Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement connection and subscription resources for jira and slack. #1116

Merged
merged 12 commits into from
Oct 15, 2024
7 changes: 7 additions & 0 deletions .changelog/1116.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
```release-note:feature
Add preview of the following Vault Radar connections and subscriptions:
hcp_vault_radar_integration_jira_connection
hcp_vault_radar_integration_jira_subscription
hcp_vault_radar_integration_slack_connection
hcp_vault_radar_integration_slack_subscription
```
47 changes: 47 additions & 0 deletions docs/resources/vault_radar_integration_jira_connection.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
---
page_title: "hcp_vault_radar_integration_jira_connection Resource - terraform-provider-hcp"
subcategory: ""
description: |-
This terraform resource manages an Integration Jira Connection in Vault Radar.
---

# hcp_vault_radar_integration_jira_connection (Resource)
kartheek-hc marked this conversation as resolved.
Show resolved Hide resolved

-> **Note:** HCP Vault Radar Terraform resources are in preview.

This terraform resource manages an Integration Jira Connection in Vault Radar.

## Example Usage

```terraform
variable "jira_token" {
type = string
sensitive = true
}

resource "hcp_vault_radar_integration_jira_connection" "jira_connection" {
name = "example connection to jira"
email = "[email protected]"
token = var.jira_token
base_url = "https://example.atlassian.net"
}
Comment on lines +22 to +27

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this resource supposed to only work for Jira server as well? For Jira server, the users need to create a personal access token and email is not required

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure what you mean by jira server, and I went by what was required in the integration jira connection in the UI and the python schema.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Jira server is the self-hosted variant of Atlassian Jira. I am not sure we currently support Jira server but going by the integration type (jira), I thought we want to use the same terraform resource for both Jira Cloud and Server. If not, the resource name should contain jira_cloud right

Copy link

@kathytong-hashicorp kathytong-hashicorp Oct 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think Jira Server also supports Basic Auth, we may have never made the update to support personal access tokens?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

K, going to leave it as like this then.

Copy link

@kartheek-hc kartheek-hc Oct 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Basic auth is not a preferred way to make requests to the Jira server API. Same story for Confluence server onboarding, we only support personal access token not basic auth

However, as basic authentication repeatedly sends the username and password on each request, which could be cached in the web browser, it is not the most secure method of authentication we support.

We recommend you use OAuth over basic authentication for most cases. OAuth requires more work to implement, but it uses a token-based workflow that is much more secure.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think Jira Server also supports Basic Auth, we may have never made the update to support personal access tokens?

I think the APIs that we use validate the assignee field on the subscription only work for Jira Cloud. We probably have to make some changes before Jira server integration is fully supported

```


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `base_url` (String) The Jira base URL. Example: https://acme.atlassian.net
- `email` (String) Jira user's email.
- `name` (String) Name of connection. Name must be unique.
- `token` (String, Sensitive) A Jira API token.

### Optional

- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.

### Read-Only

- `id` (String) The ID of this resource.
59 changes: 59 additions & 0 deletions docs/resources/vault_radar_integration_jira_subscription.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
---
page_title: "hcp_vault_radar_integration_jira_subscription Resource - terraform-provider-hcp"
subcategory: ""
description: |-
This terraform resource manages an Integration Jira Subscription in Vault Radar.
---

# hcp_vault_radar_integration_jira_subscription (Resource)

-> **Note:** HCP Vault Radar Terraform resources are in preview.

This terraform resource manages an Integration Jira Subscription in Vault Radar.

## Example Usage

```terraform
variable "jira_token" {
type = string
sensitive = true
}

# A Jira subscription requires a Jira connection.
resource "hcp_vault_radar_integration_jira_connection" "jira_connection" {
name = "example integration jira connection"
email = "[email protected]"
token = var.jira_token
base_url = "https://example.atlassian.net"
}

resource "hcp_vault_radar_integration_jira_subscription" "jira_subscription" {
name = "example integration jira subscription"
connection_id = hcp_vault_radar_integration_jira_connection.jira_connection.id
jira_project_key = "SEC"
issue_type = "Task"
assignee = "id-of-assignee"
message = "Example message"
}
```


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `connection_id` (String) id of the integration jira connection to use for the subscription.
- `issue_type` (String) The type of issue to be created from the alert(s). Example: Task
trentdibacco marked this conversation as resolved.
Show resolved Hide resolved
- `jira_project_key` (String) The name of the project under which the jira issue will be created. Example: OPS
- `name` (String) Name of subscription. Name must be unique.

### Optional

- `assignee` (String) The identifier of the Jira user who will be assigned the ticket. Example: 1e25fbc8895d5b0c9703c19c
trentdibacco marked this conversation as resolved.
Show resolved Hide resolved
- `message` (String) This message will be included in the ticket description.
- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.

### Read-Only

- `id` (String) The ID of this resource.
43 changes: 43 additions & 0 deletions docs/resources/vault_radar_integration_slack_connection.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
---
page_title: "hcp_vault_radar_integration_slack_connection Resource - terraform-provider-hcp"
subcategory: ""
description: |-
This terraform resource manages an Integration Slack Connection in Vault Radar.
---

# hcp_vault_radar_integration_slack_connection (Resource)

-> **Note:** HCP Vault Radar Terraform resources are in preview.

