Skip to content

Commit 70b1801

Browse files
author
Ben Lucas
authored
feat(policies): Data source for sysdig_secure_rule_network (#348)
* add data source for sysdig_secure_rule_network * test for data source sysdig_secure_rule_network * add documentation for the data source sysdig_secure_rule_network
1 parent 43a2936 commit 70b1801

8 files changed

+251
-26
lines changed

‎sysdig/data_source_sysdig_secure_rule.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
package sysdig
22

33
import (
4+
"context"
45
"strconv"
56

67
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
79
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
810
)
911

@@ -49,3 +51,32 @@ func ruleDataSourceToResourceData(rule v2.Rule, d *schema.ResourceData) {
4951
_ = d.Set("tags", rule.Tags)
5052
_ = d.Set("version", rule.Version)
5153
}
54+
55+
func commonDataSourceSysdigRuleRead(ctx context.Context, d *schema.ResourceData, meta interface{}, ruleType string, setResourceData func(v2.Rule, *schema.ResourceData) diag.Diagnostics) diag.Diagnostics {
56+
client, err := getSecureRuleClient(meta.(SysdigClients))
57+
if err != nil {
58+
return diag.FromErr(err)
59+
}
60+
61+
ruleName := d.Get("name").(string)
62+
63+
rules, err := client.GetRuleGroup(ctx, ruleName, ruleType)
64+
if err != nil {
65+
return diag.FromErr(err)
66+
}
67+
68+
if len(rules) == 0 {
69+
return diag.Errorf("unable to find rule")
70+
}
71+
72+
if len(rules) > 1 {
73+
return diag.Errorf("more than one rule with that name was found")
74+
}
75+
76+
rule := rules[0]
77+
78+
ruleDataSourceToResourceData(rule, d)
79+
diag := setResourceData(rule, d)
80+
81+
return diag
82+
}

‎sysdig/data_source_sysdig_secure_rule_container.go‎

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -36,31 +36,10 @@ func dataSourceSysdigSecureRuleContainer() *schema.Resource {
3636
}
3737

3838
func dataSourceSysdigRuleContainerRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
39-
client, err := getSecureRuleClient(meta.(SysdigClients))
40-
if err != nil {
41-
return diag.FromErr(err)
42-
}
43-
44-
ruleName := d.Get("name").(string)
45-
ruleType := v2.RuleTypeContainer
46-
47-
rules, err := client.GetRuleGroup(ctx, ruleName, ruleType)
48-
if err != nil {
49-
return diag.FromErr(err)
50-
}
51-
52-
if len(rules) == 0 {
53-
return diag.Errorf("unable to find rule")
54-
}
55-
56-
if len(rules) > 1 {
57-
return diag.Errorf("more than one rule with that name was found")
58-
}
59-
60-
rule := rules[0]
61-
62-
ruleDataSourceToResourceData(rule, d)
39+
return commonDataSourceSysdigRuleRead(ctx, d, meta, v2.RuleTypeContainer, containerRuleDataSourceToResourceData)
40+
}
6341

42+
func containerRuleDataSourceToResourceData(rule v2.Rule, d *schema.ResourceData) diag.Diagnostics {
6443
_ = d.Set("matching", rule.Details.Containers.MatchItems)
6544
_ = d.Set("containers", rule.Details.Containers.Items)
6645

‎sysdig/data_source_sysdig_secure_rule_network.go‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
package sysdig
2+
3+
import (
4+
"context"
5+
"strconv"
6+
"time"
7+
8+
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
9+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
11+
)
12+
13+
func dataSourceSysdigSecureRuleNetwork() *schema.Resource {
14+
timeout := 5 * time.Minute
15+
16+
return &schema.Resource{
17+
ReadContext: dataSourceSysdigRuleNetworkRead,
18+
19+
Timeouts: &schema.ResourceTimeout{
20+
Read: schema.DefaultTimeout(timeout),
21+
},
22+
23+
Schema: createRuleDataSourceSchema(map[string]*schema.Schema{
24+
"block_inbound": {
25+
Type: schema.TypeBool,
26+
Computed: true,
27+
},
28+
"block_outbound": {
29+
Type: schema.TypeBool,
30+
Computed: true,
31+
},
32+
"tcp": {
33+
Type: schema.TypeList,
34+
Computed: true,
35+
Elem: &schema.Resource{
36+
Schema: map[string]*schema.Schema{
37+
"matching": {
38+
Type: schema.TypeBool,
39+
Computed: true,
40+
},
41+
"ports": {
42+
Type: schema.TypeSet,
43+
Computed: true,
44+
Elem: &schema.Schema{
45+
Type: schema.TypeInt,
46+
},
47+
},
48+
},
49+
},
50+
},
51+
"udp": {
52+
Type: schema.TypeList,
53+
Optional: true,
54+
Elem: &schema.Resource{
55+
Schema: map[string]*schema.Schema{
56+
"matching": {
57+
Type: schema.TypeBool,
58+
Computed: true,
59+
},
60+
"ports": {
61+
Type: schema.TypeSet,
62+
Computed: true,
63+
Elem: &schema.Schema{
64+
Type: schema.TypeInt,
65+
},
66+
},
67+
},
68+
},
69+
},
70+
}),
71+
}
72+
}
73+
74+
func dataSourceSysdigRuleNetworkRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
75+
return commonDataSourceSysdigRuleRead(ctx, d, meta, v2.RuleTypeNetwork, networkRuleDataSourceToResourceData)
76+
}
77+
78+
func networkRuleDataSourceToResourceData(rule v2.Rule, d *schema.ResourceData) diag.Diagnostics {
79+
_ = d.Set("block_inbound", rule.Details.AllInbound)
80+
_ = d.Set("block_outbound", rule.Details.AllOutbound)
81+
82+
if rule.Details.TCPListenPorts == nil {
83+
return diag.Errorf("no tcpListenPorts for a network rule")
84+
}
85+
86+
if rule.Details.UDPListenPorts == nil {
87+
return diag.Errorf("no udpListenPorts for a network rule")
88+
}
89+
90+
if len(rule.Details.TCPListenPorts.Items) > 0 {
91+
tcpPorts := []int{}
92+
for _, port := range rule.Details.TCPListenPorts.Items {
93+
intPort, err := strconv.Atoi(port)
94+
if err != nil {
95+
return diag.FromErr(err)
96+
}
97+
tcpPorts = append(tcpPorts, intPort)
98+
}
99+
_ = d.Set("tcp", []map[string]interface{}{{
100+
"matching": rule.Details.TCPListenPorts.MatchItems,
101+
"ports": tcpPorts,
102+
}})
103+
}
104+
if len(rule.Details.UDPListenPorts.Items) > 0 {
105+
udpPorts := []int{}
106+
for _, port := range rule.Details.UDPListenPorts.Items {
107+
intPort, err := strconv.Atoi(port)
108+
if err != nil {
109+
return diag.FromErr(err)
110+
}
111+
udpPorts = append(udpPorts, intPort)
112+
}
113+
_ = d.Set("udp", []map[string]interface{}{{
114+
"matching": rule.Details.UDPListenPorts.MatchItems,
115+
"ports": udpPorts,
116+
}})
117+
}
118+
119+
return nil
120+
}

‎sysdig/data_source_sysdig_secure_rule_network_test.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
//go:build tf_acc_sysdig || tf_acc_sysdig_secure || tf_acc_policies
2+
3+
package sysdig_test
4+
5+
import (
6+
"fmt"
7+
"os"
8+
"testing"
9+
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
11+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
12+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
13+
14+
"github.com/draios/terraform-provider-sysdig/sysdig"
15+
)
16+
17+
func TestAccRuleNetworkDataSource(t *testing.T) {
18+
rText := func() string { return acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum) }
19+
20+
resource.ParallelTest(t, resource.TestCase{
21+
PreCheck: func() {
22+
if v := os.Getenv("SYSDIG_SECURE_API_TOKEN"); v == "" {
23+
t.Fatal("SYSDIG_SECURE_API_TOKEN must be set for acceptance tests")
24+
}
25+
},
26+
ProviderFactories: map[string]func() (*schema.Provider, error){
27+
"sysdig": func() (*schema.Provider, error) {
28+
return sysdig.Provider(), nil
29+
},
30+
},
31+
Steps: []resource.TestStep{
32+
{
33+
Config: ruleNetworkDataSource(rText()),
34+
},
35+
},
36+
})
37+
}
38+
39+
func ruleNetworkDataSource(name string) string {
40+
return fmt.Sprintf(`
41+
%s
42+
43+
data "sysdig_secure_rule_network" "data_sample" {
44+
name = "TERRAFORM TEST %s"
45+
depends_on = [ sysdig_secure_rule_network.foo ]
46+
}
47+
`, ruleNetworkWithName(name), name)
48+
}

