Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

azurerm_ip_group - support for firewall_ids, firewall_policy_ids #19845

Merged
merged 8 commits into from
Jan 17, 2023
Merged

azurerm_ip_group - support for firewall_ids, firewall_policy_ids #19845

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b2d86a6
fix: ip groups linked to az firewall must be updated sequentially
sponte Jan 3, 2023
dd289ed
Exclude vendor from git
sponte Jan 3, 2023
c7ff2a4
Address automated review comments
sponte Jan 3, 2023
0b5dfe6
Use API resources instead of terraform state in the delete function
sponte Jan 3, 2023
cdea17c
Re-add incorrectly removed `vendor`
sponte Jan 3, 2023
8744a34
Updating the docs
sponte Jan 5, 2023
7254410
Update the type of the exported properties
sponte Jan 10, 2023
e53df81
Fix the type of the firewall_ids
sponte Jan 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions internal/services/firewall/firewall_application_rule_collection_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,8 +147,8 @@ func resourceFirewallApplicationRuleCollectionCreateUpdate(d *pluginsdk.Resource
return fmt.Errorf("expanding Firewall Application Rules: %+v", err)
}

locks.ByName(firewallName, azureFirewallResourceName)
defer locks.UnlockByName(firewallName, azureFirewallResourceName)
locks.ByName(firewallName, AzureFirewallResourceName)
defer locks.UnlockByName(firewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, resourceGroup, firewallName)
if err != nil {
Expand Down Expand Up @@ -324,8 +324,8 @@ func resourceFirewallApplicationRuleCollectionDelete(d *pluginsdk.ResourceData,
return err
}

locks.ByName(id.AzureFirewallName, azureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, azureFirewallResourceName)
locks.ByName(id.AzureFirewallName, AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, id.ResourceGroup, id.AzureFirewallName)
if err != nil {
Expand Down
8 changes: 4 additions & 4 deletions internal/services/firewall/firewall_nat_rule_collection_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,8 +140,8 @@ func resourceFirewallNatRuleCollectionCreateUpdate(d *pluginsdk.ResourceData, me
firewallName := d.Get("azure_firewall_name").(string)
resourceGroup := d.Get("resource_group_name").(string)

locks.ByName(firewallName, azureFirewallResourceName)
defer locks.UnlockByName(firewallName, azureFirewallResourceName)
locks.ByName(firewallName, AzureFirewallResourceName)
defer locks.UnlockByName(firewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, resourceGroup, firewallName)
if err != nil {
Expand Down Expand Up @@ -322,8 +322,8 @@ func resourceFirewallNatRuleCollectionDelete(d *pluginsdk.ResourceData, meta int
return err
}

locks.ByName(id.AzureFirewallName, azureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, azureFirewallResourceName)
locks.ByName(id.AzureFirewallName, AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, id.ResourceGroup, id.AzureFirewallName)
if err != nil {
Expand Down
8 changes: 4 additions & 4 deletions internal/services/firewall/firewall_network_rule_collection_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,8 +142,8 @@ func resourceFirewallNetworkRuleCollectionCreateUpdate(d *pluginsdk.ResourceData
firewallName := d.Get("azure_firewall_name").(string)
resourceGroup := d.Get("resource_group_name").(string)

locks.ByName(firewallName, azureFirewallResourceName)
defer locks.UnlockByName(firewallName, azureFirewallResourceName)
locks.ByName(firewallName, AzureFirewallResourceName)
defer locks.UnlockByName(firewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, resourceGroup, firewallName)
if err != nil {
Expand Down Expand Up @@ -325,8 +325,8 @@ func resourceFirewallNetworkRuleCollectionDelete(d *pluginsdk.ResourceData, meta
return err
}

locks.ByName(id.AzureFirewallName, azureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, azureFirewallResourceName)
locks.ByName(id.AzureFirewallName, AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, AzureFirewallResourceName)

firewall, err := client.Get(ctx, id.ResourceGroup, id.AzureFirewallName)
if err != nil {
Expand Down
10 changes: 5 additions & 5 deletions internal/services/firewall/firewall_policy_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ import (
"github.com/tombuildsstuff/kermit/sdk/network/2022-05-01/network"
)

const azureFirewallPolicyResourceName = "azurerm_firewall_policy"
const AzureFirewallPolicyResourceName = "azurerm_firewall_policy"

