Skip to content

Commit 79e5518

Browse files
author
bbhupesh
authored
feat:Service | added local policies (#279)
* SLK-88212:Updated service changes with local policies schema and example
1 parent a96ea55 commit 79e5518

File tree

8 files changed

+654
-200
lines changed

8 files changed

+654
-200
lines changed

‎aquasec/data_service.go‎

Lines changed: 122 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,84 @@ func dataSourceService() *schema.Resource {
9595
Type: schema.TypeString,
9696
},
9797
Description: "The service's policies; an array of container firewall policy names.",
98-
Computed: true,
98+
Required: true,
99+
},
100+
"local_policies": {
101+
Type: schema.TypeList,
102+
Description: "A list of local policies for the service, including inbound and outbound network rules.",
103+
Optional: true,
104+
Elem: &schema.Resource{
105+
Schema: map[string]*schema.Schema{
106+
"name": {
107+
Type: schema.TypeString,
108+
Description: "The name of the local policy.",
109+
Required: true,
110+
},
111+
"type": {
112+
Type: schema.TypeString,
113+
Description: "The type of the local policy, e.g., access.control.",
114+
Required: true,
115+
},
116+
"description": {
117+
Type: schema.TypeString,
118+
Description: "A description of the local policy.",
119+
Optional: true,
120+
},
121+
"inbound_networks": {
122+
Type: schema.TypeList,
123+
Description: "Inbound network rules for the local policy.",
124+
Optional: true,
125+
Elem: &schema.Resource{
126+
Schema: map[string]*schema.Schema{
127+
"port_range": {
128+
Type: schema.TypeString,
129+
Description: "The port range for the inbound network rule.",
130+
Required: true,
131+
},
132+
"resource_type": {
133+
Type: schema.TypeString,
134+
Description: "The resource type for the inbound network rule (e.g., anywhere).",
135+
Required: true,
136+
},
137+
"allow": {
138+
Type: schema.TypeBool,
139+
Description: "Whether the inbound network rule is allowed.",
140+
Required: true,
141+
},
142+
},
143+
},
144+
},
145+
"outbound_networks": {
146+
Type: schema.TypeList,
147+
Description: "Outbound network rules for the local policy.",
148+
Optional: true,
149+
Elem: &schema.Resource{
150+
Schema: map[string]*schema.Schema{
151+
"port_range": {
152+
Type: schema.TypeString,
153+
Description: "The port range for the outbound network rule.",
154+
Required: true,
155+
},
156+
"resource_type": {
157+
Type: schema.TypeString,
158+
Description: "The resource type for the outbound network rule (e.g., anywhere).",
159+
Required: true,
160+
},
161+
"allow": {
162+
Type: schema.TypeBool,
163+
Description: "Whether the outbound network rule is allowed.",
164+
Required: true,
165+
},
166+
},
167+
},
168+
},
169+
"block_metadata_service": {
170+
Type: schema.TypeBool,
171+
Description: "Whether to block access to the metadata service.",
172+
Optional: true,
173+
},
174+
},
175+
},
99176
},
100177
"evaluated": {
101178
Type: schema.TypeBool,
@@ -196,11 +273,54 @@ func dataServiceRead(ctx context.Context, d *schema.ResourceData, m interface{})
196273
d.Set("unregistered_count", service.UnregisteredCount)
197274
d.Set("is_registered", service.IsRegistered)
198275
d.Set("application_scopes", service.ApplicationScopes)
199-
276+
if err := d.Set("local_policies", flattenLocalPolicies(service.LocalPolicies)); err != nil {
277+
return diag.FromErr(err)
278+
}
200279
d.SetId(name)
201280
} else {
202281
return diag.FromErr(err)
203282
}
204283

