Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

azurerm_container_registry - support for trust_policy and retention_policy #8698

Merged
merged 7 commits into from
Oct 15, 2020
Merged

azurerm_container_registry - support for trust_policy and retention_policy #8698

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
103ddb8
container registry update sku and sku-dependent attributes at the sam…
notchairmk Sep 30, 2020
1045d55
add support for container registry policies
notchairmk Sep 30, 2020
7d409c3
fmt container registry tests
notchairmk Sep 30, 2020
2e42fd3
remove policies block
notchairmk Oct 5, 2020
d0e4b71
Merge remote-tracking branch 'upstream/master' into acr_policy
notchairmk Oct 5, 2020
6d9e2b8
ACR formatting
notchairmk Oct 5, 2020
0eac96d
recommit standard sku
notchairmk Oct 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
184 changes: 179 additions & 5 deletions azurerm/internal/services/containers/container_registry_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,46 @@ func resourceArmContainerRegistry() *schema.Resource {
},
},

"retention_policy": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
Computed: true,
ConfigMode: schema.SchemaConfigModeAttr,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"days": {
Type: schema.TypeInt,
Optional: true,
Default: 7,
},

"enabled": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
},
},

"trust_policy": {
Type: schema.TypeList,
MaxItems: 1,
Optional: true,
Computed: true,
ConfigMode: schema.SchemaConfigModeAttr,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"enabled": {
Type: schema.TypeBool,
Optional: true,
Default: false,
},
},
},
},

"tags": tags.Schema(),
},

Expand All @@ -181,6 +221,16 @@ func resourceArmContainerRegistry() *schema.Resource {
return fmt.Errorf("ACR geo-replication can only be applied when using the Premium Sku.")
}

retentionPolicyEnabled, ok := d.GetOk("retention_policy.0.enabled")
if ok && retentionPolicyEnabled.(bool) && !strings.EqualFold(sku, string(containerregistry.Premium)) {
return fmt.Errorf("ACR retention policy can only be applied when using the Premium Sku. If you are downgrading from a Premium SKU please set retention_policy {}")
}

trustPolicyEnabled, ok := d.GetOk("trust_policy.0.enabled")
if ok && trustPolicyEnabled.(bool) && !strings.EqualFold(sku, string(containerregistry.Premium)) {
return fmt.Errorf("ACR trust policy can only be applied when using the Premium Sku. If you are downgrading from a Premium SKU please set trust_policy {}")
}

return nil
},
}
Expand Down Expand Up @@ -232,6 +282,12 @@ func resourceArmContainerRegistryCreate(d *schema.ResourceData, meta interface{}
return fmt.Errorf("`network_rule_set_set` can only be specified for a Premium Sku. If you are reverting from a Premium to Basic SKU plese set network_rule_set = []")
}

retentionPolicyRaw := d.Get("retention_policy").([]interface{})
retentionPolicy := expandRetentionPolicy(retentionPolicyRaw)

trustPolicyRaw := d.Get("trust_policy").([]interface{})
trustPolicy := expandTrustPolicy(trustPolicyRaw)

parameters := containerregistry.Registry{
Location: &location,
Sku: &containerregistry.Sku{
Expand All @@ -241,6 +297,10 @@ func resourceArmContainerRegistryCreate(d *schema.ResourceData, meta interface{}
RegistryProperties: &containerregistry.RegistryProperties{
AdminUserEnabled: utils.Bool(adminUserEnabled),
NetworkRuleSet: networkRuleSet,
Policies: &containerregistry.Policies{
RetentionPolicy: retentionPolicy,
TrustPolicy: trustPolicy,
},
},

Tags: tags.Expand(t),
Expand Down Expand Up @@ -301,6 +361,11 @@ func resourceArmContainerRegistryUpdate(d *schema.ResourceData, meta interface{}
name := d.Get("name").(string)

sku := d.Get("sku").(string)
skuChange := d.HasChange("sku")
isBasicSku := strings.EqualFold(sku, string(containerregistry.Basic))
isPremiumSku := strings.EqualFold(sku, string(containerregistry.Premium))
isStandardSku := strings.EqualFold(sku, string(containerregistry.Standard))

adminUserEnabled := d.Get("admin_enabled").(bool)
t := d.Get("tags").(map[string]interface{})

Expand All @@ -309,19 +374,28 @@ func resourceArmContainerRegistryUpdate(d *schema.ResourceData, meta interface{}
oldGeoReplicationLocations := old.(*schema.Set)
newGeoReplicationLocations := new.(*schema.Set)

// handle upgrade to Premium SKU first
if skuChange && isPremiumSku {
if err := applyContainerRegistrySku(d, meta, sku, resourceGroup, name); err != nil {
return fmt.Errorf("Error applying sku %q for Container Registry %q (Resource Group %q): %+v", sku, name, resourceGroup, err)
}
}
katbyte marked this conversation as resolved.
Show resolved Hide resolved

networkRuleSet := expandNetworkRuleSet(d.Get("network_rule_set").([]interface{}))
if networkRuleSet != nil && !strings.EqualFold(sku, string(containerregistry.Premium)) {
if networkRuleSet != nil && isBasicSku {
return fmt.Errorf("`network_rule_set_set` can only be specified for a Premium Sku. If you are reverting from a Premium to Basic SKU plese set network_rule_set = []")
}

retentionPolicy := expandRetentionPolicy(d.Get("retention_policy").([]interface{}))
trustPolicy := expandTrustPolicy(d.Get("trust_policy").([]interface{}))
parameters := containerregistry.RegistryUpdateParameters{
RegistryPropertiesUpdateParameters: &containerregistry.RegistryPropertiesUpdateParameters{
AdminUserEnabled: utils.Bool(adminUserEnabled),
NetworkRuleSet: networkRuleSet,
},
Sku: &containerregistry.Sku{
Name: containerregistry.SkuName(sku),
Tier: containerregistry.SkuTier(sku),
Policies: &containerregistry.Policies{
RetentionPolicy: retentionPolicy,
TrustPolicy: trustPolicy,
},
},
Tags: tags.Expand(t),
}
Expand Down Expand Up @@ -355,6 +429,13 @@ func resourceArmContainerRegistryUpdate(d *schema.ResourceData, meta interface{}
}
}

// downgrade to Basic or Standard SKU
if skuChange && (isBasicSku || isStandardSku) {
if err := applyContainerRegistrySku(d, meta, sku, resourceGroup, name); err != nil {
return fmt.Errorf("Error applying sku %q for Container Registry %q (Resource Group %q): %+v", sku, name, resourceGroup, err)
}
}

read, err := client.Get(ctx, resourceGroup, name)
if err != nil {
return fmt.Errorf("Error retrieving Container Registry %q (Resource Group %q): %+v", name, resourceGroup, err)
Expand All @@ -369,6 +450,30 @@ func resourceArmContainerRegistryUpdate(d *schema.ResourceData, meta interface{}
return resourceArmContainerRegistryRead(d, meta)
}

func applyContainerRegistrySku(d *schema.ResourceData, meta interface{}, sku string, resourceGroup string, name string) error {
client := meta.(*clients.Client).Containers.RegistriesClient
ctx, cancel := timeouts.ForUpdate(meta.(*clients.Client).StopContext, d)
defer cancel()

parameters := containerregistry.RegistryUpdateParameters{
Sku: &containerregistry.Sku{
Name: containerregistry.SkuName(sku),
Tier: containerregistry.SkuTier(sku),
},
}

future, err := client.Update(ctx, resourceGroup, name, parameters)
if err != nil {
return fmt.Errorf("Error updating Container Registry %q (Resource Group %q): %+v", name, resourceGroup, err)
}

if err = future.WaitForCompletionRef(ctx, client.Client); err != nil {
return fmt.Errorf("Error waiting for update of Container Registry %q (Resource Group %q): %+v", name, resourceGroup, err)
}

return nil
}

func applyGeoReplicationLocations(d *schema.ResourceData, meta interface{}, resourceGroup string, name string, oldGeoReplicationLocations []interface{}, newGeoReplicationLocations []interface{}) error {
replicationClient := meta.(*clients.Client).Containers.ReplicationsClient
ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d)
Expand Down Expand Up @@ -478,6 +583,15 @@ func resourceArmContainerRegistryRead(d *schema.ResourceData, meta interface{})
return fmt.Errorf("Error setting `network_rule_set`: %+v", err)
}

if properties := resp.RegistryProperties; properties != nil {
if err := d.Set("retention_policy", flattenRetentionPolicy(properties.Policies)); err != nil {
return fmt.Errorf("Error setting `retention_policy`: %+v", err)
}
if err := d.Set("trust_policy", flattenTrustPolicy(properties.Policies)); err != nil {
return fmt.Errorf("Error setting `trust_policy`: %+v", err)
}
}

if sku := resp.Sku; sku != nil {
d.Set("sku", string(sku.Tier))
}
Expand Down Expand Up @@ -613,6 +727,41 @@ func expandNetworkRuleSet(profiles []interface{}) *containerregistry.NetworkRule
return &networkRuleSet
}

func expandRetentionPolicy(p []interface{}) *containerregistry.RetentionPolicy {
retentionPolicy := containerregistry.RetentionPolicy{
Status: containerregistry.Disabled,
}

if len(p) > 0 {
v := p[0].(map[string]interface{})
days := int32(v["days"].(int))
enabled := v["enabled"].(bool)
if enabled {
retentionPolicy.Status = containerregistry.Enabled
}
retentionPolicy.Days = utils.Int32(days)
}

return &retentionPolicy
}

func expandTrustPolicy(p []interface{}) *containerregistry.TrustPolicy {
trustPolicy := containerregistry.TrustPolicy{
Status: containerregistry.Disabled,
}

if len(p) > 0 {
v := p[0].(map[string]interface{})
enabled := v["enabled"].(bool)
if enabled {
trustPolicy.Status = containerregistry.Enabled
}
trustPolicy.Type = containerregistry.Notary
}

return &trustPolicy
}

func flattenNetworkRuleSet(networkRuleSet *containerregistry.NetworkRuleSet) []interface{} {
if networkRuleSet == nil {
return []interface{}{}
Expand Down Expand Up @@ -654,3 +803,28 @@ func flattenNetworkRuleSet(networkRuleSet *containerregistry.NetworkRuleSet) []i

return []interface{}{values}
}

func flattenRetentionPolicy(p *containerregistry.Policies) []interface{} {
if p == nil || p.RetentionPolicy == nil {
return nil
}

r := *p.RetentionPolicy
retentionPolicy := make(map[string]interface{})
retentionPolicy["days"] = r.Days
enabled := strings.EqualFold(string(r.Status), string(containerregistry.Enabled))
retentionPolicy["enabled"] = utils.Bool(enabled)
return []interface{}{retentionPolicy}
}

func flattenTrustPolicy(p *containerregistry.Policies) []interface{} {
if p == nil || p.TrustPolicy == nil {
return nil
}

t := *p.TrustPolicy
trustPolicy := make(map[string]interface{})
enabled := strings.EqualFold(string(t.Status), string(containerregistry.Enabled))
trustPolicy["enabled"] = utils.Bool(enabled)
return []interface{}{trustPolicy}
}
107 changes: 107 additions & 0 deletions azurerm/internal/services/containers/tests/container_registry_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,50 @@ func TestAccAzureRMContainerRegistry_networkAccessProfileVnet(t *testing.T) {
})
}

func TestAccAzureRMContainerRegistry_policies(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_registry", "test")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { acceptance.PreCheck(t) },
Providers: acceptance.SupportedProviders,
CheckDestroy: testCheckAzureRMContainerRegistryDestroy,
Steps: []resource.TestStep{
{
Config: testAccAzureRMContainerRegistry_policies(data, 10),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMContainerRegistryExists(data.ResourceName),
resource.TestCheckResourceAttr(data.ResourceName, "network_rule_set.0.default_action", "Allow"),
resource.TestCheckResourceAttr(data.ResourceName, "network_rule_set.0.virtual_network.#", "0"),
resource.TestCheckResourceAttr(data.ResourceName, "retention_policy.0.days", "10"),
resource.TestCheckResourceAttr(data.ResourceName, "retention_policy.0.enabled", "true"),
resource.TestCheckResourceAttr(data.ResourceName, "trust_policy.0.enabled", "true"),
),
},
{
Config: testAccAzureRMContainerRegistry_policies(data, 20),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMContainerRegistryExists(data.ResourceName),
resource.TestCheckResourceAttr(data.ResourceName, "network_rule_set.0.default_action", "Allow"),
resource.TestCheckResourceAttr(data.ResourceName, "network_rule_set.0.virtual_network.#", "0"),
resource.TestCheckResourceAttr(data.ResourceName, "retention_policy.0.days", "20"),
resource.TestCheckResourceAttr(data.ResourceName, "retention_policy.0.enabled", "true"),
resource.TestCheckResourceAttr(data.ResourceName, "trust_policy.0.enabled", "true"),
),
},
{
Config: testAccAzureRMContainerRegistry_policies_downgradeUpdate(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMContainerRegistryExists(data.ResourceName),
resource.TestCheckResourceAttr(data.ResourceName, "network_rule_set.#", "0"),
resource.TestCheckResourceAttr(data.ResourceName, "retention_policy.0.enabled", "false"),
resource.TestCheckResourceAttr(data.ResourceName, "trust_policy.0.enabled", "false"),
),
},
data.ImportStep(),
},
})
}

func testCheckAzureRMContainerRegistryDestroy(s *terraform.State) error {
conn := acceptance.AzureProvider.Meta().(*clients.Client).Containers.RegistriesClient
ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
Expand Down Expand Up @@ -781,3 +825,66 @@ resource "azurerm_container_registry" "test" {
}
`, data.RandomInteger, data.Locations.Primary)
}

func testAccAzureRMContainerRegistry_policies(data acceptance.TestData, days int) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "test" {
name = "acctestRG-acr-%d"
location = "%s"
}

resource "azurerm_container_registry" "test" {
name = "acctestACR%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
admin_enabled = false
sku = "Premium"

retention_policy {
days = %d
enabled = true
}

trust_policy {
enabled = true
}

tags = {
Environment = "Production"
}
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, days)
}

func testAccAzureRMContainerRegistry_policies_downgradeUpdate(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "test" {
name = "acctestRG-acr-%d"
location = "%s"
}

resource "azurerm_container_registry" "test" {
name = "acctestACR%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
admin_enabled = false
sku = "Basic"
network_rule_set = []

retention_policy {}
trust_policy {}

tags = {
Environment = "Production"
}
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}