func resourceFirewallPolicy() *pluginsdk.Resource {
return &pluginsdk.Resource{
Expand Down Expand Up @@ -121,8 +121,8 @@ func resourceFirewallPolicyCreateUpdate(d *pluginsdk.ResourceData, meta interfac
}
}

locks.ByName(id.Name, azureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, azureFirewallPolicyResourceName)
locks.ByName(id.Name, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, AzureFirewallPolicyResourceName)

future, err := client.CreateOrUpdate(ctx, id.ResourceGroup, id.Name, props)
if err != nil {
Expand Down Expand Up @@ -254,8 +254,8 @@ func resourceFirewallPolicyDelete(d *pluginsdk.ResourceData, meta interface{}) e
return err
}

locks.ByName(id.Name, azureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, azureFirewallPolicyResourceName)
locks.ByName(id.Name, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, AzureFirewallPolicyResourceName)

future, err := client.Delete(ctx, id.ResourceGroup, id.Name)
if err != nil {
Expand Down
8 changes: 4 additions & 4 deletions internal/services/firewall/firewall_policy_rule_collection_group_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,8 +442,8 @@ func resourceFirewallPolicyRuleCollectionGroupCreateUpdate(d *pluginsdk.Resource
}
}

locks.ByName(policyId.Name, azureFirewallPolicyResourceName)
defer locks.UnlockByName(policyId.Name, azureFirewallPolicyResourceName)
locks.ByName(policyId.Name, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(policyId.Name, AzureFirewallPolicyResourceName)

param := network.FirewallPolicyRuleCollectionGroup{
FirewallPolicyRuleCollectionGroupProperties: &network.FirewallPolicyRuleCollectionGroupProperties{
Expand Down Expand Up @@ -540,8 +540,8 @@ func resourceFirewallPolicyRuleCollectionGroupDelete(d *pluginsdk.ResourceData,
return err
}

locks.ByName(id.FirewallPolicyName, azureFirewallPolicyResourceName)
defer locks.UnlockByName(id.FirewallPolicyName, azureFirewallPolicyResourceName)
locks.ByName(id.FirewallPolicyName, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.FirewallPolicyName, AzureFirewallPolicyResourceName)

future, err := client.Delete(ctx, id.ResourceGroup, id.FirewallPolicyName, id.RuleCollectionGroupName)
if err != nil {
Expand Down
22 changes: 17 additions & 5 deletions internal/services/firewall/firewall_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ import (
"github.com/tombuildsstuff/kermit/sdk/network/2022-05-01/network"
)

var azureFirewallResourceName = "azurerm_firewall"
var AzureFirewallResourceName = "azurerm_firewall"

func resourceFirewall() *pluginsdk.Resource {
resource := pluginsdk.Resource{
Expand Down Expand Up @@ -327,8 +327,14 @@ func resourceFirewallCreateUpdate(d *pluginsdk.ResourceData, meta interface{}) e
}
}

locks.ByName(id.AzureFirewallName, azureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, azureFirewallResourceName)
if policyId, ok := d.GetOk("firewall_policy_id"); ok {
id, _ := parse.FirewallPolicyID(policyId.(string))
locks.ByName(id.Name, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, AzureFirewallPolicyResourceName)
}

locks.ByName(id.AzureFirewallName, AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, AzureFirewallResourceName)

locks.MultipleByName(vnetToLock, VirtualNetworkResourceName)
defer locks.UnlockMultipleByName(vnetToLock, VirtualNetworkResourceName)
Expand Down Expand Up @@ -497,8 +503,14 @@ func resourceFirewallDelete(d *pluginsdk.ResourceData, meta interface{}) error {
}
}

locks.ByName(id.AzureFirewallName, azureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, azureFirewallResourceName)
if read.FirewallPolicy != nil && read.FirewallPolicy.ID != nil {
id, _ := parse.FirewallPolicyID(*read.FirewallPolicy.ID)
locks.ByName(id.Name, AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, AzureFirewallPolicyResourceName)
}

locks.ByName(id.AzureFirewallName, AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, AzureFirewallResourceName)

locks.MultipleByName(&virtualNetworkNamesToLock, VirtualNetworkResourceName)
defer locks.UnlockMultipleByName(&virtualNetworkNamesToLock, VirtualNetworkResourceName)
Expand Down
75 changes: 75 additions & 0 deletions internal/services/network/ip_group_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,16 @@ package network

import (
"fmt"
"log"
"time"