205284
return nil
206285
}
286+
func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{} {
287+
if policies == nil {
288+
return []map[string]interface{}{}
289+
}
290+
291+
var result []map[string]interface{}
292+
for _, policy := range policies {
293+
p := map[string]interface{}{
294+
"name": policy.Name,
295+
"type": policy.Type,
296+
"description": policy.Description,
297+
"block_metadata_service": policy.BlockMetadataService,
298+
}
299+
300+
// Flatten inbound_networks
301+
var inboundNetworks []map[string]interface{}
302+
for _, inbound := range policy.InboundNetworks {
303+
inboundNetworks = append(inboundNetworks, map[string]interface{}{
304+
"port_range": inbound.PortRange,
305+
"resource_type": inbound.ResourceType,
306+
"allow": inbound.Allow,
307+
})
308+
}
309+
p["inbound_networks"] = inboundNetworks
310+
311+
// Flatten outbound_networks
312+
var outboundNetworks []map[string]interface{}
313+
for _, outbound := range policy.OutboundNetworks {
314+
outboundNetworks = append(outboundNetworks, map[string]interface{}{
315+
"port_range": outbound.PortRange,
316+
"resource_type": outbound.ResourceType,
317+
"allow": outbound.Allow,
318+
})
319+
}
320+
p["outbound_networks"] = outboundNetworks
321+
322+
result = append(result, p)
323+
}
324+
325+
return result
326+
}

‎aquasec/data_service_test.go‎

Lines changed: 38 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func TestDataSourceServiceBasic(t *testing.T) {
2626
resource.TestCheckResourceAttr(rootRef, "policies.#", fmt.Sprintf("%d", len(basicService.Policies))),
2727
resource.TestCheckResourceAttr(rootRef, "policies.0", basicService.Policies[0]),
2828
resource.TestCheckResourceAttr(rootRef, "enforce", "false"),
29-
resource.TestCheckResourceAttr(rootRef, "application_scopes.#", fmt.Sprintf("%v", len(basicService.ApplicationScopes))),
29+
resource.TestCheckResourceAttr(rootRef, "application_scopes.#", fmt.Sprintf("%d", len(basicService.ApplicationScopes))),
3030
resource.TestCheckResourceAttr(rootRef, "application_scopes.0", basicService.ApplicationScopes[0]),
3131
resource.TestCheckResourceAttr(rootRef, "priority", "100"),
3232
resource.TestCheckResourceAttr(rootRef, "target", basicService.MembershipRules.Target),
@@ -38,12 +38,23 @@ func TestDataSourceServiceBasic(t *testing.T) {
3838
resource.TestCheckResourceAttrSet(rootRef, "lastupdate"),
3939
resource.TestCheckResourceAttrSet(rootRef, "evaluated"),
4040
resource.TestCheckResourceAttrSet(rootRef, "is_registered"),
41+
42+
// Assert no local policies
43+
resource.TestCheckResourceAttr(rootRef, "local_policies.#", "0"),
4144
),
4245
},
4346
},
4447
})
4548
}
4649

