From 26e064a613f29ee734ce2bda788258609cc5d8a8 Mon Sep 17 00:00:00 2001 From: michaelkad Date: Wed, 14 Aug 2024 15:35:26 -0500 Subject: [PATCH] [D] Network Security Group [R] Add NSG [R] Add NSG Action [R] Add NSG Member [R] Add NSG Member test Update Provider --- go.mod | 2 +- go.sum | 4 +- ibm/acctest/acctest.go | 6 + ibm/provider/provider.go | 5 + ...ta_source_ibm_pi_network_security_group.go | 320 ++++++++++++++++++ ...urce_ibm_pi_network_security_group_test.go | 38 +++ ...a_source_ibm_pi_network_security_groups.go | 261 ++++++++++++++ ...rce_ibm_pi_network_security_groups_test.go | 35 ++ ibm/service/power/ibm_pi_constants.go | 28 +- .../resource_ibm_pi_network_security_group.go | 320 ++++++++++++++++++ ...ce_ibm_pi_network_security_group_action.go | 163 +++++++++ ...m_pi_network_security_group_action_test.go | 44 +++ ...ce_ibm_pi_network_security_group_member.go | 306 +++++++++++++++++ ...m_pi_network_security_group_member_test.go | 81 +++++ ...urce_ibm_pi_network_security_group_test.go | 104 ++++++ .../pi_network-security-groups.html.markdown | 81 +++++ .../d/pi_network_security_group.html.markdown | 88 +++++ .../r/pi_network_security_group.html.markdown | 89 +++++ ...etwork_security_group_action.html.markdown | 56 +++ ...etwork_security_group_member.html.markdown | 86 +++++ 20 files changed, 2113 insertions(+), 4 deletions(-) create mode 100644 ibm/service/power/data_source_ibm_pi_network_security_group.go create mode 100644 ibm/service/power/data_source_ibm_pi_network_security_group_test.go create mode 100644 ibm/service/power/data_source_ibm_pi_network_security_groups.go create mode 100644 ibm/service/power/data_source_ibm_pi_network_security_groups_test.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group_action.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group_action_test.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group_member.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group_member_test.go create mode 100644 ibm/service/power/resource_ibm_pi_network_security_group_test.go create mode 100644 website/docs/d/pi_network-security-groups.html.markdown create mode 100644 website/docs/d/pi_network_security_group.html.markdown create mode 100644 website/docs/r/pi_network_security_group.html.markdown create mode 100644 website/docs/r/pi_network_security_group_action.html.markdown create mode 100644 website/docs/r/pi_network_security_group_member.html.markdown diff --git a/go.mod b/go.mod index d73aaa801d..8f9c776e5d 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ toolchain go1.22.5 require ( github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20240725064144-454a2ae23113 - github.com/IBM-Cloud/power-go-client v1.7.0 + github.com/IBM-Cloud/power-go-client v1.8.0-beta7 github.com/IBM/apigateway-go-sdk v0.0.0-20210714141226-a5d5d49caaca github.com/IBM/appconfiguration-go-admin-sdk v0.3.0 github.com/IBM/appid-management-go-sdk v0.0.0-20210908164609-dd0e0eaf732f diff --git a/go.sum b/go.sum index ad0cb7525e..fb0cb6d55f 100644 --- a/go.sum +++ b/go.sum @@ -118,8 +118,8 @@ github.com/IBM-Cloud/bluemix-go v0.0.0-20240719075425-078fcb3a55be/go.mod h1:/7h github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20240725064144-454a2ae23113 h1:f2Erqfea1dKpaTFagTJM6W/wnD3JGq/Vn9URh8nuRwk= github.com/IBM-Cloud/container-services-go-sdk v0.0.0-20240725064144-454a2ae23113/go.mod h1:xUQL9SGAjoZFd4GNjrjjtEpjpkgU7RFXRyHesbKTjiY= github.com/IBM-Cloud/ibm-cloud-cli-sdk v0.5.3/go.mod h1:RiUvKuHKTBmBApDMUQzBL14pQUGKcx/IioKQPIcRQjs= -github.com/IBM-Cloud/power-go-client v1.7.0 h1:/GuGwPMTKoCZACfnwt7b6wKr4v32q1VO1AMFGNETRN4= -github.com/IBM-Cloud/power-go-client v1.7.0/go.mod h1:9izycYAmNQ+NAdVPXDC3fHYxqWLjlR2YiwqKYveMv5Y= +github.com/IBM-Cloud/power-go-client v1.8.0-beta7 h1:Demsd49LqqnoAVc6cNS3taDgmX5sJyC38gpCEKW0N1k= +github.com/IBM-Cloud/power-go-client v1.8.0-beta7/go.mod h1:oAkZiHX25cmr2Yun5V0q6CpnUemegvSrpcEy/oQcjzU= github.com/IBM-Cloud/softlayer-go v1.0.5-tf h1:koUAyF9b6X78lLLruGYPSOmrfY2YcGYKOj/Ug9nbKNw= github.com/IBM-Cloud/softlayer-go v1.0.5-tf/go.mod h1:6HepcfAXROz0Rf63krk5hPZyHT6qyx2MNvYyHof7ik4= github.com/IBM/apigateway-go-sdk v0.0.0-20210714141226-a5d5d49caaca h1:crniVcf+YcmgF03NmmfonXwSQ73oJF+IohFYBwknMxs= diff --git a/ibm/acctest/acctest.go b/ibm/acctest/acctest.go index ba2c8a4c5b..286664ee88 100644 --- a/ibm/acctest/acctest.go +++ b/ibm/acctest/acctest.go @@ -217,6 +217,7 @@ var ( Pi_instance_name string Pi_key_name string Pi_network_name string + Pi_network_security_group_id string Pi_placement_group_name string Pi_replication_volume_name string Pi_resource_group_id string @@ -1049,6 +1050,11 @@ func init() { fmt.Println("[INFO] Set the environment variable PI_NETWORK_NAME for testing ibm_pi_network_name resource else it is set to default value 'terraform-test-power'") } + Pi_network_security_group_id = os.Getenv("PI_NETWORK_SECURITY_GROUP_ID") + if Pi_network_security_group_id == "" { + Pi_network_security_group_id = "terraform-test-power" + fmt.Println("[INFO] Set the environment variable PI_NETWORK_SECURITY_GROUP_ID for testing ibm_pi_network_security_group resource else it is set to default value 'terraform-test-power'") + } Pi_volume_name = os.Getenv("PI_VOLUME_NAME") if Pi_volume_name == "" { Pi_volume_name = "terraform-test-power" diff --git a/ibm/provider/provider.go b/ibm/provider/provider.go index 8dccade6f8..bd137569ae 100644 --- a/ibm/provider/provider.go +++ b/ibm/provider/provider.go @@ -651,6 +651,8 @@ func Provider() *schema.Provider { "ibm_pi_key": power.DataSourceIBMPIKey(), "ibm_pi_keys": power.DataSourceIBMPIKeys(), "ibm_pi_network_port": power.DataSourceIBMPINetworkPort(), + "ibm_pi_network_security_group": power.DataSourceIBMPINetworkSecurityGroup(), + "ibm_pi_network-security-groups": power.DataSourceIBMPINetworkSecurityGroups(), "ibm_pi_network": power.DataSourceIBMPINetwork(), "ibm_pi_networks": power.DataSourceIBMPINetworks(), "ibm_pi_placement_group": power.DataSourceIBMPIPlacementGroup(), @@ -1285,6 +1287,9 @@ func Provider() *schema.Provider { "ibm_pi_ipsec_policy": power.ResourceIBMPIIPSecPolicy(), "ibm_pi_key": power.ResourceIBMPIKey(), "ibm_pi_network_port_attach": power.ResourceIBMPINetworkPortAttach(), + "ibm_pi_network_security_group_action": power.ResourceIBMPINetworkSecurityGroupAction(), + "ibm_pi_network_security_group_member": power.ResourceIBMPINetworkSecurityGroupMember(), + "ibm_pi_network_security_group": power.ResourceIBMPINetworkSecurityGroup(), "ibm_pi_network": power.ResourceIBMPINetwork(), "ibm_pi_placement_group": power.ResourceIBMPIPlacementGroup(), "ibm_pi_shared_processor_pool": power.ResourceIBMPISharedProcessorPool(), diff --git a/ibm/service/power/data_source_ibm_pi_network_security_group.go b/ibm/service/power/data_source_ibm_pi_network_security_group.go new file mode 100644 index 0000000000..6bdf13c11b --- /dev/null +++ b/ibm/service/power/data_source_ibm_pi_network_security_group.go @@ -0,0 +1,320 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power + +import ( + "context" + + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + "github.com/IBM-Cloud/power-go-client/power/models" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" +) + +func DataSourceIBMPINetworkSecurityGroup() *schema.Resource { + return &schema.Resource{ + ReadContext: dataSourceIBMPINetworkSecurityGroupRead, + + Schema: map[string]*schema.Schema{ + // Arguments + Arg_CloudInstanceID: { + Description: "The GUID of the service instance associated with an account.", + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + Arg_NetworkSecurityGroupID: { + Description: "network security group ID.", + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + // Attributes + Attr_CRN: { + Computed: true, + Description: "The network security group's crn.", + Type: schema.TypeString, + }, + Attr_Members: { + Computed: true, + Description: "The list of IPv4 addresses and, or network interfaces in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the member in a network security group.", + Type: schema.TypeString, + }, + Attr_MacAddress: { + Computed: true, + Description: "The mac address of a network interface included if the type is network-interface.", + Type: schema.TypeString, + }, + Attr_Target: { + Computed: true, + Description: "If ipv4-address type, then IPv4 address or if network-interface type, then network interface ID.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of member.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Name: { + Computed: true, + Description: "The name of the network security group.", + Type: schema.TypeString, + }, + Attr_Rules: { + Computed: true, + Description: "The list of rules in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Action: { + Computed: true, + Description: "The action to take if the rule matches network traffic.", + Type: schema.TypeString, + }, + Attr_DestinationPort: { + Computed: true, + Description: "The list of destination port.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_ID: { + Computed: true, + Description: "The ID of the rule in a network security group.", + Type: schema.TypeString, + }, + Attr_Name: { + Computed: true, + Description: "The unique name of the network security group rule.", + Type: schema.TypeString, + }, + Attr_Protocol: { + Computed: true, + Description: "The list of protocol.