Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

db/cassandra: Add support for skip_verification config #2346

Merged
merged 4 commits into from
Oct 28, 2024
Merged

db/cassandra: Add support for skip_verification config #2346

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
15ce0ed
db/cassandra: Add support for skip_verification config
wmrmrx Oct 28, 2024
2ee9c53
Update CHANGELOG.md
wmrmrx Oct 28, 2024
5081f17
Add missing test
wmrmrx Oct 28, 2024
d698db1
Add skip_verification to getConnectionDetailsCassandra
wmrmrx Oct 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
FEATURES:

* Update `vault_database_secret_backend_connection` to support inline TLS config for PostgreSQL ([#2339](https://github.com/hashicorp/terraform-provider-vault/pull/2339))
* Update `vault_database_secret_backend_connection` to support skip_verification config for Cassandra ([#2346](https://github.com/hashicorp/terraform-provider-vault/pull/2346))

## 4.4.0 (Aug 7, 2024)

Expand Down
12 changes: 12 additions & 0 deletions vault/resource_database_secret_backend_connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,12 @@ func getDatabaseSchema(typ schema.ValueType) schemaMap {
Default: 5,
Description: "The number of seconds to use as a connection timeout.",
},
"skip_verification": {
Type: schema.TypeBool,
Optional: true,
Default: false,
Description: "Skip permissions checks when a connection to Cassandra is first created. These checks ensure that Vault is able to create roles, but can be resource intensive in clusters with many roles.",
},
},
},
MaxItems: 1,
Expand Down Expand Up @@ -1041,6 +1047,9 @@ func setCassandraDatabaseConnectionData(d *schema.ResourceData, prefix string, d
if v, ok := d.GetOkExists(prefix + "connect_timeout"); ok {
data["connect_timeout"] = v.(int)
}
if v, ok := d.GetOkExists(prefix + "skip_verification"); ok {
data["skip_verification"] = v.(bool)
}
Comment on lines +1050 to +1052
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we also need to add this field to the read operation as well?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right, the resource is displaying a permanent false -> true drift for the skip_verification field.
I'm still investigating which part of the code needs to be changed to fix this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added here

}

func getConnectionDetailsFromResponse(d *schema.ResourceData, prefix string, resp *api.Secret) map[string]interface{} {
Expand Down Expand Up @@ -2070,6 +2079,9 @@ func getConnectionDetailsCassandra(d *schema.ResourceData, prefix string, resp *
}
result["connect_timeout"] = timeout
}
if v, ok := data["skip_verification"]; ok {
result["skip_verification"] = v.(bool)
}
return result, nil
}
return nil, nil
Expand Down
2 changes: 2 additions & 0 deletions vault/resource_database_secret_backend_connection_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ func TestAccDatabaseSecretBackendConnection_cassandra(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.pem_json", ""),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.protocol_version", "4"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.connect_timeout", "5"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.skip_verification", "false"),
),
},
},
Expand Down Expand Up @@ -159,6 +160,7 @@ func TestAccDatabaseSecretBackendConnection_cassandraProtocol(t *testing.T) {
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.pem_json", ""),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.protocol_version", "5"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.connect_timeout", "5"),
resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "cassandra.0.skip_verification", "false"),
),
},
},
Expand Down
3 changes: 3 additions & 0 deletions website/docs/r/database_secret_backend_connection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,9 @@ Exactly one of the nested blocks of configuration options must be supplied.
* `connect_timeout` - (Optional) The number of seconds to use as a connection
timeout.

* `skip_verification` - (Optional) Skip permissions checks when a connection to Cassandra is first created.
These checks ensure that Vault is able to create roles, but can be resource intensive in clusters with many roles.

### Couchbase Configuration Options

* `hosts` - (Required) A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
Expand Down