50+
func getBasicServiceData() string {
51+
return getBasicServiceResource() + `
52+
data "aquasec_service" "test-svc" {
53+
name = aquasec_service.test-basic-svc.id
54+
policies = aquasec_service.test-basic-svc.policies
55+
}
56+
`
57+
}
4758
func TestDataSourceServiceComplex(t *testing.T) {
4859
t.Parallel()
4960
rootRef := "data.aquasec_service.test-svc"
@@ -56,24 +67,32 @@ func TestDataSourceServiceComplex(t *testing.T) {
5667
{
5768
Config: getComplexServiceData(),
5869
Check: resource.ComposeAggregateTestCheckFunc(
59-
resource.TestCheckResourceAttr(rootRef, "name", complexService.Name),
60-
resource.TestCheckResourceAttr(rootRef, "description", complexService.Description),
70+
resource.TestCheckResourceAttr(rootRef, "name", "test-complex-svc"),
71+
resource.TestCheckResourceAttr(rootRef, "description", "Test complex service"),
6172
resource.TestCheckResourceAttr(rootRef, "monitoring", "false"),
62-
resource.TestCheckResourceAttr(rootRef, "policies.#", fmt.Sprintf("%d", len(complexService.Policies))),
63-
resource.TestCheckResourceAttr(rootRef, "policies.0", complexService.Policies[0]),
64-
resource.TestCheckResourceAttr(rootRef, "enforce", fmt.Sprintf("%v", complexService.Enforce)),
65-
resource.TestCheckResourceAttr(rootRef, "application_scopes.#", fmt.Sprintf("%d", len(complexService.ApplicationScopes))),
66-
resource.TestCheckResourceAttr(rootRef, "application_scopes.0", complexService.ApplicationScopes[0]),
67-
resource.TestCheckResourceAttr(rootRef, "priority", fmt.Sprintf("%d", complexService.MembershipRules.Priority)),
68-
resource.TestCheckResourceAttr(rootRef, "target", complexService.MembershipRules.Target),
69-
resource.TestCheckResourceAttr(rootRef, "scope_expression", complexService.MembershipRules.Scope.Expression),
70-
resource.TestCheckResourceAttr(rootRef, "scope_variables.#", fmt.Sprintf("%v", len(complexService.MembershipRules.Scope.Variables))),
71-
resource.TestCheckResourceAttr(rootRef, "scope_variables.0.attribute", complexService.MembershipRules.Scope.Variables[0].Attribute),
72-
resource.TestCheckResourceAttr(rootRef, "scope_variables.0.value", complexService.MembershipRules.Scope.Variables[0].Value),
73-
resource.TestCheckResourceAttr(rootRef, "scope_variables.1.attribute", complexService.MembershipRules.Scope.Variables[1].Attribute),
74-
resource.TestCheckResourceAttr(rootRef, "scope_variables.1.value", complexService.MembershipRules.Scope.Variables[1].Value),
75-
resource.TestCheckResourceAttr(rootRef, "scope_variables.2.attribute", complexService.MembershipRules.Scope.Variables[2].Attribute),
76-
resource.TestCheckResourceAttr(rootRef, "scope_variables.2.value", complexService.MembershipRules.Scope.Variables[2].Value),
73+
resource.TestCheckResourceAttr(rootRef, "policies.#", "2"),
74+
resource.TestCheckResourceAttr(rootRef, "policies.0", "local-policy-1"),
75+
resource.TestCheckResourceAttr(rootRef, "policies.1", "default"),
76+
resource.TestCheckResourceAttr(rootRef, "local_policies.#", "1"),
77+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.name", "local-policy-1"),
78+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.type", "access.control"),
79+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.description", "Local policy for testing"),
80+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.block_metadata_service", "true"),
81+
82+
// Inbound Networks
83+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.#", "1"),
84+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.port_range", "22-80"),
85+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource_type", "anywhere"),
86+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.allow", "true"),
87+
88+
// Outbound Networks
89+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.#", "1"),
90+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.port_range", "443"),
91+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource_type", "anywhere"),
92+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.allow", "false"),
93+
94+
resource.TestCheckResourceAttr(rootRef, "priority", "1"),
95+
resource.TestCheckResourceAttr(rootRef, "target", "container"),
7796
resource.TestCheckResourceAttr(rootRef, "author", os.Getenv("AQUA_USER")),
7897
resource.TestCheckResourceAttrSet(rootRef, "containers_count"),
7998
resource.TestCheckResourceAttrSet(rootRef, "lastupdate"),
@@ -85,20 +104,11 @@ func TestDataSourceServiceComplex(t *testing.T) {
85104
})
86105
}
87106

88-
func getBasicServiceData() string {
89-
return getBasicServiceResource() + fmt.Sprintf(`
90-
91-
data "aquasec_service" "test-svc" {
92-
name = aquasec_service.test-basic-svc.id
93-
}
94-
`)
95-
}
96-
97107
func getComplexServiceData() string {
98108
return getComplexServiceResource() + fmt.Sprintf(`
99-
100109
data "aquasec_service" "test-svc" {
101110
name = aquasec_service.test-complex-svc.id
111+
policies = aquasec_service.test-complex-svc.policies
102112
}
103113
`)
104114
}

0 commit comments

Comments
 (0)