Skip to content

feat: RBAC datasources to provider #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
ChrisMcKenzie merged 20 commits into from
Dec 12, 2025
Merged

feat: RBAC datasources to provider #163

ChrisMcKenzie merged 20 commits into from
Dec 12, 2025

Conversation

@ChrisMcKenzie
Copy link
Contributor

@ChrisMcKenzie ChrisMcKenzie commented Dec 9, 2025 •
edited by atlassian bot
Loading

● ENG-5987

what

This PR adds two new Terraform data sources for RBAC (Role-Based Access Control):

  1. stacklet_role - Query role information by name
  2. stacklet_role_assignments - Query role assignments for specific targets (system, account groups, policy collections, repositories)

why

These data sources enable users to:

  • Query existing roles and their permissions
  • Discover which principals (users/SSO groups) have access to specific resources
  • Build access control auditing and reporting workflows in Terraform
  • Reference role information in other Terraform configurations

This is part of the RBAC support feature set, specifically focusing on read-only data sources (resources will be added in a separate PR).

testing

  • Added acceptance tests with recordings for stacklet_role data source
  • All existing acceptance tests pass
  • Go unit tests pass
  • Terraform validation passes (just lint-tf)
  • Code builds successfully
  • API integration tested with filter-based GraphQL queries

docs

  • Example Terraform configurations added in examples/data-sources/stacklet_role/ and examples/data-sources/stacklet_role_assignments/
  • Schema documentation included in datasource definitions
  • Release notes should be added to NEWS.MD when merged

@ChrisMcKenzie ChrisMcKenzie changed the title Feature/rbac support pr2 Add: RBAC datasources to provider Dec 9, 2025
@ChrisMcKenzie ChrisMcKenzie force-pushed the feature/RBAC-Support-pr2 branch from ccb4953 to 531080f Compare December 9, 2025 20:47
@ChrisMcKenzie ChrisMcKenzie marked this pull request as ready for review December 9, 2025 21:01
@ChrisMcKenzie ChrisMcKenzie requested a review from a team as a code owner December 9, 2025 21:01
@ChrisMcKenzie ChrisMcKenzie changed the title Add: RBAC datasources to provider feat: RBAC datasources to provider Dec 9, 2025
@albertodonato
Copy link
Contributor

albertodonato commented Dec 10, 2025

Change looks good in general, but I think we should treat target and principal identifiers as opaque, and not parse the type:id, which is going to make the input for resources more verbose and prone to error.

I think we should first of all add role_assignment_target (mapping roleAssignmentTarget from graphql) and role_assignment_principal (from roleAssignmentPrincipal) attributes to existing resources, returning the string value to use as target or principal.

That way those can just be passed as target/principal attributes to the new data sources and resources, without having to parse and differentiate them as individual objects

albertodonato
albertodonato reviewed Dec 10, 2025
View reviewed changes
internal/api/role.go Outdated
}

roles := make([]Role, 0, len(query.Roles.Edges))
for _, edge := range query.Roles.Edges {
Copy link
Contributor

@albertodonato albertodonato Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to handle pagination as results might span over multiple batches (see e.g. FindByURL for repositories)

internal/api/role.go Outdated
}

// GetFilterSchema returns the filter schema for roles.
func (r roleAPI) GetFilterSchema(ctx context.Context) (*FilterSchema, error) {
Copy link
Contributor

@albertodonato albertodonato Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This (and the type above) doesn't seem to be used?

@ChrisMcKenzie
Copy link
Contributor Author

ChrisMcKenzie commented Dec 10, 2025

Change looks good in general, but I think we should treat target and principal identifiers as opaque, and not parse the type:id, which is going to make the input for resources more verbose and prone to error.

ok I will work on this change today as well as the other comments

ChrisMcKenzie and others added 11 commits December 10, 2025 11:51
@ChrisMcKenzie
add: role and role_assignment graphql scaffolding
5b6239c
@ChrisMcKenzie
add: role datasource
86a5c04
@ChrisMcKenzie @claude
fix: update role datasource API to use filter-based queries
be2e998 
Cherry-picked from abd2054 with only datasource-related changes.

Changes:
- Update role.Read() to use filter-based query instead of direct lookup
- Add GetFilterSchema() method for role filters
- Fix role not found handling

This fixes the role datasource query mechanism to align with GraphQL API changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@ChrisMcKenzie
add: lint fixes
47b02e9
@ChrisMcKenzie
add: test recordings for role data source
fcf471a
@ChrisMcKenzie
add: docs for role
8496295
@ChrisMcKenzie
add: role_assignment datasources.
4caf857
@ChrisMcKenzie
add: role_assignment datasources docs.
724d8bb
@ChrisMcKenzie
chore: fix datasource tests
f2ea30c
@ChrisMcKenzie
chore: fix tf lint
f42bdd0
@ChrisMcKenzie
chore: add new attribute to resources that have principal and target …
2672f83 
…attributes in api
@ChrisMcKenzie ChrisMcKenzie force-pushed the feature/RBAC-Support-pr2 branch from 531080f to 2672f83 Compare December 10, 2025 17:52
albertodonato
albertodonato reviewed Dec 11, 2025
View reviewed changes
@albertodonato
Copy link
Contributor

albertodonato commented Dec 11, 2025

Thanks for the changes, I think it's getting there.

I have a few more suggestions inline. Also there's bits of the role assignment API that are related to resource creation, those could be probably moved to the branch that adds the resources.

@ChrisMcKenzie
Copy link
Contributor Author

ChrisMcKenzie commented Dec 11, 2025

Thanks for the changes, I think it's getting there.

I have a few more suggestions inline. Also there's bits of the role assignment API that are related to resource creation, those could be probably moved to the branch that adds the resources.

oh yupp looks like I missed some spots in my clean up was letting claude help with that. will get those fixed up and move that stuff over to the other pr when it is ready

albertodonato
albertodonato approved these changes Dec 12, 2025
View reviewed changes
Copy link
Contributor

@albertodonato albertodonato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks for the changes!

LGTM, just one minor nit inline.

internal/api/role_assignment.go Outdated

// ListByTargetString returns role assignments filtered by an opaque target string.
// The target string should be in the format "type:id" (e.g., "account-group:uuid", "system:all").
func (r roleAssignmentAPI) ListByTargetString(ctx context.Context, targetStr string) ([]RoleAssignment, error) {
Copy link
Contributor

@albertodonato albertodonato Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can now go away, and List can be directly used instead?

@ChrisMcKenzie ChrisMcKenzie merged commit 1c4ce45 into main Dec 12, 2025
6 checks passed
@ChrisMcKenzie ChrisMcKenzie deleted the feature/RBAC-Support-pr2 branch December 12, 2025 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sontek sontek sontek approved these changes

@albertodonato albertodonato albertodonato approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@ChrisMcKenzie @albertodonato @sontek