Skip to content

Commit d91302f

Browse files
vinay-gopalanvinay-gopalan
authored
Add field set_namespace_from_token to Provider configuration (hashicorp#2070)
1 parent f7c9bdf commit d91302f

File tree

6 files changed

+74
-14
lines changed

6 files changed

+74
-14
lines changed

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ FEATURES:
44
* Add support for configuring SAML Auth resources ([#2053](https://github.com/hashicorp/terraform-provider-vault/pull/2053))
55
* Add support for `custom_metadata` on `vault_namespace`: ([#2033](https://github.com/hashicorp/terraform-provider-vault/pull/2033))
66
* Add support for `OCSP*` role fields for the cert auth resource: ([#2056](https://github.com/hashicorp/terraform-provider-vault/pull/2056))
7+
* Add field `set_namespace_from_token` to Provider configuration ([#2070](https://github.com/hashicorp/terraform-provider-vault/pull/2070))
78

89
BUGS:
910
* Fix panic when reading `client_secret` from a public oidc client ([#2048](https://github.com/hashicorp/terraform-provider-vault/pull/2048))

‎internal/consts/consts.go

+1
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,7 @@ const (
363363
FieldServiceAccountJWT = "service_account_jwt"
364364
FieldDisableISSValidation = "disable_iss_validation"
365365
FieldPEMKeys = "pem_keys"
366+
FieldSetNamespaceFromToken = "set_namespace_from_token"
366367
/*
367368
common environment variables
368369
*/

‎internal/provider/meta.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -314,8 +314,10 @@ func NewProviderMeta(d *schema.ResourceData) (interface{}, error) {
314314
namespace = tokenNamespace
315315
// set the namespace on the provider to ensure that all child
316316
// namespace paths are properly honoured.
317-
if err := d.Set(consts.FieldNamespace, namespace); err != nil {
318-
return nil, err
317+
if v, ok := d.Get(consts.FieldSetNamespaceFromToken).(bool); ok && v {
318+
if err := d.Set(consts.FieldNamespace, namespace); err != nil {
319+
return nil, err
320+
}
319321
}
320322
}
321323

‎internal/provider/meta_test.go

+56-12
Original file line numberDiff line numberDiff line change
@@ -553,13 +553,15 @@ func TestNewProviderMeta(t *testing.T) {
553553
}
554554

555555
tests := []struct {
556-
name string
557-
d *schema.ResourceData
558-
data map[string]interface{}
559-
wantNamespace string
560-
tokenNamespace string
561-
authLoginNamespace string
562-
wantErr bool
556+
name string
557+
d *schema.ResourceData
558+
data map[string]interface{}
559+
wantNamespace string
560+
tokenNamespace string
561+
authLoginNamespace string
562+
wantErr bool
563+
checkSetSetTokenNamespace bool
564+
wantNamespaceFromToken string
563565
}{
564566
{
565567
name: "invalid-nil-ResourceData",
@@ -627,22 +629,60 @@ func TestNewProviderMeta(t *testing.T) {
627629
name: "with-provider-ns-and-auth-login-with-ns",
628630
d: pr.TestResourceData(),
629631
data: map[string]interface{}{
630-
consts.FieldNamespace: nsPrefix + "prov-ns-auth-ns",
632+
consts.FieldNamespace: nsPrefix + "prov-ns-prov-ns",
631633
consts.FieldSkipGetVaultVersion: true,
632634
consts.FieldSkipChildToken: true,
633635
consts.FieldAuthLoginUserpass: []map[string]interface{}{
634636
{
635-
consts.FieldNamespace: nsPrefix + "auth-ns-prov-ns",
637+
consts.FieldNamespace: nsPrefix + "auth-ns-auth-ns",
636638
consts.FieldMount: consts.MountTypeUserpass,
637639
consts.FieldUsername: defaultUser,
638640
consts.FieldPassword: defaultPassword,
639641
},
640642
},
641643
},
642-
authLoginNamespace: nsPrefix + "auth-ns-prov-ns",
643-
wantNamespace: nsPrefix + "prov-ns-auth-ns",
644+
authLoginNamespace: nsPrefix + "auth-ns-auth-ns",
645+
wantNamespace: nsPrefix + "prov-ns-prov-ns",
644646
wantErr: false,
645647
},
648+
{
649+
// expect token based namespace to be ignored.
650+
name: "set-namespace-from-token-false",
651+
d: pr.TestResourceData(),
652+
data: map[string]interface{}{
653+
consts.FieldSkipGetVaultVersion: true,
654+
consts.FieldSetNamespaceFromToken: false,
655+
consts.FieldSkipChildToken: true,
656+
},
657+
tokenNamespace: nsPrefix + "set-ns-from-token-auth-false-ignored",
658+
wantNamespace: nsPrefix + "set-ns-from-token-auth-false-ignored",
659+
checkSetSetTokenNamespace: true,
660+
wantNamespaceFromToken: "",
661+
wantErr: false,
662+
},
663+
{
664+
// expect token based namespace to be ignored.
665+
name: "set-namespace-from-token-true",
666+
d: pr.TestResourceData(),
667+
data: map[string]interface{}{
668+
consts.FieldSkipGetVaultVersion: true,
669+
consts.FieldSetNamespaceFromToken: true,
670+
consts.FieldSkipChildToken: true,
671+
consts.FieldAuthLoginUserpass: []map[string]interface{}{
672+
{
673+
consts.FieldNamespace: nsPrefix + "set-ns-from-token-auth-true",
674+
consts.FieldMount: consts.MountTypeUserpass,
675+
consts.FieldUsername: defaultUser,
676+
consts.FieldPassword: defaultPassword,
677+
},
678+
},
679+
},
680+
authLoginNamespace: nsPrefix + "set-ns-from-token-auth-true",
681+
wantNamespace: nsPrefix + "set-ns-from-token-auth-true",
682+
checkSetSetTokenNamespace: true,
683+
wantNamespaceFromToken: nsPrefix + "set-ns-from-token-auth-true",
684+
wantErr: false,
685+
},
646686
}
647687