‎sysdig/internal/client/v2/model.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,7 @@ const (
262262
RuleTypeContainer = "CONTAINER"
263263
RuleTypeFalco = "FALCO"
264264
RuleTypeFilesystem = "FILESYSTEM"
265+
RuleTypeNetwork = "NETWORK"
265266
)
266267

267268
type Details struct {

‎sysdig/provider.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ func Provider() *schema.Provider {
134134
"sysdig_secure_rule_falco": dataSourceSysdigSecureRuleFalco(),
135135
"sysdig_secure_rule_falco_count": dataSourceSysdigSecureRuleFalcoCount(),
136136
"sysdig_secure_rule_filesystem": dataSourceSysdigSecureRuleFilesystem(),
137+
"sysdig_secure_rule_network": dataSourceSysdigSecureRuleNetwork(),
137138

138139
"sysdig_current_user": dataSourceSysdigCurrentUser(),
139140
"sysdig_user": dataSourceSysdigUser(),

‎sysdig/resource_sysdig_secure_rule_network.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@ package sysdig
22

33
import (
44
"context"
5-
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
65
"strconv"
76
"time"
87

8+
v2 "github.com/draios/terraform-provider-sysdig/sysdig/internal/client/v2"
9+
910
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
1011

1112
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -210,7 +211,7 @@ func resourceSysdigRuleNetworkDelete(ctx context.Context, d *schema.ResourceData
210211

211212
func resourceSysdigRuleNetworkFromResourceData(d *schema.ResourceData) (rule v2.Rule, err error) {
212213
rule = ruleFromResourceData(d)
213-
rule.Details.RuleType = "NETWORK"
214+
rule.Details.RuleType = v2.RuleTypeNetwork
214215

215216
rule.Details.TCPListenPorts = &v2.TCPListenPorts{}
216217
rule.Details.UDPListenPorts = &v2.UDPListenPorts{}

‎website/docs/d/secure_rule_network.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
subcategory: "Sysdig Secure"
3+
layout: "sysdig"
4+
page_title: "Sysdig: sysdig_secure_rule_network"
5+
description: |-
6+
Retrieves a Sysdig Secure Network Rule.
7+
---
8+
9+
# Data Source: sysdig_secure_rule_network
10+
11+
Retrieves the information of an existing Sysdig Secure Network Rule.
12+
13+
-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository.
14+
15+
## Example Usage
16+
17+
```terraform
18+
data "sysdig_secure_rule_network" "example" {
19+
name = "Disallowed SSH Connection"
20+
}
21+
```
22+
23+
## Argument Reference
24+
25+
* `name` - (Required) The name of the Secure rule to retrieve.
26+
27+
## Attributes Reference
28+
29+
In addition to the argument above, the following attributes are exported:
30+
31+
* `description` - The description of Secure rule.
32+
* `tags` - A list of tags for this rule.
33+
* `block_inbound` - Detect if there is an inbound connection.
34+
* `block_outbound` - Detect if there is an outbound connection.
35+
* `tcp` - A block with the properties `matching` and `ports` for TCP connections.
36+
* `udp` - A block with the properties `matching` and `ports` for UDP connections.
37+
* `version` - Current version of the resource in Sysdig Secure.
38+
39+
## Connection Blocks
40+
41+
The `tcp` and `udp` blocks will have the the following attributes:
42+
43+
* `matching` - Defines if the port matches or not with the provided list.
44+
* `ports` - List of ports to match.

0 commit comments

Comments
 (0)