Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Disables preview mode for EAR private endpoint so it may be normally accessible #2571

Merged
merged 29 commits into from
Sep 10, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
03c49fd
update sdk dev (#2490)
maastha Aug 12, 2024
8892a15
chore: Creates TF models & interfaces for new `mongodbatlas_encryptio…
maastha Aug 13, 2024
19059e4
chore: Creates TF models & interfaces for new `mongodbatlas_encryptio…
maastha Aug 13, 2024
d28c740
Merge branch 'master' into CLOUDP-246459-ear-kms-dev
maastha Aug 14, 2024
4dc933a
feat: Updates `mongodbatlas_encryption_at_rest` resource to use new `…
maastha Aug 19, 2024
8226718
chore: Creates TF models & interfaces for `mongodbatlas_encryption_at…
maastha Aug 19, 2024
33e18d2
feat: Implements `mongodbatlas_encryption_at_rest_private_endpoint` r…
AgustinBettati Aug 27, 2024
aaabcff
feat: Implements `mongodbatlas_encryption_at_rest_private_endpoint` s…
AgustinBettati Aug 27, 2024
c22c80e
doc: Updates existing documentation for `mongodbatlas_encryption_at_r…
maastha Aug 28, 2024
c839d75
doc: Include example for new `mongodbatlas_encryption_at_rest_private…
AgustinBettati Aug 30, 2024
9305dd0
feat: Implements new `mongodbatlas_encryption_at_rest_private_endpoin…
AgustinBettati Sep 2, 2024
9275394
feat: Implements new `mongodbatlas_encryption_at_rest` singular data …
maastha Sep 2, 2024
8d3324a
fix: Adds error message handling to `mongodbatlas_encryption_at_rest_…
maastha Sep 3, 2024
3d92da0
doc: Adds documentation for new `encryption_at_rest_private_endpoint`…
AgustinBettati Sep 3, 2024
4a20878
chore: Adopt latest changes from master into ear private endpoint dev…
AgustinBettati Sep 4, 2024
e99d7d5
doc: Adds documentation & examples for `mongodbatlas_encryption_at_re…
maastha Sep 4, 2024
2eb7cdb
chore: Enables `mongodbatlas_encryption_at_rest` (Azure) tests to run…
maastha Sep 5, 2024
ba95eed
chore: Adds `mongodbatlas_encryption_at_rest_private_endpoint` accept…
maastha Sep 6, 2024
eab27cf
doc: Add user journey considerations in current resource and example …
AgustinBettati Sep 6, 2024
8bbb12a
Merge branch 'master' into CLOUDP-246459-ear-kms-dev
maastha Sep 9, 2024
75d5807
update project_ip_addresses action
maastha Sep 9, 2024
e1b801f
address doc comment
maastha Sep 9, 2024
a1c21d2
update test, provider & docs
maastha Sep 9, 2024
79838fc
update example
maastha Sep 9, 2024
179c019
update docs
maastha Sep 9, 2024
138a6c9
address PR comments
maastha Sep 9, 2024
db5a243
Merge branch 'master' into CLOUDP-272475-disable-ear-pe-preview
maastha Sep 9, 2024
380c497
Merge branch 'master' into CLOUDP-272475-disable-ear-pe-preview
maastha Sep 10, 2024
acbce73
minor
maastha Sep 10, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/data-sources/encryption_at_rest_private_endpoint.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`mongodbatlas_encryption_at_rest_private_endpoint` describes a private endpoint used for encryption at rest using customer-managed keys.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this data source. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

## Example Usages

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`mongodbatlas_encryption_at_rest_private_endpoints` describes private endpoints of a particular cloud provider used for encryption at rest using customer-managed keys.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this data source. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

## Example Usages

Expand Down
2 changes: 1 addition & 1 deletion docs/resources/encryption_at_rest_private_endpoint.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`mongodbatlas_encryption_at_rest_private_endpoint` provides a resource for managing a private endpoint used for encryption at rest with customer-managed keys. This ensures all traffic between Atlas and customer key management systems take place over private network interfaces.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this resource. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

-> **NOTE:** As a prerequisite to configuring a private endpoint for Azure Key Vault, the corresponding [`mongodbatlas_encryption_at_rest`](encryption_at_rest) resource has to be adjust by configuring [`azure_key_vault_config.require_private_networking`](encryption_at_rest#require_private_networking) to true. This attribute should be updated in place, ensuring the customer-managed keys encryption is never disabled.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,7 @@ This example shows how to configure encryption at rest using Azure with customer

The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.

**2\. Enable `MONGODB_ATLAS_ENABLE_PREVIEW` flag.**

This step is needed to make use of the `mongodbatlas_encryption_at_rest_private_endpoint` resource.

```
export MONGODB_ATLAS_ENABLE_PREVIEW="true"
```

**3\. Provide the appropriate values for the input variables.**
**2\. Provide the appropriate values for the input variables.**

- `atlas_public_key`: The public API key for MongoDB Atlas
- `atlas_private_key`: The private API key for MongoDB Atlas
Expand All @@ -41,7 +33,7 @@ export MONGODB_ATLAS_ENABLE_PREVIEW="true"
- GET (Key Management Operation), ENCRYPT (Cryptographic Operation) and DECRYPT (Cryptographic Operation) policy permissions.
- A `Key Vault Reader` role.

**4\. Review the Terraform plan.**
**3\. Review the Terraform plan.**

Execute the following command and ensure you are happy with the plan.

