Skip to content

Commit 4b75d66

Browse files
Mark Mudimbasrinioci
Mark Mudimba
authored and
srinioci
committed
Added - Support for OIDC Discovery in OKE
1 parent d26dcc4 commit 4b75d66

File tree

5 files changed

+339
-10
lines changed

5 files changed

+339
-10
lines changed

‎examples/container_engine/oidc_discovery/main.tf‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
// Copyright (c) 2017, 2024, Oracle and/or its affiliates. All rights reserved.
2+
// Licensed under the Mozilla Public License v2.0
3+
4+
variable "tenancy_ocid" {
5+
}
6+
7+
variable "user_ocid" {
8+
}
9+
10+
variable "compartment_ocid" {
11+
}
12+
13+
variable "region" {
14+
default = "us-ashburn-1"
15+
}
16+
17+
variable "kms_vault_id" {
18+
}
19+
20+
variable "compartment_id" {
21+
}
22+
23+
variable "cluster_cluster_pod_network_options_cni_type" {
24+
default = "OCI_VCN_IP_NATIVE"
25+
}
26+
27+
variable "cluster_defined_tags_value" {
28+
default = "value"
29+
}
30+
31+
variable "cluster_endpoint_config_is_public_ip_enabled" {
32+
default = false
33+
}
34+
35+
variable "cluster_endpoint_config_nsg_ids" {
36+
default = []
37+
}
38+
39+
variable "cluster_freeform_tags" {
40+
default = { "Department" = "Finance" }
41+
}
42+
43+
variable "cluster_image_policy_config_is_policy_enabled" {
44+
default = false
45+
}
46+
47+
variable "cluster_kubernetes_version" {
48+
default = "v1.30.1"
49+
}
50+
51+
variable "cluster_name" {
52+
default = "oidc-discovery-example"
53+
}
54+
55+
variable "cluster_options_add_ons_is_kubernetes_dashboard_enabled" {
56+
default = false
57+
}
58+
59+
variable "cluster_options_add_ons_is_tiller_enabled" {
60+
default = false
61+
}
62+
63+
variable "cluster_options_admission_controller_options_is_pod_security_policy_enabled" {
64+
default = false
65+
}
66+
67+
variable "cluster_options_open_id_connect_discovery_is_open_id_connect_discovery_enabled" {
68+
default = false
69+
}
70+
71+
variable "cluster_options_kubernetes_network_config_pods_cidr" {
72+
default = "10.1.0.0/16"
73+
}
74+
75+
variable "cluster_options_kubernetes_network_config_services_cidr" {
76+
default = "10.2.0.0/16"
77+
}
78+
79+
variable "cluster_options_persistent_volume_config_defined_tags_value" {
80+
default = "value"
81+
}
82+
83+
variable "cluster_options_persistent_volume_config_freeform_tags" {
84+
default = { "Department" = "Finance" }
85+
}
86+
87+
variable "cluster_options_service_lb_config_defined_tags_value" {
88+
default = "value"
89+
}
90+
91+
variable "cluster_options_service_lb_config_freeform_tags" {
92+
default = { "Department" = "Finance" }
93+
}
94+
95+
variable "cluster_options_service_lb_subnet_ids" {
96+
default = []
97+
}
98+
99+
variable "cluster_state" {
100+
default = []
101+
}
102+
103+
// enhanced cluster is required for OIDC Discovery to be enabled
104+
variable "cluster_type" {
105+
default = "ENHANCED_CLUSTER"
106+
}
107+
108+
109+
110+
provider "oci" {
111+
region = var.region
112+
auth = "SecurityToken"
113+
config_file_profile = "terraform-federation-test"
114+
}
115+
116+
variable defined_tag_namespace_name {
117+
default = "test"
118+
}
119+
120+
resource "oci_core_vcn" "test_vcn" {
121+
cidr_block = "10.0.0.0/16"
122+
compartment_id = var.compartment_ocid
123+
display_name = "tfVcnForClusters"
124+
}
125+
126+
resource "oci_core_internet_gateway" "test_ig" {
127+
compartment_id = var.compartment_ocid
128+
display_name = "tfClusterInternetGateway"
129+
vcn_id = oci_core_vcn.test_vcn.id
130+
}
131+
132+
resource "oci_identity_tag_namespace" "tag-namespace1" {
133+
#Required
134+
compartment_id = var.tenancy_ocid
135+
description = "example tag namespace"
136+
name = var.defined_tag_namespace_name != "" ? var.defined_tag_namespace_name : "example-tag-namespace-all"
137+
138+
is_retired = false
139+
}
140+
141+
resource "oci_core_route_table" "test_route_table" {
142+
compartment_id = var.compartment_ocid
143+
vcn_id = oci_core_vcn.test_vcn.id
144+
display_name = "tfClustersRouteTable"
145+
146+
route_rules {
147+
destination = "0.0.0.0/0"
148+
destination_type = "CIDR_BLOCK"
149+
network_entity_id = oci_core_internet_gateway.test_ig.id
150+
}
151+
}
152+
153+
data "oci_identity_availability_domains" "test_availability_domains" {
154+
compartment_id = var.tenancy_ocid
155+
}
156+
157+
data "oci_identity_availability_domain" "ad1" {
158+
compartment_id = var.tenancy_ocid
159+
ad_number = 1
160+
}
161+
162+
data "oci_identity_availability_domain" "ad2" {
163+
compartment_id = var.tenancy_ocid
164+
ad_number = 2
165+
}
166+
167+
resource "oci_core_subnet" "clusterSubnet_2" {
168+
#Required
169+
availability_domain = data.oci_identity_availability_domain.ad2.name
170+
cidr_block = "10.0.21.0/24"
171+
compartment_id = var.compartment_ocid
172+
vcn_id = oci_core_vcn.test_vcn.id
173+
display_name = "tfSubNet1ForClusters"
174+
175+
176+
# Provider code tries to maintain compatibility with old versions.
177+
security_list_ids = [oci_core_vcn.test_vcn.default_security_list_id]
178+
route_table_id = oci_core_route_table.test_route_table.id
179+
}
180+
181+
resource "oci_containerengine_cluster" "test_cluster" {
182+
#Required
183+
compartment_id = var.compartment_ocid
184+
kubernetes_version = var.cluster_kubernetes_version
185+
name = "tfTestCluster"
186+
vcn_id = oci_core_vcn.test_vcn.id
187+
type = var.cluster_type
188+
189+
#Optional
190+
# defined_tags = map(oci_identity_tag_namespace.tag-namespace1.name.oci_identity_tag.tag1.name, var.cluster_defined_tags_value)
191+
192+
freeform_tags = var.cluster_freeform_tags
193+
194+
options {
195+
196+
#Optional
197+
add_ons {
198+
199+
#Optional
200+
is_kubernetes_dashboard_enabled = var.cluster_options_add_ons_is_kubernetes_dashboard_enabled
201+
is_tiller_enabled = var.cluster_options_add_ons_is_tiller_enabled
202+
}
203+
admission_controller_options {
204+
205+
#Optional
206+
is_pod_security_policy_enabled = var.cluster_options_admission_controller_options_is_pod_security_policy_enabled
207+
}
208+
kubernetes_network_config {
209+
210+
#Optional
211+
pods_cidr = var.cluster_options_kubernetes_network_config_pods_cidr
212+
services_cidr = var.cluster_options_kubernetes_network_config_services_cidr
213+
}
214+
215+
open_id_connect_discovery {
216+
#Optional
217+
is_open_id_connect_discovery_enabled = var.cluster_options_open_id_connect_discovery_is_open_id_connect_discovery_enabled
218+
}
219+
}
220+
}
221+
222+
data "oci_containerengine_clusters" "test_clusters" {
223+
#Required
224+
compartment_id = var.compartment_id
225+
226+
#Optional
227+
name = var.cluster_name
228+
state = var.cluster_state
229+
}

