitionSecret {
134134
return parsedSecrets
135135
}
136136

137-
func CreateJobDefinitionSecret(rawSecretReference any, api *jobs.API, region scw.Region, jobID string) error {
138-
parsedSecretReferences := expandJobDefinitionSecret(rawSecretReference)
139-
secrets := []*jobs.CreateJobDefinitionSecretsRequestSecretConfig{}
137+
func CreateJobDefinitionSecret(jobSecrets []JobDefinitionSecret, api *jobs.API, region scw.Region, jobID string) error {
140138

141-
for _, parsedSecretRef := range parsedSecretReferences {
142-
var secretConfig *jobs.CreateJobDefinitionSecretsRequestSecretConfig
139+
secretConfigs := []*jobs.CreateJobDefinitionSecretsRequestSecretConfig{}
140+
141+
for _, parsedSecretRef := range jobSecrets {
142+
secretConfig := &jobs.CreateJobDefinitionSecretsRequestSecretConfig{}
143+
144+
secretRegion, secretID, err := regional.ParseID(parsedSecretRef.SecretID)
145+
if err != nil {
146+
secretID = parsedSecretRef.SecretID
147+
}
148+
149+
if secretRegion != "" && secretRegion != region {
150+
return fmt.Errorf("the secret id %s does not appear to be in the same region as the job definition id %s", parsedSecretRef.SecretID, jobID)
151+
}
152+
153+
secretConfigs = append(secretConfigs, secretConfig)
154+
155+
secretConfig.SecretManagerID = secretID
156+
secretConfig.SecretManagerVersion = parsedSecretRef.SecretVersion
143157

144158
if parsedSecretRef.Environment != "" {
145-
secretConfig = &jobs.CreateJobDefinitionSecretsRequestSecretConfig{
146-
SecretManagerID: parsedSecretRef.SecretID,
147-
SecretManagerVersion: parsedSecretRef.SecretVersion,
148-
EnvVarName: &parsedSecretRef.Environment,
149-
}
159+
secretConfig.EnvVarName = &parsedSecretRef.Environment
150160
}
151161

152162
if parsedSecretRef.File != "" {
153-
secretConfig = &jobs.CreateJobDefinitionSecretsRequestSecretConfig{
154-
SecretManagerID: parsedSecretRef.SecretID,
155-
SecretManagerVersion: parsedSecretRef.SecretVersion,
156-
Path: &parsedSecretRef.File,
157-
}
163+
secretConfig.Path = &parsedSecretRef.File
158164
}
159165

160166
if parsedSecretRef.Environment != "" && parsedSecretRef.File != "" {
@@ -164,14 +170,12 @@ func CreateJobDefinitionSecret(rawSecretReference any, api *jobs.API, region scw
164170
if parsedSecretRef.Environment == "" && parsedSecretRef.File == "" {
165171
return fmt.Errorf("the secret id %s is missing a mount point: file or environment", parsedSecretRef.SecretID)
166172
}
167-
168-
secrets = append(secrets, secretConfig)
169173
}
170174

171175
_, err := api.CreateJobDefinitionSecrets(&jobs.CreateJobDefinitionSecretsRequest{
172176
Region: region,
173177
JobDefinitionID: jobID,
174-
Secrets: secrets,
178+
Secrets: secretConfigs,
175179
})
176180

177181
return err

0 commit comments

Comments
 (0)