Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(iplb): add support for deniedSource on tcp frontends #652

Merged
merged 1 commit into from
May 21, 2024
Merged

feat(iplb): add support for deniedSource on tcp frontends #652

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions ovh/resource_iploadbalancing_tcp_frontend.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,11 @@ func resourceIpLoadbalancingTcpFrontend() *schema.Resource {
Optional: true,
ForceNew: false,
},
"denied_source": {
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
"disabled": {
Type: schema.TypeBool,
Default: false,
Expand Down Expand Up @@ -95,6 +100,7 @@ func resourceIpLoadbalancingTcpFrontendCreate(d *schema.ResourceData, meta inter
config := meta.(*Config)

allowedSources, _ := helpers.StringsFromSchema(d, "allowed_source")
deniedSources, _ := helpers.StringsFromSchema(d, "denied_source")
dedicatedIpFo, _ := helpers.StringsFromSchema(d, "dedicated_ipfo")

for _, s := range allowedSources {
Expand All @@ -103,6 +109,12 @@ func resourceIpLoadbalancingTcpFrontendCreate(d *schema.ResourceData, meta inter
}
}

for _, s := range deniedSources {
if err := helpers.ValidateIpBlock(s); err != nil {
return fmt.Errorf("Error validating `denied_source` value: %s", err)
}
}

for _, s := range dedicatedIpFo {
if err := helpers.ValidateIpBlock(s); err != nil {
return fmt.Errorf("Error validating `dedicated_ipfo` value: %s", err)
Expand All @@ -114,6 +126,7 @@ func resourceIpLoadbalancingTcpFrontendCreate(d *schema.ResourceData, meta inter
Zone: d.Get("zone").(string),
AllowedSource: allowedSources,
DedicatedIpFo: dedicatedIpFo,
DeniedSource: deniedSources,
Disabled: d.Get("disabled").(bool),
Ssl: d.Get("ssl").(bool),
DisplayName: d.Get("display_name").(string),
Expand Down Expand Up @@ -151,6 +164,9 @@ func resourceIpLoadbalancingTcpFrontendRead(d *schema.ResourceData, meta interfa
allowedSources := make([]string, 0)
allowedSources = append(allowedSources, r.AllowedSource...)

deniedSources := make([]string, 0)
deniedSources = append(deniedSources, r.DeniedSource...)

dedicatedIpFos := make([]string, 0)
dedicatedIpFos = append(dedicatedIpFos, r.DedicatedIpFo...)

Expand All @@ -163,6 +179,7 @@ func resourceIpLoadbalancingTcpFrontendRead(d *schema.ResourceData, meta interfa
d.Set("ssl", r.Ssl)
d.Set("zone", r.Zone)
d.Set("allowed_source", allowedSources)
d.Set("denied_source", deniedSources)

return nil
}
Expand All @@ -173,6 +190,7 @@ func resourceIpLoadbalancingTcpFrontendUpdate(d *schema.ResourceData, meta inter
endpoint := fmt.Sprintf("/ipLoadbalancing/%s/tcp/frontend/%s", service, d.Id())

allowedSources, _ := helpers.StringsFromSchema(d, "allowed_source")
deniedSources, _ := helpers.StringsFromSchema(d, "denied_source")
dedicatedIpFo, _ := helpers.StringsFromSchema(d, "dedicated_ipfo")

for _, s := range allowedSources {
Expand All @@ -181,6 +199,12 @@ func resourceIpLoadbalancingTcpFrontendUpdate(d *schema.ResourceData, meta inter
}
}

for _, s := range deniedSources {
if err := helpers.ValidateIpBlock(s); err != nil {
return fmt.Errorf("Error validating `denied_source` value: %s", err)
}
}

for _, s := range dedicatedIpFo {
if err := helpers.ValidateIpBlock(s); err != nil {
return fmt.Errorf("Error validating `dedicated_ipfo` value: %s", err)
Expand All @@ -192,6 +216,7 @@ func resourceIpLoadbalancingTcpFrontendUpdate(d *schema.ResourceData, meta inter
Zone: d.Get("zone").(string),
AllowedSource: allowedSources,
DedicatedIpFo: dedicatedIpFo,
DeniedSource: deniedSources,
Disabled: d.Get("disabled").(bool),
Ssl: d.Get("ssl").(bool),
DisplayName: d.Get("display_name").(string),
Expand Down
33 changes: 33 additions & 0 deletions ovh/resource_iploadbalancing_tcp_frontend_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ func TestAccIpLoadbalancingTcpFrontend_basic(t *testing.T) {
"ovh_iploadbalancing_tcp_frontend.testfrontend", "disabled", "true"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "allowed_source.#", "0"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "denied_source.#", "0"),
),
},
{
Expand All @@ -101,6 +103,25 @@ func TestAccIpLoadbalancingTcpFrontend_basic(t *testing.T) {
"ovh_iploadbalancing_tcp_frontend.testfrontend", "disabled", "false"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "allowed_source.#", "1"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "denied_source.#", "0"),
),
},
{
Config: fmt.Sprintf(testAccCheckOvhIpLoadbalancingTcpFrontendConfig_denied_source, iplb, test_prefix),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "display_name", test_prefix),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "ssl", "false"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "port", "22280,22443"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "disabled", "false"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "allowed_source.#", "0"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "denied_source.#", "1"),
),
},
{
Expand All @@ -116,6 +137,8 @@ func TestAccIpLoadbalancingTcpFrontend_basic(t *testing.T) {
"ovh_iploadbalancing_tcp_frontend.testfrontend", "disabled", "true"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "allowed_source.#", "0"),
resource.TestCheckResourceAttr(
"ovh_iploadbalancing_tcp_frontend.testfrontend", "denied_source.#", "0"),
),
},
},
Expand Down Expand Up @@ -162,6 +185,16 @@ resource "ovh_iploadbalancing_tcp_frontend" "testfrontend" {
}
`

const testAccCheckOvhIpLoadbalancingTcpFrontendConfig_denied_source = `
resource "ovh_iploadbalancing_tcp_frontend" "testfrontend" {
service_name = "%s"
display_name = "%s"
zone = "all"
port = "22280,22443"
denied_source = ["8.8.8.8/32"]
}
`

const testAccCheckOvhIpLoadbalancingTcpFrontendConfig_withfarm = `
data "ovh_iploadbalancing" "iplb" {
service_name = "%s"
Expand Down
1 change: 1 addition & 0 deletions ovh/types_iploadbalancing.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -499,6 +499,7 @@ type IpLoadbalancingTcpFrontend struct {
DedicatedIpFo []string `json:"dedicatedIpfo"`
DefaultFarmId *int `json:"defaultFarmId,omitempty"`
DefaultSslId *int `json:"defaultSslId,omitempty"`
DeniedSource []string `json:"deniedSource"`
Disabled bool `json:"disabled"`
Ssl bool `json:"ssl"`
DisplayName string `json:"displayName"`
Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/iploadbalancing_tcp_frontend.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ The following arguments are supported:
and/or 'range'. Each port must be in the [1;49151] range
* `zone` - (Required) Zone where the frontend will be defined (ie. `gra`, `bhs` also supports `all`)
* `allowed_source` - Restrict IP Load Balancing access to these ip block. No restriction if null. List of IP blocks.
* `denied_source` - Deny IP Load Balancing access to these ip block. No restriction if null. You cannot specify both `allowed_source` and `denied_source` at the same time. List of IP blocks.
* `dedicated_ipfo` - Only attach frontend on these ip. No restriction if null. List of Ip blocks.
* `default_farm_id` - Default TCP Farm of your frontend
* `default_ssl_id` - Default ssl served to your customer
Expand All @@ -55,6 +56,7 @@ The following attributes are exported:
* `id` - Id of your frontend
* `display_name` - See Argument Reference above.
* `allowed_source` - See Argument Reference above.
* `denied_source` - See Argument Reference above.
* `dedicated_ipfo` - See Argument Reference above.
* `default_farm_id` - See Argument Reference above.
* `default_ssl_id` - See Argument Reference above.
Expand Down