Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CSE bugs #1266

Merged
merged 10 commits into from
Jun 3, 2024
Merged

Conversation

adambarreiro
Copy link
Collaborator

@adambarreiro adambarreiro commented May 9, 2024

Overview

This PR fixes two bugs in vcd_cse_kubernetes_cluster:

Closes #1265

When any user performs a change in a vcd_cse_kubernetes_cluster and runs terraform plan, the output will always show the Kubeconfig, which can be used to access the cluster by unauthorized people.

Closes #1258

When a user tries to create a vcd_cse_kubernetes_cluster with a network that belongs to a VDC Group, cluster creation fails as the network can't be found.

Fix

Extra changes

During the implementation of vcd_cse_kubernetes_cluster in previous release, I added some redundant validation functions that were already implemented in the validation package. I've removed these functions and just used the available ones, to reduce boilerplate code.

The removed functions are matchRegex and minimumValue, replaced by validation. StringMatch and validation.IntAtLeast, respectively.

Test

Tests passed in VCD 10.5.1 with CSE 4.2.1.

To test the fix about VDC Groups, one can create an extra VDC in their CSE environment, create a VDC Group, increase the scope of the existing Edge Gateway, then the cluster creation with the routed network should not fail anymore:

data "vcd_vdc_group" "group" {
  org  = "tenant_org"
  name = "group" # An ad-hoc VDC group created for this manual check
}

data "vcd_nsxt_edgegateway" "egw" {
  org      = data.vcd_org_vdc.vdc.org
  owner_id = data.vcd_vdc_group.group.id # References the VDC group, not VDC
  name     = "tenant_edgegateway"
}

data "vcd_network_routed_v2" "routed" {
  org             = data.vcd_nsxt_edgegateway.egw.org
  edge_gateway_id = data.vcd_nsxt_edgegateway.egw.id
  name            = "tenant_net_routed"
}

Signed-off-by: abarreiro <abarreiro@vmware.com>
@adambarreiro adambarreiro self-assigned this May 9, 2024
Signed-off-by: abarreiro <abarreiro@vmware.com>
Signed-off-by: abarreiro <abarreiro@vmware.com>
#
Signed-off-by: abarreiro <abarreiro@vmware.com>
#
Signed-off-by: abarreiro <abarreiro@vmware.com>
@adambarreiro adambarreiro changed the title Mark vcd_cse_kubernetes_cluster attribute "kubeconfig" as sensitive Fix CSE bugs May 10, 2024
Signed-off-by: abarreiro <abarreiro@vmware.com>
#
Signed-off-by: abarreiro <abarreiro@vmware.com>
Signed-off-by: abarreiro <abarreiro@vmware.com>
go.mod Outdated Show resolved Hide resolved
Signed-off-by: abarreiro <abarreiro@vmware.com>
Signed-off-by: abarreiro <abarreiro@vmware.com>
@adambarreiro adambarreiro merged commit b0bfff1 into vmware:main Jun 3, 2024
3 checks passed
@adambarreiro adambarreiro deleted the mark-kubeconfig-sensitive branch June 3, 2024 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants