diff --git a/README.md b/README.md index 9bf231d6a..6eb0087ee 100644 --- a/README.md +++ b/README.md @@ -42,9 +42,6 @@ $ cd $GOPATH/src/github.com/hashicorp/terraform-provider-vault $ make build ``` -Using the provider ----------------------- - Developing the Provider --------------------------- @@ -94,3 +91,35 @@ If you wish to run specific tests, use the `TESTARGS` environment variable: ```sh TESTARGS="--run DataSourceAWSAccessCredentials" make testacc ``` + +Using a local development build +---------------------- + +It's possible to use a local build of the Vault provider with Terraform directly. +This is useful when testing the provider outside the acceptance test framework. + +Configure Terraform to use the development build of the provider. + +> **warning**: backup your `~/.terraformrc` before running this command: + +```shell +cat > ~/.terraformrc < **warning**: backup your `~/.terraformrc` before running this command: + +```shell +cat > ~/.terraformrc < 1 { + return nil, fmt.Errorf("client_auth block may appear only once") + } + + clientAuthCert := "" + clientAuthKey := "" + if len(clientAuthI) == 1 { + clientAuth := clientAuthI[0].(map[string]interface{}) + clientAuthCert = clientAuth["cert_file"].(string) + clientAuthKey = clientAuth["key_file"].(string) + } + + err := clientConfig.ConfigureTLS(&api.TLSConfig{ + CACert: d.Get("ca_cert_file").(string), + CAPath: d.Get("ca_cert_dir").(string), + Insecure: d.Get("skip_tls_verify").(bool), + TLSServerName: d.Get("tls_server_name").(string), + + ClientCert: clientAuthCert, + ClientKey: clientAuthKey, + }) + if err != nil { + return nil, fmt.Errorf("failed to configure TLS for Vault API: %s", err) + } + + clientConfig.HttpClient.Transport = helper.NewTransport( + "Vault", + clientConfig.HttpClient.Transport, + helper.DefaultTransportOptions(), + ) + + // enable ReadYourWrites to support read-after-write on Vault Enterprise + clientConfig.ReadYourWrites = true + + // set default MaxRetries + clientConfig.MaxRetries = DefaultMaxHTTPRetries + + client, err := api.NewClient(clientConfig) + if err != nil { + return nil, fmt.Errorf("failed to configure Vault API: %s", err) + } + + // setting this is critical for proper namespace handling + client.SetCloneHeaders(true) + + // setting this is critical for proper client cloning + client.SetCloneToken(true) + + // Set headers if provided + headers := d.Get("headers").([]interface{}) + parsedHeaders := client.Headers().Clone() + + if parsedHeaders == nil { + parsedHeaders = make(http.Header) + } + + for _, h := range headers { + header := h.(map[string]interface{}) + if name, ok := header["name"]; ok { + parsedHeaders.Add(name.(string), header["value"].(string)) + } + } + client.SetHeaders(parsedHeaders) + + client.SetMaxRetries(d.Get("max_retries").(int)) + + MaxHTTPRetriesCCC = d.Get("max_retries_ccc").(int) + + // Try and get the token from the config or token helper + token, err := GetToken(d) + if err != nil { + return nil, err + } + + // Attempt to use auth/login if 'auth_login' is provided in provider config + authLoginI := d.Get("auth_login").([]interface{}) + if len(authLoginI) > 1 { + return "", fmt.Errorf("auth_login block may appear only once") + } + + if len(authLoginI) == 1 { + authLogin := authLoginI[0].(map[string]interface{}) + authLoginPath := authLogin[consts.FieldPath].(string) + authLoginNamespace := "" + if authLoginNamespaceI, ok := authLogin[consts.FieldNamespace]; ok { + authLoginNamespace = authLoginNamespaceI.(string) + client.SetNamespace(authLoginNamespace) + } + authLoginParameters := authLogin[consts.FieldParameters].(map[string]interface{}) + + method := authLogin[consts.FieldMethod].(string) + if method == "aws" { + logger := hclog.Default() + if logging.IsDebugOrHigher() { + logger.SetLevel(hclog.Debug) + } else { + logger.SetLevel(hclog.Error) + } + if err := signAWSLogin(authLoginParameters, logger); err != nil { + return nil, fmt.Errorf("error signing AWS login request: %s", err) + } + } + + secret, err := client.Logical().Write(authLoginPath, authLoginParameters) + if err != nil { + return nil, err + } + token = secret.Auth.ClientToken + } + if token != "" { + client.SetToken(token) + } + if client.Token() == "" { + return nil, errors.New("no vault token found") + } + + skipChildToken := d.Get("skip_child_token").(bool) + if !skipChildToken { + err := setChildToken(d, client) + if err != nil { + return nil, err + } + } + + // Set the namespace to the requested namespace, if provided + namespace := d.Get(consts.FieldNamespace).(string) + if namespace != "" { + client.SetNamespace(namespace) + } + + return &ProviderMeta{ + resourceData: d, + client: client, + }, nil +} + +// GetClient is meant to be called from a schema.Resource function. +// It ensures that the returned api.Client's matches the resource's configured +// namespace. The value for the namespace is resolved from *schema.ResourceData, +// *schema.ResourceDiff, or *terraform.InstanceState. +func GetClient(i interface{}, meta interface{}) (*api.Client, error) { + p, ok := meta.(*ProviderMeta) + if p == nil || !ok { + return nil, fmt.Errorf("meta argument must be a ProviderMeta") + } + + var ns string + switch v := i.(type) { + case *schema.ResourceData: + if v, ok := v.GetOk(consts.FieldNamespace); ok { + ns = v.(string) + } + case *schema.ResourceDiff: + if v, ok := v.GetOk(consts.FieldNamespace); ok { + ns = v.(string) + } + case *terraform.InstanceState: + ns = v.Attributes[consts.FieldNamespace] + default: + return nil, fmt.Errorf("GetClient() called with unsupported type %T", v) + } + + if ns == "" { + // in order to import namespaced resources the user must provide + // the namespace from an environment variable. + ns = os.Getenv(consts.EnvVarVaultNamespaceImport) + if ns != "" { + log.Printf("[DEBUG] Value for %q set from environment", consts.FieldNamespace) + } + } + + if ns != "" { + return p.GetNSClient(ns) + } + + return p.GetClient(), nil +} + +func setChildToken(d *schema.ResourceData, c *api.Client) error { + tokenName := d.Get("token_name").(string) + if tokenName == "" { + tokenName = "terraform" + } + + // In order to enforce our relatively-short lease TTL, we derive a + // temporary child token that inherits all of the policies of the + // token we were given but expires after max_lease_ttl_seconds. + // + // The intent here is that Terraform will need to re-fetch any + // secrets on each run and so we limit the exposure risk of secrets + // that end up stored in the Terraform state, assuming that they are + // credentials that Vault is able to revoke. + // + // Caution is still required with state files since not all secrets + // can explicitly be revoked, and this limited scope won't apply to + // any secrets that are *written* by Terraform to Vault. + + // Set the namespace to the token's namespace only for the + // child token creation + tokenInfo, err := c.Auth().Token().LookupSelf() + if err != nil { + return err + } + if tokenNamespaceRaw, ok := tokenInfo.Data["namespace_path"]; ok { + tokenNamespace := tokenNamespaceRaw.(string) + if tokenNamespace != "" { + c.SetNamespace(tokenNamespace) + } + } + + renewable := false + childTokenLease, err := c.Auth().Token().Create(&api.TokenCreateRequest{ + DisplayName: tokenName, + TTL: fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)), + ExplicitMaxTTL: fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)), + Renewable: &renewable, + }) + if err != nil { + return fmt.Errorf("failed to create limited child token: %s", err) + } + + childToken := childTokenLease.Auth.ClientToken + policies := childTokenLease.Auth.Policies + + log.Printf("[INFO] Using Vault token with the following policies: %s", strings.Join(policies, ", ")) + + // Set the token to the generated child token + c.SetToken(childToken) + + return nil +} + +func signAWSLogin(parameters map[string]interface{}, logger hclog.Logger) error { + var accessKey, secretKey, securityToken string + if val, ok := parameters["aws_access_key_id"].(string); ok { + accessKey = val + } + + if val, ok := parameters["aws_secret_access_key"].(string); ok { + secretKey = val + } + + if val, ok := parameters["aws_security_token"].(string); ok { + securityToken = val + } + + creds, err := awsutil.RetrieveCreds(accessKey, secretKey, securityToken, logger) + if err != nil { + return fmt.Errorf("failed to retrieve AWS credentials: %s", err) + } + + var headerValue, stsRegion string + if val, ok := parameters["header_value"].(string); ok { + headerValue = val + } + + if val, ok := parameters["sts_region"].(string); ok { + stsRegion = val + } + + loginData, err := awsutil.GenerateLoginData(creds, headerValue, stsRegion, logger) + if err != nil { + return fmt.Errorf("failed to generate AWS login data: %s", err) + } + + parameters["iam_http_request_method"] = loginData["iam_http_request_method"] + parameters["iam_request_url"] = loginData["iam_request_url"] + parameters["iam_request_headers"] = loginData["iam_request_headers"] + parameters["iam_request_body"] = loginData["iam_request_body"] + + return nil +} + +func GetToken(d *schema.ResourceData) (string, error) { + if token := d.Get("token").(string); token != "" { + return token, nil + } + + if addAddr := d.Get("add_address_to_env").(string); addAddr == "true" { + if addr := d.Get("address").(string); addr != "" { + addrEnvVar := api.EnvVaultAddress + if current, exists := os.LookupEnv(addrEnvVar); exists { + defer func() { + os.Setenv(addrEnvVar, current) + }() + } else { + defer func() { + os.Unsetenv(addrEnvVar) + }() + } + if err := os.Setenv(addrEnvVar, addr); err != nil { + return "", err + } + } + } + + // Use ~/.vault-token, or the configured token helper. + tokenHelper, err := config.DefaultTokenHelper() + if err != nil { + return "", fmt.Errorf("error getting token helper: %s", err) + } + token, err := tokenHelper.Get() + if err != nil { + return "", fmt.Errorf("error getting token: %s", err) + } + return strings.TrimSpace(token), nil +} + +const DefaultMaxHTTPRetries = 2 diff --git a/internal/provider/meta_test.go b/internal/provider/meta_test.go new file mode 100644 index 000000000..5d69b590a --- /dev/null +++ b/internal/provider/meta_test.go @@ -0,0 +1,345 @@ +package provider + +import ( + "errors" + "fmt" + "os" + "reflect" + "sync" + "testing" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" + "github.com/hashicorp/vault/api" + vault_consts "github.com/hashicorp/vault/sdk/helper/consts" + + "github.com/hashicorp/terraform-provider-vault/internal/consts" +) + +func TestProviderMeta_GetNSClient(t *testing.T) { + rootClient, err := api.NewClient(api.DefaultConfig()) + if err != nil { + t.Fatal(err) + } + + tests := []struct { + name string + client *api.Client + resourceData *schema.ResourceData + ns string + expectNs string + wantErr bool + expectErr error + calls int + }{ + { + name: "no-client", + client: nil, + resourceData: &schema.ResourceData{}, + wantErr: true, + expectErr: errors.New("root api.Client not set, init with NewProviderMeta()"), + }, + { + name: "no-resource-data", + client: &api.Client{}, + resourceData: nil, + wantErr: true, + expectErr: errors.New("provider ResourceData not set, init with NewProviderMeta()"), + }, + { + name: "basic-no-root-ns", + client: rootClient, + resourceData: schema.TestResourceDataRaw(t, + map[string]*schema.Schema{ + "namespace": { + Type: schema.TypeString, + Required: true, + }, + }, + map[string]interface{}{}, + ), + ns: "foo", + expectNs: "foo", + }, + { + name: "basic-root-ns", + client: rootClient, + resourceData: schema.TestResourceDataRaw(t, + map[string]*schema.Schema{ + "namespace": { + Type: schema.TypeString, + Required: true, + }, + }, + map[string]interface{}{ + "namespace": "bar", + }, + ), + ns: "foo", + expectNs: "bar/foo", + calls: 5, + }, + { + name: "basic-root-ns-trimmed", + client: rootClient, + resourceData: schema.TestResourceDataRaw(t, + map[string]*schema.Schema{ + "namespace": { + Type: schema.TypeString, + Required: true, + }, + }, + map[string]interface{}{ + "namespace": "bar", + }, + ), + ns: "/foo/", + expectNs: "bar/foo", + calls: 5, + }, + } + + assertClientCache := func(t *testing.T, p *ProviderMeta, expectedCache map[string]*api.Client) { + t.Helper() + + if !reflect.DeepEqual(expectedCache, p.clientCache) { + t.Errorf("GetNSClient() expected Client cache %#v, actual %#v", expectedCache, p.clientCache) + } + } + + assertClientNs := func(t *testing.T, c *api.Client, expectNs string) { + actualNs := c.Headers().Get(vault_consts.NamespaceHeaderName) + if actualNs != expectNs { + t.Errorf("GetNSClient() got ns = %v, want %v", actualNs, expectNs) + } + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + p := &ProviderMeta{ + client: tt.client, + resourceData: tt.resourceData, + } + got, err := p.GetNSClient(tt.ns) + + if (err != nil) != tt.wantErr { + t.Errorf("GetNSClient() error = %v, wantErr %v", err, tt.wantErr) + return + } + + if tt.wantErr { + if err == nil { + t.Fatalf("GetNSClient() expected an err, actual %#v", err) + } + + if !reflect.DeepEqual(err, tt.expectErr) { + t.Errorf("GetNSClient() expected err %#v, actual %#v", tt.expectErr, err) + } + + var expectedCache map[string]*api.Client + assertClientCache(t, p, expectedCache) + + return + } + + assertClientCache(t, p, map[string]*api.Client{ + tt.expectNs: got, + }) + assertClientNs(t, got, tt.expectNs) + + // test cache locking + if tt.calls > 0 { + var wg sync.WaitGroup + p.clientCache = nil + wg.Add(tt.calls) + for i := 0; i < tt.calls; i++ { + go func() { + defer wg.Done() + got, err := p.GetNSClient(tt.ns) + if err != nil { + t.Error(err) + return + } + + assertClientCache(t, p, map[string]*api.Client{ + tt.expectNs: got, + }) + assertClientNs(t, got, tt.expectNs) + }() + } + wg.Wait() + } + }) + } +} + +func TestGetClient(t *testing.T) { + rootClient, err := api.NewClient(api.DefaultConfig()) + if err != nil { + t.Fatal(err) + } + + // testing schema.ResourceDiff is not covered here + // since its field members are private. + + rscData := func(t *testing.T, set bool, ns string) interface{} { + i := schema.TestResourceDataRaw(t, + map[string]*schema.Schema{ + consts.FieldNamespace: { + Type: schema.TypeString, + Required: true, + }, + }, + map[string]interface{}{}, + ) + if set { + if err := i.Set(consts.FieldNamespace, ns); err != nil { + t.Fatal(err) + } + } + return i + } + + instanceState := func(_ *testing.T, set bool, ns string) interface{} { + i := &terraform.InstanceState{ + Attributes: map[string]string{}, + } + if set { + i.Attributes[consts.FieldNamespace] = ns + } + return i + } + + tests := []struct { + name string + meta *ProviderMeta + ifcNS string + envNS string + want string + wantErr bool + expectErr error + setAttr bool + ifaceFunc func(t *testing.T, set bool, ns string) interface{} + }{ + { + name: "rsc-data", + ifcNS: "ns1-rsc-data", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + ifaceFunc: rscData, + want: "ns1-rsc-data", + setAttr: true, + }, + { + name: "inst-state", + ifcNS: "ns1-inst-state", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + want: "ns1-inst-state", + setAttr: true, + ifaceFunc: instanceState, + }, + { + name: "import-env", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + ifaceFunc: instanceState, + envNS: "ns1-import-env", + want: "ns1-import-env", + setAttr: false, + }, + { + name: "ignore-env-rsc-data", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + ifaceFunc: rscData, + ifcNS: "ns1", + envNS: "ns1-import-env", + want: "ns1", + setAttr: true, + }, + { + name: "ignore-env-inst-state", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + ifaceFunc: instanceState, + ifcNS: "ns1", + envNS: "ns1-import-env", + want: "ns1", + setAttr: true, + }, + { + name: "error-unsupported-type", + meta: &ProviderMeta{ + client: rootClient, + resourceData: nil, + }, + ifaceFunc: func(t *testing.T, set bool, ns string) interface{} { + return nil + }, + wantErr: true, + expectErr: fmt.Errorf("GetClient() called with unsupported type "), + }, + { + name: "error-not-provider-meta", + meta: nil, + wantErr: true, + expectErr: fmt.Errorf("meta argument must be a ProviderMeta"), + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if tt.meta != nil { + tt.meta.resourceData = schema.TestResourceDataRaw(t, + map[string]*schema.Schema{ + consts.FieldNamespace: { + Type: schema.TypeString, + Required: true, + }, + }, + map[string]interface{}{}, + ) + } + + var i interface{} + if tt.ifaceFunc != nil { + i = tt.ifaceFunc(t, tt.setAttr, tt.ifcNS) + } + + // set ns in env + if tt.envNS != "" { + if err := os.Setenv(consts.EnvVarVaultNamespaceImport, tt.envNS); err != nil { + t.Fatal(err) + } + defer os.Unsetenv(consts.EnvVarVaultNamespaceImport) + } + + got, err := GetClient(i, tt.meta) + if tt.wantErr { + if err == nil { + t.Errorf("GetClient() error = %v, wantErr %v", err, tt.wantErr) + return + } + if !reflect.DeepEqual(err, tt.expectErr) { + t.Errorf("GetClient() expected err %#v, actual %#v", tt.expectErr, err) + } + return + } + + actual := got.Headers().Get(vault_consts.NamespaceHeaderName) + if !reflect.DeepEqual(actual, tt.want) { + t.Errorf("GetClient() got = %v, want %v", actual, tt.want) + } + }) + } +} diff --git a/testutil/testutil.go b/testutil/testutil.go index 54fd43871..e5754e159 100644 --- a/testutil/testutil.go +++ b/testutil/testutil.go @@ -24,7 +24,7 @@ const ( ) func TestAccPreCheck(t *testing.T) { - FatalTestEnvUnset(t, "VAULT_ADDR", "VAULT_TOKEN") + FatalTestEnvUnset(t, api.EnvVaultAddress, api.EnvVaultToken) } func TestEntPreCheck(t *testing.T) { diff --git a/vault/data_identity_entity.go b/vault/data_identity_entity.go index 639ee6c72..20ac7ae9c 100644 --- a/vault/data_identity_entity.go +++ b/vault/data_identity_entity.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -195,7 +197,6 @@ func identityEntityDataSource() *schema.Resource { func identityEntityLookup(client *api.Client, data map[string]interface{}) (*api.Secret, error) { log.Print("[DEBUG] Looking up IdentityEntity") resp, err := client.Logical().Write("identity/lookup/entity", data) - if err != nil { return nil, fmt.Errorf("Error reading Identity Entity '%v': %s", data, err) } @@ -213,10 +214,12 @@ func identityEntityLookup(client *api.Client, data map[string]interface{}) (*api } func identityEntityDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } data := map[string]interface{}{} - if v, ok := d.GetOk("entity_name"); ok { data["name"] = v.(string) } @@ -235,7 +238,6 @@ func identityEntityDataSourceRead(d *schema.ResourceData, meta interface{}) erro log.Print("[DEBUG] Reading IdentityEntity") resp, err := identityEntityLookup(client, data) - if err != nil { return err } diff --git a/vault/data_identity_entity_test.go b/vault/data_identity_entity_test.go index 52759cd2a..121171b28 100644 --- a/vault/data_identity_entity_test.go +++ b/vault/data_identity_entity_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -69,7 +69,7 @@ func testDataSourceIdentityEntity_check() resource.TestCheckFunc { } id := instanceState.ID - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := identityEntityLookup(client, map[string]interface{}{"id": id}) if err != nil { diff --git a/vault/data_identity_group.go b/vault/data_identity_group.go index 04d4c366c..fb027f11a 100644 --- a/vault/data_identity_group.go +++ b/vault/data_identity_group.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -170,7 +172,6 @@ func identityGroupDataSource() *schema.Resource { func identityGroupLookup(client *api.Client, data map[string]interface{}) (*api.Secret, error) { log.Print("[DEBUG] Looking up IdentityGroup") resp, err := client.Logical().Write("identity/lookup/group", data) - if err != nil { return nil, fmt.Errorf("Error reading Identity Group '%v': %s", data, err) } @@ -188,7 +189,10 @@ func identityGroupLookup(client *api.Client, data map[string]interface{}) (*api. } func identityGroupDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } data := map[string]interface{}{} @@ -210,7 +214,6 @@ func identityGroupDataSourceRead(d *schema.ResourceData, meta interface{}) error log.Print("[DEBUG] Reading IdentityGroup") resp, err := identityGroupLookup(client, data) - if err != nil { return err } diff --git a/vault/data_identity_group_test.go b/vault/data_identity_group_test.go index 64f57bfc7..51a924e5f 100644 --- a/vault/data_identity_group_test.go +++ b/vault/data_identity_group_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -69,7 +69,7 @@ func testDataSourceIdentityGroup_check(resource string) resource.TestCheckFunc { } id := instanceState.ID - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := identityGroupLookup(client, map[string]interface{}{"id": id}) if err != nil { diff --git a/vault/data_identity_oidc_client_creds.go b/vault/data_identity_oidc_client_creds.go index b40b818bd..2cd0b18e0 100644 --- a/vault/data_identity_oidc_client_creds.go +++ b/vault/data_identity_oidc_client_creds.go @@ -5,7 +5,8 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func identityOIDCClientCredsDataSource() *schema.Resource { @@ -33,7 +34,10 @@ func identityOIDCClientCredsDataSource() *schema.Resource { } func readOIDCClientCredsResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Get("name").(string) path := getOIDCClientPath(name) diff --git a/vault/data_identity_oidc_openid_config.go b/vault/data_identity_oidc_openid_config.go index 5d099874e..c351c7f09 100644 --- a/vault/data_identity_oidc_openid_config.go +++ b/vault/data_identity_oidc_openid_config.go @@ -7,7 +7,8 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const identityOIDCOpenIDConfigPathSuffix = "/.well-known/openid-configuration" @@ -104,7 +105,10 @@ func identityOIDCOpenIDConfigDataSource() *schema.Resource { } func readOIDCOpenIDConfigResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Get("name").(string) path := "/v1/" + getOIDCProviderPath(name) + identityOIDCOpenIDConfigPathSuffix r := client.NewRequest("GET", path) diff --git a/vault/data_identity_oidc_openid_config_test.go b/vault/data_identity_oidc_openid_config_test.go index a01d3152d..5a0cc8555 100644 --- a/vault/data_identity_oidc_openid_config_test.go +++ b/vault/data_identity_oidc_openid_config_test.go @@ -9,6 +9,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + "github.com/hashicorp/vault/api" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -21,7 +22,7 @@ func TestDataSourceIdentityOIDCOpenIDConfig(t *testing.T) { keyName := acctest.RandomWithPrefix("test-key") clientName := acctest.RandomWithPrefix("test-client") - u, err := url.Parse(os.Getenv("VAULT_ADDR")) + u, err := url.Parse(os.Getenv(api.EnvVaultAddress)) if err != nil { t.Fatal(err) } diff --git a/vault/data_identity_oidc_public_keys.go b/vault/data_identity_oidc_public_keys.go index b1ddb61b3..6eb4e68cf 100644 --- a/vault/data_identity_oidc_public_keys.go +++ b/vault/data_identity_oidc_public_keys.go @@ -7,7 +7,8 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const identityOIDCPublicKeysPathSuffix = "/.well-known/keys" @@ -35,7 +36,10 @@ func identityOIDCPublicKeysDataSource() *schema.Resource { } func readOIDCPublicKeysResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Get("name").(string) path := "/v1/" + getOIDCProviderPath(name) + identityOIDCPublicKeysPathSuffix r := client.NewRequest("GET", path) diff --git a/vault/data_source_ad_credentials.go b/vault/data_source_ad_credentials.go index ae60eb80c..e5a6e4fd0 100644 --- a/vault/data_source_ad_credentials.go +++ b/vault/data_source_ad_credentials.go @@ -2,9 +2,11 @@ package vault import ( "fmt" - "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" "log" + + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func adAccessCredentialsDataSource() *schema.Resource { @@ -42,7 +44,11 @@ func adAccessCredentialsDataSource() *schema.Resource { } func readCredsResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + backend := d.Get("backend").(string) role := d.Get("role").(string) path := fmt.Sprintf("%s/creds/%s", backend, role) diff --git a/vault/data_source_approle_auth_backend_role_id.go b/vault/data_source_approle_auth_backend_role_id.go index df0674a90..3556bad53 100644 --- a/vault/data_source_approle_auth_backend_role_id.go +++ b/vault/data_source_approle_auth_backend_role_id.go @@ -6,7 +6,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func approleAuthBackendRoleIDDataSource() *schema.Resource { @@ -41,7 +42,10 @@ func approleAuthBackendRoleIDDataSource() *schema.Resource { } func approleAuthBackendRoleIDRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := approleAuthBackendRolePath(d.Get("backend").(string), d.Get("role_name").(string)) diff --git a/vault/data_source_auth_backend.go b/vault/data_source_auth_backend.go index 2615253eb..bda666565 100644 --- a/vault/data_source_auth_backend.go +++ b/vault/data_source_auth_backend.go @@ -5,7 +5,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func authBackendDataSource() *schema.Resource { @@ -57,7 +58,10 @@ func authBackendDataSource() *schema.Resource { } func authBackendDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } targetPath := d.Get("path").(string) diff --git a/vault/data_source_aws_access_credentials.go b/vault/data_source_aws_access_credentials.go index 11a18de9e..d619fccc5 100644 --- a/vault/data_source_aws_access_credentials.go +++ b/vault/data_source_aws_access_credentials.go @@ -14,7 +14,8 @@ import ( "github.com/hashicorp/go-cleanhttp" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const ( @@ -125,7 +126,10 @@ func awsAccessCredentialsDataSource() *schema.Resource { } func awsAccessCredentialsDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) credType := d.Get("type").(string) diff --git a/vault/data_source_azure_access_credentials.go b/vault/data_source_azure_access_credentials.go index 35d588ef5..8791a92a4 100644 --- a/vault/data_source_azure_access_credentials.go +++ b/vault/data_source_azure_access_credentials.go @@ -14,6 +14,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" "github.com/hashicorp/vault/sdk/helper/pointerutil" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func azureAccessCredentialsDataSource() *schema.Resource { @@ -109,7 +111,10 @@ Some possible values: AzurePublicCloud, AzureGovernmentCloud`, } func azureAccessCredentialsDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -204,21 +209,21 @@ func azureAccessCredentialsDataSourceRead(d *schema.ResourceData, meta interface } clientOptions := &arm.ClientOptions{} - var e string + var environment string if v, ok := d.GetOk("environment"); ok { - e = v.(string) + environment = v.(string) } else { data, err := getConfigData() if err != nil { return err } if v, ok := data["environment"]; ok && v.(string) != "" { - e = v.(string) + environment = v.(string) } } - if e != "" { - env, err := azure.EnvironmentFromName(e) + if environment != "" { + env, err := azure.EnvironmentFromName(environment) if err != nil { return err } diff --git a/vault/data_source_gcp_auth_backend_role.go b/vault/data_source_gcp_auth_backend_role.go index 0629028a5..54294962e 100644 --- a/vault/data_source_gcp_auth_backend_role.go +++ b/vault/data_source_gcp_auth_backend_role.go @@ -6,22 +6,21 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" -) -var ( - gcpRoleFields = []string{ - "role_id", - "type", - "bound_service_accounts", - "bound_projects", - "bound_zones", - "bound_regions", - "bound_instance_groups", - "token_policies", - } + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) +var gcpRoleFields = []string{ + "role_id", + "type", + "bound_service_accounts", + "bound_projects", + "bound_zones", + "bound_regions", + "bound_instance_groups", + "token_policies", +} + func gcpAuthBackendRoleDataSource() *schema.Resource { fields := map[string]*schema.Schema{ "role_name": { @@ -110,7 +109,10 @@ func gcpAuthBackendRoleDataSource() *schema.Resource { } func gcpAuthBackendRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := gcpRoleResourcePath(d.Get("backend").(string), d.Get("role_name").(string)) diff --git a/vault/data_source_generic_secret.go b/vault/data_source_generic_secret.go index 22a44170d..29cc38087 100644 --- a/vault/data_source_generic_secret.go +++ b/vault/data_source_generic_secret.go @@ -8,7 +8,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func genericSecretDataSource() *schema.Resource { @@ -79,7 +79,10 @@ func genericSecretDataSource() *schema.Resource { } func genericSecretDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Get("path").(string) diff --git a/vault/data_source_kubernetes_auth_backend_config.go b/vault/data_source_kubernetes_auth_backend_config.go index 222a29100..cb7539d67 100644 --- a/vault/data_source_kubernetes_auth_backend_config.go +++ b/vault/data_source_kubernetes_auth_backend_config.go @@ -1,12 +1,13 @@ package vault import ( + "fmt" + "log" "strings" - "fmt" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" - "log" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func kubernetesAuthBackendConfigDataSource() *schema.Resource { @@ -66,7 +67,10 @@ func kubernetesAuthBackendConfigDataSource() *schema.Resource { } func kubernetesAuthBackendConfigDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := kubernetesAuthBackendConfigPath(d.Get("backend").(string)) diff --git a/vault/data_source_kubernetes_auth_backend_role.go b/vault/data_source_kubernetes_auth_backend_role.go index 3161c91ff..61e4f400a 100644 --- a/vault/data_source_kubernetes_auth_backend_role.go +++ b/vault/data_source_kubernetes_auth_backend_role.go @@ -6,7 +6,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func kubernetesAuthBackendRoleDataSource() *schema.Resource { @@ -63,7 +64,10 @@ func kubernetesAuthBackendRoleDataSource() *schema.Resource { } func kubernetesAuthBackendRoleDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) role := d.Get("role_name").(string) diff --git a/vault/data_source_nomad_credentials.go b/vault/data_source_nomad_credentials.go index 054d4ea32..f6a638543 100644 --- a/vault/data_source_nomad_credentials.go +++ b/vault/data_source_nomad_credentials.go @@ -5,7 +5,8 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func nomadAccessCredentialsDataSource() *schema.Resource { @@ -38,7 +39,11 @@ func nomadAccessCredentialsDataSource() *schema.Resource { } func readNomadCredsResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + backend := d.Get("backend").(string) role := d.Get("role").(string) path := fmt.Sprintf("%s/creds/%s", backend, role) diff --git a/vault/data_source_transit_decrypt.go b/vault/data_source_transit_decrypt.go index d7724b01d..3f2d4867e 100644 --- a/vault/data_source_transit_decrypt.go +++ b/vault/data_source_transit_decrypt.go @@ -3,8 +3,10 @@ package vault import ( "encoding/base64" "fmt" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func transitDecryptDataSource() *schema.Resource { @@ -43,7 +45,10 @@ func transitDecryptDataSource() *schema.Resource { } func transitDecryptDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) key := d.Get("key").(string) diff --git a/vault/data_source_transit_encrypt.go b/vault/data_source_transit_encrypt.go index ecf0a3f17..44ddd4f75 100644 --- a/vault/data_source_transit_encrypt.go +++ b/vault/data_source_transit_encrypt.go @@ -3,9 +3,10 @@ package vault import ( "encoding/base64" "fmt" + "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func transitEncryptDataSource() *schema.Resource { @@ -49,7 +50,10 @@ func transitEncryptDataSource() *schema.Resource { } func transitEncryptDataSourceRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) key := d.Get("key").(string) diff --git a/vault/import_generic_secret_test.go b/vault/import_generic_secret_test.go index a0ff61c45..8a8b15c53 100644 --- a/vault/import_generic_secret_test.go +++ b/vault/import_generic_secret_test.go @@ -1,6 +1,7 @@ package vault import ( + "fmt" "testing" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" @@ -10,13 +11,15 @@ import ( ) func TestAccGenericSecret_importBasic(t *testing.T) { - path := acctest.RandomWithPrefix("secretsv1/test-") + mount := "secretsv1" + name := acctest.RandomWithPrefix("test") + path := fmt.Sprintf("%s/%s", mount, name) resource.Test(t, resource.TestCase{ PreCheck: func() { testutil.TestAccPreCheck(t) }, Providers: testProviders, Steps: []resource.TestStep{ { - Config: testResourceGenericSecret_initialConfig(path), + Config: testResourceGenericSecret_initialConfig(mount, name), Check: testResourceGenericSecret_initialCheck(path), }, { @@ -28,3 +31,34 @@ func TestAccGenericSecret_importBasic(t *testing.T) { }, }) } + +func TestAccGenericSecret_importBasicNS(t *testing.T) { + // TODO: investigate why namespace field is not honoured during import. + // Work around is to set the namespace in the provider{} for import. + t.Skip("VAULT-4254: namespaced resource imports require provider config") + + ns := acctest.RandomWithPrefix("ns") + mount := "secretsv1" + name := acctest.RandomWithPrefix("test") + path := fmt.Sprintf("%s/%s", mount, name) + resourceName := "vault_generic_secret.test" + resource.Test(t, resource.TestCase{ + PreCheck: func() { testutil.TestEntPreCheck(t) }, + Providers: testProviders, + Steps: []resource.TestStep{ + { + Config: testResourceGenericSecret_initialConfigNS(ns, mount, name), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr(resourceName, "namespace", ns), + testResourceGenericSecret_initialCheck(path), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + ImportStateVerifyIgnore: []string{"delete_all_versions"}, + }, + }, + }) +} diff --git a/vault/password_policy.go b/vault/password_policy.go index 7218c4bfa..dd1dbe6bd 100644 --- a/vault/password_policy.go +++ b/vault/password_policy.go @@ -8,6 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func readPasswordPolicy(client *api.Client, name string) (map[string]interface{}, error) { @@ -37,7 +39,10 @@ func readPasswordPolicy(client *api.Client, name string) (map[string]interface{} } func passwordPolicyDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Id() @@ -56,12 +61,14 @@ func passwordPolicyDelete(d *schema.ResourceData, meta interface{}) error { } func passwordPolicyRead(attributes []string, d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Id() policy, err := readPasswordPolicy(client, name) - if err != nil { return fmt.Errorf("error reading from Vault: %s", err) } @@ -75,7 +82,10 @@ func passwordPolicyRead(attributes []string, d *schema.ResourceData, meta interf } func passwordPolicyWrite(attributes []string, d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Get("name").(string) diff --git a/vault/provider.go b/vault/provider.go index 352aaed9a..980d43703 100644 --- a/vault/provider.go +++ b/vault/provider.go @@ -1,22 +1,15 @@ package vault import ( - "errors" "fmt" - "log" - "net/http" - "os" - "strings" - "github.com/hashicorp/go-hclog" "github.com/hashicorp/go-multierror" - "github.com/hashicorp/go-secure-stdlib/awsutil" - "github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" - "github.com/hashicorp/vault/command/config" "github.com/hashicorp/terraform-provider-vault/helper" + "github.com/hashicorp/terraform-provider-vault/internal/consts" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const ( @@ -31,15 +24,12 @@ const ( UnknownPath = "unknown" // DefaultMaxHTTPRetries is used for configuring the api.Client's MaxRetries. - DefaultMaxHTTPRetries = 2 // DefaultMaxHTTPRetriesCCC is used for configuring the api.Client's MaxRetries // for Client Controlled Consistency related operations. DefaultMaxHTTPRetriesCCC = 10 ) -var maxHTTPRetriesCCC int - // This is a global MutexKV for use within this provider. // Use this when you need to have multiple resources or even multiple instances // of the same resource write to the same path in Vault. @@ -60,7 +50,7 @@ func Provider() *schema.Provider { "address": { Type: schema.TypeString, Required: true, - DefaultFunc: schema.EnvDefaultFunc("VAULT_ADDR", nil), + DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultAddress, nil), Description: "URL of the root of the target Vault server.", }, "add_address_to_env": { @@ -72,7 +62,7 @@ func Provider() *schema.Provider { "token": { Type: schema.TypeString, Required: true, - DefaultFunc: schema.EnvDefaultFunc("VAULT_TOKEN", ""), + DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultToken, ""), Description: "Token to use to authenticate to Vault.", }, "token_name": { @@ -108,22 +98,22 @@ func Provider() *schema.Provider { Description: "Login to vault with an existing auth method using auth//login", Elem: &schema.Resource{ Schema: map[string]*schema.Schema{ - "path": { + consts.FieldPath: { Type: schema.TypeString, Required: true, }, - "namespace": { + consts.FieldNamespace: { Type: schema.TypeString, Optional: true, }, - "parameters": { + consts.FieldParameters: { Type: schema.TypeMap, Optional: true, Elem: &schema.Schema{ Type: schema.TypeString, }, }, - "method": { + consts.FieldMethod: { Type: schema.TypeString, Optional: true, }, @@ -177,7 +167,7 @@ func Provider() *schema.Provider { "max_retries": { Type: schema.TypeInt, Optional: true, - DefaultFunc: schema.EnvDefaultFunc("VAULT_MAX_RETRIES", DefaultMaxHTTPRetries), + DefaultFunc: schema.EnvDefaultFunc("VAULT_MAX_RETRIES", provider.DefaultMaxHTTPRetries), Description: "Maximum number of retries when a 5xx error code is encountered.", }, "max_retries_ccc": { @@ -186,7 +176,7 @@ func Provider() *schema.Provider { DefaultFunc: schema.EnvDefaultFunc("VAULT_MAX_RETRIES_CCC", DefaultMaxHTTPRetriesCCC), Description: "Maximum number of retries for Client Controlled Consistency related operations", }, - "namespace": { + consts.FieldNamespace: { Type: schema.TypeString, Optional: true, DefaultFunc: schema.EnvDefaultFunc("VAULT_NAMESPACE", ""), @@ -213,7 +203,7 @@ func Provider() *schema.Provider { }, }, }, - ConfigureFunc: providerConfigure, + ConfigureFunc: provider.NewProviderMeta, DataSourcesMap: dataSourcesMap, ResourcesMap: resourcesMap, } @@ -243,105 +233,105 @@ type Description struct { var ( DataSourceRegistry = map[string]*Description{ "vault_approle_auth_backend_role_id": { - Resource: approleAuthBackendRoleIDDataSource(), + Resource: updateSchemaResource(approleAuthBackendRoleIDDataSource()), PathInventory: []string{"/auth/approle/role/{role_name}/role-id"}, }, "vault_identity_entity": { - Resource: identityEntityDataSource(), + Resource: updateSchemaResource(identityEntityDataSource()), PathInventory: []string{"/identity/lookup/entity"}, }, "vault_identity_group": { - Resource: identityGroupDataSource(), + Resource: updateSchemaResource(identityGroupDataSource()), PathInventory: []string{"/identity/lookup/group"}, }, "vault_kubernetes_auth_backend_config": { - Resource: kubernetesAuthBackendConfigDataSource(), + Resource: updateSchemaResource(kubernetesAuthBackendConfigDataSource()), PathInventory: []string{"/auth/kubernetes/config"}, }, "vault_kubernetes_auth_backend_role": { - Resource: kubernetesAuthBackendRoleDataSource(), + Resource: updateSchemaResource(kubernetesAuthBackendRoleDataSource()), PathInventory: []string{"/auth/kubernetes/role/{name}"}, }, "vault_ad_access_credentials": { - Resource: adAccessCredentialsDataSource(), + Resource: updateSchemaResource(adAccessCredentialsDataSource()), PathInventory: []string{"/ad/creds/{role}"}, }, "vault_nomad_access_token": { - Resource: nomadAccessCredentialsDataSource(), + Resource: updateSchemaResource(nomadAccessCredentialsDataSource()), PathInventory: []string{"/nomad/creds/{role}"}, }, "vault_aws_access_credentials": { - Resource: awsAccessCredentialsDataSource(), + Resource: updateSchemaResource(awsAccessCredentialsDataSource()), PathInventory: []string{"/aws/creds"}, }, "vault_azure_access_credentials": { - Resource: azureAccessCredentialsDataSource(), + Resource: updateSchemaResource(azureAccessCredentialsDataSource()), PathInventory: []string{"/azure/creds/{role}"}, }, "vault_generic_secret": { - Resource: genericSecretDataSource(), + Resource: updateSchemaResource(genericSecretDataSource()), PathInventory: []string{"/secret/data/{path}"}, }, "vault_policy_document": { - Resource: policyDocumentDataSource(), + Resource: updateSchemaResource(policyDocumentDataSource()), PathInventory: []string{"/sys/policy/{name}"}, }, "vault_auth_backend": { - Resource: authBackendDataSource(), + Resource: updateSchemaResource(authBackendDataSource()), PathInventory: []string{"/sys/auth"}, }, "vault_transit_encrypt": { - Resource: transitEncryptDataSource(), + Resource: updateSchemaResource(transitEncryptDataSource()), PathInventory: []string{"/transit/encrypt/{name}"}, }, "vault_transit_decrypt": { - Resource: transitDecryptDataSource(), + Resource: updateSchemaResource(transitDecryptDataSource()), PathInventory: []string{"/transit/decrypt/{name}"}, }, "vault_gcp_auth_backend_role": { - Resource: gcpAuthBackendRoleDataSource(), + Resource: updateSchemaResource(gcpAuthBackendRoleDataSource()), PathInventory: []string{"/auth/gcp/role/{role_name}"}, }, "vault_identity_oidc_client_creds": { - Resource: identityOIDCClientCredsDataSource(), + Resource: updateSchemaResource(identityOIDCClientCredsDataSource()), PathInventory: []string{"/identity/oidc/client/{name}"}, }, "vault_identity_oidc_public_keys": { - Resource: identityOIDCPublicKeysDataSource(), + Resource: updateSchemaResource(identityOIDCPublicKeysDataSource()), PathInventory: []string{"/identity/oidc/provider/{name}/.well-known/keys"}, }, "vault_identity_oidc_openid_config": { - Resource: identityOIDCOpenIDConfigDataSource(), + Resource: updateSchemaResource(identityOIDCOpenIDConfigDataSource()), PathInventory: []string{"/identity/oidc/provider/{name}/.well-known/openid-configuration"}, }, } ResourceRegistry = map[string]*Description{ "vault_alicloud_auth_backend_role": { - Resource: alicloudAuthBackendRoleResource(), + Resource: updateSchemaResource(alicloudAuthBackendRoleResource()), PathInventory: []string{"/auth/alicloud/role/{name}"}, }, "vault_approle_auth_backend_login": { - Resource: approleAuthBackendLoginResource(), + Resource: updateSchemaResource(approleAuthBackendLoginResource()), PathInventory: []string{"/auth/approle/login"}, }, "vault_approle_auth_backend_role": { - Resource: approleAuthBackendRoleResource(), + Resource: updateSchemaResource(approleAuthBackendRoleResource()), PathInventory: []string{"/auth/approle/role/{role_name}"}, }, "vault_approle_auth_backend_role_secret_id": { - Resource: approleAuthBackendRoleSecretIDResource("vault_approle_auth_backend_role_secret_id"), + Resource: updateSchemaResource(approleAuthBackendRoleSecretIDResource("vault_approle_auth_backend_role_secret_id")), PathInventory: []string{ "/auth/approle/role/{role_name}/secret-id", "/auth/approle/role/{role_name}/custom-secret-id", }, }, "vault_auth_backend": { - Resource: AuthBackendResource(), + Resource: updateSchemaResource(AuthBackendResource()), PathInventory: []string{"/sys/auth/{path}"}, }, "vault_token": { - Resource: tokenResource(), + Resource: updateSchemaResource(tokenResource()), PathInventory: []string{ "/auth/token/create", "/auth/token/create-orphan", @@ -349,187 +339,187 @@ var ( }, }, "vault_token_auth_backend_role": { - Resource: tokenAuthBackendRoleResource(), + Resource: updateSchemaResource(tokenAuthBackendRoleResource()), PathInventory: []string{"/auth/token/roles/{role_name}"}, }, "vault_ad_secret_backend": { - Resource: adSecretBackendResource(), + Resource: updateSchemaResource(adSecretBackendResource()), PathInventory: []string{"/ad"}, }, "vault_ad_secret_library": { - Resource: adSecretBackendLibraryResource(), + Resource: updateSchemaResource(adSecretBackendLibraryResource()), PathInventory: []string{"/ad/library/{name}"}, }, "vault_ad_secret_role": { - Resource: adSecretBackendRoleResource(), + Resource: updateSchemaResource(adSecretBackendRoleResource()), PathInventory: []string{"/ad/roles/{role}"}, }, "vault_aws_auth_backend_cert": { - Resource: awsAuthBackendCertResource(), + Resource: updateSchemaResource(awsAuthBackendCertResource()), PathInventory: []string{"/auth/aws/config/certificate/{cert_name}"}, }, "vault_aws_auth_backend_client": { - Resource: awsAuthBackendClientResource(), + Resource: updateSchemaResource(awsAuthBackendClientResource()), PathInventory: []string{"/auth/aws/config/client"}, }, "vault_aws_auth_backend_identity_whitelist": { - Resource: awsAuthBackendIdentityWhitelistResource(), + Resource: updateSchemaResource(awsAuthBackendIdentityWhitelistResource()), PathInventory: []string{"/auth/aws/config/tidy/identity-whitelist"}, }, "vault_aws_auth_backend_login": { - Resource: awsAuthBackendLoginResource(), + Resource: updateSchemaResource(awsAuthBackendLoginResource()), PathInventory: []string{"/auth/aws/login"}, }, "vault_aws_auth_backend_role": { - Resource: awsAuthBackendRoleResource(), + Resource: updateSchemaResource(awsAuthBackendRoleResource()), PathInventory: []string{"/auth/aws/role/{role}"}, }, "vault_aws_auth_backend_role_tag": { - Resource: awsAuthBackendRoleTagResource(), + Resource: updateSchemaResource(awsAuthBackendRoleTagResource()), PathInventory: []string{"/auth/aws/role/{role}/tag"}, }, "vault_aws_auth_backend_roletag_blacklist": { - Resource: awsAuthBackendRoleTagBlacklistResource(), + Resource: updateSchemaResource(awsAuthBackendRoleTagBlacklistResource()), PathInventory: []string{"/auth/aws/config/tidy/roletag-blacklist"}, }, "vault_aws_auth_backend_sts_role": { - Resource: awsAuthBackendSTSRoleResource(), + Resource: updateSchemaResource(awsAuthBackendSTSRoleResource()), PathInventory: []string{"/auth/aws/config/sts/{account_id}"}, }, "vault_aws_secret_backend": { - Resource: awsSecretBackendResource(), + Resource: updateSchemaResource(awsSecretBackendResource()), PathInventory: []string{"/aws/config/root"}, }, "vault_aws_secret_backend_role": { - Resource: awsSecretBackendRoleResource("vault_aws_secret_backend_role"), + Resource: updateSchemaResource(awsSecretBackendRoleResource("vault_aws_secret_backend_role")), PathInventory: []string{"/aws/roles/{name}"}, }, "vault_azure_secret_backend": { - Resource: azureSecretBackendResource(), + Resource: updateSchemaResource(azureSecretBackendResource()), PathInventory: []string{"/azure/config"}, }, "vault_azure_secret_backend_role": { - Resource: azureSecretBackendRoleResource(), + Resource: updateSchemaResource(azureSecretBackendRoleResource()), PathInventory: []string{"/azure/roles/{name}"}, }, "vault_azure_auth_backend_config": { - Resource: azureAuthBackendConfigResource(), + Resource: updateSchemaResource(azureAuthBackendConfigResource()), PathInventory: []string{"/auth/azure/config"}, }, "vault_azure_auth_backend_role": { - Resource: azureAuthBackendRoleResource(), + Resource: updateSchemaResource(azureAuthBackendRoleResource()), PathInventory: []string{"/auth/azure/role/{name}"}, }, "vault_consul_secret_backend": { - Resource: consulSecretBackendResource(), + Resource: updateSchemaResource(consulSecretBackendResource()), PathInventory: []string{"/consul/config/access"}, }, "vault_consul_secret_backend_role": { - Resource: consulSecretBackendRoleResource(), + Resource: updateSchemaResource(consulSecretBackendRoleResource()), PathInventory: []string{"/consul/roles/{name}"}, }, "vault_database_secrets_mount": { - Resource: databaseSecretsMountResource(), + Resource: updateSchemaResource(databaseSecretsMountResource()), PathInventory: []string{"/database/config/{name}"}, }, "vault_database_secret_backend_connection": { - Resource: databaseSecretBackendConnectionResource(), + Resource: updateSchemaResource(databaseSecretBackendConnectionResource()), PathInventory: []string{"/database/config/{name}"}, }, "vault_database_secret_backend_role": { - Resource: databaseSecretBackendRoleResource(), + Resource: updateSchemaResource(databaseSecretBackendRoleResource()), PathInventory: []string{"/database/roles/{name}"}, }, "vault_database_secret_backend_static_role": { - Resource: databaseSecretBackendStaticRoleResource(), + Resource: updateSchemaResource(databaseSecretBackendStaticRoleResource()), PathInventory: []string{"/database/static-roles/{name}"}, }, "vault_github_auth_backend": { - Resource: githubAuthBackendResource(), + Resource: updateSchemaResource(githubAuthBackendResource()), PathInventory: []string{"/auth/github/config"}, }, "vault_github_team": { - Resource: githubTeamResource(), + Resource: updateSchemaResource(githubTeamResource()), PathInventory: []string{"/auth/github/map/teams"}, }, "vault_github_user": { - Resource: githubUserResource(), + Resource: updateSchemaResource(githubUserResource()), PathInventory: []string{"/auth/github/map/users"}, }, "vault_gcp_auth_backend": { - Resource: gcpAuthBackendResource(), + Resource: updateSchemaResource(gcpAuthBackendResource()), PathInventory: []string{"/auth/gcp/config"}, }, "vault_gcp_auth_backend_role": { - Resource: gcpAuthBackendRoleResource(), + Resource: updateSchemaResource(gcpAuthBackendRoleResource()), PathInventory: []string{"/auth/gcp/role/{name}"}, }, "vault_gcp_secret_backend": { - Resource: gcpSecretBackendResource("vault_gcp_secret_backend"), + Resource: updateSchemaResource(gcpSecretBackendResource("vault_gcp_secret_backend")), PathInventory: []string{"/gcp/config"}, }, "vault_gcp_secret_roleset": { - Resource: gcpSecretRolesetResource(), + Resource: updateSchemaResource(gcpSecretRolesetResource()), PathInventory: []string{"/gcp/roleset/{name}"}, }, "vault_gcp_secret_static_account": { - Resource: gcpSecretStaticAccountResource(), + Resource: updateSchemaResource(gcpSecretStaticAccountResource()), PathInventory: []string{"/gcp/static-account/{name}"}, }, "vault_cert_auth_backend_role": { - Resource: certAuthBackendRoleResource(), + Resource: updateSchemaResource(certAuthBackendRoleResource()), PathInventory: []string{"/auth/cert/certs/{name}"}, }, "vault_generic_endpoint": { - Resource: genericEndpointResource("vault_generic_endpoint"), + Resource: updateSchemaResource(genericEndpointResource("vault_generic_endpoint")), PathInventory: []string{GenericPath}, }, "vault_generic_secret": { - Resource: genericSecretResource("vault_generic_secret"), + Resource: updateSchemaResource(genericSecretResource("vault_generic_secret")), PathInventory: []string{GenericPath}, }, "vault_jwt_auth_backend": { - Resource: jwtAuthBackendResource(), + Resource: updateSchemaResource(jwtAuthBackendResource()), PathInventory: []string{"/auth/jwt/config"}, }, "vault_jwt_auth_backend_role": { - Resource: jwtAuthBackendRoleResource(), + Resource: updateSchemaResource(jwtAuthBackendRoleResource()), PathInventory: []string{"/auth/jwt/role/{name}"}, }, "vault_kubernetes_auth_backend_config": { - Resource: kubernetesAuthBackendConfigResource(), + Resource: updateSchemaResource(kubernetesAuthBackendConfigResource()), PathInventory: []string{"/auth/kubernetes/config"}, }, "vault_kubernetes_auth_backend_role": { - Resource: kubernetesAuthBackendRoleResource(), + Resource: updateSchemaResource(kubernetesAuthBackendRoleResource()), PathInventory: []string{"/auth/kubernetes/role/{name}"}, }, "vault_okta_auth_backend": { - Resource: oktaAuthBackendResource(), + Resource: updateSchemaResource(oktaAuthBackendResource()), PathInventory: []string{"/auth/okta/config"}, }, "vault_okta_auth_backend_user": { - Resource: oktaAuthBackendUserResource(), + Resource: updateSchemaResource(oktaAuthBackendUserResource()), PathInventory: []string{"/auth/okta/users/{name}"}, }, "vault_okta_auth_backend_group": { - Resource: oktaAuthBackendGroupResource(), + Resource: updateSchemaResource(oktaAuthBackendGroupResource()), PathInventory: []string{"/auth/okta/groups/{name}"}, }, "vault_ldap_auth_backend": { - Resource: ldapAuthBackendResource(), + Resource: updateSchemaResource(ldapAuthBackendResource()), PathInventory: []string{"/auth/ldap/config"}, }, "vault_ldap_auth_backend_user": { - Resource: ldapAuthBackendUserResource(), + Resource: updateSchemaResource(ldapAuthBackendUserResource()), PathInventory: []string{"/auth/ldap/users/{name}"}, }, "vault_ldap_auth_backend_group": { - Resource: ldapAuthBackendGroupResource(), + Resource: updateSchemaResource(ldapAuthBackendGroupResource()), PathInventory: []string{"/auth/ldap/groups/{name}"}, }, "vault_nomad_secret_backend": { - Resource: nomadSecretAccessBackendResource(), + Resource: updateSchemaResource(nomadSecretAccessBackendResource()), PathInventory: []string{ "/nomad", "/nomad/config/access", @@ -537,456 +527,230 @@ var ( }, }, "vault_nomad_secret_role": { - Resource: nomadSecretBackendRoleResource(), + Resource: updateSchemaResource(nomadSecretBackendRoleResource()), PathInventory: []string{"/nomad/role/{role}"}, }, "vault_policy": { - Resource: policyResource(), + Resource: updateSchemaResource(policyResource()), PathInventory: []string{"/sys/policy/{name}"}, }, "vault_egp_policy": { - Resource: egpPolicyResource(), + Resource: updateSchemaResource(egpPolicyResource()), PathInventory: []string{"/sys/policies/egp/{name}"}, EnterpriseOnly: true, }, "vault_rgp_policy": { - Resource: rgpPolicyResource(), + Resource: updateSchemaResource(rgpPolicyResource()), PathInventory: []string{"/sys/policies/rgp/{name}"}, EnterpriseOnly: true, }, "vault_mfa_duo": { - Resource: mfaDuoResource(), + Resource: updateSchemaResource(mfaDuoResource()), PathInventory: []string{"/sys/mfa/method/duo/{name}"}, EnterpriseOnly: true, }, "vault_mfa_okta": { - Resource: mfaOktaResource(), + Resource: updateSchemaResource(mfaOktaResource()), PathInventory: []string{"/sys/mfa/method/okta/{name}"}, EnterpriseOnly: true, }, "vault_mfa_totp": { - Resource: mfaTOTPResource(), + Resource: updateSchemaResource(mfaTOTPResource()), PathInventory: []string{"/sys/mfa/method/totp/{name}"}, EnterpriseOnly: true, }, "vault_mfa_pingid": { - Resource: mfaPingIDResource(), + Resource: updateSchemaResource(mfaPingIDResource()), PathInventory: []string{"/sys/mfa/method/totp/{name}"}, EnterpriseOnly: true, }, "vault_mount": { - Resource: MountResource(), + Resource: updateSchemaResource(MountResource()), PathInventory: []string{"/sys/mounts/{path}"}, }, "vault_namespace": { - Resource: namespaceResource(), + Resource: updateSchemaResource(namespaceResource()), PathInventory: []string{"/sys/namespaces/{path}"}, EnterpriseOnly: true, }, "vault_audit": { - Resource: auditResource(), + Resource: updateSchemaResource(auditResource()), PathInventory: []string{"/sys/audit/{path}"}, }, "vault_ssh_secret_backend_ca": { - Resource: sshSecretBackendCAResource(), + Resource: updateSchemaResource(sshSecretBackendCAResource()), PathInventory: []string{"/ssh/config/ca"}, }, "vault_ssh_secret_backend_role": { - Resource: sshSecretBackendRoleResource(), + Resource: updateSchemaResource(sshSecretBackendRoleResource()), PathInventory: []string{"/ssh/roles/{role}"}, }, "vault_identity_entity": { - Resource: identityEntityResource(), + Resource: updateSchemaResource(identityEntityResource()), PathInventory: []string{"/identity/entity"}, }, "vault_identity_entity_alias": { - Resource: identityEntityAliasResource(), + Resource: updateSchemaResource(identityEntityAliasResource()), PathInventory: []string{"/identity/entity-alias"}, }, "vault_identity_entity_policies": { - Resource: identityEntityPoliciesResource(), + Resource: updateSchemaResource(identityEntityPoliciesResource()), PathInventory: []string{"/identity/lookup/entity"}, }, "vault_identity_group": { - Resource: identityGroupResource(), + Resource: updateSchemaResource(identityGroupResource()), PathInventory: []string{"/identity/group"}, }, "vault_identity_group_alias": { - Resource: identityGroupAliasResource(), + Resource: updateSchemaResource(identityGroupAliasResource()), PathInventory: []string{"/identity/group-alias"}, }, "vault_identity_group_member_entity_ids": { - Resource: identityGroupMemberEntityIdsResource(), + Resource: updateSchemaResource(identityGroupMemberEntityIdsResource()), PathInventory: []string{"/identity/group/id/{id}"}, }, "vault_identity_group_policies": { - Resource: identityGroupPoliciesResource(), + Resource: updateSchemaResource(identityGroupPoliciesResource()), PathInventory: []string{"/identity/lookup/group"}, }, "vault_identity_oidc": { - Resource: identityOidc(), + Resource: updateSchemaResource(identityOidc()), PathInventory: []string{"/identity/oidc/config"}, }, "vault_identity_oidc_key": { - Resource: identityOidcKey(), + Resource: updateSchemaResource(identityOidcKey()), PathInventory: []string{"/identity/oidc/key/{name}"}, }, "vault_identity_oidc_key_allowed_client_id": { - Resource: identityOidcKeyAllowedClientId(), + Resource: updateSchemaResource(identityOidcKeyAllowedClientId()), PathInventory: []string{"/identity/oidc/key/{name}"}, }, "vault_identity_oidc_role": { - Resource: identityOidcRole(), + Resource: updateSchemaResource(identityOidcRole()), PathInventory: []string{"/identity/oidc/role/{name}"}, }, "vault_rabbitmq_secret_backend": { - Resource: rabbitMQSecretBackendResource(), + Resource: updateSchemaResource(rabbitMQSecretBackendResource()), PathInventory: []string{ "/rabbitmq/config/connection", "/rabbitmq/config/lease", }, }, "vault_rabbitmq_secret_backend_role": { - Resource: rabbitMQSecretBackendRoleResource(), + Resource: updateSchemaResource(rabbitMQSecretBackendRoleResource()), PathInventory: []string{"/rabbitmq/roles/{name}"}, }, "vault_password_policy": { - Resource: passwordPolicyResource(), + Resource: updateSchemaResource(passwordPolicyResource()), PathInventory: []string{"/sys/policy/password/{name}"}, }, "vault_pki_secret_backend_cert": { - Resource: pkiSecretBackendCertResource(), + Resource: updateSchemaResource(pkiSecretBackendCertResource()), PathInventory: []string{"/pki/issue/{role}"}, }, "vault_pki_secret_backend_crl_config": { - Resource: pkiSecretBackendCrlConfigResource(), + Resource: updateSchemaResource(pkiSecretBackendCrlConfigResource()), PathInventory: []string{"/pki/config/crl"}, }, "vault_pki_secret_backend_config_ca": { - Resource: pkiSecretBackendConfigCAResource(), + Resource: updateSchemaResource(pkiSecretBackendConfigCAResource()), PathInventory: []string{"/pki/config/ca"}, }, "vault_pki_secret_backend_config_urls": { - Resource: pkiSecretBackendConfigUrlsResource(), + Resource: updateSchemaResource(pkiSecretBackendConfigUrlsResource()), PathInventory: []string{"/pki/config/urls"}, }, "vault_pki_secret_backend_intermediate_cert_request": { - Resource: pkiSecretBackendIntermediateCertRequestResource(), + Resource: updateSchemaResource(pkiSecretBackendIntermediateCertRequestResource()), PathInventory: []string{"/pki/intermediate/generate/{exported}"}, }, "vault_pki_secret_backend_intermediate_set_signed": { - Resource: pkiSecretBackendIntermediateSetSignedResource(), + Resource: updateSchemaResource(pkiSecretBackendIntermediateSetSignedResource()), PathInventory: []string{"/pki/intermediate/set-signed"}, }, "vault_pki_secret_backend_role": { - Resource: pkiSecretBackendRoleResource(), + Resource: updateSchemaResource(pkiSecretBackendRoleResource()), PathInventory: []string{"/pki/roles/{name}"}, }, "vault_pki_secret_backend_root_cert": { - Resource: pkiSecretBackendRootCertResource(), + Resource: updateSchemaResource(pkiSecretBackendRootCertResource()), PathInventory: []string{"/pki/root/generate/{exported}"}, }, "vault_pki_secret_backend_root_sign_intermediate": { - Resource: pkiSecretBackendRootSignIntermediateResource(), + Resource: updateSchemaResource(pkiSecretBackendRootSignIntermediateResource()), PathInventory: []string{"/pki/root/sign-intermediate"}, }, "vault_pki_secret_backend_sign": { - Resource: pkiSecretBackendSignResource(), + Resource: updateSchemaResource(pkiSecretBackendSignResource()), PathInventory: []string{"/pki/sign/{role}"}, }, "vault_quota_lease_count": { - Resource: quotaLeaseCountResource(), + Resource: updateSchemaResource(quotaLeaseCountResource()), PathInventory: []string{"/sys/quotas/lease-count/{name}"}, }, "vault_quota_rate_limit": { - Resource: quotaRateLimitResource(), + Resource: updateSchemaResource(quotaRateLimitResource()), PathInventory: []string{"/sys/quotas/rate-limit/{name}"}, }, "vault_terraform_cloud_secret_backend": { - Resource: terraformCloudSecretBackendResource(), + Resource: updateSchemaResource(terraformCloudSecretBackendResource()), PathInventory: []string{"/terraform/config"}, }, "vault_terraform_cloud_secret_creds": { - Resource: terraformCloudSecretCredsResource(), + Resource: updateSchemaResource(terraformCloudSecretCredsResource()), PathInventory: []string{"/terraform/creds/{role}"}, }, "vault_terraform_cloud_secret_role": { - Resource: terraformCloudSecretRoleResource(), + Resource: updateSchemaResource(terraformCloudSecretRoleResource()), PathInventory: []string{"/terraform/role/{name}"}, }, "vault_transit_secret_backend_key": { - Resource: transitSecretBackendKeyResource(), + Resource: updateSchemaResource(transitSecretBackendKeyResource()), PathInventory: []string{"/transit/keys/{name}"}, }, "vault_transit_secret_cache_config": { - Resource: transitSecretBackendCacheConfig(), + Resource: updateSchemaResource(transitSecretBackendCacheConfig()), PathInventory: []string{"/transit/cache-config"}, }, "vault_raft_snapshot_agent_config": { - Resource: raftSnapshotAgentConfigResource(), + Resource: updateSchemaResource(raftSnapshotAgentConfigResource()), PathInventory: []string{"/sys/storage/raft/snapshot-auto/config/{name}"}, }, "vault_raft_autopilot": { - Resource: raftAutopilotConfigResource(), + Resource: updateSchemaResource(raftAutopilotConfigResource()), PathInventory: []string{"/sys/storage/raft/autopilot/configuration"}, }, "vault_kmip_secret_backend": { - Resource: kmipSecretBackendResource(), + Resource: updateSchemaResource(kmipSecretBackendResource()), PathInventory: []string{"/kmip/config"}, }, "vault_kmip_secret_scope": { - Resource: kmipSecretScopeResource(), + Resource: updateSchemaResource(kmipSecretScopeResource()), PathInventory: []string{"/kmip/scope/{scope}"}, }, "vault_kmip_secret_role": { - Resource: kmipSecretRoleResource(), + Resource: updateSchemaResource(kmipSecretRoleResource()), PathInventory: []string{"/kmip/scope/{scope}/role/{role}"}, }, "vault_identity_oidc_scope": { - Resource: identityOIDCScopeResource(), + Resource: updateSchemaResource(identityOIDCScopeResource()), PathInventory: []string{"/identity/oidc/scope/{scope}"}, }, "vault_identity_oidc_assignment": { - Resource: identityOIDCAssignmentResource(), + Resource: updateSchemaResource(identityOIDCAssignmentResource()), PathInventory: []string{"/identity/oidc/assignment/{name}"}, }, "vault_identity_oidc_client": { - Resource: identityOIDCClientResource(), + Resource: updateSchemaResource(identityOIDCClientResource()), PathInventory: []string{"/identity/oidc/client/{name}"}, }, "vault_identity_oidc_provider": { - Resource: identityOIDCProviderResource(), + Resource: updateSchemaResource(identityOIDCProviderResource()), PathInventory: []string{"/identity/oidc/provider/{name}"}, }, } ) -func providerToken(d *schema.ResourceData) (string, error) { - if token := d.Get("token").(string); token != "" { - return token, nil - } - - if addAddr := d.Get("add_address_to_env").(string); addAddr == "true" { - if addr := d.Get("address").(string); addr != "" { - if current, exists := os.LookupEnv("VAULT_ADDR"); exists { - defer func() { - os.Setenv("VAULT_ADDR", current) - }() - } else { - defer func() { - os.Unsetenv("VAULT_ADDR") - }() - } - os.Setenv("VAULT_ADDR", addr) - } - } - - // Use ~/.vault-token, or the configured token helper. - tokenHelper, err := config.DefaultTokenHelper() - if err != nil { - return "", fmt.Errorf("error getting token helper: %s", err) - } - token, err := tokenHelper.Get() - if err != nil { - return "", fmt.Errorf("error getting token: %s", err) - } - return strings.TrimSpace(token), nil -} - -func providerConfigure(d *schema.ResourceData) (interface{}, error) { - clientConfig := api.DefaultConfig() - addr := d.Get("address").(string) - if addr != "" { - clientConfig.Address = addr - } - - clientAuthI := d.Get("client_auth").([]interface{}) - if len(clientAuthI) > 1 { - return nil, fmt.Errorf("client_auth block may appear only once") - } - - clientAuthCert := "" - clientAuthKey := "" - if len(clientAuthI) == 1 { - clientAuth := clientAuthI[0].(map[string]interface{}) - clientAuthCert = clientAuth["cert_file"].(string) - clientAuthKey = clientAuth["key_file"].(string) - } - - err := clientConfig.ConfigureTLS(&api.TLSConfig{ - CACert: d.Get("ca_cert_file").(string), - CAPath: d.Get("ca_cert_dir").(string), - Insecure: d.Get("skip_tls_verify").(bool), - TLSServerName: d.Get("tls_server_name").(string), - - ClientCert: clientAuthCert, - ClientKey: clientAuthKey, - }) - if err != nil { - return nil, fmt.Errorf("failed to configure TLS for Vault API: %s", err) - } - - clientConfig.HttpClient.Transport = helper.NewTransport( - "Vault", - clientConfig.HttpClient.Transport, - helper.DefaultTransportOptions(), - ) - - // enable ReadYourWrites to support read-after-write on Vault Enterprise - clientConfig.ReadYourWrites = true - - // set default MaxRetries - clientConfig.MaxRetries = DefaultMaxHTTPRetries - - client, err := api.NewClient(clientConfig) - if err != nil { - return nil, fmt.Errorf("failed to configure Vault API: %s", err) - } - - // setting this is critical for proper namespace handling - client.SetCloneHeaders(true) - - // setting this is critical for proper client cloning - client.SetCloneToken(true) - - // Set headers if provided - headers := d.Get("headers").([]interface{}) - parsedHeaders := client.Headers().Clone() - - if parsedHeaders == nil { - parsedHeaders = make(http.Header) - } - - for _, h := range headers { - header := h.(map[string]interface{}) - if name, ok := header["name"]; ok { - parsedHeaders.Add(name.(string), header["value"].(string)) - } - } - client.SetHeaders(parsedHeaders) - - client.SetMaxRetries(d.Get("max_retries").(int)) - - maxHTTPRetriesCCC = d.Get("max_retries_ccc").(int) - - // Try an get the token from the config or token helper - token, err := providerToken(d) - if err != nil { - return nil, err - } - - // Attempt to use auth/login if 'auth_login' is provided in provider config - authLoginI := d.Get("auth_login").([]interface{}) - if len(authLoginI) > 1 { - return "", fmt.Errorf("auth_login block may appear only once") - } - - if len(authLoginI) == 1 { - authLogin := authLoginI[0].(map[string]interface{}) - authLoginPath := authLogin["path"].(string) - authLoginNamespace := "" - if authLoginNamespaceI, ok := authLogin["namespace"]; ok { - authLoginNamespace = authLoginNamespaceI.(string) - client.SetNamespace(authLoginNamespace) - } - authLoginParameters := authLogin["parameters"].(map[string]interface{}) - - method := authLogin["method"].(string) - if method == "aws" { - logger := hclog.Default() - if logging.IsDebugOrHigher() { - logger.SetLevel(hclog.Debug) - } else { - logger.SetLevel(hclog.Error) - } - if err := signAWSLogin(authLoginParameters, logger); err != nil { - return nil, fmt.Errorf("error signing AWS login request: %s", err) - } - } - - secret, err := client.Logical().Write(authLoginPath, authLoginParameters) - if err != nil { - return nil, err - } - token = secret.Auth.ClientToken - } - if token != "" { - client.SetToken(token) - } - if client.Token() == "" { - return nil, errors.New("no vault token found") - } - - skipChildToken := d.Get("skip_child_token").(bool) - if !skipChildToken { - err := setChildToken(d, client) - if err != nil { - return nil, err - } - } - - // Set the namespace to the requested namespace, if provided - namespace := d.Get("namespace").(string) - if namespace != "" { - client.SetNamespace(namespace) - } - return client, nil -} - -func setChildToken(d *schema.ResourceData, c *api.Client) error { - tokenName := d.Get("token_name").(string) - if tokenName == "" { - tokenName = "terraform" - } - - // In order to enforce our relatively-short lease TTL, we derive a - // temporary child token that inherits all of the policies of the - // token we were given but expires after max_lease_ttl_seconds. - // - // The intent here is that Terraform will need to re-fetch any - // secrets on each run and so we limit the exposure risk of secrets - // that end up stored in the Terraform state, assuming that they are - // credentials that Vault is able to revoke. - // - // Caution is still required with state files since not all secrets - // can explicitly be revoked, and this limited scope won't apply to - // any secrets that are *written* by Terraform to Vault. - - // Set the namespace to the token's namespace only for the - // child token creation - tokenInfo, err := c.Auth().Token().LookupSelf() - if err != nil { - return err - } - if tokenNamespaceRaw, ok := tokenInfo.Data["namespace_path"]; ok { - tokenNamespace := tokenNamespaceRaw.(string) - if tokenNamespace != "" { - c.SetNamespace(tokenNamespace) - } - } - - renewable := false - childTokenLease, err := c.Auth().Token().Create(&api.TokenCreateRequest{ - DisplayName: tokenName, - TTL: fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)), - ExplicitMaxTTL: fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)), - Renewable: &renewable, - }) - if err != nil { - return fmt.Errorf("failed to create limited child token: %s", err) - } - - childToken := childTokenLease.Auth.ClientToken - policies := childTokenLease.Auth.Policies - - log.Printf("[INFO] Using Vault token with the following policies: %s", strings.Join(policies, ", ")) - - // Set the token to the generated child token - c.SetToken(childToken) - - return nil -} - func parse(descs map[string]*Description) (map[string]*schema.Resource, error) { var errs error resourceMap := make(map[string]*schema.Resource) @@ -999,43 +763,20 @@ func parse(descs map[string]*Description) (map[string]*schema.Resource, error) { return resourceMap, errs } -func signAWSLogin(parameters map[string]interface{}, logger hclog.Logger) error { - var accessKey, secretKey, securityToken string - if val, ok := parameters["aws_access_key_id"].(string); ok { - accessKey = val - } - - if val, ok := parameters["aws_secret_access_key"].(string); ok { - secretKey = val - } - - if val, ok := parameters["aws_security_token"].(string); ok { - securityToken = val +func addCommonSchemaFields(m map[string]*schema.Schema) map[string]*schema.Schema { + m[consts.FieldNamespace] = &schema.Schema{ + Type: schema.TypeString, + Optional: true, + ForceNew: true, + Description: "Target namespace. (requires Enterprise)", + ValidateFunc: validateNoLeadingTrailingSlashes, } - creds, err := awsutil.RetrieveCreds(accessKey, secretKey, securityToken, logger) - if err != nil { - return fmt.Errorf("failed to retrieve AWS credentials: %s", err) - } - - var headerValue, stsRegion string - if val, ok := parameters["header_value"].(string); ok { - headerValue = val - } - - if val, ok := parameters["sts_region"].(string); ok { - stsRegion = val - } - - loginData, err := awsutil.GenerateLoginData(creds, headerValue, stsRegion, logger) - if err != nil { - return fmt.Errorf("failed to generate AWS login data: %s", err) - } - - parameters["iam_http_request_method"] = loginData["iam_http_request_method"] - parameters["iam_request_url"] = loginData["iam_request_url"] - parameters["iam_request_headers"] = loginData["iam_request_headers"] - parameters["iam_request_body"] = loginData["iam_request_body"] + return m +} - return nil +// TODO: temporary solution for adding common schema fields to the current code base. +func updateSchemaResource(r *schema.Resource) *schema.Resource { + addCommonSchemaFields(r.Schema) + return r } diff --git a/vault/provider_test.go b/vault/provider_test.go index b4c5f128d..9bdfd8f95 100644 --- a/vault/provider_test.go +++ b/vault/provider_test.go @@ -11,9 +11,12 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" + "github.com/hashicorp/vault/api" "github.com/hashicorp/vault/command/config" "github.com/mitchellh/go-homedir" + "github.com/hashicorp/terraform-provider-vault/internal/consts" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -85,7 +88,7 @@ func TestAccAuthLoginProviderConfigure(t *testing.T) { }) rootProviderData := rootProviderResource.TestResourceData() - if _, err := providerConfigure(rootProviderData); err != nil { + if _, err := provider.NewProviderMeta(rootProviderData); err != nil { t.Fatal(err) } } @@ -108,7 +111,7 @@ func TestTokenReadProviderConfigureWithHeaders(t *testing.T) { }) rootProviderData := rootProviderResource.TestResourceData() - if _, err := providerConfigure(rootProviderData); err != nil { + if _, err := provider.NewProviderMeta(rootProviderData); err != nil { t.Fatal(err) } } @@ -121,7 +124,7 @@ func TestAccNamespaceProviderConfigure(t *testing.T) { Schema: rootProvider.Schema, } rootProviderData := rootProviderResource.TestResourceData() - if _, err := providerConfigure(rootProviderData); err != nil { + if _, err := provider.NewProviderMeta(rootProviderData); err != nil { t.Fatal(err) } @@ -147,8 +150,8 @@ func TestAccNamespaceProviderConfigure(t *testing.T) { } nsProviderData := nsProviderResource.TestResourceData() nsProviderData.Set("namespace", namespacePath) - nsProviderData.Set("token", os.Getenv("VAULT_TOKEN")) - if _, err := providerConfigure(nsProviderData); err != nil { + nsProviderData.Set("token", os.Getenv(api.EnvVaultToken)) + if _, err := provider.NewProviderMeta(nsProviderData); err != nil { t.Fatal(err) } @@ -234,7 +237,7 @@ func testResourceApproleLoginCheckAttrs(t *testing.T) resource.TestCheckFunc { } approleProviderData := approleProviderResource.TestResourceData() approleProviderData.Set("auth_login", authLoginData) - _, err := providerConfigure(approleProviderData) + _, err := provider.NewProviderMeta(approleProviderData) if err != nil { t.Fatal(err) } @@ -291,7 +294,7 @@ func testResourceAdminPeriodicOrphanTokenCheckAttrs(namespacePath string, t *tes ns2ProviderData := ns2ProviderResource.TestResourceData() ns2ProviderData.Set("namespace", namespacePath) ns2ProviderData.Set("token", vaultToken) - if _, err := providerConfigure(ns2ProviderData); err != nil { + if _, err := provider.NewProviderMeta(ns2ProviderData); err != nil { t.Fatal(err) } @@ -354,9 +357,9 @@ func TestAccProviderToken(t *testing.T) { } // Create a "resource" we can use for constructing ResourceData. - provider := Provider() + p := Provider() providerResource := &schema.Resource{ - Schema: provider.Schema, + Schema: p.Schema, } type testcase struct { @@ -373,7 +376,7 @@ func TestAccProviderToken(t *testing.T) { expectedToken: "", }, { - // The provider will read the token file "~/.vault-token". + // The p will read the token file "~/.vault-token". name: "File", fileToken: true, expectedToken: "file-token", @@ -423,8 +426,8 @@ func TestAccProviderToken(t *testing.T) { d.Set("token", "schema-token") } - // Get and check the provider token. - token, err := providerToken(d) + // Get and check the p token. + token, err := provider.GetToken(d) if err != nil { t.Fatal(err) } @@ -516,7 +519,7 @@ func TestAccTokenName(t *testing.T) { } func TestAccChildToken(t *testing.T) { - defer os.Unsetenv("TERRAFORM_VAULT_SKIP_CHILD_TOKEN") + defer os.Unsetenv(consts.EnvVarSkipChildToken) checkTokenUsed := func(expectChildToken bool) resource.TestCheckFunc { if expectChildToken { @@ -526,7 +529,7 @@ func TestAccChildToken(t *testing.T) { } else { // If the child token setting was disabled, the used token // should match the user-provided VAULT_TOKEN - return checkSelfToken("id", os.Getenv("VAULT_TOKEN")) + return checkSelfToken("id", os.Getenv(api.EnvVaultToken)) } } @@ -591,12 +594,12 @@ func TestAccChildToken(t *testing.T) { { PreConfig: func() { if test.useChildTokenEnv { - err := os.Setenv("TERRAFORM_VAULT_SKIP_CHILD_TOKEN", test.skipChildTokenEnv) + err := os.Setenv(consts.EnvVarSkipChildToken, test.skipChildTokenEnv) if err != nil { t.Fatal(err) } } else { - err := os.Unsetenv("TERRAFORM_VAULT_SKIP_CHILD_TOKEN") + err := os.Unsetenv(consts.EnvVarSkipChildToken) if err != nil { t.Fatal(err) } @@ -731,7 +734,7 @@ func TestAccProviderVaultAddrEnv(t *testing.T) { for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { if tc.vaultAddrEnv != "" { - unset, err := tempSetenv("VAULT_ADDR", tc.vaultAddrEnv) + unset, err := tempSetenv(api.EnvVaultAddress, tc.vaultAddrEnv) defer failIfErr(t, unset) if err != nil { t.Fatal(err) @@ -747,7 +750,7 @@ func TestAccProviderVaultAddrEnv(t *testing.T) { } // Get and check the provider token. - token, err := providerToken(d) + token, err := provider.GetToken(d) if err != nil { t.Fatal(err) } diff --git a/vault/resource_ad_secret_backend.go b/vault/resource_ad_secret_backend.go index 1147aa37a..80a269cf0 100644 --- a/vault/resource_ad_secret_backend.go +++ b/vault/resource_ad_secret_backend.go @@ -5,6 +5,7 @@ import ( "log" "strings" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" @@ -220,7 +221,11 @@ func adSecretBackendResource() *schema.Resource { } func createConfigResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + backend := d.Get("backend").(string) description := d.Get("description").(string) defaultTTL := d.Get("default_lease_ttl_seconds").(int) @@ -343,7 +348,10 @@ func createConfigResource(d *schema.ResourceData, meta interface{}) error { } func readConfigResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Reading %q", path) @@ -517,7 +525,11 @@ func readConfigResource(d *schema.ResourceData, meta interface{}) error { func updateConfigResource(d *schema.ResourceData, meta interface{}) error { backend := d.Id() - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + defaultTTL := d.Get("default_lease_ttl_seconds").(int) maxTTL := d.Get("max_lease_ttl_seconds").(int) tune := api.MountConfigInput{} @@ -638,7 +650,11 @@ func updateConfigResource(d *schema.ResourceData, meta interface{}) error { } func deleteConfigResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + vaultPath := d.Id() log.Printf("[DEBUG] Unmounting AD backend %q", vaultPath) diff --git a/vault/resource_ad_secret_backend_test.go b/vault/resource_ad_secret_backend_test.go index 296795988..9b05e4251 100644 --- a/vault/resource_ad_secret_backend_test.go +++ b/vault/resource_ad_secret_backend_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -56,7 +56,7 @@ func TestADSecretBackend(t *testing.T) { } func testAccADSecretBackendCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_ad_secret_library.go b/vault/resource_ad_secret_library.go index 4ac7db2f1..e488e9795 100644 --- a/vault/resource_ad_secret_library.go +++ b/vault/resource_ad_secret_library.go @@ -7,8 +7,9 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" - "github.com/hashicorp/vault/api" ) var ( @@ -71,7 +72,11 @@ func adSecretBackendLibraryResource() *schema.Resource { } func createLibraryResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + backend := d.Get("backend").(string) set := d.Get("name").(string) setPath := fmt.Sprintf("%s/library/%s", backend, set) @@ -105,7 +110,11 @@ func createLibraryResource(d *schema.ResourceData, meta interface{}) error { } func readLibraryResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + setPath := d.Id() log.Printf("[DEBUG] Reading %q", setPath) @@ -165,7 +174,11 @@ func readLibraryResource(d *schema.ResourceData, meta interface{}) error { } func updateLibraryResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + setPath := d.Id() log.Printf("[DEBUG] Updating %q", setPath) @@ -194,7 +207,11 @@ func updateLibraryResource(d *schema.ResourceData, meta interface{}) error { } func deleteLibraryResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + setPath := d.Id() log.Printf("[DEBUG] Deleting %q", setPath) diff --git a/vault/resource_ad_secret_library_test.go b/vault/resource_ad_secret_library_test.go index 6cdb7f66b..293779f69 100644 --- a/vault/resource_ad_secret_library_test.go +++ b/vault/resource_ad_secret_library_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -76,7 +76,7 @@ func TestAccADSecretBackendLibrary_import(t *testing.T) { } func testAccADSecretBackendLibraryCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_ad_secret_library" { diff --git a/vault/resource_ad_secret_roles.go b/vault/resource_ad_secret_roles.go index a81c80b63..950c0428f 100644 --- a/vault/resource_ad_secret_roles.go +++ b/vault/resource_ad_secret_roles.go @@ -7,8 +7,9 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" - "github.com/hashicorp/vault/api" ) var ( @@ -67,7 +68,11 @@ func adSecretBackendRoleResource() *schema.Resource { } func createRoleResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + backend := d.Get("backend").(string) role := d.Get("role").(string) rolePath := fmt.Sprintf("%s/roles/%s", backend, role) @@ -93,7 +98,11 @@ func createRoleResource(d *schema.ResourceData, meta interface{}) error { } func readRoleResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + rolePath := d.Id() log.Printf("[DEBUG] Reading %q", rolePath) @@ -148,7 +157,11 @@ func readRoleResource(d *schema.ResourceData, meta interface{}) error { } func updateRoleResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + rolePath := d.Id() log.Printf("[DEBUG] Updating %q", rolePath) @@ -167,7 +180,11 @@ func updateRoleResource(d *schema.ResourceData, meta interface{}) error { } func deleteRoleResource(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + rolePath := d.Id() log.Printf("[DEBUG] Deleting %q", rolePath) diff --git a/vault/resource_ad_secret_roles_test.go b/vault/resource_ad_secret_roles_test.go index 39a9c2bc3..157995aac 100644 --- a/vault/resource_ad_secret_roles_test.go +++ b/vault/resource_ad_secret_roles_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -73,7 +73,7 @@ func TestAccADSecretBackendRole_import(t *testing.T) { } func testAccADSecretBackendRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_ad_secret_role" { diff --git a/vault/resource_alicloud_auth_backend_role.go b/vault/resource_alicloud_auth_backend_role.go index 99c734ea7..0bb08221f 100644 --- a/vault/resource_alicloud_auth_backend_role.go +++ b/vault/resource_alicloud_auth_backend_role.go @@ -8,7 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func alicloudAuthBackendRoleResource() *schema.Resource { @@ -83,7 +84,10 @@ func alicloudAuthBackendRoleUpdateFields(d *schema.ResourceData, data map[string } func alicloudAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -106,7 +110,11 @@ func alicloudAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, } func alicloudAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() data := map[string]interface{}{} @@ -123,7 +131,11 @@ func alicloudAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, } func alicloudAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() log.Printf("[DEBUG] Reading AliCloud role %q", path) @@ -168,7 +180,11 @@ func alicloudAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta } func alicloudAuthBackendRoleDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() log.Printf("[DEBUG] Deleting AliCloud role %q", path) @@ -180,17 +196,3 @@ func alicloudAuthBackendRoleDelete(_ context.Context, d *schema.ResourceData, me return nil } - -func alicloudAuthBackendRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) - path := d.Id() - - log.Printf("[DEBUG] Checking if AliCloud Auth Backend role %q exists", path) - resp, err := client.Logical().Read(path) - if err != nil { - return true, fmt.Errorf("error checking for existence of AliCloud Auth Backend resource config %q: %s", path, err) - } - log.Printf("[DEBUG] Checked if AliCloud Auth Backend role %q exists", path) - - return resp != nil, nil -} diff --git a/vault/resource_alicloud_auth_backend_role_test.go b/vault/resource_alicloud_auth_backend_role_test.go index 8c83c1682..4875e8408 100644 --- a/vault/resource_alicloud_auth_backend_role_test.go +++ b/vault/resource_alicloud_auth_backend_role_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -50,7 +50,7 @@ func TestAlicloudAuthBackendRole_basic(t *testing.T) { } func testAlicloudAuthBackedRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_alicloud_auth_backend_role" { diff --git a/vault/resource_approle_auth_backend_login.go b/vault/resource_approle_auth_backend_login.go index 2444052d9..e7bed2145 100644 --- a/vault/resource_approle_auth_backend_login.go +++ b/vault/resource_approle_auth_backend_login.go @@ -7,8 +7,10 @@ import ( "time" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/terraform-provider-vault/util" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" + "github.com/hashicorp/terraform-provider-vault/util" ) func approleAuthBackendLoginResource() *schema.Resource { @@ -88,7 +90,10 @@ func approleAuthBackendLoginResource() *schema.Resource { } func approleAuthBackendLoginCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) @@ -116,7 +121,10 @@ func approleAuthBackendLoginCreate(d *schema.ResourceData, meta interface{}) err } func approleAuthBackendLoginRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } log.Printf("[DEBUG] Reading token %q", d.Id()) resp, err := client.Auth().Token().LookupAccessor(d.Id()) @@ -155,7 +163,11 @@ func approleAuthBackendLoginRead(d *schema.ResourceData, meta interface{}) error } func approleAuthBackendLoginDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + accessor := d.Id() log.Printf("[DEBUG] Revoking token %q", accessor) @@ -169,7 +181,11 @@ func approleAuthBackendLoginDelete(d *schema.ResourceData, meta interface{}) err } func approleAuthBackendLoginExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + accessor := d.Id() log.Printf("[DEBUG] Checking if token %q exists", accessor) diff --git a/vault/resource_approle_auth_backend_role.go b/vault/resource_approle_auth_backend_role.go index c138e6de4..416829363 100644 --- a/vault/resource_approle_auth_backend_role.go +++ b/vault/resource_approle_auth_backend_role.go @@ -9,8 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" ) @@ -123,7 +123,10 @@ func approleAuthBackendRoleUpdateFields(d *schema.ResourceData, data map[string] } func approleAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) role := d.Get("role_name").(string) @@ -173,7 +176,11 @@ func approleAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, m } func approleAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() backend, err := approleAuthBackendRoleBackendFromPath(path) @@ -240,7 +247,11 @@ func approleAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta } func approleAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() log.Printf("[DEBUG] Updating AppRole auth backend role %q", path) @@ -273,7 +284,11 @@ func approleAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, m } func approleAuthBackendRoleDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() log.Printf("[DEBUG] Deleting AppRole auth backend role %q", path) diff --git a/vault/resource_approle_auth_backend_role_secret_id.go b/vault/resource_approle_auth_backend_role_secret_id.go index 774dbc47b..3b3ae1062 100644 --- a/vault/resource_approle_auth_backend_role_secret_id.go +++ b/vault/resource_approle_auth_backend_role_secret_id.go @@ -8,8 +8,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" ) @@ -117,7 +117,10 @@ func approleAuthBackendRoleSecretIDResource(name string) *schema.Resource { } func approleAuthBackendRoleSecretIDCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) role := d.Get("role_name").(string) @@ -197,7 +200,11 @@ func approleAuthBackendRoleSecretIDCreate(d *schema.ResourceData, meta interface } func approleAuthBackendRoleSecretIDRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + id := d.Id() backend, role, accessor, wrapped, err := approleAuthBackendRoleSecretIDParseID(id) @@ -276,7 +283,11 @@ func approleAuthBackendRoleSecretIDRead(d *schema.ResourceData, meta interface{} } func approleAuthBackendRoleSecretIDDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + id := d.Id() backend, role, accessor, wrapped, err := approleAuthBackendRoleSecretIDParseID(id) if err != nil { @@ -306,7 +317,11 @@ func approleAuthBackendRoleSecretIDDelete(d *schema.ResourceData, meta interface } func approleAuthBackendRoleSecretIDExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + id := d.Id() backend, role, accessor, wrapped, err := approleAuthBackendRoleSecretIDParseID(id) diff --git a/vault/resource_approle_auth_backend_role_secret_id_test.go b/vault/resource_approle_auth_backend_role_secret_id_test.go index 66c74a788..3e53115dc 100644 --- a/vault/resource_approle_auth_backend_role_secret_id_test.go +++ b/vault/resource_approle_auth_backend_role_secret_id_test.go @@ -8,9 +8,9 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" "github.com/hashicorp/vault/sdk/helper/consts" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -181,7 +181,7 @@ func TestAccAppRoleAuthBackendRoleSecretID_full(t *testing.T) { } func testAccCheckAppRoleAuthBackendRoleSecretIDDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_approle_auth_backend_role_secret_id" { @@ -282,7 +282,7 @@ provider "vault" { func testAssertClientNamespace(expectedNS string) resource.TestCheckFunc { return func(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() actualNS := client.Headers().Get(consts.NamespaceHeaderName) if actualNS != expectedNS { return fmt.Errorf("expected namespace %v, actual %v", expectedNS, actualNS) diff --git a/vault/resource_approle_auth_backend_role_test.go b/vault/resource_approle_auth_backend_role_test.go index 85cccb198..163eb96f0 100644 --- a/vault/resource_approle_auth_backend_role_test.go +++ b/vault/resource_approle_auth_backend_role_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -310,7 +310,7 @@ func TestAccAppRoleAuthBackendRole_fullUpdate(t *testing.T) { } func testAccCheckAppRoleAuthBackendRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_approle_auth_backend_role" { diff --git a/vault/resource_audit.go b/vault/resource_audit.go index f891f00c5..34a7eeec2 100644 --- a/vault/resource_audit.go +++ b/vault/resource_audit.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func auditResource() *schema.Resource { @@ -56,7 +58,10 @@ func auditResource() *schema.Resource { } func auditWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } description := d.Get("description").(string) local := d.Get("local").(bool) @@ -91,7 +96,10 @@ func auditWrite(d *schema.ResourceData, meta interface{}) error { } func auditDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -105,7 +113,10 @@ func auditDelete(d *schema.ResourceData, meta interface{}) error { } func auditRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() diff --git a/vault/resource_audit_test.go b/vault/resource_audit_test.go index df263543d..8e422827e 100644 --- a/vault/resource_audit_test.go +++ b/vault/resource_audit_test.go @@ -9,6 +9,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -88,7 +89,7 @@ func testResourceAudit_initialCheck(expectedPath string) resource.TestCheckFunc } func findAudit(path string) (*api.Audit, error) { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() path = path + "/" diff --git a/vault/resource_auth_backend.go b/vault/resource_auth_backend.go index f6eab0290..340b12b4e 100644 --- a/vault/resource_auth_backend.go +++ b/vault/resource_auth_backend.go @@ -6,6 +6,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func AuthBackendResource() *schema.Resource { @@ -66,7 +68,10 @@ func AuthBackendResource() *schema.Resource { } func authBackendWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } mountType := d.Get("type").(string) path := d.Get("path").(string) @@ -92,7 +97,10 @@ func authBackendWrite(d *schema.ResourceData, meta interface{}) error { } func authBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -106,7 +114,10 @@ func authBackendDelete(d *schema.ResourceData, meta interface{}) error { } func authBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -140,7 +151,10 @@ func authBackendRead(d *schema.ResourceData, meta interface{}) error { } func authBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Updating auth %s in Vault", path) diff --git a/vault/resource_auth_backend_test.go b/vault/resource_auth_backend_test.go index 414b6ece2..a45b79e4d 100644 --- a/vault/resource_auth_backend_test.go +++ b/vault/resource_auth_backend_test.go @@ -9,6 +9,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -37,7 +38,7 @@ func TestResourceAuth(t *testing.T) { } func testAccCheckAuthBackendDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() auths, err := client.Sys().ListAuth() if err != nil { @@ -113,7 +114,7 @@ func testResourceAuth_initialCheck(expectedPath string) resource.TestCheckFunc { return fmt.Errorf("unexpected auth local") } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() auths, err := client.Sys().ListAuth() if err != nil { return fmt.Errorf("error reading back auth: %s", err) @@ -165,7 +166,7 @@ func testResourceAuth_updateCheck(s *terraform.State) error { return fmt.Errorf("unexpected auth name") } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() auths, err := client.Sys().ListAuth() if err != nil { return fmt.Errorf("error reading back auth: %s", err) @@ -259,7 +260,7 @@ resource "vault_auth_backend" "test" { func checkAuthMount(backend string, checker func(*api.AuthMount) error) resource.TestCheckFunc { return func(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() auths, err := client.Sys().ListAuth() if err != nil { return fmt.Errorf("error reading back auth: %s", err) diff --git a/vault/resource_aws_auth_backend_cert.go b/vault/resource_aws_auth_backend_cert.go index bea738c17..2b8c7fbbd 100644 --- a/vault/resource_aws_auth_backend_cert.go +++ b/vault/resource_aws_auth_backend_cert.go @@ -9,7 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -64,7 +65,10 @@ func awsAuthBackendCertResource() *schema.Resource { } func awsAuthBackendCertCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) certType := d.Get("type").(string) @@ -91,7 +95,10 @@ func awsAuthBackendCertCreate(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendCertRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -130,7 +137,11 @@ func awsAuthBackendCertRead(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendCertDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Removing cert %q from AWS auth backend", path) @@ -144,7 +155,10 @@ func awsAuthBackendCertDelete(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendCertExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() diff --git a/vault/resource_aws_auth_backend_cert_test.go b/vault/resource_aws_auth_backend_cert_test.go index 635e71c6f..7d14e3930 100644 --- a/vault/resource_aws_auth_backend_cert_test.go +++ b/vault/resource_aws_auth_backend_cert_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -55,7 +55,7 @@ func TestAccAWSAuthBackendCert_basic(t *testing.T) { } func testAccCheckAWSAuthBackendCertDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_cert" { continue @@ -105,7 +105,7 @@ func testAccAWSAuthBackendCertCheck_attrs(backend, name string) resource.TestChe return fmt.Errorf("expected ID to be %q, got %q", "auth/"+backend+"/config/certificate/"+name, endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back AWS auth certificate from %q: %s", endpoint, err) diff --git a/vault/resource_aws_auth_backend_client.go b/vault/resource_aws_auth_backend_client.go index 613952b23..3342e4322 100644 --- a/vault/resource_aws_auth_backend_client.go +++ b/vault/resource_aws_auth_backend_client.go @@ -7,7 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func awsAuthBackendClientResource() *schema.Resource { @@ -75,7 +76,10 @@ func awsAuthBackendClientResource() *schema.Resource { } func awsAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } // if backend comes from the config, it won't have the StateFunc // applied yet, so we need to apply it again. @@ -121,7 +125,10 @@ func awsAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } log.Printf("[DEBUG] Reading AWS auth backend client config") secret, err := client.Logical().Read(d.Id()) @@ -153,7 +160,10 @@ func awsAuthBackendRead(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } log.Printf("[DEBUG] Deleting AWS auth backend client config from %q", d.Id()) _, err := client.Logical().Delete(d.Id()) @@ -166,7 +176,10 @@ func awsAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } log.Printf("[DEBUG] Checking if AWS auth backend client is configured at %q", d.Id()) secret, err := client.Logical().Read(d.Id()) diff --git a/vault/resource_aws_auth_backend_client_test.go b/vault/resource_aws_auth_backend_client_test.go index 5401a905b..0f3280253 100644 --- a/vault/resource_aws_auth_backend_client_test.go +++ b/vault/resource_aws_auth_backend_client_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -115,7 +115,7 @@ func TestAccAWSAuthBackendClientStsRegionNoEndpoint(t *testing.T) { } func testAccCheckAWSAuthBackendClientDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_client" { @@ -150,7 +150,7 @@ func testAccAWSAuthBackendClientCheck_attrs(backend string) resource.TestCheckFu return fmt.Errorf("expected ID to be %q, got %q", "auth/"+backend+"/config/client", endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back AWS auth client config from %q: %s", endpoint, err) diff --git a/vault/resource_aws_auth_backend_identity_whitelist.go b/vault/resource_aws_auth_backend_identity_whitelist.go index 1a06468b1..9073f65b5 100644 --- a/vault/resource_aws_auth_backend_identity_whitelist.go +++ b/vault/resource_aws_auth_backend_identity_whitelist.go @@ -7,13 +7,12 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" -) -var ( - awsAuthBackendIdentityWhitelistBackendFromPathRegex = regexp.MustCompile("^auth/(.+)/config/tidy/identity-whitelist$") + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) +var awsAuthBackendIdentityWhitelistBackendFromPathRegex = regexp.MustCompile("^auth/(.