This terraform resource manages an Integration Slack Connection in Vault Radar.

## Example Usage

```terraform
variable "slack_token" {
type = string
sensitive = true
}

resource "hcp_vault_radar_integration_slack_connection" "slack_connection" {
name = "example connection to slack"
token = var.slack_token
}
```


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) Name of connection. Name must be unique.
- `token` (String, Sensitive) Slack bot user oAuth token. Example: Bot token strings begin with 'xoxb'.

### Optional

- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.

### Read-Only

- `id` (String) The ID of this resource.
51 changes: 51 additions & 0 deletions docs/resources/vault_radar_integration_slack_subscription.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
---
page_title: "hcp_vault_radar_integration_slack_subscription Resource - terraform-provider-hcp"
subcategory: ""
description: |-
This terraform resource manages an Integration Slack Subscription in Vault Radar.
---

# hcp_vault_radar_integration_slack_subscription (Resource)

-> **Note:** HCP Vault Radar Terraform resources are in preview.

This terraform resource manages an Integration Slack Subscription in Vault Radar.

## Example Usage

```terraform
variable "slack_token" {
type = string
sensitive = true
}

# A Slack subscription requires a Slack connection.
resource "hcp_vault_radar_integration_slack_connection" "slack_connection" {
name = "example connection to slack"
token = var.slack_token
}

resource "hcp_vault_radar_integration_slack_subscription" "slack_subscription" {
name = "example integration slack subscription"
connection_id = hcp_vault_radar_integration_slack_connection.slack_connection.id
channel = "sec-ops-team"
}
```


<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `channel` (String) Slack channel that messages will be sent to. Note that HashiCorp Vault Radar will send a test message to verify channel's name. Example: dev-ops-team
kartheek-hc marked this conversation as resolved.
Show resolved Hide resolved
- `connection_id` (String) id of the integration slack connection to use for the subscription.
- `name` (String) Name of subscription. Name must be unique.

### Optional

- `project_id` (String) The ID of the HCP project where Vault Radar is located. If not specified, the project specified in the HCP Provider config block will be used, if configured.

### Read-Only

- `id` (String) The ID of this resource.
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
variable "jira_token" {
type = string
sensitive = true
}

resource "hcp_vault_radar_integration_jira_connection" "jira_connection" {
name = "example connection to jira"
email = "[email protected]"
token = var.jira_token
base_url = "https://example.atlassian.net"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
variable "jira_token" {
type = string
sensitive = true
}

# A Jira subscription requires a Jira connection.
resource "hcp_vault_radar_integration_jira_connection" "jira_connection" {
name = "example integration jira connection"
email = "[email protected]"
token = var.jira_token
base_url = "https://example.atlassian.net"
}

resource "hcp_vault_radar_integration_jira_subscription" "jira_subscription" {
name = "example integration jira subscription"
connection_id = hcp_vault_radar_integration_jira_connection.jira_connection.id
jira_project_key = "SEC"
issue_type = "Task"
assignee = "id-of-assignee"
trentdibacco marked this conversation as resolved.
Show resolved Hide resolved
message = "Example message"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
variable "slack_token" {
type = string
sensitive = true
}

resource "hcp_vault_radar_integration_slack_connection" "slack_connection" {
name = "example connection to slack"
token = var.slack_token
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
variable "slack_token" {
type = string
sensitive = true
}

# A Slack subscription requires a Slack connection.
resource "hcp_vault_radar_integration_slack_connection" "slack_connection" {
name = "example connection to slack"
token = var.slack_token
}

resource "hcp_vault_radar_integration_slack_subscription" "slack_subscription" {
name = "example integration slack subscription"
connection_id = hcp_vault_radar_integration_slack_connection.slack_connection.id
channel = "sec-ops-team"
}
6 changes: 6 additions & 0 deletions internal/clients/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@ import (

cloud_vault_radar "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client"
radar_src_registration_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/data_source_registration_service"
radar_connection_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/integration_connection_service"
radar_subscription_service "github.com/hashicorp/hcp-sdk-go/clients/cloud-vault-radar/preview/2023-05-01/client/integration_subscription_service"

hcpConfig "github.com/hashicorp/hcp-sdk-go/config"
sdk "github.com/hashicorp/hcp-sdk-go/httpclient"
Expand Down Expand Up @@ -92,6 +94,8 @@ type Client struct {
LogService log_service.ClientService
ResourceService resource_service.ClientService
RadarSourceRegistrationService radar_src_registration_service.ClientService
RadarConnectionService radar_connection_service.ClientService
RadarSubscriptionService radar_subscription_service.ClientService
}

// ClientConfig specifies configuration for the client that interacts with HCP
Expand Down Expand Up @@ -182,6 +186,8 @@ func NewClient(config ClientConfig) (*Client, error) {
Webhook: cloud_webhook.New(httpClient, nil).WebhookService,
ResourceService: cloud_resource_manager.New(httpClient, nil).ResourceService,
RadarSourceRegistrationService: cloud_vault_radar.New(httpClient, nil).DataSourceRegistrationService,
RadarConnectionService: cloud_vault_radar.New(httpClient, nil).IntegrationConnectionService,
RadarSubscriptionService: cloud_vault_radar.New(httpClient, nil).IntegrationSubscriptionService,
}

return client, nil
Expand Down
Loading