Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add vcd_nsxt_dynamic_security_group resource and data source #877

Merged
merged 5 commits into from
Jul 27, 2022

Conversation

Didainius
Copy link
Collaborator

@Didainius Didainius commented Jun 30, 2022

Closes #459, #787

Starting with VCD 10.3 there is a concept called Dynamic Security Groups which allows users to define dynamic rules (based on names and tags) for firewall group membership.

This PR introduces vcd_nsxt_dynamic_security_group resource and data source.
Note. Dynamic Security Groups require VCD 10.3+ and an NSX-T VDC Group. Meeting these prerequisites allow to create these groups and consume them in both Edge Gateway firewalls (provided Edge Gateway is a member of VDC Group) and Distributed firewalls.

Note2. As opposed to IP Sets and Static Security Groups, Dynamic security groups can only be scoped to VDC Groups and a self-explanatory error is returned if they are scoped to Edge Gateway in a VDC only:

Error: [nsxt dynamic security group create] error creating NSX-T dynamic security group
'test-dynamic-security-group': error creating NSX-T Firewall Group: error in HTTP POST request:
BAD_REQUEST - [ 27e7eea1-0f65-4147-93e6-b6ecc7ecc61f ] Firewall Group test-dynamic-security-group
cannot have type VM_CRITERIA unless it is scoped to a VDC Group

This is the reason a field is called vdc_group_id instead of owner_id where we use it to accept different objects.

More about Dynamic Security Groups in VCD official docs and VMware Blog post:

Signed-off-by: Dainius Serplis <dserplis@vmware.com>
Signed-off-by: Dainius Serplis <dserplis@vmware.com>
@Didainius Didainius marked this pull request as ready for review July 1, 2022 09:19
Copy link
Collaborator

@lvirbalas lvirbalas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some thoughts and suggestions.

vcd/resource_vcd_nsxt_dynamic_security_group.go Outdated Show resolved Hide resolved
vcd/resource_vcd_nsxt_dynamic_security_group.go Outdated Show resolved Hide resolved
vcd/resource_vcd_nsxt_dynamic_security_group.go Outdated Show resolved Hide resolved
website/docs/d/nsxt_dynamic_security_group.html.markdown Outdated Show resolved Hide resolved
website/docs/r/nsxt_dynamic_security_group.html.markdown Outdated Show resolved Hide resolved
website/docs/r/nsxt_dynamic_security_group.html.markdown Outdated Show resolved Hide resolved
website/docs/r/nsxt_dynamic_security_group.html.markdown Outdated Show resolved Hide resolved
Signed-off-by: Dainius Serplis <dserplis@vmware.com>
@lvirbalas lvirbalas removed the request for review from vbauzys July 15, 2022 06:51
Copy link
Collaborator

@adambarreiro adambarreiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Just minor things

vcd/datasource_vcd_nsxt_dynamic_security_group.go Outdated Show resolved Hide resolved
Signed-off-by: Dainius Serplis <dserplis@vmware.com>
Signed-off-by: Dainius Serplis <dserplis@vmware.com>
@Didainius Didainius merged commit 619471d into vmware:main Jul 27, 2022
@Didainius Didainius deleted the dynamic_groups-pr branch July 27, 2022 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add resources to create NSX-T security tags and manage assignment
3 participants