+)/config/tidy/identity-whitelist$") + func awsAuthBackendIdentityWhitelistResource() *schema.Resource { return &schema.Resource{ Create: awsAuthBackendIdentityWhitelistWrite, @@ -52,7 +51,10 @@ func awsAuthBackendIdentityWhitelistResource() *schema.Resource { } func awsAuthBackendIdentityWhitelistWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) data := map[string]interface{}{} @@ -81,7 +83,10 @@ func awsAuthBackendIdentityWhitelistWrite(d *schema.ResourceData, meta interface } func awsAuthBackendIdentityWhitelistRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -110,7 +115,11 @@ func awsAuthBackendIdentityWhitelistRead(d *schema.ResourceData, meta interface{ } func awsAuthBackendIdentityWhitelistDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Removing identity whitelist %q from AWS auth backend", path) @@ -124,7 +133,10 @@ func awsAuthBackendIdentityWhitelistDelete(d *schema.ResourceData, meta interfac } func awsAuthBackendIdentityWhitelistExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() diff --git a/vault/resource_aws_auth_backend_identity_whitelist_test.go b/vault/resource_aws_auth_backend_identity_whitelist_test.go index b13460ce6..3b30a7393 100644 --- a/vault/resource_aws_auth_backend_identity_whitelist_test.go +++ b/vault/resource_aws_auth_backend_identity_whitelist_test.go @@ -9,8 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -50,7 +50,7 @@ func TestAccAWSAuthBackendIdentityWhitelist_basic(t *testing.T) { } func testAccCheckAWSAuthBackendIdentityWhitelistDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_identity_whitelist" { continue @@ -98,7 +98,7 @@ func testAccAWSAuthBackendIdentityWhitelistCheck_attrs(backend string) resource. return fmt.Errorf("expected ID to be %q, got %q", "auth/"+backend+"/config/tidy/identity-whitelist", endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back AWS auth bavkend identity whitelist config from %q: %s", endpoint, err) diff --git a/vault/resource_aws_auth_backend_login.go b/vault/resource_aws_auth_backend_login.go index 069246214..6a34f41d3 100644 --- a/vault/resource_aws_auth_backend_login.go +++ b/vault/resource_aws_auth_backend_login.go @@ -8,7 +8,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func awsAuthBackendLoginResource() *schema.Resource { @@ -150,7 +150,10 @@ func awsAuthBackendLoginCreate(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendLoginRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := strings.Trim(d.Get("backend").(string), "/") path := "auth/" + backend + "/login" @@ -230,7 +233,10 @@ func awsAuthBackendLoginRead(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendLoginDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } accessor := d.Get("accessor").(string) token, ok := d.GetOk("client_token") diff --git a/vault/resource_aws_auth_backend_role.go b/vault/resource_aws_auth_backend_role.go index e6ec7e1e0..ab3171206 100644 --- a/vault/resource_aws_auth_backend_role.go +++ b/vault/resource_aws_auth_backend_role.go @@ -9,7 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -196,7 +197,10 @@ func setSlice(d *schema.ResourceData, tfFieldName, vaultFieldName string, data m } func awsAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -300,7 +304,10 @@ func awsAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta } func awsAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() backend, err := awsAuthBackendRoleBackendFromPath(path) @@ -401,7 +408,11 @@ func awsAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta inte } func awsAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } + path := d.Id() log.Printf("[DEBUG] Updating AWS auth backend role %q", path) @@ -507,7 +518,10 @@ func isEc2(authType, inferred string) bool { } func awsAuthBackendRoleDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Deleting AWS auth backend role %q", path) diff --git a/vault/resource_aws_auth_backend_role_tag.go b/vault/resource_aws_auth_backend_role_tag.go index dd6de2abe..b075cce7a 100644 --- a/vault/resource_aws_auth_backend_role_tag.go +++ b/vault/resource_aws_auth_backend_role_tag.go @@ -7,7 +7,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func awsAuthBackendRoleTagResource() *schema.Resource { @@ -76,7 +76,10 @@ func awsAuthBackendRoleTagResource() *schema.Resource { } func awsAuthBackendRoleTagResourceCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) role := d.Get("role").(string) diff --git a/vault/resource_aws_auth_backend_role_test.go b/vault/resource_aws_auth_backend_role_test.go index ec16181ea..dbc46157e 100644 --- a/vault/resource_aws_auth_backend_role_test.go +++ b/vault/resource_aws_auth_backend_role_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -210,7 +210,7 @@ func TestAccAWSAuthBackendRole_iamUpdate(t *testing.T) { } func testAccCheckAWSAuthBackendRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_role" { @@ -245,7 +245,7 @@ func testAccAWSAuthBackendRoleCheck_attrs(backend, role string) resource.TestChe return fmt.Errorf("expected ID to be %q, got %q instead", "auth/"+backend+"/role/"+role, endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("%q doesn't exist", endpoint) diff --git a/vault/resource_aws_auth_backend_roletag_blacklist.go b/vault/resource_aws_auth_backend_roletag_blacklist.go index 7179533d1..a987665d9 100644 --- a/vault/resource_aws_auth_backend_roletag_blacklist.go +++ b/vault/resource_aws_auth_backend_roletag_blacklist.go @@ -7,13 +7,12 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" -) -var ( - awsAuthBackendRoleTagBlacklistBackendFromPathRegex = regexp.MustCompile("^auth/(.+)/config/tidy/roletag-blacklist$") + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) +var awsAuthBackendRoleTagBlacklistBackendFromPathRegex = regexp.MustCompile("^auth/(.+)/config/tidy/roletag-blacklist$") + func awsAuthBackendRoleTagBlacklistResource() *schema.Resource { return &schema.Resource{ Create: awsAuthBackendRoleTagBlacklistWrite, @@ -53,7 +52,10 @@ func awsAuthBackendRoleTagBlacklistResource() *schema.Resource { } func awsAuthBackendRoleTagBlacklistWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) data := map[string]interface{}{ @@ -65,7 +67,6 @@ func awsAuthBackendRoleTagBlacklistWrite(d *schema.ResourceData, meta interface{ log.Printf("[DEBUG] Configuring AWS auth backend roletag blacklist %q", path) _, err := client.Logical().Write(path, data) - if err != nil { d.SetId("") return fmt.Errorf("Error configuring AWS auth backend roletag blacklist %q: %s", path, err) @@ -78,7 +79,10 @@ func awsAuthBackendRoleTagBlacklistWrite(d *schema.ResourceData, meta interface{ } func awsAuthBackendRoleTagBlacklistRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -109,7 +113,11 @@ func awsAuthBackendRoleTagBlacklistRead(d *schema.ResourceData, meta interface{} } func awsAuthBackendRoleTagBlacklistDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Removing roletag blacklist %q from AWS auth backend", path) @@ -123,7 +131,10 @@ func awsAuthBackendRoleTagBlacklistDelete(d *schema.ResourceData, meta interface } func awsAuthBackendRoleTagBlacklistExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() diff --git a/vault/resource_aws_auth_backend_roletag_blacklist_test.go b/vault/resource_aws_auth_backend_roletag_blacklist_test.go index 290988617..94d598532 100644 --- a/vault/resource_aws_auth_backend_roletag_blacklist_test.go +++ b/vault/resource_aws_auth_backend_roletag_blacklist_test.go @@ -9,8 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -87,7 +87,7 @@ func TestAccAWSAuthBackendRoleTagBlacklist_updated(t *testing.T) { } func testAccCheckAWSAuthBackendRoleTagBlacklistDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_roletag_blacklist" { continue @@ -163,7 +163,7 @@ func testAccAWSAuthBackendRoleTagBlacklistCheck_attrs(backend string) resource.T return fmt.Errorf("expected ID to be %q, got %q", "auth/"+backend+"/config/tidy/roletag-blacklist", endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back AWS auth bavkend roletag blacklist config from %q: %s", endpoint, err) diff --git a/vault/resource_aws_auth_backend_sts_role.go b/vault/resource_aws_auth_backend_sts_role.go index b2008e512..5f3be2a12 100644 --- a/vault/resource_aws_auth_backend_sts_role.go +++ b/vault/resource_aws_auth_backend_sts_role.go @@ -7,7 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -53,7 +54,10 @@ func awsAuthBackendSTSRoleResource() *schema.Resource { } func awsAuthBackendSTSRoleCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) accountID := d.Get("account_id").(string) @@ -78,7 +82,10 @@ func awsAuthBackendSTSRoleCreate(d *schema.ResourceData, meta interface{}) error } func awsAuthBackendSTSRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -111,7 +118,10 @@ func awsAuthBackendSTSRoleRead(d *schema.ResourceData, meta interface{}) error { } func awsAuthBackendSTSRoleUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } stsRole := d.Get("sts_role").(string) path := d.Id() @@ -129,7 +139,10 @@ func awsAuthBackendSTSRoleUpdate(d *schema.ResourceData, meta interface{}) error } func awsAuthBackendSTSRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Deleting STS role %q from AWS auth backend", path) @@ -143,7 +156,10 @@ func awsAuthBackendSTSRoleDelete(d *schema.ResourceData, meta interface{}) error } func awsAuthBackendSTSRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() log.Printf("[DEBUG] Checking if STS role %q exists in AWS auth backend", path) diff --git a/vault/resource_aws_auth_backend_sts_role_test.go b/vault/resource_aws_auth_backend_sts_role_test.go index bdb368a54..779b83cce 100644 --- a/vault/resource_aws_auth_backend_sts_role_test.go +++ b/vault/resource_aws_auth_backend_sts_role_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -58,7 +58,7 @@ func TestAccAWSAuthBackendSTSRole_basic(t *testing.T) { } func testAccCheckAWSAuthBackendSTSRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_auth_backend_sts_role" { @@ -93,7 +93,7 @@ func testAccAWSAuthBackendSTSRoleCheck_attrs(backend, accountID, stsRole string) return fmt.Errorf("expected ID to be %q, got %q instead", "auth/"+backend+"/config/sts/"+accountID, endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back sts role from %q: %s", endpoint, err) diff --git a/vault/resource_aws_secret_backend.go b/vault/resource_aws_secret_backend.go index 58b37eb5d..68e0f9d5f 100644 --- a/vault/resource_aws_secret_backend.go +++ b/vault/resource_aws_secret_backend.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func awsSecretBackendResource() *schema.Resource { @@ -96,7 +98,10 @@ func awsSecretBackendResource() *schema.Resource { } func awsSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Get("path").(string) description := d.Get("description").(string) @@ -156,7 +161,10 @@ func awsSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -226,7 +234,10 @@ func awsSecretBackendRead(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() d.Partial(true) @@ -279,7 +290,10 @@ func awsSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -293,7 +307,11 @@ func awsSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := d.Id() log.Printf("[DEBUG] Checking if AWS backend exists at %q", path) mounts, err := client.Sys().ListMounts() diff --git a/vault/resource_aws_secret_backend_role.go b/vault/resource_aws_secret_backend_role.go index ae5948e6b..331523c7a 100644 --- a/vault/resource_aws_secret_backend_role.go +++ b/vault/resource_aws_secret_backend_role.go @@ -7,8 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" ) @@ -100,7 +100,10 @@ func awsSecretBackendRoleResource(name string) *schema.Resource { } func awsSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) name := d.Get("name").(string) @@ -136,7 +139,6 @@ func awsSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { } else { return fmt.Errorf("permissions_boundary_arn is only valid when credential_type is iam_user") } - } if d.HasChange("policy_document") { data["policy_document"] = policyDocument @@ -188,7 +190,10 @@ func awsSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() pathPieces := strings.Split(path, "/") @@ -244,7 +249,10 @@ func awsSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { } func awsSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Deleting role %q", path) @@ -257,7 +265,10 @@ func awsSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) error } func awsSecretBackendRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() log.Printf("[DEBUG] Checking if %q exists", path) diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go index ebd3d7189..31993ba20 100644 --- a/vault/resource_aws_secret_backend_role_test.go +++ b/vault/resource_aws_secret_backend_role_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -115,7 +115,7 @@ func TestAccAWSSecretBackendRole_nested(t *testing.T) { } func testAccAWSSecretBackendRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_aws_secret_backend_role" { @@ -203,7 +203,6 @@ func testAccAWSSecretBackendRoleCheckUpdatedAttributes(name, backend string) res func testAccAWSSecretBackendRoleConfig_basic(name, path, accessKey, secretKey string) string { resources := []string{ - fmt.Sprintf(` resource "vault_aws_secret_backend" "test" { path = "%s" diff --git a/vault/resource_aws_secret_backend_test.go b/vault/resource_aws_secret_backend_test.go index 8e98e2446..b3aa7a564 100644 --- a/vault/resource_aws_secret_backend_test.go +++ b/vault/resource_aws_secret_backend_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -104,7 +104,7 @@ func TestAccAWSSecretBackend_usernameTempl(t *testing.T) { } func testAccAWSSecretBackendCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_azure_auth_backend_config.go b/vault/resource_azure_auth_backend_config.go index b67a77d9b..72b898bfd 100644 --- a/vault/resource_azure_auth_backend_config.go +++ b/vault/resource_azure_auth_backend_config.go @@ -6,7 +6,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func azureAuthBackendConfigResource() *schema.Resource { @@ -65,7 +66,7 @@ func azureAuthBackendConfigResource() *schema.Resource { } func azureAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { - config := meta.(*api.Client) + config := meta.(*provider.ProviderMeta).GetClient() // if backend comes from the config, it won't have the StateFunc // applied yet, so we need to apply it again. @@ -99,7 +100,7 @@ func azureAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { } func azureAuthBackendRead(d *schema.ResourceData, meta interface{}) error { - config := meta.(*api.Client) + config := meta.(*provider.ProviderMeta).GetClient() log.Printf("[DEBUG] Reading Azure auth backend config") secret, err := config.Logical().Read(d.Id()) @@ -129,7 +130,7 @@ func azureAuthBackendRead(d *schema.ResourceData, meta interface{}) error { } func azureAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { - config := meta.(*api.Client) + config := meta.(*provider.ProviderMeta).GetClient() log.Printf("[DEBUG] Deleting Azure auth backend config from %q", d.Id()) _, err := config.Logical().Delete(d.Id()) @@ -142,7 +143,7 @@ func azureAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { } func azureAuthBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - config := meta.(*api.Client) + config := meta.(*provider.ProviderMeta).GetClient() log.Printf("[DEBUG] Checking if Azure auth backend is configured at %q", d.Id()) secret, err := config.Logical().Read(d.Id()) diff --git a/vault/resource_azure_auth_backend_config_test.go b/vault/resource_azure_auth_backend_config_test.go index a95c61923..70657e12e 100644 --- a/vault/resource_azure_auth_backend_config_test.go +++ b/vault/resource_azure_auth_backend_config_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -53,7 +53,7 @@ func TestAccAzureAuthBackendConfig_basic(t *testing.T) { } func testAccCheckAzureAuthBackendConfigDestroy(s *terraform.State) error { - config := testProvider.Meta().(*api.Client) + config := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_azure_auth_backend_config" { @@ -106,7 +106,7 @@ func testAccAzureAuthBackendConfigCheck_attrs(backend string) resource.TestCheck return fmt.Errorf("expected ID to be %q, got %q", "auth/"+backend+"/config", endpoint) } - config := testProvider.Meta().(*api.Client) + config := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := config.Logical().Read(endpoint) if err != nil { return fmt.Errorf("error reading back Azure auth config from %q: %s", endpoint, err) diff --git a/vault/resource_azure_auth_backend_role.go b/vault/resource_azure_auth_backend_role.go index 509b398ef..a33d01417 100644 --- a/vault/resource_azure_auth_backend_role.go +++ b/vault/resource_azure_auth_backend_role.go @@ -9,7 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -101,7 +102,10 @@ func azureAuthBackendRoleResource() *schema.Resource { } func azureAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -178,7 +182,10 @@ func azureAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, met } func azureAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() backend, err := azureAuthBackendRoleBackendFromPath(path) @@ -240,7 +247,10 @@ func azureAuthBackendRoleRead(_ context.Context, d *schema.ResourceData, meta in } func azureAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Updating Azure auth backend role %q", path) @@ -307,7 +317,10 @@ func azureAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, met } func azureAuthBackendRoleDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Deleting Azure auth backend role %q", path) diff --git a/vault/resource_azure_auth_backend_role_test.go b/vault/resource_azure_auth_backend_role_test.go index 09ab1ac53..b6127e16e 100644 --- a/vault/resource_azure_auth_backend_role_test.go +++ b/vault/resource_azure_auth_backend_role_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -70,7 +70,7 @@ func TestAzureAuthBackendRole(t *testing.T) { } func testAzureAuthBackendRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_azure_auth_backend_role" { @@ -104,7 +104,7 @@ func testAzureAuthBackendRoleCheck_attrs(backend, name string) resource.TestChec return fmt.Errorf("expected ID to be %q, got %q instead", endpoint, instanceState.ID) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() authMounts, err := client.Sys().ListAuth() if err != nil { return err diff --git a/vault/resource_azure_secret_backend.go b/vault/resource_azure_secret_backend.go index 0a74eea6e..6d22c5804 100644 --- a/vault/resource_azure_secret_backend.go +++ b/vault/resource_azure_secret_backend.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func azureSecretBackendResource() *schema.Resource { @@ -84,7 +86,10 @@ func azureSecretBackendResource() *schema.Resource { } func azureSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Get("path").(string) description := d.Get("description").(string) @@ -116,7 +121,10 @@ func azureSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { } func azureSecretBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -172,7 +180,10 @@ func azureSecretBackendRead(d *schema.ResourceData, meta interface{}) error { } func azureSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -189,7 +200,10 @@ func azureSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { } func azureSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -203,7 +217,11 @@ func azureSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { } func azureSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := d.Id() log.Printf("[DEBUG] Checking if Azure backend exists at %q", path) mounts, err := client.Sys().ListMounts() diff --git a/vault/resource_azure_secret_backend_role.go b/vault/resource_azure_secret_backend_role.go index 9af29a0e8..2f85e1ff1 100644 --- a/vault/resource_azure_secret_backend_role.go +++ b/vault/resource_azure_secret_backend_role.go @@ -7,7 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func azureSecretBackendRoleResource() *schema.Resource { @@ -103,7 +104,6 @@ func azureSecretBackendRoleResource() *schema.Resource { } func azureSecretBackendRoleUpdateFields(d *schema.ResourceData, data map[string]interface{}) error { - if v, ok := d.GetOk("azure_roles"); ok { rawAzureList := v.(*schema.Set).List() @@ -151,7 +151,10 @@ func azureSecretBackendRoleUpdateFields(d *schema.ResourceData, data map[string] } func azureSecretBackendRoleCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -177,7 +180,11 @@ func azureSecretBackendRoleCreate(d *schema.ResourceData, meta interface{}) erro } func azureSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Reading Azure Secret role %q", path) @@ -221,7 +228,11 @@ func azureSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error } func azureSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Deleting Azure Secret role %q", path) diff --git a/vault/resource_azure_secret_backend_role_test.go b/vault/resource_azure_secret_backend_role_test.go index 7f2e4e7f2..d1ca53cf8 100644 --- a/vault/resource_azure_secret_backend_role_test.go +++ b/vault/resource_azure_secret_backend_role_test.go @@ -9,8 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -52,7 +52,7 @@ func TestAzureSecretBackendRole(t *testing.T) { } func testAccAzureSecretBackendRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_azure_secret_backend_test.go b/vault/resource_azure_secret_backend_test.go index cfb42ff49..1cb7f233b 100644 --- a/vault/resource_azure_secret_backend_test.go +++ b/vault/resource_azure_secret_backend_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -61,7 +61,7 @@ func TestAzureSecretBackend(t *testing.T) { } func testAccAzureSecretBackendCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_cert_auth_backend_role.go b/vault/resource_cert_auth_backend_role.go index b68bc8360..d5e6a6269 100644 --- a/vault/resource_cert_auth_backend_role.go +++ b/vault/resource_cert_auth_backend_role.go @@ -8,7 +8,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func certAuthBackendRoleResource() *schema.Resource { @@ -113,7 +113,10 @@ func certCertResourcePath(backend, name string) string { } func certAuthResourceWrite(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) name := d.Get("name").(string) @@ -166,7 +169,10 @@ func certAuthResourceWrite(ctx context.Context, d *schema.ResourceData, meta int } func certAuthResourceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() data := map[string]interface{}{} @@ -213,7 +219,10 @@ func certAuthResourceUpdate(ctx context.Context, d *schema.ResourceData, meta in } func certAuthResourceRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Reading cert %q", path) @@ -308,7 +317,10 @@ func certAuthResourceRead(_ context.Context, d *schema.ResourceData, meta interf } func certAuthResourceDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Deleting cert %q", path) diff --git a/vault/resource_cert_auth_backend_role_test.go b/vault/resource_cert_auth_backend_role_test.go index cd5299dc6..953456c6d 100644 --- a/vault/resource_cert_auth_backend_role_test.go +++ b/vault/resource_cert_auth_backend_role_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -122,7 +122,7 @@ func TestCertAuthBackend(t *testing.T) { } func testCertAuthBackendDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_cert_auth_backend_role" { @@ -156,7 +156,7 @@ func testCertAuthBackendCheck_attrs(backend, name string) resource.TestCheckFunc return fmt.Errorf("expected ID to be %q, got %q instead", endpoint, instanceState.ID) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() authMounts, err := client.Sys().ListAuth() if err != nil { return err diff --git a/vault/resource_consul_secret_backend.go b/vault/resource_consul_secret_backend.go index 4e6905d73..855f46eee 100644 --- a/vault/resource_consul_secret_backend.go +++ b/vault/resource_consul_secret_backend.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func consulSecretBackendResource() *schema.Resource { @@ -102,7 +104,10 @@ func consulSecretBackendResource() *schema.Resource { } func consulSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Get("path").(string) address := d.Get("address").(string) @@ -154,7 +159,10 @@ func consulSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { } func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() configPath := consulSecretBackendConfigPath(path) @@ -200,7 +208,10 @@ func consulSecretBackendRead(d *schema.ResourceData, meta interface{}) error { } func consulSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() configPath := consulSecretBackendConfigPath(path) @@ -240,7 +251,10 @@ func consulSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { } func consulSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -254,7 +268,10 @@ func consulSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { } func consulSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() diff --git a/vault/resource_consul_secret_backend_role.go b/vault/resource_consul_secret_backend_role.go index c1346bd4b..7d64014e4 100644 --- a/vault/resource_consul_secret_backend_role.go +++ b/vault/resource_consul_secret_backend_role.go @@ -7,7 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -108,7 +109,10 @@ func consulSecretBackendRoleGetBackend(d *schema.ResourceData) string { } func consulSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } name := d.Get("name").(string) @@ -156,7 +160,10 @@ func consulSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) erro } func consulSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } upgradeOldID(d) @@ -230,7 +237,10 @@ func consulSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error } func consulSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -244,7 +254,10 @@ func consulSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) err } func consulSecretBackendRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } upgradeOldID(d) diff --git a/vault/resource_consul_secret_backend_role_test.go b/vault/resource_consul_secret_backend_role_test.go index 9f3b40147..ce5aa7115 100644 --- a/vault/resource_consul_secret_backend_role_test.go +++ b/vault/resource_consul_secret_backend_role_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -75,7 +75,7 @@ func TestConsulSecretBackendRole(t *testing.T) { } func testAccConsulSecretBackendRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_consul_secret_backend_role" { diff --git a/vault/resource_consul_secret_backend_test.go b/vault/resource_consul_secret_backend_test.go index 721a8b229..21a4e9693 100644 --- a/vault/resource_consul_secret_backend_test.go +++ b/vault/resource_consul_secret_backend_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -106,7 +106,7 @@ func TestConsulSecretBackend(t *testing.T) { } func testAccConsulSecretBackendCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_database_secret_backend_connection.go b/vault/resource_database_secret_backend_connection.go index 4f56add6c..a0dd90160 100644 --- a/vault/resource_database_secret_backend_connection.go +++ b/vault/resource_database_secret_backend_connection.go @@ -16,6 +16,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation" "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/util" ) @@ -1304,7 +1305,10 @@ func setDatabaseConnectionDataWithDisableEscaping(d *schema.ResourceData, prefix func databaseSecretBackendConnectionCreateOrUpdate( d *schema.ResourceData, meta interface{}, ) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } engine, err := getDBEngine(d) if err != nil { @@ -1411,7 +1415,10 @@ func getSortedPluginPrefixes() ([]string, error) { } func databaseSecretBackendConnectionRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -1633,7 +1640,11 @@ func getConnectionDetailsMongoDBAtlas(d *schema.ResourceData, prefix string, res } func databaseSecretBackendConnectionDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Removing database connection config %q", path) @@ -1647,7 +1658,10 @@ func databaseSecretBackendConnectionDelete(d *schema.ResourceData, meta interfac } func databaseSecretBackendConnectionExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() diff --git a/vault/resource_database_secret_backend_connection_test.go b/vault/resource_database_secret_backend_connection_test.go index f7fa5f231..571ef8b0e 100644 --- a/vault/resource_database_secret_backend_connection_test.go +++ b/vault/resource_database_secret_backend_connection_test.go @@ -21,6 +21,7 @@ import ( mssqlhelper "github.com/hashicorp/vault/helper/testhelpers/mssql" "github.com/hashicorp/vault/sdk/database/helper/dbutil" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -594,7 +595,7 @@ func TestAccDatabaseSecretBackendConnectionTemplatedUpdateExcludePassword_mysql( Config: testAccDatabaseSecretBackendConnectionConfigTemplated_mysql(name, backend, testConnURL, secondaryRootUsername, secondaryRootPassword, 10), PreConfig: func() { path := fmt.Sprintf("%s/rotate-root/%s", backend, name) - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Write(path, map[string]interface{}{}) if err != nil { t.Error(err) @@ -876,7 +877,7 @@ resource "vault_database_secret_backend_connection" "test" { } func testAccDatabaseSecretBackendConnectionCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_database_secret_backend_connection" { diff --git a/vault/resource_database_secret_backend_role.go b/vault/resource_database_secret_backend_role.go index 8dd3ad4fe..5a35d25d2 100644 --- a/vault/resource_database_secret_backend_role.go +++ b/vault/resource_database_secret_backend_role.go @@ -8,7 +8,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -85,7 +86,10 @@ func databaseSecretBackendRoleResource() *schema.Resource { } func databaseSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) name := d.Get("name").(string) @@ -125,7 +129,10 @@ func databaseSecretBackendRoleWrite(d *schema.ResourceData, meta interface{}) er } func databaseSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -212,7 +219,10 @@ func databaseSecretBackendRoleRead(d *schema.ResourceData, meta interface{}) err } func databaseSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Deleting role %q", path) @@ -225,7 +235,10 @@ func databaseSecretBackendRoleDelete(d *schema.ResourceData, meta interface{}) e } func databaseSecretBackendRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() log.Printf("[DEBUG] Checking if %q exists", path) diff --git a/vault/resource_database_secret_backend_role_test.go b/vault/resource_database_secret_backend_role_test.go index 59cefecfe..c30c5df1d 100644 --- a/vault/resource_database_secret_backend_role_test.go +++ b/vault/resource_database_secret_backend_role_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -87,7 +87,7 @@ func TestAccDatabaseSecretBackendRole_basic(t *testing.T) { } func testAccDatabaseSecretBackendRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_database_secret_backend_role" { diff --git a/vault/resource_database_secret_backend_static_role.go b/vault/resource_database_secret_backend_static_role.go index 73d0b0ade..95a0360fe 100644 --- a/vault/resource_database_secret_backend_static_role.go +++ b/vault/resource_database_secret_backend_static_role.go @@ -8,7 +8,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -75,7 +76,10 @@ func databaseSecretBackendStaticRoleResource() *schema.Resource { } func databaseSecretBackendStaticRoleWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) name := d.Get("name").(string) @@ -105,7 +109,10 @@ func databaseSecretBackendStaticRoleWrite(d *schema.ResourceData, meta interface } func databaseSecretBackendStaticRoleRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -165,7 +172,10 @@ func databaseSecretBackendStaticRoleRead(d *schema.ResourceData, meta interface{ } func databaseSecretBackendStaticRoleDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() log.Printf("[DEBUG] Deleting static role %q", path) @@ -178,7 +188,10 @@ func databaseSecretBackendStaticRoleDelete(d *schema.ResourceData, meta interfac } func databaseSecretBackendStaticRoleExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } path := d.Id() log.Printf("[DEBUG] Checking if %q exists", path) diff --git a/vault/resource_database_secret_backend_static_role_test.go b/vault/resource_database_secret_backend_static_role_test.go index cda898332..2a7ee6466 100644 --- a/vault/resource_database_secret_backend_static_role_test.go +++ b/vault/resource_database_secret_backend_static_role_test.go @@ -11,8 +11,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -99,7 +99,7 @@ func TestAccDatabaseSecretBackendStaticRole_basic(t *testing.T) { } func testAccDatabaseSecretBackendStaticRoleCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_database_secret_backend_static_role" { diff --git a/vault/resource_database_secrets_mount.go b/vault/resource_database_secrets_mount.go index f855404a0..7c079e4d1 100644 --- a/vault/resource_database_secrets_mount.go +++ b/vault/resource_database_secrets_mount.go @@ -8,6 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) type dbConfigStore struct { @@ -209,7 +211,10 @@ func setCommonDatabaseSchema(s schemaMap) schemaMap { } func databaseSecretsMountCreateOrUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } var root string if d.IsNewResource() { @@ -259,7 +264,10 @@ func databaseSecretsMountCreateOrUpdate(d *schema.ResourceData, meta interface{} } func databaseSecretsMountRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } if err := readMount(d, meta, true); err != nil { return err diff --git a/vault/resource_database_secrets_mount_test.go b/vault/resource_database_secrets_mount_test.go index d213dcee1..790abf767 100644 --- a/vault/resource_database_secrets_mount_test.go +++ b/vault/resource_database_secrets_mount_test.go @@ -8,9 +8,9 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" mssqlhelper "github.com/hashicorp/vault/helper/testhelpers/mssql" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -69,7 +69,7 @@ func TestAccDatabaseSecretsMount_mssql(t *testing.T) { }, { PreConfig: func() { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(fmt.Sprintf("%s/creds/%s", backend, "dev")) if err != nil { t.Fatal(err) @@ -169,7 +169,7 @@ func TestAccDatabaseSecretsMount_mssql_multi(t *testing.T) { }, { PreConfig: func() { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, role := range []string{"dev1", "dev2"} { resp, err := client.Logical().Read(fmt.Sprintf("%s/creds/%s", backend, role)) @@ -321,7 +321,7 @@ resource "vault_database_secret_backend_role" "test2" { } func testAccDatabaseSecretsMountCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_database_secrets_mount" { diff --git a/vault/resource_egp_policy_test.go b/vault/resource_egp_policy_test.go index 81834166c..8184d32d3 100644 --- a/vault/resource_egp_policy_test.go +++ b/vault/resource_egp_policy_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -42,7 +42,7 @@ func TestAccEndpointGoverningPolicy(t *testing.T) { } func testAccEndpointGoverningPolicyCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_egp_policy" { continue diff --git a/vault/resource_gcp_auth_backend.go b/vault/resource_gcp_auth_backend.go index 93d19426c..6052b9d78 100644 --- a/vault/resource_gcp_auth_backend.go +++ b/vault/resource_gcp_auth_backend.go @@ -8,6 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const ( @@ -17,7 +19,6 @@ const ( func gcpAuthBackendResource() *schema.Resource { return &schema.Resource{ - Create: gcpAuthBackendWrite, Update: gcpAuthBackendUpdate, Read: gcpAuthBackendRead, @@ -113,7 +114,10 @@ func gcpAuthBackendConfigPath(path string) string { } func gcpAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } authType := gcpAuthType path := d.Get("path").(string) @@ -137,7 +141,10 @@ func gcpAuthBackendWrite(d *schema.ResourceData, meta interface{}) error { } func gcpAuthBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := gcpAuthBackendConfigPath(d.Id()) data := map[string]interface{}{} @@ -148,7 +155,6 @@ func gcpAuthBackendUpdate(d *schema.ResourceData, meta interface{}) error { log.Printf("[DEBUG] Writing gcp config %q", path) _, err := client.Logical().Write(path, data) - if err != nil { d.SetId("") return fmt.Errorf("error writing gcp config %q: %s", path, err) @@ -159,7 +165,11 @@ func gcpAuthBackendUpdate(d *schema.ResourceData, meta interface{}) error { } func gcpAuthBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := gcpAuthBackendConfigPath(d.Id()) log.Printf("[DEBUG] Reading gcp auth backend config %q", path) @@ -198,7 +208,11 @@ func gcpAuthBackendRead(d *schema.ResourceData, meta interface{}) error { } func gcpAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Deleting gcp auth backend %q", path) @@ -212,7 +226,11 @@ func gcpAuthBackendDelete(d *schema.ResourceData, meta interface{}) error { } func gcpAuthBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := gcpAuthBackendConfigPath(d.Id()) log.Printf("[DEBUG] Checking if gcp auth backend %q exists", path) diff --git a/vault/resource_gcp_auth_backend_role.go b/vault/resource_gcp_auth_backend_role.go index 0840d7ee7..c5e6e73c7 100644 --- a/vault/resource_gcp_auth_backend_role.go +++ b/vault/resource_gcp_auth_backend_role.go @@ -10,7 +10,7 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -169,7 +169,10 @@ func gcpRoleUpdateFields(d *schema.ResourceData, data map[string]interface{}, cr } func gcpAuthResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } backend := d.Get("backend").(string) role := d.Get("role").(string) @@ -192,7 +195,10 @@ func gcpAuthResourceCreate(ctx context.Context, d *schema.ResourceData, meta int } func gcpAuthResourceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() data := map[string]interface{}{} @@ -209,7 +215,10 @@ func gcpAuthResourceUpdate(ctx context.Context, d *schema.ResourceData, meta int } func gcpAuthResourceRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Reading GCP role %q", path) @@ -275,7 +284,10 @@ func gcpAuthResourceRead(_ context.Context, d *schema.ResourceData, meta interfa } func gcpAuthResourceDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return diag.FromErr(e) + } path := d.Id() log.Printf("[DEBUG] Deleting GCP role %q", path) diff --git a/vault/resource_gcp_auth_backend_role_test.go b/vault/resource_gcp_auth_backend_role_test.go index 2118fb16a..4309c700d 100644 --- a/vault/resource_gcp_auth_backend_role_test.go +++ b/vault/resource_gcp_auth_backend_role_test.go @@ -10,8 +10,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -135,7 +135,7 @@ func TestGCPAuthBackendRole_gce(t *testing.T) { } func testGCPAuthBackendRoleDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_gcp_auth_backend_role" { @@ -169,7 +169,7 @@ func testGCPAuthBackendRoleCheck_attrs(backend, name string) resource.TestCheckF return fmt.Errorf("expected ID to be %q, got %q instead", endpoint, instanceState.ID) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() authMounts, err := client.Sys().ListAuth() if err != nil { return err diff --git a/vault/resource_gcp_auth_backend_test.go b/vault/resource_gcp_auth_backend_test.go index ca3a5b7cf..8debe8542 100644 --- a/vault/resource_gcp_auth_backend_test.go +++ b/vault/resource_gcp_auth_backend_test.go @@ -6,8 +6,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -67,7 +67,7 @@ func TestGCPAuthBackend_import(t *testing.T) { } func testGCPAuthBackendDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_gcp_auth_backend" { diff --git a/vault/resource_gcp_secret_backend.go b/vault/resource_gcp_secret_backend.go index bf2db0693..5e1337739 100644 --- a/vault/resource_gcp_secret_backend.go +++ b/vault/resource_gcp_secret_backend.go @@ -7,6 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func gcpSecretBackendResource(name string) *schema.Resource { @@ -81,7 +83,10 @@ func gcpSecretBackendResource(name string) *schema.Resource { } func gcpSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Get("path").(string) description := d.Get("description").(string) @@ -127,7 +132,10 @@ func gcpSecretBackendCreate(d *schema.ResourceData, meta interface{}) error { } func gcpSecretBackendRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -157,7 +165,10 @@ func gcpSecretBackendRead(d *schema.ResourceData, meta interface{}) error { } func gcpSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() d.Partial(true) @@ -190,7 +201,10 @@ func gcpSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error { } func gcpSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -204,7 +218,11 @@ func gcpSecretBackendDelete(d *schema.ResourceData, meta interface{}) error { } func gcpSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := d.Id() log.Printf("[DEBUG] Checking if GCP backend exists at %q", path) mounts, err := client.Sys().ListMounts() diff --git a/vault/resource_gcp_secret_backend_test.go b/vault/resource_gcp_secret_backend_test.go index b0f31aee1..216527410 100644 --- a/vault/resource_gcp_secret_backend_test.go +++ b/vault/resource_gcp_secret_backend_test.go @@ -8,8 +8,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -47,7 +47,7 @@ func TestGCPSecretBackend(t *testing.T) { } func testAccGCPSecretBackendCheckDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() mounts, err := client.Sys().ListMounts() if err != nil { diff --git a/vault/resource_gcp_secret_roleset.go b/vault/resource_gcp_secret_roleset.go index 9229c5e0a..183d990e0 100644 --- a/vault/resource_gcp_secret_roleset.go +++ b/vault/resource_gcp_secret_roleset.go @@ -9,7 +9,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -109,7 +110,10 @@ func gcpSecretRolesetResource() *schema.Resource { } func gcpSecretRolesetCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) roleset := d.Get("roleset").(string) @@ -132,7 +136,11 @@ func gcpSecretRolesetCreate(d *schema.ResourceData, meta interface{}) error { } func gcpSecretRolesetRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() backend, err := gcpSecretRolesetBackendFromPath(path) @@ -192,7 +200,11 @@ func gcpSecretRolesetRead(d *schema.ResourceData, meta interface{}) error { } func gcpSecretRolesetUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() data := map[string]interface{}{} @@ -210,7 +222,11 @@ func gcpSecretRolesetUpdate(d *schema.ResourceData, meta interface{}) error { } func gcpSecretRolesetDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Deleting GCP secrets backend roleset %q", path) @@ -244,7 +260,11 @@ func gcpSecretRolesetUpdateFields(d *schema.ResourceData, data map[string]interf } func gcpSecretRolesetExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := d.Id() log.Printf("[DEBUG] Checking if %q exists", path) secret, err := client.Logical().Read(path) diff --git a/vault/resource_gcp_secret_roleset_test.go b/vault/resource_gcp_secret_roleset_test.go index c84a73988..411a457d5 100644 --- a/vault/resource_gcp_secret_roleset_test.go +++ b/vault/resource_gcp_secret_roleset_test.go @@ -12,8 +12,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -120,7 +120,7 @@ func testGCPSecretRoleset_attrs(backend, roleset string) resource.TestCheckFunc return fmt.Errorf("expected ID to be %q, got %q instead", backend+"/roleset/"+roleset, endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("%q doesn't exist", endpoint) @@ -290,7 +290,7 @@ func testGCPSecretRoleset_serviceAccountEmail(serviceAccountEmail *string, check } func testGCPSecretRolesetDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_gcp_secret_roleset" { diff --git a/vault/resource_gcp_secret_static_account.go b/vault/resource_gcp_secret_static_account.go index 765a5ead2..f6b07ad94 100644 --- a/vault/resource_gcp_secret_static_account.go +++ b/vault/resource_gcp_secret_static_account.go @@ -7,7 +7,8 @@ import ( "strings" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) var ( @@ -96,7 +97,10 @@ func gcpSecretStaticAccountResource() *schema.Resource { } func gcpSecretStaticAccountCreate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } backend := d.Get("backend").(string) staticAccount := d.Get("static_account").(string) @@ -119,7 +123,11 @@ func gcpSecretStaticAccountCreate(d *schema.ResourceData, meta interface{}) erro } func gcpSecretStaticAccountRead(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() backend, err := gcpSecretStaticAccountBackendFromPath(path) @@ -175,7 +183,11 @@ func gcpSecretStaticAccountRead(d *schema.ResourceData, meta interface{}) error } func gcpSecretStaticAccountUpdate(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() data := map[string]interface{}{} @@ -193,7 +205,11 @@ func gcpSecretStaticAccountUpdate(d *schema.ResourceData, meta interface{}) erro } func gcpSecretStaticAccountDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } + path := d.Id() log.Printf("[DEBUG] Deleting GCP secrets backend static account %q", path) @@ -229,7 +245,11 @@ func gcpSecretStaticAccountUpdateFields(d *schema.ResourceData, data map[string] } func gcpSecretStaticAccountExists(d *schema.ResourceData, meta interface{}) (bool, error) { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return false, e + } + path := d.Id() log.Printf("[DEBUG] Checking if %q exists", path) secret, err := client.Logical().Read(path) diff --git a/vault/resource_gcp_secret_static_account_test.go b/vault/resource_gcp_secret_static_account_test.go index 9c4081d9c..9158ce6ca 100644 --- a/vault/resource_gcp_secret_static_account_test.go +++ b/vault/resource_gcp_secret_static_account_test.go @@ -12,9 +12,9 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" "golang.org/x/oauth2/google" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -143,7 +143,7 @@ func testGCPSecretStaticAccount_attrs(backend, staticAccount string) resource.Te return fmt.Errorf("expected ID to be %q, got %q instead", backend+"/static-account/"+staticAccount, endpoint) } - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() resp, err := client.Logical().Read(endpoint) if err != nil { return fmt.Errorf("%q doesn't exist", endpoint) @@ -291,7 +291,7 @@ func testGCPSecretStaticAccount_attrs(backend, staticAccount string) resource.Te } func testGCPSecretStaticAccountDestroy(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_gcp_secret_static_account" { diff --git a/vault/resource_generic_endpoint.go b/vault/resource_generic_endpoint.go index 8678e9bc8..6a6bc64ad 100644 --- a/vault/resource_generic_endpoint.go +++ b/vault/resource_generic_endpoint.go @@ -6,7 +6,8 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) func genericEndpointResource(name string) *schema.Resource { @@ -88,7 +89,10 @@ func genericEndpointResource(name string) *schema.Resource { } func genericEndpointResourceWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } var data map[string]interface{} err := json.Unmarshal([]byte(d.Get("data_json").(string)), &data) @@ -151,7 +155,10 @@ func genericEndpointResourceDelete(d *schema.ResourceData, meta interface{}) err shouldDelete := !d.Get("disable_delete").(bool) if shouldDelete { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() @@ -172,7 +179,10 @@ func genericEndpointResourceRead(d *schema.ResourceData, meta interface{}) error ignore_absent_fields := d.Get("ignore_absent_fields").(bool) if shouldRead { - client := meta.(*api.Client) + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } log.Printf("[DEBUG] Reading %s from Vault", path) data, err := client.Logical().Read(path) diff --git a/vault/resource_generic_endpoint_test.go b/vault/resource_generic_endpoint_test.go index 88c2a3c1d..4f78042c0 100644 --- a/vault/resource_generic_endpoint_test.go +++ b/vault/resource_generic_endpoint_test.go @@ -7,8 +7,8 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" - "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) @@ -173,7 +173,7 @@ func testResourceGenericEndpoint_initialCheck(s *terraform.State) error { func testResourceGenericEndpoint_destroyCheck(path string) resource.TestCheckFunc { return func(s *terraform.State) error { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() for _, rs := range s.RootModule().Resources { if rs.Type != "vault_generic_endpoint" { diff --git a/vault/resource_generic_secret.go b/vault/resource_generic_secret.go index c28b85a51..7651ac404 100644 --- a/vault/resource_generic_secret.go +++ b/vault/resource_generic_secret.go @@ -6,7 +6,9 @@ import ( "log" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema" - "github.com/hashicorp/vault/api" + + "github.com/hashicorp/terraform-provider-vault/internal/consts" + "github.com/hashicorp/terraform-provider-vault/internal/provider" ) const latestSecretVersion = -1 @@ -25,7 +27,7 @@ func genericSecretResource(name string) *schema.Resource { MigrateState: resourceGenericSecretMigrateState, Schema: map[string]*schema.Schema{ - "path": { + consts.FieldPath: { Type: schema.TypeString, Required: true, ForceNew: true, @@ -118,15 +120,16 @@ func normalizeDataJSON(data string) (string, error) { } func genericSecretResourceWrite(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) - + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } var data map[string]interface{} - err := json.Unmarshal([]byte(d.Get("data_json").(string)), &data) - if err != nil { + if err := json.Unmarshal([]byte(d.Get("data_json").