Expand All @@ -55,15 +47,15 @@ This project will execute the following changes to acheive a successful Azure Pr
- Approve the connection from the Azure Key Vault. This is being done through terraform with the `azapi_update_resource` resource. Alternatively, the private connection can be approved through the Azure UI or CLI.
- CLI example command: `az keyvault private-endpoint-connection approve --approval-description {"OPTIONAL DESCRIPTION"} --resource-group {RG} --vault-name {KEY VAULT NAME} –name {PRIVATE LINK CONNECTION NAME}`

**3\. Execute the Terraform apply.**
**4\. Execute the Terraform apply.**

Now execute the plan to provision the resources.

``` bash
$ terraform apply
```

**4\. Destroy the resources.**
**5\. Destroy the resources.**

When you have finished your testing, ensure you destroy the resources to avoid unnecessary Atlas charges.

Expand Down
7 changes: 3 additions & 4 deletions internal/provider/provider.go
Original file line number Diff line number Diff line change
Expand Up @@ -440,11 +440,10 @@ func (p *MongodbtlasProvider) DataSources(context.Context) []func() datasource.D
streamprocessor.DataSource,
streamprocessor.PluralDataSource,
encryptionatrest.DataSource,
}
previewDataSources := []func() datasource.DataSource{ // Data sources not yet in GA
encryptionatrestprivateendpoint.DataSource,
encryptionatrestprivateendpoint.PluralDataSource,
}
previewDataSources := []func() datasource.DataSource{} // Data sources not yet in GA

if providerEnablePreview {
dataSources = append(dataSources, previewDataSources...)
Expand All @@ -464,10 +463,10 @@ func (p *MongodbtlasProvider) Resources(context.Context) []func() resource.Resou
streaminstance.Resource,
streamconnection.Resource,
streamprocessor.Resource,
}
previewResources := []func() resource.Resource{ // Resources not yet in GA
encryptionatrestprivateendpoint.Resource,
}
previewResources := []func() resource.Resource{} // Resources not yet in GA

if providerEnablePreview {
resources = append(resources, previewResources...)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ func basicTestCase(tb testing.TB) *resource.TestCase {
)

return &resource.TestCase{
PreCheck: func() { acc.PreCheckBasic(tb); acc.PreCheckEncryptionAtRestEnvAzure(tb); acc.PreCheckPreviewFlag(tb) },
PreCheck: func() { acc.PreCheckBasic(tb); acc.PreCheckEncryptionAtRestEnvAzure(tb) },
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
CheckDestroy: checkDestroy,
Steps: []resource.TestStep{
Expand Down Expand Up @@ -95,7 +95,7 @@ func TestAccEncryptionAtRestPrivateEndpoint_approveEndpointWithAzureProvider(t *
)

resource.Test(t, resource.TestCase{
PreCheck: func() { acc.PreCheckBasic(t); acc.PreCheckEncryptionAtRestEnvAzure(t); acc.PreCheckPreviewFlag(t) },
PreCheck: func() { acc.PreCheckBasic(t); acc.PreCheckEncryptionAtRestEnvAzure(t) },
ExternalProviders: acc.ExternalProvidersOnlyAzapi(),
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
CheckDestroy: checkDestroy,
Expand Down Expand Up @@ -137,7 +137,7 @@ func TestAccEncryptionAtRestPrivateEndpoint_transitionPublicToPrivateNetwork(t *
)

resource.Test(t, resource.TestCase{
PreCheck: func() { acc.PreCheckBasic(t); acc.PreCheckEncryptionAtRestEnvAzure(t); acc.PreCheckPreviewFlag(t) },
PreCheck: func() { acc.PreCheckBasic(t); acc.PreCheckEncryptionAtRestEnvAzure(t) },
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
CheckDestroy: checkDestroy,
Steps: []resource.TestStep{
Expand All @@ -160,7 +160,7 @@ func TestAccEncryptionAtRestPrivateEndpoint_transitionPublicToPrivateNetwork(t *
})
}

func TestAccEncryptionAtRest_azure_requirePrivateNetworking_preview(t *testing.T) {
func TestAccEncryptionAtRest_azure_requirePrivateNetworking(t *testing.T) {
var (
projectID = os.Getenv("MONGODB_ATLAS_PROJECT_EAR_PE_ID")

Expand Down Expand Up @@ -199,7 +199,6 @@ func TestAccEncryptionAtRest_azure_requirePrivateNetworking_preview(t *testing.T
PreCheck: func() {
acc.PreCheckEncryptionAtRestPrivateEndpoint(t)
acc.PreCheckEncryptionAtRestEnvAzureWithUpdate(t)
acc.PreCheckPreviewFlag(t)
},
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
CheckDestroy: acc.EARDestroy,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`{{.Name}}` describes a private endpoint used for encryption at rest using customer-managed keys.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this data source. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

## Example Usages

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`{{.Name}}` describes private endpoints of a particular cloud provider used for encryption at rest using customer-managed keys.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this data source. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

## Example Usages

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
`{{.Name}}` provides a resource for managing a private endpoint used for encryption at rest with customer-managed keys. This ensures all traffic between Atlas and customer key management systems take place over private network interfaces.

~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
Additionally, you'll need to set the environment variable `MONGODB_ATLAS_ENABLE_PREVIEW=true` to use this resource. To learn more about existing limitations, see the [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).

-> **NOTE:** As a prerequisite to configuring a private endpoint for Azure Key Vault, the corresponding [`mongodbatlas_encryption_at_rest`](encryption_at_rest) resource has to be adjust by configuring [`azure_key_vault_config.require_private_networking`](encryption_at_rest#require_private_networking) to true. This attribute should be updated in place, ensuring the customer-managed keys encryption is never disabled.

Expand Down