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ICMTypes: { + Computed: true, + Description: "If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched.", + Elem: &schema.Schema{ + Type: schema.TypeFloat, + }, + Type: schema.TypeList, + }, + Attr_TCPFlags: { + Computed: true, + Description: "If tcp type, the list of TCP flags and if not present then all flags are matched.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Flag: { + Computed: true, + Description: "TCP flag.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Type: { + Computed: true, + Description: "The protocol of the network traffic.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Remote: { + Computed: true, + Description: "List of remote.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the remote Network Address Group or network security group the rules apply to. Not required for default-network-address-group.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of remote group the rules apply to.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_SourcePort: { + Computed: true, + Description: "ist of source port", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_UserTags: { + Computed: true, + Description: "The user tags associated with this resource.", + Elem: &schema.Schema{Type: schema.TypeString}, + Type: schema.TypeList, + }, + }, + } +} + +func dataSourceIBMPINetworkSecurityGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + + networkSecurityGroup, err := nsgClient.Get(d.Get(Arg_NetworkSecurityGroupID).(string)) + if err != nil { + return diag.FromErr(err) + } + + d.SetId(*networkSecurityGroup.ID) + d.Set(Attr_CRN, networkSecurityGroup.Crn) + + if networkSecurityGroup.Members != nil { + members := []map[string]interface{}{} + for _, mbr := range networkSecurityGroup.Members { + mbrMap := networkSecurityGroupMemberToMap(mbr) + members = append(members, mbrMap) + } + d.Set(Attr_Members, members) + } + + d.Set(Attr_Name, networkSecurityGroup.Name) + + if networkSecurityGroup.Rules != nil { + rules := []map[string]interface{}{} + for _, rule := range networkSecurityGroup.Rules { + ruleMap := networkSecurityGroupRuleToMap(rule) + rules = append(rules, ruleMap) + } + d.Set(Attr_Rules, rules) + } + + if len(networkSecurityGroup.UserTags) > 0 { + d.Set(Attr_UserTags, networkSecurityGroup.UserTags) + } + + return nil +} + +func networkSecurityGroupMemberToMap(mbr *models.NetworkSecurityGroupMember) map[string]interface{} { + mbrMap := make(map[string]interface{}) + mbrMap[Attr_ID] = mbr.ID + if mbr.MacAddress != "" { + mbrMap[Attr_MacAddress] = mbr.MacAddress + } + mbrMap[Attr_Target] = mbr.Target + mbrMap[Attr_Type] = mbr.Type + return mbrMap +} + +func networkSecurityGroupRuleToMap(rule *models.NetworkSecurityGroupRule) map[string]interface{} { + ruleMap := make(map[string]interface{}) + ruleMap[Attr_Action] = rule.Action + if rule.DestinationPort != nil { + destinationPortMap := networkSecurityGroupRulePortToMap(rule.DestinationPort) + ruleMap[Attr_DestinationPort] = []map[string]interface{}{destinationPortMap} + } + + ruleMap[Attr_ID] = rule.ID + ruleMap[Attr_Name] = rule.Name + + protocolMap := networkSecurityGroupRuleProtocolToMap(rule.Protocol) + ruleMap[Attr_Protocol] = []map[string]interface{}{protocolMap} + + remoteMap := networkSecurityGroupRuleRemoteToMap(rule.Remote) + + ruleMap[Attr_Remote] = []map[string]interface{}{remoteMap} + + if rule.SourcePort != nil { + sourcePortMap := networkSecurityGroupRulePortToMap(rule.SourcePort) + ruleMap[Attr_SourcePort] = []map[string]interface{}{sourcePortMap} + } + + return ruleMap +} + +func networkSecurityGroupRulePortToMap(port *models.NetworkSecurityGroupRulePort) map[string]interface{} { + portMap := make(map[string]interface{}) + portMap[Attr_Maximum] = port.Maximum + portMap[Attr_Minimum] = port.Minimum + return portMap +} + +func networkSecurityGroupRuleProtocolToMap(protocol *models.NetworkSecurityGroupRuleProtocol) map[string]interface{} { + protocolMap := make(map[string]interface{}) + if protocol.IcmpTypes != nil { + protocolMap[Attr_ICMTypes] = protocol.IcmpTypes + } + if protocol.TCPFlags != nil { + tcpFlags := []map[string]interface{}{} + for _, tcpFlagsItem := range protocol.TCPFlags { + tcpFlagsItemMap := make(map[string]interface{}) + tcpFlagsItemMap[Attr_Flag] = tcpFlagsItem.Flag + tcpFlags = append(tcpFlags, tcpFlagsItemMap) + } + protocolMap[Attr_TCPFlags] = tcpFlags + } + if protocol.Type != "" { + protocolMap[Attr_Type] = protocol.Type + } + return protocolMap +} + +func networkSecurityGroupRuleRemoteToMap(remote *models.NetworkSecurityGroupRuleRemote) map[string]interface{} { + remoteMap := make(map[string]interface{}) + if remote.ID != "" { + remoteMap[Attr_ID] = remote.ID + } + if remote.Type != "" { + remoteMap[Attr_Type] = remote.Type + } + return remoteMap +} diff --git a/ibm/service/power/data_source_ibm_pi_network_security_group_test.go b/ibm/service/power/data_source_ibm_pi_network_security_group_test.go new file mode 100644 index 0000000000..5655784dfe --- /dev/null +++ b/ibm/service/power/data_source_ibm_pi_network_security_group_test.go @@ -0,0 +1,38 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power_test + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + + acc "github.com/IBM-Cloud/terraform-provider-ibm/ibm/acctest" +) + +func TestAccIBMPINetworkSecurityGroupDataSourceBasic(t *testing.T) { + resource.Test(t, resource.TestCase{ + PreCheck: func() { acc.TestAccPreCheck(t) }, + Providers: acc.TestAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccCheckIBMPINetworkSecurityGroupDataSourceConfigBasic(), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttrSet("data.ibm_pi_network_security_group.network_security_group", "id"), + resource.TestCheckResourceAttrSet("data.ibm_pi_network_security_group.network_security_group", "crn"), + resource.TestCheckResourceAttrSet("data.ibm_pi_network_security_group.network_security_group", "name"), + ), + }, + }, + }) +} + +func testAccCheckIBMPINetworkSecurityGroupDataSourceConfigBasic() string { + return fmt.Sprintf(` + data "ibm_pi_network_security_group" "network_security_group" { + pi_cloud_instance_id = "%s" + pi_network_security_group_id = "%s" + }`, acc.Pi_cloud_instance_id, acc.Pi_network_security_group_id) +} diff --git a/ibm/service/power/data_source_ibm_pi_network_security_groups.go b/ibm/service/power/data_source_ibm_pi_network_security_groups.go new file mode 100644 index 0000000000..d4c55a1f6a --- /dev/null +++ b/ibm/service/power/data_source_ibm_pi_network_security_groups.go @@ -0,0 +1,261 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power + +import ( + "context" + + "github.com/hashicorp/go-uuid" + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + "github.com/IBM-Cloud/power-go-client/power/models" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" +) + +func DataSourceIBMPINetworkSecurityGroups() *schema.Resource { + return &schema.Resource{ + ReadContext: dataSourceIBMPINetworkSecurityGroupsRead, + + Schema: map[string]*schema.Schema{ + // Arguments + Arg_CloudInstanceID: { + Description: "The GUID of the service instance associated with an account.", + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + // Attributes + Attr_NetworkSecurityGroups: { + Computed: true, + Description: "list of Network Security Groups.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_CRN: { + Computed: true, + Description: "The network security group's crn.", + Type: schema.TypeString, + }, + Attr_Members: { + Computed: true, + Description: "The list of IPv4 addresses and, or network interfaces in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the member in a network security group.", + Type: schema.TypeString, + }, + Attr_MacAddress: { + Computed: true, + Description: "The mac address of a network interface included if the type is network-interface.", + Type: schema.TypeString, + }, + Attr_Target: { + Computed: true, + Description: "If ipv4-address type, then IPv4 address or if network-interface type, then network interface ID.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of member.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Name: { + Computed: true, + Description: "The name of the network security group.", + Type: schema.TypeString, + }, + Attr_Rules: { + Computed: true, + Description: "The list of rules in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Action: { + Computed: true, + Description: "The action to take if the rule matches network traffic.", + Type: schema.TypeString, + }, + Attr_DestinationPort: { + Computed: true, + Description: "The list of destination port.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_ID: { + Computed: true, + Description: "The ID of the rule in a network security group.", + Type: schema.TypeString, + }, + Attr_Name: { + Computed: true, + Description: "The unique name of the network security group rule.", + Type: schema.TypeString, + }, + Attr_Protocol: { + Computed: true, + Description: "The list of protocol.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ICMTypes: { + Computed: true, + Description: "If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched.", + Elem: &schema.Schema{ + Type: schema.TypeFloat, + }, + Type: schema.TypeList, + }, + Attr_TCPFlags: { + Computed: true, + Description: "If tcp type, the list of TCP flags and if not present then all flags are matched.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Flag: { + Computed: true, + Description: "TCP flag.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Type: { + Computed: true, + Description: "The protocol of the network traffic.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Remote: { + Computed: true, + Description: "List of remote.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the remote Network Address Group or network security group the rules apply to. Not required for default-network-address-group.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of remote group the rules apply to.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_SourcePort: { + Computed: true, + Description: "List of source port", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_UserTags: { + Computed: true, + Description: "The user tags associated with this resource.", + Elem: &schema.Schema{Type: schema.TypeString}, + Type: schema.TypeList, + }, + }, + }, + Type: schema.TypeList, + }, + }, + } +} + +func dataSourceIBMPINetworkSecurityGroupsRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + nsgResp, err := nsgClient.GetAll() + if err != nil { + return diag.FromErr(err) + } + + var clientgenU, _ = uuid.GenerateUUID() + d.SetId(clientgenU) + + networkSecurityGroups := []map[string]interface{}{} + if nsgResp.NetworkSecurityGroups != nil { + for _, nsg := range nsgResp.NetworkSecurityGroups { + networkSecurityGroup := networkSecurityGroupToMap(nsg) + networkSecurityGroups = append(networkSecurityGroups, networkSecurityGroup) + } + } + + d.Set(Attr_NetworkSecurityGroups, networkSecurityGroups) + + return nil +} + +func networkSecurityGroupToMap(nsg *models.NetworkSecurityGroup) map[string]interface{} { + networkSecurityGroup := make(map[string]interface{}) + networkSecurityGroup[Attr_CRN] = nsg.Crn + networkSecurityGroup[Attr_ID] = nsg.ID + if nsg.Members != nil { + members := []map[string]interface{}{} + for _, mbr := range nsg.Members { + mbrMap := networkSecurityGroupMemberToMap(mbr) + members = append(members, mbrMap) + } + networkSecurityGroup[Attr_Members] = members + } + networkSecurityGroup[Attr_Name] = nsg.Name + if nsg.Rules != nil { + rules := []map[string]interface{}{} + for _, rule := range nsg.Rules { + rulesItemMap := networkSecurityGroupRuleToMap(rule) + rules = append(rules, rulesItemMap) + } + networkSecurityGroup[Attr_Rules] = rules + } + if nsg.UserTags != nil { + networkSecurityGroup[Attr_UserTags] = nsg.UserTags + } + return networkSecurityGroup +} diff --git a/ibm/service/power/data_source_ibm_pi_network_security_groups_test.go b/ibm/service/power/data_source_ibm_pi_network_security_groups_test.go new file mode 100644 index 0000000000..7d3c9abf05 --- /dev/null +++ b/ibm/service/power/data_source_ibm_pi_network_security_groups_test.go @@ -0,0 +1,35 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power_test + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + + acc "github.com/IBM-Cloud/terraform-provider-ibm/ibm/acctest" +) + +func TestAccIBMPINetworkSecurityGroupsDataSourceBasic(t *testing.T) { + resource.Test(t, resource.TestCase{ + PreCheck: func() { acc.TestAccPreCheck(t) }, + Providers: acc.TestAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccCheckIBMPINetworkSecurityGroupsDataSourceConfigBasic(), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttrSet("data.ibm_pi_network_security_groups.network_security_groups", "id"), + ), + }, + }, + }) +} + +func testAccCheckIBMPINetworkSecurityGroupsDataSourceConfigBasic() string { + return fmt.Sprintf(` + data "ibm_pi_network_security_groups" "network_security_groups" { + pi_cloud_instance_id = "%s" + }`, acc.Pi_cloud_instance_id) +} diff --git a/ibm/service/power/ibm_pi_constants.go b/ibm/service/power/ibm_pi_constants.go index 3e76559db8..e094201b41 100644 --- a/ibm/service/power/ibm_pi_constants.go +++ b/ibm/service/power/ibm_pi_constants.go @@ -45,6 +45,8 @@ const ( Arg_Name = "pi_name" Arg_Network = "pi_network" Arg_NetworkName = "pi_network_name" + Arg_NetworkSecurityGroupID = "pi_network_security_group_id" + Arg_PIInstanceSharedProcessorPool = "pi_shared_processor_pool" Arg_PinPolicy = "pi_pin_policy" Arg_PlacementGroupID = "pi_placement_group_id" Arg_PlacementGroupName = "pi_placement_group_name" @@ -82,8 +84,11 @@ const ( Arg_StoragePoolAffinity = "pi_storage_pool_affinity" Arg_StorageType = "pi_storage_type" Arg_SysType = "pi_sys_type" + Arg_Target = "pi_target" Arg_TargetStorageTier = "pi_target_storage_tier" + Arg_Type = "pi_type" Arg_UserData = "pi_user_data" + Arg_UserTags = "pi_user_tags" Arg_VirtualCoresAssigned = "pi_virtual_cores_assigned" Arg_VirtualOpticalDevice = "pi_virtual_optical_device" Arg_VolumeCloneName = "pi_volume_clone_name" @@ -158,9 +163,11 @@ const ( Attr_DeleteOnTermination = "delete_on_termination" Attr_DeploymentType = "deployment_type" Attr_Description = "description" + Attr_DestinationPort = "destination_port" Attr_Details = "details" Attr_DhcpID = "dhcp_id" Attr_DhcpManaged = "dhcp_managed" + Attr_Direction = "direction" Attr_DisasterRecoveryLocations = "disaster_recovery_locations" Attr_DiskFormat = "disk_format" Attr_DiskType = "disk_type" @@ -172,6 +179,7 @@ const ( Attr_FailureMessage = "failure_message" Attr_FailureReason = "failure_reason" Attr_Fault = "fault" + Attr_Flag = "flag" Attr_FlashCopyMappings = "flash_copy_mappings" Attr_FlashCopyName = "flash_copy_name" Attr_FreezeTime = "freeze_time" @@ -195,6 +203,7 @@ const ( Attr_IBMiPHA = "ibmi_pha" Attr_IBMiRDS = "ibmi_rds" Attr_IBMiRDSUsers = "ibmi_rds_users" + Attr_ICMTypes = "icmp_types" Attr_ID = "id" Attr_ImageID = "image_id" Attr_ImageInfo = "image_info" @@ -233,6 +242,7 @@ const ( Attr_MaxAllocationSize = "max_allocation_size" Attr_MaxAvailable = "max_available" Attr_MaxCoresAvailable = "max_cores_available" + Attr_Maximum = "maximum" Attr_MaximumStorageAllocation = "max_storage_allocation" Attr_MaxMem = "maxmem" Attr_MaxMemory = "max_memory" @@ -246,6 +256,7 @@ const ( Attr_Metered = "metered" Attr_MigrationStatus = "migration_status" Attr_Min = "min" + Attr_Minimum = "minimum" Attr_MinMem = "minmem" Attr_MinMemory = "min_memory" Attr_MinProc = "minproc" @@ -258,6 +269,8 @@ const ( Attr_NetworkName = "network_name" Attr_NetworkPorts = "network_ports" Attr_Networks = "networks" + Attr_NetworkSecurityGroupID = "network_security_group_id" + Attr_NetworkSecurityGroups = "network_security_groups" Attr_NumberOfVolumes = "number_of_volumes" Attr_Onboardings = "onboardings" Attr_OperatingSystem = "operating_system" @@ -280,11 +293,13 @@ const ( Attr_ProfileID = "profile_id" Attr_Profiles = "profiles" Attr_Progress = "progress" + Attr_Protocol = "protocol" Attr_PublicIP = "public_ip" Attr_PVMInstanceID = "pvm_instance_id" Attr_PVMInstances = "pvm_instances" Attr_PVMSnapshots = "pvm_snapshots" Attr_Region = "region" + Attr_Remote = "remote" Attr_RemoteCopyID = "remote_copy_id" Attr_RemoteCopyRelationshipNames = "remote_copy_relationship_names" Attr_RemoteCopyRelationships = "remote_copy_relationships" @@ -297,6 +312,7 @@ const ( Attr_ReservedMemory = "reserved_memory" Attr_ResultsOnboardedVolumes = "results_onboarded_volumes" Attr_ResultsVolumeOnboardingFailures = "results_volume_onboarding_failures" + Attr_Rules = "rules" Attr_SAPS = "saps" Attr_Secondaries = "secondaries" Attr_ServerName = "server_name" @@ -323,6 +339,7 @@ const ( Attr_SharedProcessorPoolStatusDetail = "status_detail" Attr_Size = "size" Attr_SnapshotID = "snapshot_id" + Attr_SourcePort = "source_port" Attr_SourceVolumeID = "source_volume_id" Attr_SourceVolumeName = "source_volume_name" Attr_Speed = "speed" @@ -349,8 +366,10 @@ const ( Attr_Systems = "systems" Attr_SysType = "sys_type" Attr_Systype = "systype" + Attr_Target = "target" Attr_TargetVolumeName = "target_volume_name" Attr_TaskID = "task_id" + Attr_TCPFlags = "tcp_flags" Attr_TenantID = "tenant_id" Attr_TenantName = "tenant_name" Attr_TotalCapacity = "total_capacity" @@ -369,6 +388,7 @@ const ( Attr_UsedIPPercent = "used_ip_percent" Attr_UsedMemory = "used_memory" Attr_UserIPAddress = "user_ip_address" + Attr_UserTags = "user_tags" Attr_VCPUs = "vcpus" Attr_Vendor = "vendor" Attr_VirtualCoresAssigned = "virtual_cores_assigned" @@ -423,11 +443,15 @@ const ( DeploymentTypeEpic = "EPIC" DeploymentTypeVMNoStorage = "VMNoStorage" DHCPVlan = "dhcp-vlan" + Disable = "disable" + Enable = "enable" Hana = "Hana" Hard = "hard" Host = "host" HostGroup = "hostGroup" + IPV4_Address = "ipv4-address" Netweaver = "Netweaver" + Network_Interface = "network-interface" None = "none" OK = "OK" Prefix = "prefix" @@ -460,6 +484,7 @@ const ( State_Build = "build" State_Building = "building" State_Completed = "completed" + State_Configuring = "configuring" State_Creating = "creating" State_Deleted = "deleted" State_Deleting = "deleting" @@ -477,12 +502,13 @@ const ( State_PendingReclamation = "pending_reclamation" State_Provisioning = "provisioning" State_Removed = "removed" + State_Removing = "removing" State_Resize = "resize" State_RESIZE = "RESIZE" State_Retry = "retry" State_Shutoff = "shutoff" - State_Stopping = "stopping" State_SHUTOFF = "SHUTOFF" + State_Stopping = "stopping" State_Up = "up" State_VerifyResize = "verify_resize" Status_Active = "ACTIVE" diff --git a/ibm/service/power/resource_ibm_pi_network_security_group.go b/ibm/service/power/resource_ibm_pi_network_security_group.go new file mode 100644 index 0000000000..351a1c1fc8 --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group.go @@ -0,0 +1,320 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power + +import ( + "context" + "fmt" + + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" + + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + "github.com/IBM-Cloud/power-go-client/power/models" +) + +func ResourceIBMPINetworkSecurityGroup() *schema.Resource { + return &schema.Resource{ + CreateContext: resourceIBMPINetworkSecurityGroupCreate, + ReadContext: resourceIBMPINetworkSecurityGroupRead, + UpdateContext: resourceIBMPINetworkSecurityGroupUpdate, + DeleteContext: resourceIBMPINetworkSecurityGroupDelete, + Importer: &schema.ResourceImporter{}, + + Schema: map[string]*schema.Schema{ + // Arguments + Arg_CloudInstanceID: { + Description: "The GUID of the service instance associated with an account.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + Arg_Name: { + Description: "The name of the network security group.", + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + Arg_UserTags: { + Description: "The user tags associated with this resource.", + Elem: &schema.Schema{Type: schema.TypeString}, + ForceNew: true, + Optional: true, + Type: schema.TypeList, + }, + // Attributes + Attr_CRN: { + Computed: true, + Description: "The network security group's crn.", + Type: schema.TypeString, + }, + Attr_Members: { + Computed: true, + Description: "The list of IPv4 addresses and, or network interfaces in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the member in a network security group.", + Type: schema.TypeString, + }, + Attr_MacAddress: { + Computed: true, + Description: "The mac address of a network interface included if the type is network-interface.", + Type: schema.TypeString, + }, + Attr_Target: { + Computed: true, + Description: "If ipv4-address type, then IPv4 address or if network-interface type, then network interface ID.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of member.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_NetworkSecurityGroupID: { + Computed: true, + Description: "The unique identifier of the network security group.", + Type: schema.TypeString, + }, + Attr_Rules: { + Computed: true, + Description: "The list of rules in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Action: { + Computed: true, + Description: "The action to take if the rule matches network traffic.", + Type: schema.TypeString, + }, + Attr_DestinationPort: { + Computed: true, + Description: "The list of destination port.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_ID: { + Computed: true, + Description: "The ID of the rule in a network security group.", + Type: schema.TypeString, + }, + Attr_Name: { + Computed: true, + Description: "The unique name of the network security group rule.", + Type: schema.TypeString, + }, + Attr_Protocol: { + Computed: true, + Description: "The list of protocol.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ICMTypes: { + Computed: true, + Description: "If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched.", + Elem: &schema.Schema{ + Type: schema.TypeFloat, + }, + Type: schema.TypeList, + }, + Attr_TCPFlags: { + Computed: true, + Description: "If tcp type, the list of TCP flags and if not present then all flags are matched.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Flag: { + Computed: true, + Description: "TCP flag.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Type: { + Computed: true, + Description: "The protocol of the network traffic.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Remote: { + Computed: true, + Description: "List of remote.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the remote Network Address Group or network security group the rules apply to. Not required for default-network-address-group.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of remote group the rules apply to.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_SourcePort: { + Computed: true, + Description: "ist of source port", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + }, + }, + Type: schema.TypeList, + }, + }, + } +} + +func resourceIBMPINetworkSecurityGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + name := d.Get(Arg_Name).(string) + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + + body := &models.NetworkSecurityGroupCreate{ + Name: &name, + } + if v, ok := d.GetOk(Arg_UserTags); ok { + var userTags []string + for _, v := range v.([]interface{}) { + userTag := v.(string) + userTags = append(userTags, userTag) + } + body.UserTags = userTags + } + + networkSecurityGroup, err := nsgClient.Create(body) + if err != nil { + return diag.FromErr(err) + } + nsgID := *networkSecurityGroup.ID + d.SetId(fmt.Sprintf("%s/%s", cloudInstanceID, nsgID)) + + return resourceIBMPINetworkSecurityGroupRead(ctx, d, meta) +} + +func resourceIBMPINetworkSecurityGroupRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + cloudInstanceID, nsgID, err := splitID(d.Id()) + if err != nil { + return diag.FromErr(err) + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + networkSecurityGroup, err := nsgClient.Get(nsgID) + if err != nil { + return diag.FromErr(err) + } + d.Set(Attr_CRN, networkSecurityGroup.Crn) + + if networkSecurityGroup.Members != nil { + members := []map[string]interface{}{} + for _, mbr := range networkSecurityGroup.Members { + mbrMap := networkSecurityGroupMemberToMap(mbr) + members = append(members, mbrMap) + } + d.Set(Attr_Members, members) + } + d.Set(Arg_Name, networkSecurityGroup.Name) + d.Set(Attr_NetworkSecurityGroupID, networkSecurityGroup.ID) + if networkSecurityGroup.Rules != nil { + rules := []map[string]interface{}{} + for _, rule := range networkSecurityGroup.Rules { + ruleMap := networkSecurityGroupRuleToMap(rule) + rules = append(rules, ruleMap) + } + d.Set(Attr_Rules, rules) + } + + return nil +} + +func resourceIBMPINetworkSecurityGroupUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + cloudInstanceID, nsgID, err := splitID(d.Id()) + if err != nil { + return diag.FromErr(err) + } + if d.HasChange(Arg_Name) { + body := &models.NetworkSecurityGroupUpdate{ + Name: d.Get(Arg_Name).(string), + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + _, err = nsgClient.Update(nsgID, body) + if err != nil { + return diag.FromErr(err) + } + } + return resourceIBMPINetworkSecurityGroupRead(ctx, d, meta) +} + +func resourceIBMPINetworkSecurityGroupDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + cloudInstanceID, nsgID, err := splitID(d.Id()) + if err != nil { + return diag.FromErr(err) + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + err = nsgClient.Delete(nsgID) + if err != nil { + return diag.FromErr(err) + } + d.SetId("") + + return nil +} diff --git a/ibm/service/power/resource_ibm_pi_network_security_group_action.go b/ibm/service/power/resource_ibm_pi_network_security_group_action.go new file mode 100644 index 0000000000..139c5283b0 --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group_action.go @@ -0,0 +1,163 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power + +import ( + "context" + "fmt" + "time" + + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + "github.com/IBM-Cloud/power-go-client/power/models" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/validate" +) + +func ResourceIBMPINetworkSecurityGroupAction() *schema.Resource { + return &schema.Resource{ + CreateContext: resourceIBMPINetworkSecurityGroupActionCreate, + ReadContext: resourceIBMPINetworkSecurityGroupActionRead, + UpdateContext: resourceIBMPINetworkSecurityGroupActionUpdate, + DeleteContext: resourceIBMPINetworkSecurityGroupActionDelete, + Importer: &schema.ResourceImporter{}, + + Timeouts: &schema.ResourceTimeout{ + Create: schema.DefaultTimeout(5 * time.Minute), + Update: schema.DefaultTimeout(5 * time.Minute), + }, + + Schema: map[string]*schema.Schema{ + // Arguments + Arg_CloudInstanceID: { + Description: "The GUID of the service instance associated with an account.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + Arg_Action: { + Description: "Name of the action to take; can be enable to enable NSGs in a workspace or disable to disable NSGs in a workspace.", + Required: true, + Type: schema.TypeString, + ValidateFunc: validate.ValidateAllowedStringValues([]string{Disable, Enable}), + }, + // Attribute + Attr_State: { + Computed: true, + Description: "The workspace network security group's state.", + Type: schema.TypeString, + }, + }, + } +} + +func resourceIBMPINetworkSecurityGroupActionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + action := d.Get(Arg_Action).(string) + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + + body := &models.NetworkSecurityGroupsAction{Action: &action} + err = nsgClient.Action(body) + if err != nil { + return diag.FromErr(err) + } + wsclient := instance.NewIBMPIWorkspacesClient(ctx, sess, cloudInstanceID) + _, err = iswaitForNSGStatus(ctx, wsclient, cloudInstanceID, action, d.Timeout(schema.TimeoutCreate)) + if err != nil { + return diag.FromErr(err) + } + d.SetId(cloudInstanceID) + return resourceIBMPINetworkSecurityGroupActionRead(ctx, d, meta) +} + +func resourceIBMPINetworkSecurityGroupActionRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + wsclient := instance.NewIBMPIWorkspacesClient(ctx, sess, d.Id()) + ws, err := wsclient.Get(d.Id()) + if err != nil { + return diag.FromErr(err) + } + d.Set(Attr_State, ws.Details.NetworkSecurityGroups.State) + + return nil +} +func resourceIBMPINetworkSecurityGroupActionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + if d.HasChange(Arg_Action) { + action := d.Get(Arg_Action).(string) + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + + body := &models.NetworkSecurityGroupsAction{Action: &action} + err = nsgClient.Action(body) + if err != nil { + return diag.FromErr(err) + } + wsclient := instance.NewIBMPIWorkspacesClient(ctx, sess, cloudInstanceID) + _, err = iswaitForNSGStatus(ctx, wsclient, cloudInstanceID, action, d.Timeout(schema.TimeoutUpdate)) + if err != nil { + return diag.FromErr(err) + } + } + + return resourceIBMPINetworkSecurityGroupActionRead(ctx, d, meta) +} +func resourceIBMPINetworkSecurityGroupActionDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + d.SetId("") + return nil +} + +func iswaitForNSGStatus(ctx context.Context, client *instance.IBMPIWorkspacesClient, id, action string, timeout time.Duration) (interface{}, error) { + stateConf := &retry.StateChangeConf{ + Pending: []string{State_Configuring, State_Removing}, + Target: []string{State_Active, State_Inactive}, + Refresh: isPERWorkspaceRefreshFunc(client, id, action), + Timeout: timeout, + Delay: 10 * time.Second, + MinTimeout: 10 * time.Second, + } + + return stateConf.WaitForStateContext(ctx) +} + +func isPERWorkspaceRefreshFunc(client *instance.IBMPIWorkspacesClient, id, action string) retry.StateRefreshFunc { + return func() (interface{}, string, error) { + ws, err := client.Get(id) + if err != nil { + return nil, "", err + } + + if *(ws.Details.NetworkSecurityGroups.State) == State_Active && action == Enable { + return ws, State_Active, nil + } + if *(ws.Details.NetworkSecurityGroups.State) == State_Inactive && action == Disable { + return ws, State_Inactive, nil + } + if *(ws.Details.NetworkSecurityGroups.State) == State_Removing { + return ws, State_Removing, nil + } + if *(ws.Details.NetworkSecurityGroups.State) == State_Error { + return ws, *ws.Details.NetworkSecurityGroups.State, fmt.Errorf("[ERROR] workspace network security group configuration failed to %s", action) + } + + return ws, State_Configuring, nil + } +} diff --git a/ibm/service/power/resource_ibm_pi_network_security_group_action_test.go b/ibm/service/power/resource_ibm_pi_network_security_group_action_test.go new file mode 100644 index 0000000000..d7cb8683b2 --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group_action_test.go @@ -0,0 +1,44 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power_test + +import ( + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + + acc "github.com/IBM-Cloud/terraform-provider-ibm/ibm/acctest" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/power" +) + +func TestAccIBMPINetworkSecurityGroupActionBasic(t *testing.T) { + + resource.Test(t, resource.TestCase{ + PreCheck: func() { acc.TestAccPreCheck(t) }, + Providers: acc.TestAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccCheckIBMPINetworkSecurityGroupActionConfigBasic(power.Enable), + Check: resource.ComposeAggregateTestCheckFunc( + resource.TestCheckResourceAttr("ibm_pi_network_security_group_action.network_security_group_action", "pi_action", power.Enable), + ), + }, + { + Config: testAccCheckIBMPINetworkSecurityGroupActionConfigBasic(power.Disable), + Check: resource.ComposeAggregateTestCheckFunc( + resource.TestCheckResourceAttr("ibm_pi_network_security_group_action.network_security_group_action", "pi_action", power.Disable), + ), + }, + }, + }) +} + +func testAccCheckIBMPINetworkSecurityGroupActionConfigBasic(action string) string { + return fmt.Sprintf(` + resource "ibm_pi_network_security_group_action" "network_security_group_action" { + pi_action = "%[1]s" + pi_cloud_id = "%[2]s" + }`, action, acc.Pi_cloud_instance_id) +} diff --git a/ibm/service/power/resource_ibm_pi_network_security_group_member.go b/ibm/service/power/resource_ibm_pi_network_security_group_member.go new file mode 100644 index 0000000000..e3a49f8cfa --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group_member.go @@ -0,0 +1,306 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power + +import ( + "context" + "fmt" + + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" + + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/validate" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + "github.com/IBM-Cloud/power-go-client/power/models" +) + +func ResourceIBMPINetworkSecurityGroupMember() *schema.Resource { + return &schema.Resource{ + CreateContext: resourceIBMPINetworkSecurityGroupMemberCreate, + ReadContext: resourceIBMPINetworkSecurityGroupMemberRead, + DeleteContext: resourceIBMPINetworkSecurityGroupMemberDelete, + Importer: &schema.ResourceImporter{}, + + Schema: map[string]*schema.Schema{ + // Arguments + Arg_CloudInstanceID: { + Description: "The GUID of the service instance associated with an account.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + ValidateFunc: validation.NoZeroValues, + }, + Arg_NetworkSecurityGroupID: { + Description: "network security group ID.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + }, + Arg_Target: { + Description: "The target member to add. An IP4 address if ipv4-address type or a network interface ID if network-interface type.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + }, + Arg_Type: { + Description: "The type of member.", + ForceNew: true, + Required: true, + Type: schema.TypeString, + ValidateFunc: validate.ValidateAllowedStringValues([]string{IPV4_Address, Network_Interface}), + }, + // Attributes + Attr_CRN: { + Computed: true, + Description: "The network security group's crn.", + Type: schema.TypeString, + }, + Attr_Members: { + Computed: true, + Description: "The list of IPv4 addresses and, or network interfaces in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the member in a network security group.", + Type: schema.TypeString, + }, + Attr_MacAddress: { + Computed: true, + Description: "The mac address of a network interface included if the type is network-interface.", + Type: schema.TypeString, + }, + Attr_Target: { + Computed: true, + Description: "If ipv4-address type, then IPv4 address or if network-interface type, then network interface ID.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of member.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Name: { + Computed: true, + Description: "The name of the network security group.", + Type: schema.TypeString, + }, + Attr_Rules: { + Computed: true, + Description: "The list of rules in the network security group.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Action: { + Computed: true, + Description: "The action to take if the rule matches network traffic.", + Type: schema.TypeString, + }, + Attr_DestinationPort: { + Computed: true, + Description: "The list of destination port.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_ID: { + Computed: true, + Description: "The ID of the rule in a network security group.", + Type: schema.TypeString, + }, + Attr_Name: { + Computed: true, + Description: "The unique name of the network security group rule.", + Type: schema.TypeString, + }, + Attr_Protocol: { + Computed: true, + Description: "The list of protocol.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ICMTypes: { + Computed: true, + Description: "If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched.", + Elem: &schema.Schema{ + Type: schema.TypeFloat, + }, + Type: schema.TypeList, + }, + Attr_TCPFlags: { + Computed: true, + Description: "If tcp type, the list of TCP flags and if not present then all flags are matched.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Flag: { + Computed: true, + Description: "TCP flag.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Type: { + Computed: true, + Description: "The protocol of the network traffic.