(string)), &data); err != nil { return fmt.Errorf("data_json %#v syntax error: %s", d.Get("data_json"), err) } - path := d.Get("path").(string) + path := d.Get(consts.FieldPath).(string) originalPath := path // if the path belongs to a v2 endpoint, it will be modified mountPath, v2, err := isKVv2(path, client) if err != nil { @@ -154,8 +157,10 @@ func genericSecretResourceWrite(d *schema.ResourceData, meta interface{}) error } func genericSecretResourceDelete(d *schema.ResourceData, meta interface{}) error { - client := meta.(*api.Client) - + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } path := d.Id() mountPath, v2, err := isKVv2(path, client) @@ -182,14 +187,16 @@ func genericSecretResourceDelete(d *schema.ResourceData, meta interface{}) error } func genericSecretResourceRead(d *schema.ResourceData, meta interface{}) error { + client, e := provider.GetClient(d, meta) + if e != nil { + return e + } var data map[string]interface{} shouldRead := !d.Get("disable_read").(bool) path := d.Id() if shouldRead { - client := meta.(*api.Client) - log.Printf("[DEBUG] Reading %s from Vault", path) secret, err := versionedSecret(latestSecretVersion, path, client) if err != nil { @@ -212,7 +219,7 @@ func genericSecretResourceRead(d *schema.ResourceData, meta interface{}) error { if err := d.Set("data_json", string(jsonData)); err != nil { return err } - if err := d.Set("path", path); err != nil { + if err := d.Set(consts.FieldPath, path); err != nil { return err } } else { diff --git a/vault/resource_generic_secret_test.go b/vault/resource_generic_secret_test.go index 2f8448438..5f315926b 100644 --- a/vault/resource_generic_secret_test.go +++ b/vault/resource_generic_secret_test.go @@ -2,6 +2,7 @@ package vault import ( "fmt" + "os" "testing" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest" @@ -9,23 +10,26 @@ import ( "github.com/hashicorp/terraform-plugin-sdk/v2/terraform" "github.com/hashicorp/vault/api" + "github.com/hashicorp/terraform-provider-vault/internal/consts" + "github.com/hashicorp/terraform-provider-vault/internal/provider" "github.com/hashicorp/terraform-provider-vault/testutil" ) func TestResourceGenericSecret(t *testing.T) { - path := acctest.RandomWithPrefix("secretsv1/test") + mount := acctest.RandomWithPrefix("secretsv1") + name := acctest.RandomWithPrefix("test") + path := fmt.Sprintf("%s/%s", mount, name) resourceName := "vault_generic_secret.test" - resource.Test(t, resource.TestCase{ Providers: testProviders, PreCheck: func() { testutil.TestAccPreCheck(t) }, Steps: []resource.TestStep{ { - Config: testResourceGenericSecret_initialConfig(path), + Config: testResourceGenericSecret_initialConfig(mount, name), Check: testResourceGenericSecret_initialCheck(path), }, { - Config: testResourceGenericSecret_updateConfig, + Config: testResourceGenericSecret_updateConfig(mount, name), Check: testResourceGenericSecret_updateCheck, }, { @@ -36,16 +40,67 @@ func TestResourceGenericSecret(t *testing.T) { }) } +func TestResourceGenericSecretNS(t *testing.T) { + ns := acctest.RandomWithPrefix("ns") + mount := acctest.RandomWithPrefix("secretsv1") + name := acctest.RandomWithPrefix("test") + path := fmt.Sprintf("%s/%s", mount, name) + resourceName := "vault_generic_secret.test" + + resource.Test(t, resource.TestCase{ + Providers: testProviders, + PreCheck: func() { testutil.TestEntPreCheck(t) }, + Steps: []resource.TestStep{ + { + Config: testResourceGenericSecret_initialConfigNS(ns, mount, name), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr(resourceName, "namespace", ns), + testResourceGenericSecret_initialCheck(path), + ), + }, + { + // unfortunately two steps are needed when testing import, + // since the tf-plugin-sdk does not allow for specifying environment variables :( + // neither does have any support for generic post-step functions. + // It is possible that this will cause issues if we ever want to support parallel tests. + // We would have to update the SDK to suport specifying extra env vars by step. + PreConfig: func() { + t.Setenv(consts.EnvVarVaultNamespaceImport, ns) + }, + ImportState: true, + ResourceName: resourceName, + }, + { + // needed for the import step above :( + Config: testResourceGenericSecret_initialConfigNS(ns, mount, name), + PreConfig: func() { + os.Unsetenv(consts.EnvVarVaultNamespaceImport) + }, + PlanOnly: true, + }, + { + Config: testResourceGenericSecret_updateConfig(mount, name), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckNoResourceAttr(resourceName, "namespace"), + testResourceGenericSecret_updateCheck, + ), + }, + }, + }) +} + func TestResourceGenericSecret_deleted(t *testing.T) { - path := acctest.RandomWithPrefix("secretsv1/test") resourceName := "vault_generic_secret.test" + mount := acctest.RandomWithPrefix("secretsv1") + name := acctest.RandomWithPrefix("test") + path := fmt.Sprintf("%s/%s", mount, name) resource.Test(t, resource.TestCase{ Providers: testProviders, PreCheck: func() { testutil.TestAccPreCheck(t) }, Steps: []resource.TestStep{ { - Config: testResourceGenericSecret_initialConfig(path), + Config: testResourceGenericSecret_initialConfig(mount, name), Check: testResourceGenericSecret_initialCheck(path), }, { @@ -54,13 +109,13 @@ func TestResourceGenericSecret_deleted(t *testing.T) { }, { PreConfig: func() { - client := testProvider.Meta().(*api.Client) + client := testProvider.Meta().(*provider.ProviderMeta).GetClient() _, err := client.Logical().Delete(path) if err != nil { t.Fatalf("unable to manually delete the secret via the SDK: %s", err) } }, - Config: testResourceGenericSecret_initialConfig(path), + Config: testResourceGenericSecret_initialConfig(mount, name), Check: testResourceGenericSecret_initialCheck(path), }, { @@ -100,10 +155,10 @@ func TestResourceGenericSecret_deleteAllVersions(t *testing.T) { }) } -func testResourceGenericSecret_initialConfig(path string) string { +func testResourceGenericSecret_initialConfig(mount, name string) string { return fmt.Sprintf(` resource "vault_mount" "v1" { - path = "secretsv1" + path = "%s" type = "kv" options = { version = "1" @@ -111,14 +166,62 @@ resource "vault_mount" "v1" { } resource "vault_generic_secret" "test" { - depends_on = ["vault_mount.v1"] + path = "${vault_mount.v1.path}/%s" + data_json = <`) - The subscription id for the Azure Active Directory. - `use_microsoft_graph_api` (`bool: `) - Use the Microsoft Graph API introduced in `vault-1.9`. diff --git a/website/docs/r/azure_secret_backend_role.html.md b/website/docs/r/azure_secret_backend_role.html.md index 77e6fe4ef..60f8ef4a7 100644 --- a/website/docs/r/azure_secret_backend_role.html.md +++ b/website/docs/r/azure_secret_backend_role.html.md @@ -54,6 +54,11 @@ resource "vault_azure_secret_backend_role" "existing_object_id" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role` - (Required) Name of the Azure role * `backend` - Path to the mounted Azure auth backend * `azure_groups` - List of Azure groups to be assigned to the generated service principal. diff --git a/website/docs/r/cert_auth_backend_role.html.md b/website/docs/r/cert_auth_backend_role.html.md index 88c672401..5a6219299 100644 --- a/website/docs/r/cert_auth_backend_role.html.md +++ b/website/docs/r/cert_auth_backend_role.html.md @@ -33,6 +33,11 @@ resource "vault_cert_auth_backend_role" "cert" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Name of the role * `certificate` - (Required) CA certificate used to validate client certificates diff --git a/website/docs/r/consul_secret_backend.html.md b/website/docs/r/consul_secret_backend.html.md index 8d42c7fc2..cd6514126 100644 --- a/website/docs/r/consul_secret_backend.html.md +++ b/website/docs/r/consul_secret_backend.html.md @@ -33,6 +33,11 @@ resource "vault_consul_secret_backend" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `token` - (Required) The Consul management token this backend should use to issue new tokens. ~> **Important** Because Vault does not support reading the configured diff --git a/website/docs/r/consul_secret_backend_role.html.md b/website/docs/r/consul_secret_backend_role.html.md index 635efcec7..c511d9c72 100644 --- a/website/docs/r/consul_secret_backend_role.html.md +++ b/website/docs/r/consul_secret_backend_role.html.md @@ -35,6 +35,11 @@ resource "vault_consul_secret_backend_role" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Optional) The unique name of an existing Consul secrets backend mount. Must not begin or end with a `/`. One of `path` or `backend` is required. * `name` - (Required) The name of the Consul secrets engine role to create. diff --git a/website/docs/r/database_secret_backend_connection.md b/website/docs/r/database_secret_backend_connection.md index cd0fe451e..418f0fb08 100644 --- a/website/docs/r/database_secret_backend_connection.md +++ b/website/docs/r/database_secret_backend_connection.md @@ -41,6 +41,11 @@ resource "vault_database_secret_backend_connection" "postgres" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) A unique name to give the database connection. * `backend` - (Required) The unique name of the Vault mount to configure. diff --git a/website/docs/r/database_secret_backend_role.md b/website/docs/r/database_secret_backend_role.md index a0e56d28a..823d6fed4 100644 --- a/website/docs/r/database_secret_backend_role.md +++ b/website/docs/r/database_secret_backend_role.md @@ -48,6 +48,11 @@ resource "vault_database_secret_backend_role" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) A unique name to give the role. * `backend` - (Required) The unique name of the Vault mount to configure. diff --git a/website/docs/r/database_secret_backend_static_role.md b/website/docs/r/database_secret_backend_static_role.md index 3d3d4b167..133f56c20 100644 --- a/website/docs/r/database_secret_backend_static_role.md +++ b/website/docs/r/database_secret_backend_static_role.md @@ -44,6 +44,11 @@ resource "vault_database_secret_backend_static_role" "static_role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) A unique name to give the static role. * `backend` - (Required) The unique name of the Vault mount to configure. diff --git a/website/docs/r/egp_policy.html.md b/website/docs/r/egp_policy.html.md index 59143a067..26ce269c9 100644 --- a/website/docs/r/egp_policy.html.md +++ b/website/docs/r/egp_policy.html.md @@ -33,6 +33,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the policy * `paths` - (Required) List of paths to which the policy will be applied to diff --git a/website/docs/r/gcp_auth_backend.html.md b/website/docs/r/gcp_auth_backend.html.md index 83094e0f4..028e0cee6 100644 --- a/website/docs/r/gcp_auth_backend.html.md +++ b/website/docs/r/gcp_auth_backend.html.md @@ -22,6 +22,11 @@ resource "vault_gcp_auth_backend" "gcp" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `credentials` - A JSON string containing the contents of a GCP credentials file. If this value is empty, Vault will try to use Application Default Credentials from the machine on which the Vault server is running. * `path` - (Optional) The path to mount the auth method — this defaults to 'gcp'. diff --git a/website/docs/r/gcp_auth_backend_role.html.md b/website/docs/r/gcp_auth_backend_role.html.md index 2ca0bbe11..81643c0e2 100644 --- a/website/docs/r/gcp_auth_backend_role.html.md +++ b/website/docs/r/gcp_auth_backend_role.html.md @@ -31,6 +31,11 @@ resource "vault_gcp_auth_backend_role" "gcp" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role` - (Required) Name of the GCP role * `type` - (Required) Type of GCP authentication role (either `gce` or `iam`) diff --git a/website/docs/r/gcp_secret_backend.html.md b/website/docs/r/gcp_secret_backend.html.md index a0ba8deb1..3a5f898dd 100644 --- a/website/docs/r/gcp_secret_backend.html.md +++ b/website/docs/r/gcp_secret_backend.html.md @@ -30,6 +30,11 @@ resource "vault_gcp_secret_backend" "gcp" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `credentials` - (Optional) The GCP service account credentials in JSON format. ~> **Important** Because Vault does not support reading the configured diff --git a/website/docs/r/gcp_secret_roleset.html.md b/website/docs/r/gcp_secret_roleset.html.md index ebb1fc46b..6a057e74f 100644 --- a/website/docs/r/gcp_secret_roleset.html.md +++ b/website/docs/r/gcp_secret_roleset.html.md @@ -45,6 +45,11 @@ resource "vault_gcp_secret_roleset" "roleset" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required, Forces new resource) Path where the GCP Secrets Engine is mounted * `roleset` - (Required, Forces new resource) Name of the Roleset to create diff --git a/website/docs/r/gcp_secret_static_account.html.md b/website/docs/r/gcp_secret_static_account.html.md index 85d8185b4..59e1cc7f4 100644 --- a/website/docs/r/gcp_secret_static_account.html.md +++ b/website/docs/r/gcp_secret_static_account.html.md @@ -48,6 +48,11 @@ resource "vault_gcp_secret_static_account" "static_account" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required, Forces new resource) Path where the GCP Secrets Engine is mounted * `static_account` - (Required, Forces new resource) Name of the Static Account to create diff --git a/website/docs/r/generic_endpoint.html.md b/website/docs/r/generic_endpoint.html.md index bcccfea9d..59b11e1b0 100644 --- a/website/docs/r/generic_endpoint.html.md +++ b/website/docs/r/generic_endpoint.html.md @@ -85,6 +85,11 @@ output "u1_id" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The full logical path at which to write the given data. Consult each backend's documentation to see which endpoints support the `PUT` methods and to determine whether they also support diff --git a/website/docs/r/generic_secret.html.md b/website/docs/r/generic_secret.html.md index 05d2d0bc8..e50a60e01 100644 --- a/website/docs/r/generic_secret.html.md +++ b/website/docs/r/generic_secret.html.md @@ -45,6 +45,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The full logical path at which to write the given data. To write data into the "generic" secret backend mounted in Vault by default, this should be prefixed with `secret/`. Writing to other backends with this diff --git a/website/docs/r/github_auth_backend.html.md b/website/docs/r/github_auth_backend.html.md index e9fd9fca4..99cfc1850 100644 --- a/website/docs/r/github_auth_backend.html.md +++ b/website/docs/r/github_auth_backend.html.md @@ -24,6 +24,11 @@ resource "vault_github_auth_backend" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Optional) Path where the auth backend is mounted. Defaults to `auth/github` if not specified. diff --git a/website/docs/r/github_team.html.md b/website/docs/r/github_team.html.md index 650b21313..c3104569e 100644 --- a/website/docs/r/github_team.html.md +++ b/website/docs/r/github_team.html.md @@ -30,6 +30,11 @@ resource "vault_github_team" "tf_devs" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) Path where the github auth backend is mounted. Defaults to `github` if not specified. diff --git a/website/docs/r/github_user.html.md b/website/docs/r/github_user.html.md index d1f6664d0..8ffeebfa7 100644 --- a/website/docs/r/github_user.html.md +++ b/website/docs/r/github_user.html.md @@ -30,6 +30,11 @@ resource "vault_github_user" "tf_user" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) Path where the github auth backend is mounted. Defaults to `github` if not specified. diff --git a/website/docs/r/identity_entity.html.md b/website/docs/r/identity_entity.html.md index 274c99bfa..e344cf7fa 100644 --- a/website/docs/r/identity_entity.html.md +++ b/website/docs/r/identity_entity.html.md @@ -33,6 +33,11 @@ resource "vault_identity_entity" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Name of the identity entity to create. * `policies` - (Optional) A list of policies to apply to the entity. diff --git a/website/docs/r/identity_entity_alias.html.md b/website/docs/r/identity_entity_alias.html.md index 532dc6c4e..94db3a0e2 100644 --- a/website/docs/r/identity_entity_alias.html.md +++ b/website/docs/r/identity_entity_alias.html.md @@ -31,6 +31,11 @@ resource "vault_identity_entity_alias" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Name of the alias. Name should be the identifier of the client in the authentication source. For example, if the alias belongs to userpass backend, the name should be a valid username within userpass backend. If alias belongs to GitHub, it should be the GitHub username. * `mount_accessor` - (Required) Accessor of the mount to which the alias should belong to. diff --git a/website/docs/r/identity_entity_policies.html.md b/website/docs/r/identity_entity_policies.html.md index c3d45227c..b5f11c165 100644 --- a/website/docs/r/identity_entity_policies.html.md +++ b/website/docs/r/identity_entity_policies.html.md @@ -66,6 +66,11 @@ resource "vault_identity_entity_policies" "others" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `policies` - (Required) List of policies to assign to the entity * `entity_id` - (Required) Entity ID to assign policies to. diff --git a/website/docs/r/identity_group.html.md b/website/docs/r/identity_group.html.md index 1d0c1e81a..3698bfbc1 100644 --- a/website/docs/r/identity_group.html.md +++ b/website/docs/r/identity_group.html.md @@ -77,6 +77,11 @@ resource "vault_identity_group" "Internal" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required, Forces new resource) Name of the identity group to create. * `type` - (Optional, Forces new resource) Type of the group, internal or external. Defaults to `internal`. diff --git a/website/docs/r/identity_group_alias.html.md b/website/docs/r/identity_group_alias.html.md index d8e482b27..74c118dd9 100644 --- a/website/docs/r/identity_group_alias.html.md +++ b/website/docs/r/identity_group_alias.html.md @@ -37,6 +37,11 @@ resource "vault_identity_group_alias" "group-alias" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required, Forces new resource) Name of the group alias to create. * `mount_accessor` - (Required) Mount accessor of the authentication backend to which this alias belongs to. diff --git a/website/docs/r/identity_group_member_entity_ids.html.md b/website/docs/r/identity_group_member_entity_ids.html.md index 7936c2c0f..ba349de16 100644 --- a/website/docs/r/identity_group_member_entity_ids.html.md +++ b/website/docs/r/identity_group_member_entity_ids.html.md @@ -84,6 +84,11 @@ resource "vault_identity_group_member_entity_ids" "others" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `member_entity_ids` - (Required) List of member entities that belong to the group * `group_id` - (Required) Group ID to assign member entities to. diff --git a/website/docs/r/identity_group_policies.html.md b/website/docs/r/identity_group_policies.html.md index aad0b0ba3..837745a94 100644 --- a/website/docs/r/identity_group_policies.html.md +++ b/website/docs/r/identity_group_policies.html.md @@ -78,6 +78,11 @@ resource "vault_identity_group_policies" "others" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `policies` - (Required) List of policies to assign to the group * `group_id` - (Required) Group ID to assign policies to. diff --git a/website/docs/r/identity_oidc.html.md b/website/docs/r/identity_oidc.html.md index 5f0d38043..57aa2eb4a 100644 --- a/website/docs/r/identity_oidc.html.md +++ b/website/docs/r/identity_oidc.html.md @@ -27,6 +27,11 @@ resource "vault_identity_oidc" "server" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `issuer` - (Optional) Issuer URL to be used in the iss claim of the token. If not set, Vault's `api_addr` will be used. The issuer is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components, but no query or fragment diff --git a/website/docs/r/identity_oidc_assignment.html.md b/website/docs/r/identity_oidc_assignment.html.md index 2d78c0ad0..b896581f8 100644 --- a/website/docs/r/identity_oidc_assignment.html.md +++ b/website/docs/r/identity_oidc_assignment.html.md @@ -40,6 +40,11 @@ resource "vault_identity_oidc_assignment" "default" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the assignment. * `entity_ids` - (Optional) A set of Vault entity IDs. diff --git a/website/docs/r/identity_oidc_client.html.md b/website/docs/r/identity_oidc_client.html.md index b887a7127..b7d804b34 100644 --- a/website/docs/r/identity_oidc_client.html.md +++ b/website/docs/r/identity_oidc_client.html.md @@ -40,6 +40,11 @@ resource "vault_identity_oidc_client" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the client. * `key` - (Optional) A reference to a named key resource in Vault. diff --git a/website/docs/r/identity_oidc_key.html.md b/website/docs/r/identity_oidc_key.html.md index 8ef89aad8..6aa09d716 100644 --- a/website/docs/r/identity_oidc_key.html.md +++ b/website/docs/r/identity_oidc_key.html.md @@ -49,6 +49,11 @@ resource "vault_identity_oidc_key_allowed_client_id" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required; Forces new resource) Name of the OIDC Key to create. * `rotation_period` - (Optional) How often to generate a new signing key in number of seconds diff --git a/website/docs/r/identity_oidc_key_allowed_client_id.html.md b/website/docs/r/identity_oidc_key_allowed_client_id.html.md index 0c5078dcb..2f6bd838a 100644 --- a/website/docs/r/identity_oidc_key_allowed_client_id.html.md +++ b/website/docs/r/identity_oidc_key_allowed_client_id.html.md @@ -48,6 +48,11 @@ resource "vault_identity_oidc_key_allowed_client_id" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `key_name` - (Required; Forces new resource) Name of the OIDC Key allow the Client ID. * `allowed_client_id` - (Required; Forces new resource) Client ID to allow usage with the OIDC named key diff --git a/website/docs/r/identity_oidc_provider.html.md b/website/docs/r/identity_oidc_provider.html.md index 3381f8da2..12649b8e1 100644 --- a/website/docs/r/identity_oidc_provider.html.md +++ b/website/docs/r/identity_oidc_provider.html.md @@ -69,6 +69,11 @@ resource "vault_identity_oidc_provider" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the provider. * `https_enabled` - (Optional) Set to true if the issuer endpoint uses HTTPS. diff --git a/website/docs/r/identity_oidc_role.html.md b/website/docs/r/identity_oidc_role.html.md index 8753249b5..cb76d8d3d 100644 --- a/website/docs/r/identity_oidc_role.html.md +++ b/website/docs/r/identity_oidc_role.html.md @@ -78,6 +78,11 @@ resource "vault_identity_oidc_key_allowed_client_id" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required; Forces new resource) Name of the OIDC Role to create. * `key` - (Required; Forces new resource) A configured named key, the key must already exist diff --git a/website/docs/r/identity_oidc_scope.html.md b/website/docs/r/identity_oidc_scope.html.md index b60f6602c..9183ee3ff 100644 --- a/website/docs/r/identity_oidc_scope.html.md +++ b/website/docs/r/identity_oidc_scope.html.md @@ -29,6 +29,11 @@ resource "vault_identity_oidc_scope" "groups" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the scope. The `openid` scope name is reserved. * `template` - (Optional) The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON. diff --git a/website/docs/r/jwt_auth_backend.html.md b/website/docs/r/jwt_auth_backend.html.md index f5b7ea729..2a07d4228 100644 --- a/website/docs/r/jwt_auth_backend.html.md +++ b/website/docs/r/jwt_auth_backend.html.md @@ -63,6 +63,11 @@ resource "vault_jwt_auth_backend" "gsuite" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to mount the JWT/OIDC auth backend * `type` - (Optional) Type of auth backend. Should be one of `jwt` or `oidc`. Default - `jwt` diff --git a/website/docs/r/jwt_auth_backend_role.html.md b/website/docs/r/jwt_auth_backend_role.html.md index f6d47ac10..02d8e1deb 100644 --- a/website/docs/r/jwt_auth_backend_role.html.md +++ b/website/docs/r/jwt_auth_backend_role.html.md @@ -58,6 +58,11 @@ resource "vault_jwt_auth_backend_role" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role_name` - (Required) The name of the role. * `role_type` - (Optional) Type of role, either "oidc" (default) or "jwt". diff --git a/website/docs/r/kmip_secret_backend.html.md b/website/docs/r/kmip_secret_backend.html.md index 602aaf0b9..bd4c5df21 100644 --- a/website/docs/r/kmip_secret_backend.html.md +++ b/website/docs/r/kmip_secret_backend.html.md @@ -31,6 +31,11 @@ resource "vault_kmip_secret_backend" "default" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The unique path this backend should be mounted at. Must not begin or end with a `/`. Defaults to `kmip`. diff --git a/website/docs/r/kmip_secret_role.html.md b/website/docs/r/kmip_secret_role.html.md index 31bc6e3e1..43f2dae20 100644 --- a/website/docs/r/kmip_secret_role.html.md +++ b/website/docs/r/kmip_secret_role.html.md @@ -44,6 +44,11 @@ resource "vault_kmip_secret_role" "admin" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The unique path this backend should be mounted at. Must not begin or end with a `/`. Defaults to `kmip`. diff --git a/website/docs/r/kmip_secret_scope.html.md b/website/docs/r/kmip_secret_scope.html.md index 95a400324..ad41e4783 100644 --- a/website/docs/r/kmip_secret_scope.html.md +++ b/website/docs/r/kmip_secret_scope.html.md @@ -31,6 +31,11 @@ resource "vault_kmip_secret_scope" "dev" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The unique path this backend should be mounted at. Must not begin or end with a `/`. Defaults to `kmip`. diff --git a/website/docs/r/kubernetes_auth_backend_config.md b/website/docs/r/kubernetes_auth_backend_config.md index fe0e952ef..f096c2564 100644 --- a/website/docs/r/kubernetes_auth_backend_config.md +++ b/website/docs/r/kubernetes_auth_backend_config.md @@ -33,6 +33,11 @@ resource "vault_kubernetes_auth_backend_config" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `kubernetes_host` - (Required) Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server. * `kubernetes_ca_cert` - (Optional) PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. diff --git a/website/docs/r/kubernetes_auth_backend_role.html.md b/website/docs/r/kubernetes_auth_backend_role.html.md index 4a9943542..242415106 100644 --- a/website/docs/r/kubernetes_auth_backend_role.html.md +++ b/website/docs/r/kubernetes_auth_backend_role.html.md @@ -34,6 +34,11 @@ resource "vault_kubernetes_auth_backend_role" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role_name` - (Required) Name of the role. * `bound_service_account_names` - (Required) List of service account names able to access this role. If set to `["*"]` all names are allowed, both this and bound_service_account_namespaces can not be "*". diff --git a/website/docs/r/ldap_auth_backend.html.md b/website/docs/r/ldap_auth_backend.html.md index 4d064ffdf..bc6ce4061 100644 --- a/website/docs/r/ldap_auth_backend.html.md +++ b/website/docs/r/ldap_auth_backend.html.md @@ -29,6 +29,11 @@ resource "vault_ldap_auth_backend" "ldap" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `url` - (Required) The URL of the LDAP server * `starttls` - (Optional) Control use of TLS when conecting to LDAP diff --git a/website/docs/r/ldap_auth_backend_group.html.md b/website/docs/r/ldap_auth_backend_group.html.md index 43f25f31e..d40be1dd9 100644 --- a/website/docs/r/ldap_auth_backend_group.html.md +++ b/website/docs/r/ldap_auth_backend_group.html.md @@ -35,6 +35,11 @@ resource "vault_ldap_auth_backend_group" "group" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `groupname` - (Required) The LDAP groupname * `policies` - (Optional) Policies which should be granted to members of the group diff --git a/website/docs/r/ldap_auth_backend_user.html.md b/website/docs/r/ldap_auth_backend_user.html.md index 1b49456f0..1a56bffc6 100644 --- a/website/docs/r/ldap_auth_backend_user.html.md +++ b/website/docs/r/ldap_auth_backend_user.html.md @@ -35,6 +35,11 @@ resource "vault_ldap_auth_backend_user" "user" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `username` - (Required) The LDAP username * `policies` - (Optional) Policies which should be granted to user diff --git a/website/docs/r/mfa_duo.html.md b/website/docs/r/mfa_duo.html.md index a9a645ed9..ec31c8d25 100644 --- a/website/docs/r/mfa_duo.html.md +++ b/website/docs/r/mfa_duo.html.md @@ -33,6 +33,11 @@ resource "vault_mfa_duo" "my_duo" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `name` `(string: )` – Name of the MFA method. - `mount_accessor` `(string: )` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping. diff --git a/website/docs/r/mfa_okta.html.md b/website/docs/r/mfa_okta.html.md index 125fd6625..7e078f4dd 100644 --- a/website/docs/r/mfa_okta.html.md +++ b/website/docs/r/mfa_okta.html.md @@ -33,6 +33,11 @@ resource "vault_mfa_okta" "my_okta" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `name` `(string: )` – Name of the MFA method. - `mount_accessor` `(string: )` - The mount to tie this method to for use in automatic mappings. diff --git a/website/docs/r/mfa_pingid.html.md b/website/docs/r/mfa_pingid.html.md index ad0aab66f..43709b1b0 100644 --- a/website/docs/r/mfa_pingid.html.md +++ b/website/docs/r/mfa_pingid.html.md @@ -34,6 +34,11 @@ resource "vault_mfa_pingid" "my_pingid" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `name` `(string: )` – Name of the MFA method. - `mount_accessor` `(string: )` - The mount to tie this method to for use in automatic mappings. diff --git a/website/docs/r/mfa_totp.html.md b/website/docs/r/mfa_totp.html.md index 3376ea734..aa02264bf 100644 --- a/website/docs/r/mfa_totp.html.md +++ b/website/docs/r/mfa_totp.html.md @@ -29,6 +29,11 @@ resource "vault_mfa_totp" "my_totp" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `name` `(string: )` – Name of the MFA method. - `issuer` `(string: )` - The name of the key's issuing organization. diff --git a/website/docs/r/mount.html.md b/website/docs/r/mount.html.md index f4c6c4e90..001d35b05 100644 --- a/website/docs/r/mount.html.md +++ b/website/docs/r/mount.html.md @@ -54,6 +54,11 @@ resource "vault_mount" "pki-example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Where the secret backend will be mounted * `type` - (Required) Type of the backend, such as "aws" diff --git a/website/docs/r/namespace.html.md b/website/docs/r/namespace.html.md index d7e0edff4..1b6fbcf53 100644 --- a/website/docs/r/namespace.html.md +++ b/website/docs/r/namespace.html.md @@ -24,6 +24,11 @@ resource "vault_namespace" "ns1" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The path of the namespace. Must not have a trailing `/` ## Attributes Reference diff --git a/website/docs/r/nomad_secret_backend.html.md b/website/docs/r/nomad_secret_backend.html.md index e04553e63..49058bc70 100644 --- a/website/docs/r/nomad_secret_backend.html.md +++ b/website/docs/r/nomad_secret_backend.html.md @@ -37,6 +37,11 @@ resource "vault_nomad_secret_backend" "config" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Optional) The unique path this backend should be mounted at. Must not begin or end with a `/`. Defaults to `nomad`. diff --git a/website/docs/r/nomad_secret_role.html.md b/website/docs/r/nomad_secret_role.html.md index e4e907a21..1e2ba1c37 100644 --- a/website/docs/r/nomad_secret_role.html.md +++ b/website/docs/r/nomad_secret_role.html.md @@ -42,6 +42,11 @@ resource "vault_nomad_secret_role" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Optional) The unique path this backend should be mounted at. Must not begin or end with a `/`. Defaults to `nomad`. diff --git a/website/docs/r/okta_auth_backend.html.md b/website/docs/r/okta_auth_backend.html.md index b62080146..ff531113c 100644 --- a/website/docs/r/okta_auth_backend.html.md +++ b/website/docs/r/okta_auth_backend.html.md @@ -35,6 +35,11 @@ resource "vault_okta_auth_backend" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to mount the Okta auth backend * `description` - (Optional) The description of the auth backend diff --git a/website/docs/r/okta_auth_backend_group.html.md b/website/docs/r/okta_auth_backend_group.html.md index 2b2876d06..4c1fa243f 100644 --- a/website/docs/r/okta_auth_backend_group.html.md +++ b/website/docs/r/okta_auth_backend_group.html.md @@ -30,6 +30,11 @@ resource "vault_okta_auth_backend_group" "foo" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The path where the Okta auth backend is mounted * `group_name` - (Required) Name of the group within the Okta diff --git a/website/docs/r/okta_auth_backend_user.html.md b/website/docs/r/okta_auth_backend_user.html.md index 8fb7774e4..159e9e431 100644 --- a/website/docs/r/okta_auth_backend_user.html.md +++ b/website/docs/r/okta_auth_backend_user.html.md @@ -30,6 +30,11 @@ resource "vault_okta_auth_backend_user" "foo" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) The path where the Okta auth backend is mounted * `username` - (Required Optional) Name of the user within Okta diff --git a/website/docs/r/password_policy.html.md b/website/docs/r/password_policy.html.md index c53052ff2..9bd20b848 100644 --- a/website/docs/r/password_policy.html.md +++ b/website/docs/r/password_policy.html.md @@ -31,6 +31,11 @@ resource "vault_password_policy" "alphanumeric" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the password policy. * `policy` - (Required) String containing a password policy. diff --git a/website/docs/r/pki_secret_backend_cert.html.md b/website/docs/r/pki_secret_backend_cert.html.md index 19aae73e0..8ef741b28 100755 --- a/website/docs/r/pki_secret_backend_cert.html.md +++ b/website/docs/r/pki_secret_backend_cert.html.md @@ -34,6 +34,11 @@ resource "vault_pki_secret_backend_cert" "app" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `name` - (Required) Name of the role to create the certificate against diff --git a/website/docs/r/pki_secret_backend_config_ca.html.md b/website/docs/r/pki_secret_backend_config_ca.html.md index 9c93a5bc9..2b31bba40 100644 --- a/website/docs/r/pki_secret_backend_config_ca.html.md +++ b/website/docs/r/pki_secret_backend_config_ca.html.md @@ -82,6 +82,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `pem_bundle` - (Required) The key and certificate PEM bundle diff --git a/website/docs/r/pki_secret_backend_config_urls.html.md b/website/docs/r/pki_secret_backend_config_urls.html.md index fc2de74a5..2e9d7cec7 100644 --- a/website/docs/r/pki_secret_backend_config_urls.html.md +++ b/website/docs/r/pki_secret_backend_config_urls.html.md @@ -33,6 +33,11 @@ resource "vault_pki_secret_backend_config_urls" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the PKI secret backend is mounted at, with no leading or trailing `/`s. * `issuing_certificates` - (Optional) Specifies the URL values for the Issuing Certificate field. diff --git a/website/docs/r/pki_secret_backend_crl_config.html.md b/website/docs/r/pki_secret_backend_crl_config.html.md index ae6c3f20d..2f855aff9 100644 --- a/website/docs/r/pki_secret_backend_crl_config.html.md +++ b/website/docs/r/pki_secret_backend_crl_config.html.md @@ -31,6 +31,11 @@ resource "vault_pki_secret_backend_crl_config" "crl_config" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the PKI secret backend is mounted at, with no leading or trailing `/`s. * `expiry` - (Optional) Specifies the time until expiration. diff --git a/website/docs/r/pki_secret_backend_intermediate_cert_request.html.md b/website/docs/r/pki_secret_backend_intermediate_cert_request.html.md index e9f968523..edb82a47c 100644 --- a/website/docs/r/pki_secret_backend_intermediate_cert_request.html.md +++ b/website/docs/r/pki_secret_backend_intermediate_cert_request.html.md @@ -32,6 +32,11 @@ resource "vault_pki_secret_backend_intermediate_cert_request" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `type` - (Required) Type of intermediate to create. Must be either \"exported\" or \"internal\" diff --git a/website/docs/r/pki_secret_backend_intermediate_set_signed.html.md b/website/docs/r/pki_secret_backend_intermediate_set_signed.html.md index 92a92b257..9d96dc1ca 100644 --- a/website/docs/r/pki_secret_backend_intermediate_set_signed.html.md +++ b/website/docs/r/pki_secret_backend_intermediate_set_signed.html.md @@ -82,6 +82,11 @@ resource "vault_pki_secret_backend_intermediate_set_signed" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `certificate` - (Required) Specifies the PEM encoded certificate. May optionally append additional diff --git a/website/docs/r/pki_secret_backend_role.html.md b/website/docs/r/pki_secret_backend_role.html.md index 8bce50462..abc209f38 100644 --- a/website/docs/r/pki_secret_backend_role.html.md +++ b/website/docs/r/pki_secret_backend_role.html.md @@ -36,6 +36,11 @@ resource "vault_pki_secret_backend_role" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the PKI secret backend is mounted at, with no leading or trailing `/`s. * `name` - (Required) The name to identify this role within the backend. Must be unique within the backend. diff --git a/website/docs/r/pki_secret_backend_root_cert.html.md b/website/docs/r/pki_secret_backend_root_cert.html.md index a56ea0b2c..fb882b15f 100644 --- a/website/docs/r/pki_secret_backend_root_cert.html.md +++ b/website/docs/r/pki_secret_backend_root_cert.html.md @@ -40,6 +40,11 @@ resource "vault_pki_secret_backend_root_cert" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `type` - (Required) Type of intermediate to create. Must be either \"exported\" or \"internal\" diff --git a/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md b/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md index 639677139..0156c3241 100644 --- a/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md +++ b/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md @@ -28,6 +28,11 @@ resource "vault_pki_secret_backend_root_sign_intermediate" "root" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `csr` - (Required) The CSR diff --git a/website/docs/r/pki_secret_backend_sign.html.md b/website/docs/r/pki_secret_backend_sign.html.md index 3b14d25c8..aeda97b89 100644 --- a/website/docs/r/pki_secret_backend_sign.html.md +++ b/website/docs/r/pki_secret_backend_sign.html.md @@ -61,6 +61,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The PKI secret backend the resource belongs to. * `name` - (Required) Name of the role to create the certificate against diff --git a/website/docs/r/policy.html.md b/website/docs/r/policy.html.md index 1130449bb..3f54d4618 100644 --- a/website/docs/r/policy.html.md +++ b/website/docs/r/policy.html.md @@ -27,6 +27,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the policy * `policy` - (Required) String containing a Vault policy diff --git a/website/docs/r/quota_lease_count.md b/website/docs/r/quota_lease_count.md index 64321f0d3..e1c837cce 100644 --- a/website/docs/r/quota_lease_count.md +++ b/website/docs/r/quota_lease_count.md @@ -31,6 +31,11 @@ resource "vault_quota_lease_count" "global" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Name of the rate limit quota * `path` - (Optional) Path of the mount or namespace to apply the quota. A blank path configures a diff --git a/website/docs/r/quota_rate_limit.md b/website/docs/r/quota_rate_limit.md index 83f21d55c..41bb42784 100644 --- a/website/docs/r/quota_rate_limit.md +++ b/website/docs/r/quota_rate_limit.md @@ -29,6 +29,11 @@ resource "vault_quota_rate_limit" "global" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Name of the rate limit quota * `path` - (Optional) Path of the mount or namespace to apply the quota. A blank path configures a diff --git a/website/docs/r/rabbitmq_secret_backend.html.md b/website/docs/r/rabbitmq_secret_backend.html.md index 265ed3133..919b7ba99 100644 --- a/website/docs/r/rabbitmq_secret_backend.html.md +++ b/website/docs/r/rabbitmq_secret_backend.html.md @@ -32,6 +32,11 @@ resource "vault_rabbitmq_secret_backend" "rabbitmq" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `connection_uri` - (Required) Specifies the RabbitMQ connection URI. * `username` - (Required) Specifies the RabbitMQ management administrator username. diff --git a/website/docs/r/rabbitmq_secret_backend_role.html.md b/website/docs/r/rabbitmq_secret_backend_role.html.md index a332ad867..4b9a2549d 100644 --- a/website/docs/r/rabbitmq_secret_backend_role.html.md +++ b/website/docs/r/rabbitmq_secret_backend_role.html.md @@ -56,6 +56,11 @@ resource "vault_rabbitmq_secret_backend_role" "role" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the RabbitMQ secret backend is mounted at, with no leading or trailing `/`s. diff --git a/website/docs/r/raft_autopilot.html.md b/website/docs/r/raft_autopilot.html.md index 3f89663f0..72be3f242 100644 --- a/website/docs/r/raft_autopilot.html.md +++ b/website/docs/r/raft_autopilot.html.md @@ -30,6 +30,11 @@ resource "vault_raft_autopilot" "autopilot" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `cleanup_dead_servers` – (Optional) Specifies whether to remove dead server nodes periodically or when a new server joins. This requires that `min-quorum` is also set. diff --git a/website/docs/r/raft_snapshot_agent_config.html.md b/website/docs/r/raft_snapshot_agent_config.html.md index 2df8b3ff5..d298e8f15 100644 --- a/website/docs/r/raft_snapshot_agent_config.html.md +++ b/website/docs/r/raft_snapshot_agent_config.html.md @@ -64,6 +64,11 @@ resource "vault_raft_snapshot_agent_config" "s3_backups" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + - `name` `` – Name of the configuration to modify. - `interval_seconds` `` - Time (in seconds) between snapshots. diff --git a/website/docs/r/rgp_policy.html.md b/website/docs/r/rgp_policy.html.md index 3bd054c80..a03ee1e5b 100644 --- a/website/docs/r/rgp_policy.html.md +++ b/website/docs/r/rgp_policy.html.md @@ -31,6 +31,11 @@ EOT The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) The name of the policy * `enforcement_level` - (Required) Enforcement level of Sentinel policy. Can be either `advisory` or `soft-mandatory` or `hard-mandatory` diff --git a/website/docs/r/ssh_secret_backend_ca.html.md b/website/docs/r/ssh_secret_backend_ca.html.md index 1a8d7e8f1..53b8329e5 100644 --- a/website/docs/r/ssh_secret_backend_ca.html.md +++ b/website/docs/r/ssh_secret_backend_ca.html.md @@ -27,6 +27,11 @@ resource "vault_ssh_secret_backend_ca" "foo" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Optional) The path where the SSH secret backend is mounted. Defaults to 'ssh' * `generate_signing_key` - (Optional) Whether Vault should generate the signing key pair internally. Defaults to true diff --git a/website/docs/r/ssh_secret_backend_role.html.md b/website/docs/r/ssh_secret_backend_role.html.md index 38edba461..5d0cb0ec3 100644 --- a/website/docs/r/ssh_secret_backend_role.html.md +++ b/website/docs/r/ssh_secret_backend_role.html.md @@ -39,6 +39,11 @@ resource "vault_ssh_secret_backend_role" "bar" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `name` - (Required) Specifies the name of the role to create. * `backend` - (Required) The path where the SSH secret backend is mounted. diff --git a/website/docs/r/terraform_cloud_secret_backend.md b/website/docs/r/terraform_cloud_secret_backend.md index d0f24007e..88b5b726e 100644 --- a/website/docs/r/terraform_cloud_secret_backend.md +++ b/website/docs/r/terraform_cloud_secret_backend.md @@ -33,6 +33,11 @@ resource "vault_terraform_cloud_secret_backend" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `token` - (Required) The Terraform Cloud management token this backend should use to issue new tokens. diff --git a/website/docs/r/terraform_cloud_secret_creds.html.md b/website/docs/r/terraform_cloud_secret_creds.html.md index 4d413d297..ae13d581e 100644 --- a/website/docs/r/terraform_cloud_secret_creds.html.md +++ b/website/docs/r/terraform_cloud_secret_creds.html.md @@ -45,6 +45,11 @@ resource "vault_terraform_cloud_secret_creds" "token" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path to the Terraform Cloud secret backend to read credentials from, with no leading or trailing `/`s. diff --git a/website/docs/r/terraform_cloud_secret_role.html.md b/website/docs/r/terraform_cloud_secret_role.html.md index 9b842c854..9de7dde04 100644 --- a/website/docs/r/terraform_cloud_secret_role.html.md +++ b/website/docs/r/terraform_cloud_secret_role.html.md @@ -32,6 +32,11 @@ resource "vault_terraform_cloud_secret_role" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Optional) The unique name of an existing Terraform Cloud secrets backend mount. Must not begin or end with a `/`. * `name` - (Required) The name of the Terraform Cloud secrets engine role to create. diff --git a/website/docs/r/token.html.md b/website/docs/r/token.html.md index 06ce034a9..f2dbfd150 100644 --- a/website/docs/r/token.html.md +++ b/website/docs/r/token.html.md @@ -45,6 +45,11 @@ resource "vault_token" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role_name` - (Optional) The token role name * `policies` - (Optional) List of policies to attach to this token diff --git a/website/docs/r/token_auth_backend_role.html.md b/website/docs/r/token_auth_backend_role.html.md index 5b963712d..4d018168c 100644 --- a/website/docs/r/token_auth_backend_role.html.md +++ b/website/docs/r/token_auth_backend_role.html.md @@ -32,6 +32,11 @@ resource "vault_token_auth_backend_role" "example" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `role_name` - (Required) The name of the role. * `allowed_policies` (Optional) List of allowed policies for given role. diff --git a/website/docs/r/transform_alphabet.html.md b/website/docs/r/transform_alphabet.html.md index 962f57654..ca9334de6 100644 --- a/website/docs/r/transform_alphabet.html.md +++ b/website/docs/r/transform_alphabet.html.md @@ -31,6 +31,11 @@ resource "vault_transform_alphabet" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to where the back-end is mounted within Vault. * `alphabet` - (Optional) A string of characters that contains the alphabet set. * `name` - (Required) The name of the alphabet. diff --git a/website/docs/r/transform_role.html.md b/website/docs/r/transform_role.html.md index 11d075b83..3c8c75e39 100644 --- a/website/docs/r/transform_role.html.md +++ b/website/docs/r/transform_role.html.md @@ -31,6 +31,11 @@ resource "vault_transform_role" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to where the back-end is mounted within Vault. * `name` - (Required) The name of the role. * `transformations` - (Optional) A comma separated string or slice of transformations to use. diff --git a/website/docs/r/transform_template.html.md b/website/docs/r/transform_template.html.md index fdf644959..4d94be1a1 100644 --- a/website/docs/r/transform_template.html.md +++ b/website/docs/r/transform_template.html.md @@ -54,6 +54,11 @@ resource "vault_transform_template" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to where the back-end is mounted within Vault. * `alphabet` - (Optional) The alphabet to use for this template. This is only used during FPE transformations. * `name` - (Required) The name of the template. diff --git a/website/docs/r/transform_transformation.html.md b/website/docs/r/transform_transformation.html.md index 3a6a75750..a9979578c 100644 --- a/website/docs/r/transform_transformation.html.md +++ b/website/docs/r/transform_transformation.html.md @@ -34,6 +34,11 @@ resource "vault_transform_transformation" "test" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `path` - (Required) Path to where the back-end is mounted within Vault. * `allowed_roles` - (Optional) The set of roles allowed to perform this transformation. * `masking_character` - (Optional) The character used to replace data when in masking mode diff --git a/website/docs/r/transit_secret_backend_cache_config.html.md b/website/docs/r/transit_secret_backend_cache_config.html.md index 3f62c443b..206404b08 100644 --- a/website/docs/r/transit_secret_backend_cache_config.html.md +++ b/website/docs/r/transit_secret_backend_cache_config.html.md @@ -31,6 +31,11 @@ resource "vault_transit_secret_cache_config" "cfg" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the transit secret backend is mounted at, with no leading or trailing `/`s. * `size` - (Required) The number of cache entries. 0 means unlimited. diff --git a/website/docs/r/transit_secret_backend_key.html.md b/website/docs/r/transit_secret_backend_key.html.md index 38dd3e5bc..c0024a5ec 100644 --- a/website/docs/r/transit_secret_backend_key.html.md +++ b/website/docs/r/transit_secret_backend_key.html.md @@ -31,6 +31,11 @@ resource "vault_transit_secret_backend_key" "key" { The following arguments are supported: +* `namespace` - (Optional) The namespace to provision the resource in. + The value should not contain leading or trailing forward slashes. + The `namespace` is always relative to the provider's configured [namespace](../index.html#namespace). + *Available only for Vault Enterprise*. + * `backend` - (Required) The path the transit secret backend is mounted at, with no leading or trailing `/`s. * `name` - (Required) The name to identify this key within the backend. Must be unique within the backend.