"github.com/hashicorp/go-azure-helpers/resourcemanager/commonschema"
"github.com/hashicorp/terraform-provider-azurerm/helpers/azure"
"github.com/hashicorp/terraform-provider-azurerm/helpers/tf"
"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
"github.com/hashicorp/terraform-provider-azurerm/internal/locks"
"github.com/hashicorp/terraform-provider-azurerm/internal/services/firewall"
firewallParse "github.com/hashicorp/terraform-provider-azurerm/internal/services/firewall/parse"
"github.com/hashicorp/terraform-provider-azurerm/internal/services/network/parse"
"github.com/hashicorp/terraform-provider-azurerm/internal/tags"
"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
Expand Down Expand Up @@ -47,6 +51,22 @@ func resourceIpGroup() *pluginsdk.Resource {

"resource_group_name": commonschema.ResourceGroupName(),

"firewall_ids": {
Type: pluginsdk.TypeSet,
sponte marked this conversation as resolved.
Show resolved Hide resolved
Computed: true,
Elem: &pluginsdk.Schema{
Type: pluginsdk.TypeString,
},
},

"firewall_policy_ids": {
sponte marked this conversation as resolved.
Show resolved Hide resolved
Type: pluginsdk.TypeSet,
sponte marked this conversation as resolved.
Show resolved Hide resolved
Computed: true,
Elem: &pluginsdk.Schema{
Type: pluginsdk.TypeString,
},
},

"cidrs": {
Type: pluginsdk.TypeSet,
Optional: true,
Expand All @@ -68,6 +88,18 @@ func resourceIpGroupCreateUpdate(d *pluginsdk.ResourceData, meta interface{}) er
ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d)
defer cancel()

for _, fw := range d.Get("firewall_ids").(*pluginsdk.Set).List() {
id, _ := firewallParse.FirewallID(fw.(string))
locks.ByName(id.AzureFirewallName, firewall.AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, firewall.AzureFirewallResourceName)
}

for _, fwpol := range d.Get("firewall_policy_ids").(*pluginsdk.Set).List() {
id, _ := firewallParse.FirewallPolicyID(fwpol.(string))
locks.ByName(id.Name, firewall.AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, firewall.AzureFirewallPolicyResourceName)
}

id := parse.NewIpGroupID(subscriptionId, d.Get("resource_group_name").(string), d.Get("name").(string))

if d.IsNewResource() {
Expand Down Expand Up @@ -144,9 +176,29 @@ func resourceIpGroupRead(d *pluginsdk.ResourceData, meta interface{}) error {
}
}

d.Set("firewall_ids", getIds(resp.Firewalls))
d.Set("firewall_policy_ids", getIds(resp.FirewallPolicies))

return tags.FlattenAndSet(d, resp.Tags)
}

func getIds(subResource *[]network.SubResource) []string {
if subResource == nil {
return nil
}

ids := make([]string, 0)
for _, v := range *subResource {
if v.ID == nil {
continue
}

ids = append(ids, *v.ID)
}

return ids
}

func resourceIpGroupDelete(d *pluginsdk.ResourceData, meta interface{}) error {
client := meta.(*clients.Client).Network.IPGroupsClient
ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d)
Expand All @@ -157,6 +209,29 @@ func resourceIpGroupDelete(d *pluginsdk.ResourceData, meta interface{}) error {
return err
}

read, err := client.Get(ctx, id.ResourceGroup, id.Name, "")
if err != nil {
if utils.ResponseWasNotFound(read.Response) {
// deleted outside of TF
log.Printf("[DEBUG] IP Group %q was not found in Resource Group %q - assuming removed!", id.Name, id.ResourceGroup)
return nil
}

return fmt.Errorf("retrieving ip group %s : %+v", *id, err)
}

for _, fw := range *read.Firewalls {
id, _ := firewallParse.FirewallID(*fw.ID)
locks.ByName(id.AzureFirewallName, firewall.AzureFirewallResourceName)
defer locks.UnlockByName(id.AzureFirewallName, firewall.AzureFirewallResourceName)
}

for _, fwpol := range *read.FirewallPolicies {
id, _ := firewallParse.FirewallPolicyID(*fwpol.ID)
locks.ByName(id.Name, firewall.AzureFirewallPolicyResourceName)
defer locks.UnlockByName(id.Name, firewall.AzureFirewallPolicyResourceName)
}

future, err := client.Delete(ctx, id.ResourceGroup, id.Name)
if err != nil {
return fmt.Errorf("deleting IP Group %q (Resource Group %q): %+v", id.Name, id.ResourceGroup, err)
Expand Down
Loading