Skip to content
This repository has been archived by the owner on Jun 4, 2024. It is now read-only.

add terraform support for Teleport servers #1019

Merged
merged 13 commits into from
Mar 27, 2024

Conversation

hugoShaka
Copy link
Contributor

This PR implements: gravitational/teleport#37624

terraform/protoc-gen-terraform-teleport.yaml Outdated Show resolved Hide resolved
terraform/test/main_test.go Show resolved Hide resolved
terraform/test/server_test.go Outdated Show resolved Hide resolved
terraform/tfschema/validators.go Outdated Show resolved Hide resolved
terraform/tfschema/validators.go Outdated Show resolved Hide resolved
version = "v2"
sub_kind = "openssh"
metadata = {
name = "test"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you test this?

I was testing for the openssh-ec2-ice nodes and it doesn't work if we give it a non-uuid string.

An example that works:

resource "random_uuid" "ec2-random-name" {
}

resource "teleport_server" "my-dev-server" {
  version  = "v2"
  sub_kind = "openssh-ec2-ice"
  metadata = {
    name = "${random_uuid.ec2-random-name.result}"
  }
  spec = {
    addr     = "<ec2 private ip>:22"
    hostname = "my-dev-server"
    cloud_metadata = {
      aws = {
        account_id  = "<account-id>"
        instance_id = "<instance-id>"
        region      = "<region>"
        vpc_id      = "<vpc-id>"
        integration = "<awsoidc-integration-used-for-credentials>"
        subnet_id   = "<subnet-id>"
      }
    }
  }
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you test this?

I was testing for the openssh-ec2-ice nodes and it doesn't work if we give it a non-uuid string.

Do you mean against a real AWS account? No, I only checked that Teleport was accepting the resource in the operator. I don't understand why the eice server name must be a uuid 🤔

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit buried, but it is required to be an uuid because of this
https://github.com/gravitational/teleport/blob/a39c21716b40518f0433b619bb9828d127bd6b77/api/utils/route.go#L41

When I implemented EC2 ICE mode, I closely followed the OpenSSH/Agentless mode.
And I ended up making the same assumptions.

Copy link
Contributor

@tigrato tigrato Mar 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you shouldn't set the name. Instead, you should set the hostid.

Look at the condition here:

         _, err := uuid.Parse(host)
	dialByID := err == nil || aws.IsEC2NodeID(host)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the TF example to not set the name, and added tests for both named and nameless openssh servers.

terraform/Makefile Outdated Show resolved Hide resolved
Comment on lines 122 to 134

{{- if .ForceSetKind }}
{{.VarName}}Resource.Kind = {{.ForceSetKind}}
{{- end}}

{{if .HasCheckAndSetDefaults -}}
err = {{.VarName}}Resource.CheckAndSetDefaults()
if err != nil {
resp.Diagnostics.Append(diagFromWrappedErr("Error setting {{.Name}} defaults", trace.Wrap(err), "{{.Kind}}"))
return
}
{{- end}}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CheckAndSetDefaults and kind setting were moved before

id := {{.VarName}}Resource.Metadata.Name

because the name itself can be changed during this step (e.g. nameless openssh servers).

terraform/gen/main.go Outdated Show resolved Hide resolved
terraform/provider/resource_teleport_access_list.go Outdated Show resolved Hide resolved
terraform/example/server.tf.example Show resolved Hide resolved
terraform/protoc-gen-terraform-teleport.yaml Outdated Show resolved Hide resolved
terraform/test/server_test.go Outdated Show resolved Hide resolved
Co-authored-by: Marco André Dinis <[email protected]>
Copy link
Contributor

@marcoandredinis marcoandredinis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just left a comment

terraform/example/server.tf.example Outdated Show resolved Hide resolved
Copy link
Contributor

@r0mant r0mant left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bot.

@hugoShaka hugoShaka enabled auto-merge (squash) March 27, 2024 19:33
@hugoShaka hugoShaka merged commit 2097188 into master Mar 27, 2024
16 checks passed
@hugoShaka hugoShaka deleted the hugo/provider-suport-sshservers branch March 27, 2024 20:44
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants