Skip to content

Commit 8633ac1

Browse files
trentdibaccotrentdibacco
authored
RADAR-6348: Add hcp_vault_radar_secret_manager_vault_dedicated resource. (#1392)
1 parent ca21eed commit 8633ac1

File tree

13 files changed

+1005
-11
lines changed

13 files changed

+1005
-11
lines changed

‎.changelog/1392.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:feature
2+
Add preview of hcp_vault_radar_secret_manager_vault_dedicated, a new Radar resource to manage integrations with
3+
HCP Vault Dedicated as a secret manager.
4+
```

‎.github/workflows/_testacc_vaultradar.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,11 @@ jobs:
7878
# RADAR_GITHUB_ENTERPRISE_DOMAIN: ${{ secrets.RADAR_GITHUB_ENTERPRISE_DOMAIN }}
7979
# RADAR_GITHUB_ENTERPRISE_TOKEN: ${{ secrets.RADAR_GITHUB_ENTERPRISE_TOKEN }}
8080
# RADAR_GITHUB_ENTERPRISE_TOKEN_2: ${{ secrets.RADAR_GITHUB_ENTERPRISE_TOKEN_2 }}
81-
RADAR_HCP_RESOURCE_NAME: "vault-radar/project/4213bd26-e28e-4e89-b298-6a2abcaf26ca/scan-target/GJLCPNqkmmdbTCMCbdcz"
81+
RADAR_HCP_RESOURCE_NAME: "vault-radar/project/4213bd26-e28e-4e89-b298-6a2abcaf26ca/scan-target/CnDtkwdQKBzLbjLrWTbf"
8282
RADAR_RESOURCES_URI_LIKE_FILTER: "git://github.com/vaultradarcv/hcp-terraform-provider-test-resource.git"
83+
# RADAR_SM_VAULT_DEDICATED_VAULT_URL: ${{ secrets.RADAR_SM_VAULT_DEDICATED_VAULT_URL }}
84+
# RADAR_SM_VAULT_DEDICATED_MOUNT_PATH: ${{ secrets.RADAR_SM_VAULT_DEDICATED_MOUNT_PATH }}
85+
# RADAR_SM_VAULT_DEDICATED_ROLE_NAME: ${{ secrets.RADAR_SM_VAULT_DEDICATED_ROLE_NAME}}
8386
run: |
8487
go test \
8588
./internal/provider/vaultradar \

‎docs/resources/vault_radar_secret_manager_vault_dedicated.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
---
2+
page_title: "hcp_vault_radar_secret_manager_vault_dedicated Resource - terraform-provider-hcp"
3+
subcategory: "HCP Vault Radar"
4+
description: |-
5+
This terraform resource manages a HCP Vault Dedicated secret manager in Vault Radar. See Create a Vault policy https://developer.hashicorp.com/hcp/docs/vault-radar/agent/correlate-vault#create-a-vault-policy for details on creating the auth policy required.
6+
---
7+
8+
# hcp_vault_radar_secret_manager_vault_dedicated (Resource)
9+
10+
-> **Note:** This feature is currently in private beta.
11+
12+
This terraform resource manages a HCP Vault Dedicated secret manager in Vault Radar. See [Create a Vault policy](https://developer.hashicorp.com/hcp/docs/vault-radar/agent/correlate-vault#create-a-vault-policy) for details on creating the auth policy required.
13+
14+
~> **Note:** A Radar agent is required before adding a Radar secret manager resource.
15+
16+
~> **Note:** One of the following authentication methods is required to create a Radar secret manager resource:
17+
- Kubernetes
18+
- AppRole
19+
- Token
20+
21+
~> **Note:** Auth methods need to be configured in the `admin` namespace of the HCP Vault Dedicated cluster.
22+
23+
~> **Note:** Environment variables that correspond to the authentication method being used must be available to the agent.
24+
25+
## Example Usage
26+
27+
```terraform
28+
# Usage with Kubernetes auth method
29+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_1" {
30+
vault_url = "example-1.hashicorp.cloud:8200"
31+
kubernetes = {
32+
mount_path = "kubernetes"
33+
role_name = "vault-radar-role"
34+
}
35+
}
36+
37+
# Usage with AppRole (Push) auth method.
38+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_2" {
39+
vault_url = "example-2.hashicorp.cloud:8200"
40+
approle_push = {
41+
mount_path = "approle"
42+
role_id_env_var = "VAULT_APPROLE_ROLE_ID"
43+
secret_id_env_var = "VAULT_APPROLE_SECRET_ID"
44+
}
45+
}
46+
47+
# Usage with Token auth method
48+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_3" {
49+
vault_url = "example-3.hashicorp.cloud:8200"
50+
token = {
51+
token_env_var = "VAULT_TOKEN"
52+
}
53+
}
54+
```
55+
56+
57+
<!-- schema generated by tfplugindocs -->
58+
## Schema
59+
60+
### Required
61+
62+
- `vault_url` (String) Specify the URL of the Vault instance without protocol. Example: 'acme-public-vault-abc.def.z1.hashicorp.cloud:8200'.
63+
64+
### Optional
65+
66+
- `access_read_write` (Boolean) Indicates if the auth method has read and write access to the secrets engine. Defaults to false. Set this to true if you want to copy secrets to this secret manager as part of remediation process. (see https://developer.hashicorp.com/hcp/docs/vault-radar/remediate-secrets/copy-secrets)
67+
- `approle_push` (Attributes) Configuration for AppRole Push-based authentication. Only one authentication method may be configured. (see [below for nested schema](#nestedatt--approle_push))
68+
- `kubernetes` (Attributes) Configuration for Kubernetes-based authentication. Only one authentication method may be configured. (see [below for nested schema](#nestedatt--kubernetes))
69+
- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.
70+
- `token` (Attributes) Configuration for token-based authentication. Only one authentication method may be configured. (see [below for nested schema](#nestedatt--token))
71+
72+
### Read-Only
73+
74+
- `id` (String) The ID of this resource.
75+
76+
<a id="nestedatt--approle_push"></a>
77+
### Nested Schema for `approle_push`
78+
79+
Required:
80+
81+
- `mount_path` (String) Mount path of the AppRole auth method in Vault. Example 'approle'.
82+
- `role_id_env_var` (String) Environment variable containing the AppRole role ID. Example: 'VAULT_APPROLE_ROLE_ID'.
83+
- `secret_id_env_var` (String) Environment variable containing the AppRole secret ID. Example: 'VAULT_APPROLE_SECRET_ID'.
84+
85+
86+
<a id="nestedatt--kubernetes"></a>
87+
### Nested Schema for `kubernetes`
88+
89+
Required:
90+
91+
- `mount_path` (String) Mount path where the Kubernetes auth method is enabled in Vault. Example 'kubernetes'.
92+
- `role_name` (String) Kubernetes authentication role configured in Vault. Example 'vault-radar-role'.
93+
94+
95+
<a id="nestedatt--token"></a>
96+
### Nested Schema for `token`
97+
98+
Required:
99+
100+
- `token_env_var` (String) Environment variable name containing the Vault token. Example: 'VAULT_TOKEN'.

‎examples/resources/hcp_vault_radar_secret_manager_vault_dedicated/resource.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Usage with Kubernetes auth method
2+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_1" {
3+
vault_url = "example-1.hashicorp.cloud:8200"
4+
kubernetes = {
5+
mount_path = "kubernetes"
6+
role_name = "vault-radar-role"
7+
}
8+
}
9+
10+
# Usage with AppRole (Push) auth method.
11+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_2" {
12+
vault_url = "example-2.hashicorp.cloud:8200"
13+
approle_push = {
14+
mount_path = "approle"
15+
role_id_env_var = "VAULT_APPROLE_ROLE_ID"
16+
secret_id_env_var = "VAULT_APPROLE_SECRET_ID"
17+
}
18+
}
19+
20+
# Usage with Token auth method
21+
resource "hcp_vault_radar_secret_manager_vault_dedicated" "secret_manager_example_3" {
22+
vault_url = "example-3.hashicorp.cloud:8200"
23+
token = {
24+
token_env_var = "VAULT_TOKEN"
25+
}
26+
}

‎go.mod‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@ require (
1313
github.com/hashicorp/go-cty v1.5.0
1414
github.com/hashicorp/go-uuid v1.0.3
1515
github.com/hashicorp/go-version v1.7.0
16-
github.com/hashicorp/hcp-sdk-go v0.159.0
16+
github.com/hashicorp/hcp-sdk-go v0.161.0
1717
github.com/hashicorp/terraform-plugin-docs v0.20.1
1818
github.com/hashicorp/terraform-plugin-framework v1.15.0
1919
github.com/hashicorp/terraform-plugin-framework-validators v0.18.0
2020
github.com/hashicorp/terraform-plugin-go v0.28.0
2121
github.com/hashicorp/terraform-plugin-mux v0.20.0
2222
github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0
23-
github.com/stretchr/testify v1.10.0
23+
github.com/stretchr/testify v1.11.1
2424
golang.org/x/exp v0.0.0-20231006140011-7918f672742d
2525
google.golang.org/grpc v1.72.1
2626
)
@@ -29,6 +29,17 @@ require (
2929
github.com/BurntSushi/toml v1.2.1 // indirect
3030
github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
3131
github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
32+
github.com/go-openapi/swag/cmdutils v0.24.0 // indirect
33+
github.com/go-openapi/swag/conv v0.24.0 // indirect
34+
github.com/go-openapi/swag/fileutils v0.24.0 // indirect
35+
github.com/go-openapi/swag/jsonname v0.24.0 // indirect
36+
github.com/go-openapi/swag/jsonutils v0.24.0 // indirect
37+
github.com/go-openapi/swag/loading v0.24.0 // indirect
38+
github.com/go-openapi/swag/mangling v0.24.0 // indirect
39+
github.com/go-openapi/swag/netutils v0.24.0 // indirect
40+
github.com/go-openapi/swag/stringutils v0.24.0 // indirect
41+
github.com/go-openapi/swag/typeutils v0.24.0 // indirect
42+
github.com/go-openapi/swag/yamlutils v0.24.0 // indirect
3243
github.com/hashicorp/cli v1.1.7 // indirect
3344
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
3445
github.com/mattn/go-runewidth v0.0.9 // indirect
@@ -63,7 +74,7 @@ require (
6374
github.com/go-openapi/jsonreference v0.21.0 // indirect
6475
github.com/go-openapi/loads v0.22.0 // indirect
6576
github.com/go-openapi/spec v0.21.0 // indirect
66-
github.com/go-openapi/swag v0.23.1 // indirect
77+
github.com/go-openapi/swag v0.24.1 // indirect
6778
github.com/go-openapi/validate v0.24.0 // indirect
6879
github.com/go-test/deep v1.1.0 // indirect
6980
github.com/golang/protobuf v1.5.4 // indirect

‎go.sum‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,30 @@ github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9Z
7676
github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
7777
github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
7878
github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
79-
github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
80-
github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
79+
github.com/go-openapi/swag v0.24.1 h1:DPdYTZKo6AQCRqzwr/kGkxJzHhpKxZ9i/oX0zag+MF8=
80+
github.com/go-openapi/swag v0.24.1/go.mod h1:sm8I3lCPlspsBBwUm1t5oZeWZS0s7m/A+Psg0ooRU0A=
81+
github.com/go-openapi/swag/cmdutils v0.24.0 h1:KlRCffHwXFI6E5MV9n8o8zBRElpY4uK4yWyAMWETo9I=
82+
github.com/go-openapi/swag/cmdutils v0.24.0/go.mod h1:uxib2FAeQMByyHomTlsP8h1TtPd54Msu2ZDU/H5Vuf8=
83+
github.com/go-openapi/swag/conv v0.24.0 h1:ejB9+7yogkWly6pnruRX45D1/6J+ZxRu92YFivx54ik=
84+
github.com/go-openapi/swag/conv v0.24.0/go.mod h1:jbn140mZd7EW2g8a8Y5bwm8/Wy1slLySQQ0ND6DPc2c=
85+
github.com/go-openapi/swag/fileutils v0.24.0 h1:U9pCpqp4RUytnD689Ek/N1d2N/a//XCeqoH508H5oak=
86+
github.com/go-openapi/swag/fileutils v0.24.0/go.mod h1:3SCrCSBHyP1/N+3oErQ1gP+OX1GV2QYFSnrTbzwli90=
87+
github.com/go-openapi/swag/jsonname v0.24.0 h1:2wKS9bgRV/xB8c62Qg16w4AUiIrqqiniJFtZGi3dg5k=
88+
github.com/go-openapi/swag/jsonname v0.24.0/go.mod h1:GXqrPzGJe611P7LG4QB9JKPtUZ7flE4DOVechNaDd7Q=
89+
github.com/go-openapi/swag/jsonutils v0.24.0 h1:F1vE1q4pg1xtO3HTyJYRmEuJ4jmIp2iZ30bzW5XgZts=
90+
github.com/go-openapi/swag/jsonutils v0.24.0/go.mod h1:vBowZtF5Z4DDApIoxcIVfR8v0l9oq5PpYRUuteVu6f0=
91+
github.com/go-openapi/swag/loading v0.24.0 h1:ln/fWTwJp2Zkj5DdaX4JPiddFC5CHQpvaBKycOlceYc=
92+
github.com/go-openapi/swag/loading v0.24.0/go.mod h1:gShCN4woKZYIxPxbfbyHgjXAhO61m88tmjy0lp/LkJk=
93+
github.com/go-openapi/swag/mangling v0.24.0 h1:PGOQpViCOUroIeak/Uj/sjGAq9LADS3mOyjznmHy2pk=
94+
github.com/go-openapi/swag/mangling v0.24.0/go.mod h1:Jm5Go9LHkycsz0wfoaBDkdc4CkpuSnIEf62brzyCbhc=
95+
github.com/go-openapi/swag/netutils v0.24.0 h1:Bz02HRjYv8046Ycg/w80q3g9QCWeIqTvlyOjQPDjD8w=
96+
github.com/go-openapi/swag/netutils v0.24.0/go.mod h1:WRgiHcYTnx+IqfMCtu0hy9oOaPR0HnPbmArSRN1SkZM=
97+
github.com/go-openapi/swag/stringutils v0.24.0 h1:i4Z/Jawf9EvXOLUbT97O0HbPUja18VdBxeadyAqS1FM=
98+
github.com/go-openapi/swag/stringutils v0.24.0/go.mod h1:5nUXB4xA0kw2df5PRipZDslPJgJut+NjL7D25zPZ/4w=
99+
github.com/go-openapi/swag/typeutils v0.24.0 h1:d3szEGzGDf4L2y1gYOSSLeK6h46F+zibnEas2Jm/wIw=
100+
github.com/go-openapi/swag/typeutils v0.24.0/go.mod h1:q8C3Kmk/vh2VhpCLaoR2MVWOGP8y7Jc8l82qCTd1DYI=
101+
github.com/go-openapi/swag/yamlutils v0.24.0 h1:bhw4894A7Iw6ne+639hsBNRHg9iZg/ISrOVr+sJGp4c=
102+
github.com/go-openapi/swag/yamlutils v0.24.0/go.mod h1:DpKv5aYuaGm/sULePoeiG8uwMpZSfReo1HR3Ik0yaG8=
81103
github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
82104
github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
83105
github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
@@ -126,8 +148,8 @@ github.com/hashicorp/hc-install v0.9.2 h1:v80EtNX4fCVHqzL9Lg/2xkp62bbvQMnvPQ0G+O
126148
github.com/hashicorp/hc-install v0.9.2/go.mod h1:XUqBQNnuT4RsxoxiM9ZaUk0NX8hi2h+Lb6/c0OZnC/I=
127149
github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
128150
github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
129-
github.com/hashicorp/hcp-sdk-go v0.159.0 h1:HjftKECqpDbC/IHAUILBBzxpY/0HcBmcXK4Y7jUvcc4=
130-
github.com/hashicorp/hcp-sdk-go v0.159.0/go.mod h1:K8clI5eI+fPCauEEdcXgnbpkIwtk5BayzYcTyJz/sss=
151+
github.com/hashicorp/hcp-sdk-go v0.161.0 h1:7DOMGou/w9bd9TgsgiCKZPQwY57Dq+hG+tKEGqbIQ4M=
152+
github.com/hashicorp/hcp-sdk-go v0.161.0/go.mod h1:v2vbpNIrmgUTelW4Z+ur+aQuSPxeaVK3xytFdpEXvSg=
131153
github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
132154
github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
133155
github.com/hashicorp/terraform-exec v0.23.0 h1:MUiBM1s0CNlRFsCLJuM5wXZrzA3MnPYEsiXmzATMW/I=
@@ -239,8 +261,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
239261
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
240262
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
241263
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
242-
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
243-
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
264+
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
265+
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
244266
github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
245267
github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
246268
github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=

‎internal/clients/client.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ import (
6666
radar_connection_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/integration_connection_service"
6767
radar_subscription_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/integration_subscription_service"
6868
radar_resource_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/resource_service"
69+
radar_secret_manager_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/secret_manager_service"
6970

7071
hcpConfig "github.com/hashicorp/hcp-sdk-go/config"
7172
sdk "github.com/hashicorp/hcp-sdk-go/httpclient"
@@ -98,6 +99,7 @@ type Client struct {
9899
RadarConnectionService radar_connection_service.ClientService
99100
RadarSubscriptionService radar_subscription_service.ClientService
100101
RadarResourceService radar_resource_service.ClientService
102+
RadarSecretManagerService radar_secret_manager_service.ClientService
101103
}
102104

103105
// ClientConfig specifies configuration for the client that interacts with HCP
@@ -202,6 +204,7 @@ func NewClient(config ClientConfig) (*Client, error) {
202204
RadarConnectionService: cloud_vault_radar.New(httpClient, nil).IntegrationConnectionService,
203205
RadarSubscriptionService: cloud_vault_radar.New(httpClient, nil).IntegrationSubscriptionService,
204206
RadarResourceService: cloud_vault_radar.New(httpClient, nil).ResourceService,
207+
RadarSecretManagerService: cloud_vault_radar.New(httpClient, nil).SecretManagerService,
205208
}
206209

207210
return client, nil

0 commit comments

Comments
 (0)