Skip to content

Commit d20d859

Browse files
nicolaslacrouxnicolaslacroux
authored
feat: Add IP Restriction for Container Registry (#552)
Co-authored-by: Nicolas Lacroux <[email protected]>
1 parent 0d724ea commit d20d859

14 files changed

+1266
-183
lines changed

‎ovh/data_cloud_project_containerregistry_ip_restrictions_management.go

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
package ovh
2+
3+
import (
4+
"fmt"
5+
"log"
6+
"net/url"
7+
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
)
10+
11+
func dataSourceCloudProjectContainerRegistryIPRestrictionsManagement() *schema.Resource {
12+
return &schema.Resource{
13+
Read: dataSourceCloudProjectContainerRegistryIPRestrictionsManagementRead,
14+
Schema: map[string]*schema.Schema{
15+
"service_name": {
16+
Type: schema.TypeString,
17+
Description: "Service name",
18+
Required: true,
19+
DefaultFunc: schema.EnvDefaultFunc("OVH_CLOUD_PROJECT_SERVICE", nil),
20+
},
21+
"registry_id": {
22+
Type: schema.TypeString,
23+
Description: "Registry ID",
24+
Required: true,
25+
},
26+
"ip_restrictions": {
27+
Type: schema.TypeList,
28+
Description: "List your IP restrictions applied on artifact manager component",
29+
Computed: true,
30+
Elem: &schema.Schema{
31+
Type: schema.TypeMap,
32+
Set: schema.HashString,
33+
},
34+
},
35+
},
36+
}
37+
}
38+
39+
func dataSourceCloudProjectContainerRegistryIPRestrictionsManagementRead(d *schema.ResourceData, meta interface{}) error {
40+
config := meta.(*Config)
41+
serviceName := d.Get("service_name").(string)
42+
registryID := d.Get("registry_id").(string)
43+
44+
endpoint := fmt.Sprintf(
45+
"/cloud/project/%s/containerRegistry/%s/ipRestrictions/management",
46+
url.PathEscape(serviceName),
47+
url.PathEscape(registryID),
48+
)
49+
ipRestrictions := []CloudProjectContainerRegistryIPRestriction{}
50+
51+
log.Printf("[DEBUG] Will read Management IP Restrictions from registry %s and project: %s", registryID, serviceName)
52+
err := config.OVHClient.Get(endpoint, &ipRestrictions)
53+
if err != nil {
54+
return fmt.Errorf("calling get %s %w", endpoint, err)
55+
}
56+
57+
mapIPRestrictions := make([]map[string]interface{}, len(ipRestrictions))
58+
for i, ipRestriction := range ipRestrictions {
59+
mapIPRestrictions[i] = ipRestriction.ToMap()
60+
}
61+
d.Set("ip_restrictions", mapIPRestrictions)
62+
d.SetId(serviceName + "/" + registryID)
63+
64+
log.Printf("[DEBUG] Read Management IP Restrictions %+v", mapIPRestrictions)
65+
66+
return nil
67+
}