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_Remote: { + Computed: true, + Description: "List of remote.", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_ID: { + Computed: true, + Description: "The ID of the remote Network Address Group or network security group the rules apply to. Not required for default-network-address-group.", + Type: schema.TypeString, + }, + Attr_Type: { + Computed: true, + Description: "The type of remote group the rules apply to.", + Type: schema.TypeString, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_SourcePort: { + Computed: true, + Description: "ist of source port", + Elem: &schema.Resource{ + Schema: map[string]*schema.Schema{ + Attr_Maximum: { + Computed: true, + Description: "The end of the port range, if applicable, If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + Attr_Minimum: { + Computed: true, + Description: "The start of the port range, if applicable. If values are not present then all ports are in the range.", + Type: schema.TypeFloat, + }, + }, + }, + Type: schema.TypeList, + }, + }, + }, + Type: schema.TypeList, + }, + Attr_UserTags: { + Computed: true, + Description: "The user tags associated with this resource.", + Elem: &schema.Schema{Type: schema.TypeString}, + Type: schema.TypeList, + }, + }, + } +} + +func resourceIBMPINetworkSecurityGroupMemberCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + + cloudInstanceID := d.Get(Arg_CloudInstanceID).(string) + nsgID := d.Get(Arg_NetworkSecurityGroupID).(string) + target := d.Get(Arg_Target).(string) + mbrType := d.Get(Arg_Type).(string) + body := &models.NetworkSecurityGroupAddMember{ + Target: &target, + Type: &mbrType, + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + _, err = nsgClient.AddMember(nsgID, body) + if err != nil { + return diag.FromErr(err) + } + + d.SetId(fmt.Sprintf("%s/%s", cloudInstanceID, nsgID)) + + return resourceIBMPINetworkSecurityGroupMemberRead(ctx, d, meta) +} + +func resourceIBMPINetworkSecurityGroupMemberRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + cloudInstanceID, nsgID, err := splitID(d.Id()) + if err != nil { + return diag.FromErr(err) + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + networkSecurityGroup, err := nsgClient.Get(nsgID) + if err != nil { + return diag.FromErr(err) + } + d.Set(Attr_CRN, networkSecurityGroup.Crn) + + if networkSecurityGroup.Members != nil { + members := []map[string]interface{}{} + for _, mbr := range networkSecurityGroup.Members { + mbrMap := networkSecurityGroupMemberToMap(mbr) + members = append(members, mbrMap) + } + d.Set(Attr_Members, members) + } + d.Set(Arg_Name, networkSecurityGroup.Name) + d.Set(Attr_NetworkSecurityGroupID, networkSecurityGroup.ID) + if networkSecurityGroup.Rules != nil { + rules := []map[string]interface{}{} + for _, rule := range networkSecurityGroup.Rules { + ruleMap := networkSecurityGroupRuleToMap(rule) + rules = append(rules, ruleMap) + } + d.Set(Attr_Rules, rules) + } + if len(networkSecurityGroup.UserTags) > 0 { + d.Set(Attr_UserTags, networkSecurityGroup.UserTags) + } + + return nil +} + +func resourceIBMPINetworkSecurityGroupMemberDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { + sess, err := meta.(conns.ClientSession).IBMPISession() + if err != nil { + return diag.FromErr(err) + } + cloudInstanceID, nsgID, err := splitID(d.Id()) + if err != nil { + return diag.FromErr(err) + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(ctx, sess, cloudInstanceID) + err = nsgClient.Delete(nsgID) + if err != nil { + return diag.FromErr(err) + } + d.SetId("") + + return nil +} diff --git a/ibm/service/power/resource_ibm_pi_network_security_group_member_test.go b/ibm/service/power/resource_ibm_pi_network_security_group_member_test.go new file mode 100644 index 0000000000..508fd63332 --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group_member_test.go @@ -0,0 +1,81 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power_test + +import ( + "context" + "errors" + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + acc "github.com/IBM-Cloud/terraform-provider-ibm/ibm/acctest" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/power" +) + +func TestAccIBMPINetworkSecurityGroupMemberBasic(t *testing.T) { + + target := fmt.Sprintf("tf-target-%d", acctest.RandIntRange(10, 100)) + typeVar := "ipv4-address" + + resource.Test(t, resource.TestCase{ + PreCheck: func() { acc.TestAccPreCheck(t) }, + Providers: acc.TestAccProviders, + Steps: []resource.TestStep{ + { + Config: testAccCheckIBMPINetworkSecurityGroupMemberConfigBasic(target, typeVar), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckIBMPINetworkSecurityGroupMemberExists("ibm_pi_network_security_group_member.network_security_group_member"), + resource.TestCheckResourceAttrSet("ibm_pi_network_security_group_member.network_security_group_member", power.Arg_NetworkSecurityGroupID), + resource.TestCheckResourceAttr("ibm_pi_network_security_group_member.network_security_group_member", "pi_target", target), + resource.TestCheckResourceAttr("ibm_pi_network_security_group_member.network_security_group_member", "pi_type", typeVar), + resource.TestCheckResourceAttrSet("ibm_pi_network_security_group_member.network_security_group_member", power.Attr_Name), + ), + }, + }, + }) +} + +func testAccCheckIBMPINetworkSecurityGroupMemberConfigBasic(target string, typeVar string) string { + return fmt.Sprintf(` + resource "ibm_pi_network_security_group_member" "network_security_group_member" { + pi_cloud_instance_id = "%s" + pi_network_security_group_id = "%s" + pi_target = "%s" + pi_type = "%s" + }`, acc.Pi_cloud_instance_id, acc.Pi_network_security_group_id, target, typeVar) +} + +func testAccCheckIBMPINetworkSecurityGroupMemberExists(n string) resource.TestCheckFunc { + + return func(s *terraform.State) error { + rs, ok := s.RootModule().Resources[n] + if !ok { + return fmt.Errorf("Not found: %s", n) + } + + if rs.Primary.ID == "" { + return errors.New("No Record ID is set") + } + sess, err := acc.TestAccProvider.Meta().(conns.ClientSession).IBMPISession() + if err != nil { + return err + } + cloudInstanceID, nsgID, err := splitID(rs.Primary.ID) + if err != nil { + return err + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(context.Background(), sess, cloudInstanceID) + _, err = nsgClient.Get(nsgID) + if err != nil { + return err + } + return nil + } +} diff --git a/ibm/service/power/resource_ibm_pi_network_security_group_test.go b/ibm/service/power/resource_ibm_pi_network_security_group_test.go new file mode 100644 index 0000000000..5b9a423e90 --- /dev/null +++ b/ibm/service/power/resource_ibm_pi_network_security_group_test.go @@ -0,0 +1,104 @@ +// Copyright IBM Corp. 2024 All Rights Reserved. +// Licensed under the Mozilla Public License v2.0 + +package power_test + +import ( + "context" + "errors" + "fmt" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" + + "github.com/IBM-Cloud/power-go-client/clients/instance" + acc "github.com/IBM-Cloud/terraform-provider-ibm/ibm/acctest" + "github.com/IBM-Cloud/terraform-provider-ibm/ibm/conns" +) + +func TestAccIBMPINetworkSecurityGroupBasic(t *testing.T) { + name := fmt.Sprintf("tf-name-%d", acctest.RandIntRange(10, 100)) + nameUpdate := fmt.Sprintf("tf-name-update-%d", acctest.RandIntRange(10, 100)) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { acc.TestAccPreCheck(t) }, + Providers: acc.TestAccProviders, + CheckDestroy: testAccCheckIBMPINetworkSecurityGroupDestroy, + Steps: []resource.TestStep{ + { + Config: testAccCheckIBMPINetworkSecurityGroupConfigBasic(name), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckIBMPINetworkSecurityGroupExists("ibm_pi_network_security_group.network_security_group"), + resource.TestCheckResourceAttr("ibm_pi_network_security_group.network_security_group", "name", name), + ), + }, + { + Config: testAccCheckIBMPINetworkSecurityGroupConfigBasic(nameUpdate), + Check: resource.ComposeAggregateTestCheckFunc( + resource.TestCheckResourceAttr("ibm_pi_network_security_group.network_security_group", "name", nameUpdate), + ), + }, + }, + }) +} + +func testAccCheckIBMPINetworkSecurityGroupConfigBasic(name string) string { + return fmt.Sprintf(` + resource "ibm_pi_network_security_group" "network_security_group" { + pi_cloud_instance_id = "%s" + pi_name = "%s" + }`, acc.Pi_cloud_instance_id, name) +} + +func testAccCheckIBMPINetworkSecurityGroupExists(n string) resource.TestCheckFunc { + + return func(s *terraform.State) error { + rs, ok := s.RootModule().Resources[n] + if !ok { + return fmt.Errorf("Not found: %s", n) + } + if rs.Primary.ID == "" { + return errors.New("No Record ID is set") + } + sess, err := acc.TestAccProvider.Meta().(conns.ClientSession).IBMPISession() + if err != nil { + return err + } + cloudInstanceID, nsgID, err := splitID(rs.Primary.ID) + if err != nil { + return err + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(context.Background(), sess, cloudInstanceID) + _, err = nsgClient.Get(nsgID) + if err != nil { + return err + } + return nil + } +} + +func testAccCheckIBMPINetworkSecurityGroupDestroy(s *terraform.State) error { + sess, err := acc.TestAccProvider.Meta().