Allow IP CIDR Range or Any as Source and/or Destination Policy Groups

[akgiesler]

Adds a new validator specific to source and destination policy groups.
NSX-T can accept an IP, Range, CIDR, or a Group Path as a source
and/or destination group through the security policy interface.

Updates the getSecurityPolicyAndGatewayRulesSchema function to use the
new validator.

Resolves: Issue #584

[annakhm]

Thank you @akgiesler! This looks great, but a documentation update is also needed, as well as acc tests. If you can add those it will be great, otherwise we'll follow up with those on top of your change.

[akgiesler]

Sure thing @annakhm , we are working on those now.

[akgiesler]

Hi @annakhm,
I have updated the PR to include tests for Security Policy and Gateway Policy as they share the same function to get & validate their schema. I have also updated the docs for both to reference the availability of IP, CIDR, or IP ranges.

During our build-out of the tests, it was discovered that the provider already supports using "ANY" as a source or destination in security policy. The way to do this was to map the source_groups or destination_groups to an empty set.

for example:

  rule {
    display_name       = "rule1"
    source_groups      = [ nsxt_policy_group.group1.path ]
    destination_groups = [ ]
    action             = "ALLOW"
    services           = [data.nsxt_policy_service.icmp.path]
  }

This was tested in NSX-T 3.1 using NSX-T Provider v3.1.0. I added this feature into the Security policy documentation. I did not add this feature to the gateway policy documentation as I was unable to test it. I was able to test this feature in a Gateway policy and it also worked fine. I have updated the gateway policy docs as well.

[annakhm]

I would suggest to use a single function to test both Create and Update use cases (just pass different values in params), and also I think one test should be enough to cover both source and dest use cases. While our goal is to have good test coverage, we also try to keep CI running time reasonable :)

[akgiesler]

I went ahead and collapsed the tests into a single test for both security policy and gateway policy. I also reduced the terraform generating functions down to single functions as you requested.

[annakhm]

It should be helpful specifying here that IP/ranges/cidrs are only supported starting NSX 3.0.

[akgiesler]

Hi @annakhm, I have updated all of the documentation as requested.

[annakhm]

Thanks for those changes @akgiesler! You are correct, "ANY" is equivalent to empty set. I've ran your tests on gateway policy and they pass fine. I noticed that docs for gateway policy are updated in your change.
I've left couple of small comments above, another nit would be to also update documentation in resource_nsxt_policy_predefined_security_policy and resource_nsxt_policy_predefined_gateway_policy.

[annakhm]

Thank you @akgiesler, merging this!