‎ovh/data_cloud_project_containerregistry_ip_restrictions_management_test.go

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package ovh
2+
3+
import (
4+
"fmt"
5+
"os"
6+
"testing"
7+
8+
"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
9+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
10+
)
11+
12+
const testAccCloudProjectContainerRegistryIPRestrictionsManagementDataSourceConfig = `
13+
data "ovh_cloud_project_capabilities_containerregistry_filter" "registryCap" {
14+
service_name = "%s"
15+
plan_name = "SMALL"
16+
region = "%s"
17+
}
18+
19+
resource "ovh_cloud_project_containerregistry" "registry" {
20+
service_name = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.service_name
21+
plan_id = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.id
22+
name = "%s"
23+
region = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.region
24+
}
25+
26+
resource "ovh_cloud_project_containerregistry_ip_restrictions_management" "my-mgt-iprestrictions" {
27+
service_name = ovh_cloud_project_containerregistry.registry.service_name
28+
registry_id = ovh_cloud_project_containerregistry.registry.id
29+
30+
ip_restrictions = [
31+
{
32+
ip_block = "121.121.121.121/32"
33+
description = "my awesome ip"
34+
}
35+
]
36+
depends_on = [
37+
ovh_cloud_project_containerregistry.registry
38+
]
39+
}
40+
41+
data "ovh_cloud_project_containerregistry_ip_restrictions_management" "mgt-iprestrictions-data" {
42+
service_name = ovh_cloud_project_containerregistry.registry.service_name
43+
registry_id = ovh_cloud_project_containerregistry.registry.id
44+
45+
depends_on = [
46+
ovh_cloud_project_containerregistry_ip_restrictions_management.my-mgt-iprestrictions
47+
]
48+
}
49+
`
50+
51+
func TestAccCloudProjectContainerIPRestrictionsManagementDataSource_basic(t *testing.T) {
52+
serviceName := os.Getenv("OVH_CLOUD_PROJECT_SERVICE_TEST")
53+
region := os.Getenv("OVH_CLOUD_PROJECT_CONTAINERREGISTRY_REGION_TEST")
54+
registryName := acctest.RandomWithPrefix(test_prefix)
55+
56+
config := fmt.Sprintf(
57+
testAccCloudProjectContainerRegistryIPRestrictionsManagementDataSourceConfig,
58+
serviceName,
59+
region,
60+
registryName,
61+
)
62+
63+
resource.Test(t, resource.TestCase{
64+
PreCheck: func() {
65+
testAccPreCheckContainerRegistry(t)
66+
},
67+
Providers: testAccProviders,
68+
Steps: []resource.TestStep{
69+
{
70+
Config: config,
71+
Check: resource.ComposeTestCheckFunc(
72+
resource.TestCheckResourceAttr(
73+
"data.ovh_cloud_project_containerregistry_ip_restrictions_management.mgt-iprestrictions-data", "ip_restrictions.0.ip_block", "121.121.121.121/32"),
74+
resource.TestCheckResourceAttr(
75+
"data.ovh_cloud_project_containerregistry_ip_restrictions_management.mgt-iprestrictions-data", "ip_restrictions.0.description", "my awesome ip"),
76+
),
77+
},
78+
},
79+
})
80+
}

‎ovh/data_cloud_project_containerregistry_ip_restrictions_registry.go

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
package ovh
2+
3+
import (
4+
"fmt"
5+
"log"
6+
"net/url"
7+
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
9+
)
10+
11+
func dataSourceCloudProjectContainerRegistryIPRestrictionsRegistry() *schema.Resource {
12+
return &schema.Resource{
13+
Read: dataSourceCloudProjectContainerRegistryIPRestrictionsRegistryRead,
14+
Schema: map[string]*schema.Schema{
15+
"service_name": {
16+
Type: schema.TypeString,
17+
Description: "Service name",
18+
Required: true,
19+
DefaultFunc: schema.EnvDefaultFunc("OVH_CLOUD_PROJECT_SERVICE", nil),
20+
},
21+
"registry_id": {
22+
Type: schema.TypeString,
23+
Description: "Registry ID",
24+
Required: true,
25+
},
26+
"ip_restrictions": {
27+
Type: schema.TypeList,
28+
Description: "List your IP restrictions applied on artifact manager component",
29+
Computed: true,
30+
Elem: &schema.Schema{
31+
Type: schema.TypeMap,
32+
Set: schema.HashString,
33+
},
34+
},
35+
},
36+
}
37+
}
38+
39+
func dataSourceCloudProjectContainerRegistryIPRestrictionsRegistryRead(d *schema.ResourceData, meta interface{}) error {
40+
config := meta.(*Config)
41+
serviceName := d.Get("service_name").(string)
42+
registryID := d.Get("registry_id").(string)
43+
44+
endpoint := fmt.Sprintf(
45+
"/cloud/project/%s/containerRegistry/%s/ipRestrictions/registry",
46+
url.PathEscape(serviceName),
47+
url.PathEscape(registryID),
48+
)
49+
ipRestrictions := []CloudProjectContainerRegistryIPRestriction{}
50+
51+
log.Printf("[DEBUG] Will read Registry IP Restrictions from registry %s and project: %s", registryID, serviceName)
52+
err := config.OVHClient.Get(endpoint, &ipRestrictions)
53+
if err != nil {
54+
return fmt.Errorf("calling get %s %w", endpoint, err)
55+
}
56+
57+
mapIPRestrictions := make([]map[string]interface{}, len(ipRestrictions))
58+
for i, ipRestriction := range ipRestrictions {
59+
mapIPRestrictions[i] = ipRestriction.ToMap()
60+
}
61+
62+
d.Set("ip_restrictions", mapIPRestrictions)
63+
d.SetId(serviceName + "/" + registryID)
64+
65+
log.Printf("[DEBUG] Read Registry IP Restrictions %+v", mapIPRestrictions)
66+
67+
return nil
68+
}

‎ovh/data_cloud_project_containerregistry_ip_restrictions_registry_test.go

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
package ovh
2+
3+
import (
4+
"fmt"
5+
"os"
6+
"testing"
7+
8+
"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
9+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
10+
)
11+
12+
const testAccCloudProjectContainerRegistryIPRestrictionsRegistryDataSourceConfig = `
13+
data "ovh_cloud_project_capabilities_containerregistry_filter" "registryCap" {
14+
service_name = "%s"
15+
plan_name = "SMALL"
16+
region = "%s"
17+
}
18+
19+
resource "ovh_cloud_project_containerregistry" "registry" {
20+
service_name = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.service_name
21+
plan_id = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.id
22+
name = "%s"
23+
region = data.ovh_cloud_project_capabilities_containerregistry_filter.registryCap.region
24+
}
25+
26+
resource "ovh_cloud_project_containerregistry_ip_restrictions_registry" "my-registry-iprestrictions" {
27+
service_name = ovh_cloud_project_containerregistry.registry.service_name
28+
registry_id = ovh_cloud_project_containerregistry.registry.id
29+
30+
ip_restrictions = [
31+
{
32+
ip_block = "121.121.121.121/32"
33+
description = "my awesome ip"
34+
}
35+
]
36+
depends_on = [
37+
ovh_cloud_project_containerregistry.registry
38+
]
39+
}
40+
41+
data "ovh_cloud_project_containerregistry_ip_restrictions_registry" "registry-iprestrictions-data" {
42+
service_name = ovh_cloud_project_containerregistry.registry.service_name
43+
registry_id = ovh_cloud_project_containerregistry.registry.id
44+
45+
depends_on = [
46+
ovh_cloud_project_containerregistry_ip_restrictions_registry.my-registry-iprestrictions
47+
]
48+
}
49+
`
50+
51+
func TestAccCloudProjectContainerIPRestrictionsRegistryDataSource_basic(t *testing.T) {
52+
serviceName := os.Getenv("OVH_CLOUD_PROJECT_SERVICE_TEST")
53+
region := os.Getenv("OVH_CLOUD_PROJECT_CONTAINERREGISTRY_REGION_TEST")
54+
registryName := acctest.RandomWithPrefix(test_prefix)
55+
56+
config := fmt.Sprintf(
57+
testAccCloudProjectContainerRegistryIPRestrictionsRegistryDataSourceConfig,
58+
serviceName,
59+
region,
60+
registryName,
61+
)
62+
63+
resource.Test(t, resource.TestCase{
64+
PreCheck: func() {
65+
testAccPreCheckContainerRegistry(t)
66+
},
67+
Providers: testAccProviders,
68+
Steps: []resource.TestStep{
69+
{
70+
Config: config,
71+
Check: resource.ComposeTestCheckFunc(
72+
resource.TestCheckResourceAttr(
73+
"data.ovh_cloud_project_containerregistry_ip_restrictions_registry.registry-iprestrictions-data", "ip_restrictions.0.ip_block", "121.121.121.121/32"),
74+
resource.TestCheckResourceAttr(
75+
"data.ovh_cloud_project_containerregistry_ip_restrictions_registry.registry-iprestrictions-data", "ip_restrictions.0.description", "my awesome ip"),
76+
),
77+
},
78+
},
79+
})
80+
}

0 commit comments

Comments
 (0)