(conns.ClientSession).IBMPISession() + if err != nil { + return err + } + for _, rs := range s.RootModule().Resources { + if rs.Type != "ibm_pi_network_security_group" { + continue + } + + cloudInstanceID, nsgID, err := splitID(rs.Primary.ID) + if err != nil { + return err + } + nsgClient := instance.NewIBMIPINetworkSecurityGroupClient(context.Background(), sess, cloudInstanceID) + _, err = nsgClient.Get(nsgID) + if err == nil { + return fmt.Errorf("network_security_group still exists: %s", rs.Primary.ID) + } + } + + return nil +} diff --git a/website/docs/d/pi_network-security-groups.html.markdown b/website/docs/d/pi_network-security-groups.html.markdown new file mode 100644 index 0000000000..f3b95c4d7b --- /dev/null +++ b/website/docs/d/pi_network-security-groups.html.markdown @@ -0,0 +1,81 @@ +--- +layout: "ibm" +page_title: "IBM : ibm_pi_network_security_groups" +description: |- + Get information about pi_network_security_groups +subcategory: "Power Systems" +--- + +# ibm_pi_network_security_groups + +Retrieves information about network security groups. + +## Example Usage + +```terraform + data "ibm_pi_network_security_groups" "network_security_groups" { + pi_cloud_instance_id = "" + } +``` + +### Notes + +- Please find [supported Regions](https://cloud.ibm.com/apidocs/power-cloud#endpoint) for endpoints. +- If a Power cloud instance is provisioned at `lon04`, The provider level attributes should be as follows: + - `region` - `lon` + - `zone` - `lon04` + +Example usage: + + ```terraform + provider "ibm" { + region = "lon" + zone = "lon04" + } + ``` + +## Argument reference + +Review the argument references that you can specify for your data source. + +- `pi_cloud_instance_id` - (Required, String) The GUID of the service instance associated with an account. + +## Attribute Reference + +After your data source is created, you can read values from the following attributes. + +- `network_security_groups` - (List) list of network security Groups. +Nested schema for `network_security_groups`: + - `crn` - (String) The network security group's crn. + - `id` - (String) The id of the network security group. + - `members` - (List) The list of IPv4 addresses and\or network Interfaces in the network security group. + Nested schema for `members`: + - `id` - (String) The id of the member in a network security group. + - `mac_address` - (String) The mac address of a network Interface included if the type is `network-interface`. + - `target` - (String) If `ipv4-address` type, then IPv4 address or if `network-interface` type, then network interface id. + - `type` - (String) The type of member. Supported values are: `ipv4-address`, `network-interface`. + - `name` - (String) The name of the network security group. + - `rules` - (List) The list of rules in the network security group. + Nested schema for `rules`: + - `action` - (String) The action to take if the rule matches network traffic. Supported values are: `allow`, `deny`. + - `destination_port` - (List) List of destination port. + Nested schema for `destination_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + - `direction` - (String) The direction of the network traffic.Supported values are: `inbound`, `outbound`. + - `id` - (String) The id of the rule in a network security group. + - `name` - (String) The unique name of the network security group rule. + - `protocol` - (List) List of protocol. + Nested schema for `protocol`: + - `icmp_types` - (List) If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched. + - `tcp_flags` - (String) If tcp type, the list of TCP flags and if not present then all flags are matched. Supported values are: `syn`, `ack`, `fin`, `rst`, `urg`, `psh`, `wnd`, `chk`, `seq`. + - `type` - (String) The protocol of the network traffic. Supported values are: `icmp`, `tcp`, `udp`, `all`. + - `remote` - (List) List of remote. + Nested schema for `remote`: + - `id` - (String) The id of the remote network Address group or network security group the rules apply to. Not required for default-network-address-group. + - `type` - (String) The type of remote group the rules apply to. Supported values are: `network-security-group`, `network-address-group`, `default-network-address-group`. + - `source_port` - (List) List of source port. + Nested schema for `source_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + - `user_tags` - (List) The user tags associated with this resource. diff --git a/website/docs/d/pi_network_security_group.html.markdown b/website/docs/d/pi_network_security_group.html.markdown new file mode 100644 index 0000000000..9297ba20f5 --- /dev/null +++ b/website/docs/d/pi_network_security_group.html.markdown @@ -0,0 +1,88 @@ +--- +layout: "ibm" +page_title: "IBM : ibm_pi_network_security_group" +description: |- + Get information about pi_network_security_group +subcategory: "Power Systems" +--- + +# ibm_pi_network_security_group + +Retrieves information about a network security group. + +## Example Usage + +```terraform + data "ibm_pi_network_security_group" "network_security_group" { + pi_cloud_instance_id = "" + pi_network_security_group_id = "" + } +``` + +### Notes + +- Please find [supported Regions](https://cloud.ibm.com/apidocs/power-cloud#endpoint) for endpoints. +- If a Power cloud instance is provisioned at `lon04`, The provider level attributes should be as follows: + - `region` - `lon` + - `zone` - `lon04` + +Example usage: + + ```terraform + provider "ibm" { + region = "lon" + zone = "lon04" + } + ``` + +## Argument Reference + +You can specify the following arguments for this data source. + +- `pi_cloud_instance_id` - (Required, String) The GUID of the service instance associated with an account. +- `pi_network_security_group_id` - (Required, String) network security group id or name. + +## Attribute Reference + +In addition to all argument reference list, you can access the following attribute references after your data source is created. + +- `crn` - (String) The network security group's crn. + +- `members` - (List) The list of IPv4 addresses and\or network interfaces in the network security group. + + Nested schema for `members`: + - `id` - (String) The id of the member in a network security group. + - `mac_address` - (String) The mac address of a network interface included if the type is `network-interface`. + - `target` - (String) If `ipv4-address` type, then IPv4 address or if `network-interface` type, then network interface id. + - `type` - (String) The type of member. Supported values are: `ipv4-address`, `network-interface`. + +- `name` - (String) The name of the network security group. + +- `rules` - (List) The list of rules in the network security group. + + Nested schema for `rules`: + - `action` - (String) The action to take if the rule matches network traffic. Supported values are: `allow`, `deny`. + - `destination_port` - (List) The list of destination port. + Nested schema for `destination_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + - `direction` - (String) The direction of the network traffic. Supported values are: `inbound`, `outbound`. + - `id` - (String) The id of the rule in a network security group. + - `name` - (String) The unique name of the network security group rule. + - `protocol` - (List) The list of protocol. + Nested schema for `protocol`: + - `icmp_types` - (List) If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched. + - `tcp_flags` - (List) If tcp type, the list of TCP flags and if not present then all flags are matched. Supported values are: `syn`, `ack`, `fin`, `rst`, `urg`, `psh`, `wnd`, `chk`, `seq`. + Nested schema for `icmp_types`: + - `flags` - (String) TCP flag. + - `type` - (String) The protocol of the network traffic. Supported values are: `icmp`, `tcp`, `udp`, `all`. + - `remote` - (List) List of remote. + Nested schema for `remote`: + - `id` - (String) The id of the remote network Address group or network security group the rules apply to. Not required for default-network-address-group. + - `type` - (String) The type of remote group the rules apply to. Supported values are: `network-security-group`, `network-address-group`, `default-network-address-group`. + - `source_port` - (List) List of source port. + Nested schema for `source_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + +- `user_tags` - (List) The user tags associated with this resource. diff --git a/website/docs/r/pi_network_security_group.html.markdown b/website/docs/r/pi_network_security_group.html.markdown new file mode 100644 index 0000000000..29878385e3 --- /dev/null +++ b/website/docs/r/pi_network_security_group.html.markdown @@ -0,0 +1,89 @@ +--- +layout: "ibm" +page_title: "IBM : ibm_pi_network_security_group" +description: |- + Manages pi_network_security_group. +subcategory: "Power Systems" +--- + +# ibm_pi_network_security_group + +Create, update, and delete a network security group. + +## Example Usage + +```terraform + resource "ibm_pi_network_security_group" "network_security_group" { + pi_cloud_instance_id = "" + pi_name = "name" + pi_user_tags = ["tag1", "tag2"] + } +``` + +### Notes + +- Please find [supported Regions](https://cloud.ibm.com/apidocs/power-cloud#endpoint) for endpoints. +- If a Power cloud instance is provisioned at `lon04`, The provider level attributes should be as follows: + - `region` - `lon` + - `zone` - `lon04` + +Example usage: + + ```terraform + provider "ibm" { + region = "lon" + zone = "lon04" + } + ``` + +## Argument Reference + +Review the argument references that you can specify for your