648688
createNamespace := func(t *testing.T, client *api.Client, ns string) {
@@ -748,7 +788,11 @@ func TestNewProviderMeta(t *testing.T) {
748788
}
749789

750790
if !reflect.DeepEqual(p.client.Namespace(), tt.wantNamespace) {
751-
t.Errorf("NewProviderMeta() got ns = %v, want ns %v", p.client.Namespace(), tt.wantNamespace)
791+
t.Errorf("NewProviderMeta() got ns = %q, want ns %q", p.client.Namespace(), tt.wantNamespace)
792+
}
793+
794+
if tt.checkSetSetTokenNamespace && tt.wantNamespaceFromToken != tt.d.Get(consts.FieldNamespace).(string) {
795+
t.Errorf("NewProviderMeta() got ns = %q, want ns %q", tt.d.Get(consts.FieldNamespace).(string), tt.wantNamespaceFromToken)
752796
}
753797

754798
if client.Token() == "" {

‎internal/provider/provider.go

+8
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,14 @@ func NewProvider(
175175
DefaultFunc: schema.EnvDefaultFunc("VAULT_NAMESPACE", ""),
176176
Description: "The namespace to use. Available only for Vault Enterprise.",
177177
},
178+
consts.FieldSetNamespaceFromToken: {
179+
Type: schema.TypeBool,
180+
Optional: true,
181+
Default: true,
182+
Description: "In the case where the Vault token is for a specific namespace " +
183+
"and the provider namespace is not configured, use the token namespace " +
184+
"as the root namespace for all resources.",
185+
},
178186
"headers": {
179187
Type: schema.TypeList,
180188
Optional: true,

‎website/docs/index.html.markdown

+4
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,10 @@ variables in order to keep credential information out of the configuration.
214214

215215
* `use_root_namespace` - (Optional) Authenticate to the root Vault namespace. Conflicts with `namespace`.
216216

217+
* `set_namespace_from_token` -(Optional) Defaults to `true`. In the case where the Vault token is
218+
for a specific namespace and the provider namespace is not configured, use the token namespace
219+
as the root namespace for all resources.
220+
217221
* `skip_get_vault_version` - (Optional) Skip the dynamic fetching of the Vault server version.
218222
Set to `true` when the */sys/seal-status* API endpoint is not available. See [vault_version_override](#vault_version_override)
219223
for related info

0 commit comments

Comments
 (0)