resource. + +- `pi_cloud_instance_id` - (Required, String) The GUID of the service instance associated with an account. +- `pi_name` - (Required, String) The name of the Network Security Group. +- `pi_user_tags` - (Optional, List) A list of tags. + +## Attribute Reference + +In addition to all argument reference list, you can access the following attribute reference after your resource is created. + +- `crn` - (String) The network security group's crn. + +- `members` - (List) The list of IPv4 addresses and\or network interfaces in the network security group. + + Nested schema for `members`: + - `id` - (String) The id of the member in a network security group. + - `mac_address` - (String) The mac address of a network interface included if the type is `network-interface`. + - `target` - (String) If `ipv4-address` type, then IPv4 address or if `network-interface` type, then network interface id. + - `type` - (String) The type of member. Supported values are: `ipv4-address`, `network-interface`. + +- `network_security_group_id` -(String) The unique identifier of the network security group. +- `rules` - (List) The list of rules in the network security group. + + Nested schema for `rules`: + - `action` - (String) The action to take if the rule matches network traffic. Supported values are: `allow`, `deny`. + - `destination_port` - (List) The list of destination port. + + Nested schema for `destination_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + - `direction` - (String) The direction of the network traffic. Supported values are: `inbound`, `outbound`. + - `id` - (String) The id of the rule in a network security group. + - `name` - (String) The unique name of the network security group rule. + - `protocol` - (List) The list of protocol. + + Nested schema for `protocol`: + - `icmp_types` - (List) If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched. + - `tcp_flags` - (String) If tcp type, the list of TCP flags and if not present then all flags are matched. Supported values are: `syn`, `ack`, `fin`, `rst`, `urg`, `psh`, `wnd`, `chk`, `seq`. + - `type` - (String) The protocol of the network traffic. Supported values are: `icmp`, `tcp`, `udp`, `all`. + - `remote` - (List) List of remote. + + Nested schema for `remote`: + - `id` - (String) The id of the remote network Address group or network security group the rules apply to. Not required for default-network-address-group. + - `type` - (String) The type of remote group the rules apply to. Supported values are: `network-security-group`, `network-address-group`, `default-network-address-group`. + - `source_port` - (List) List of source port + + Nested schema for `source_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. diff --git a/website/docs/r/pi_network_security_group_action.html.markdown b/website/docs/r/pi_network_security_group_action.html.markdown new file mode 100644 index 0000000000..00d8c6bf4d --- /dev/null +++ b/website/docs/r/pi_network_security_group_action.html.markdown @@ -0,0 +1,56 @@ +--- +layout: "ibm" +page_title: "IBM : ibm_pi_network_security_group_action" +description: |- + Manages pi_network_security_group_action. +subcategory: "Power Systems" +--- + +# ibm_pi_network_security_group_action + +Enable or disable a network security group in your workspace. + +## Example Usage + +```terraform + resource "ibm_pi_network_security_group_action" "network_security_group_action" { + pi_cloud_instance_id = "" + pi_action = "enable" + } +``` + +### Notes + +- Please find [supported Regions](https://cloud.ibm.com/apidocs/power-cloud#endpoint) for endpoints. +- If a Power cloud instance is provisioned at `lon04`, The provider level attributes should be as follows: + - `region` - `lon` + - `zone` - `lon04` + +Example usage: + + ```terraform + provider "ibm" { + region = "lon" + zone = "lon04" + } + ``` + +## Timeouts + +The `ibm_pi_network` provides the following [Timeouts](https://www.terraform.io/docs/language/resources/syntax.html) configuration options: + +- **create** - (Default 5 minutes) Used for enabling a network security group. +- **update** - (Default 5 minutes) Used for disabling a network security group. + +## Argument Reference + +Review the argument references that you can specify for your resource. + +- `pi_action` - (Required, String) Name of the action to take; can be enable to enable NSGs in a workspace or disable to disable NSGs in a workspace. Supported values are: `enable`, `disable`. +- `pi_cloud_instance_id` - (Required, String) The GUID of the service instance associated with an account. + +## Attribute Reference + +In addition to all argument reference list, you can access the following attribute reference after your resource is created. + +- `state` - (String) The workspace network security group's state. diff --git a/website/docs/r/pi_network_security_group_member.html.markdown b/website/docs/r/pi_network_security_group_member.html.markdown new file mode 100644 index 0000000000..35d537368e --- /dev/null +++ b/website/docs/r/pi_network_security_group_member.html.markdown @@ -0,0 +1,86 @@ +--- +layout: "ibm" +page_title: "IBM : ibm_pi_network_security_group_member" +description: |- + Manages pi_network_security_group_member. +subcategory: "Power Systems" +--- + +# ibm_pi_network_security_group_member + +Add or remove a network security group member. + +## Example Usage + +```terraform + resource "ibm_pi_network_security_group_member" "network_security_group_member" { + pi_cloud_instance_id = "" + pi_network_security_group_id = "network_security_group_id" + pi_target = "target" + pi_type = "ipv4-address" + } +``` + +### Notes + +- Please find [supported Regions](https://cloud.ibm.com/apidocs/power-cloud#endpoint) for endpoints. +- If a Power cloud instance is provisioned at `lon04`, The provider level attributes should be as follows: + - `region` - `lon` + - `zone` - `lon04` + +Example usage: + + ```terraform + provider "ibm" { + region = "lon" + zone = "lon04" + } + ``` + +## Argument Reference + +Review the argument references that you can specify for your resource. + +- `pi_cloud_instance_id` - (Required, String) The GUID of the service instance associated with an account. +- `pi_network_security_group_id` - (Required, String) network security group ID. +- `pi_target` - (Required, String) The target member to add. +- `pi_type` - (Required, String) The type of member. Supported values are: `ipv4-address`, `network-interface`. + +## Attribute Reference + +In addition to all argument reference list, you can access the following attribute reference after your resource is created. + +- `id` - (String) The unique identifier of the network security group. +- `crn` - (String) The network security group's crn. + +- `members` - (List) The list of IPv4 addresses and\or network interfaces in the network security group. + Nested schema for `members`: + - `id` - (String) The id of the member in a network security group. + - `mac_address` - (String) The mac address of a network interface included if the type is `network-interface`. + - `target` - (String) If `ipv4-address` type, then IPv4 address or if `network-interface` type, then network interface id. + - `type` - (String) The type of member. Supported values are: `ipv4-address`, `network-interface`. + +- `name` - (String) The name of the network security group. +- `rules` - (List) The list of rules in the network security group. + Nested schema for `rules`: + - `action` - (String) The action to take if the rule matches network traffic. Supported values are: `allow`, `deny`. + - `destination_port` - (List) The list of destination port. + Nested schema for `destination_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. + - `id` - (String) The id of the rule in a network security group. + - `name` - (String) The unique name of the network security group rule. + - `protocol` - (List) The list of protocol. + Nested schema for `protocol`: + - `icmp_types` - (List) If icmp type, the list of ICMP packet types (by numbers) affected by ICMP rules and if not present then all types are matched. + - `tcp_flags` - (String) If tcp type, the list of TCP flags and if not present then all flags are matched. Supported values are: `syn`, `ack`, `fin`, `rst`, `urg`, `psh`, `wnd`, `chk`, `seq`. + - `type` - (String) The protocol of the network traffic. Supported values are: `icmp`, `tcp`, `udp`, `all`. + - `remote` - (List) List of remote. + Nested schema for `remote`: + - `id` - (String) The id of the remote network Address group or network security group the rules apply to. Not required for default-network-address-group. + - `type` - (String) The type of remote group the rules apply to. Supported values are: `network-security-group`, `network-address-group`, `default-network-address-group`. + - `source_port` - (List) List of source port + Nested schema for `source_port`: + - `maximum` - (Float) The end of the port range, if applicable, If values are not present then all ports are in the range. + - `minimum` - (Float) The start of the port range, if applicable. If values are not present then all ports are in the range. +- `user_tags` - (String) The user tags associated with this resource.