‎internal/integrationtest/containerengine_cluster_test.go‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ var (
6363
"kubernetes_version": acctest.Representation{RepType: acctest.Required, Create: `${data.oci_containerengine_cluster_option.test_cluster_option.kubernetes_versions[length(data.oci_containerengine_cluster_option.test_cluster_option.kubernetes_versions)-2]}`, Update: `${data.oci_containerengine_cluster_option.test_cluster_option.kubernetes_versions[length(data.oci_containerengine_cluster_option.test_cluster_option.kubernetes_versions)-1]}`},
6464
"name": acctest.Representation{RepType: acctest.Required, Create: `name`, Update: `name2`},
6565
"vcn_id": acctest.Representation{RepType: acctest.Required, Create: `${oci_core_vcn.test_vcn.id}`},
66-
"cluster_pod_network_options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: clusterClusterPodNetworkOptionsRepresentation},
66+
"cluster_pod_network_options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterClusterPodNetworkOptionsRepresentation},
6767
"defined_tags": acctest.Representation{RepType: acctest.Optional, Create: `${map("${oci_identity_tag_namespace.tag-namespace1.name}.${oci_identity_tag.tag1.name}", "value")}`, Update: `${map("${oci_identity_tag_namespace.tag-namespace1.name}.${oci_identity_tag.tag1.name}", "updatedValue")}`},
6868
"endpoint_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterEndpointConfigRepresentation},
6969
"freeform_tags": acctest.Representation{RepType: acctest.Optional, Create: map[string]string{"Department": "Finance"}, Update: map[string]string{"Department": "Accounting"}},
@@ -72,7 +72,7 @@ var (
7272
"type": acctest.Representation{RepType: acctest.Optional, Create: `ENHANCED_CLUSTER`, Update: `ENHANCED_CLUSTER`},
7373
"options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsRepresentation},
7474
}
75-
clusterClusterPodNetworkOptionsRepresentation = map[string]interface{}{
75+
ContainerengineClusterClusterPodNetworkOptionsRepresentation = map[string]interface{}{
7676
"cni_type": acctest.Representation{RepType: acctest.Required, Create: `OCI_VCN_IP_NATIVE`},
7777
}
7878
ContainerengineClusterEndpointConfigRepresentation = map[string]interface{}{
@@ -84,9 +84,11 @@ var (
8484
"key_details": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterImagePolicyConfigKeyDetailsRepresentation},
8585
}
8686
ContainerengineClusterOptionsRepresentation = map[string]interface{}{
87-
"add_ons": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsAddOnsRepresentation},
88-
"kubernetes_network_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsKubernetesNetworkConfigRepresentation},
87+
"add_ons": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsAddOnsRepresentation},
88+
"admission_controller_options": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsAdmissionControllerOptionsRepresentation},
89+
"kubernetes_network_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsKubernetesNetworkConfigRepresentation},
8990
"open_id_connect_token_authentication_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsOpenIdConnectTokenAuthenticationConfigRepresentation},
91+
"open_id_connect_discovery": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsOpenIdConnectDiscoveryRepresentation},
9092
"persistent_volume_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsPersistentVolumeConfigRepresentation},
9193
"service_lb_config": acctest.RepresentationGroup{RepType: acctest.Optional, Group: ContainerengineClusterOptionsServiceLbConfigRepresentation},
9294
"service_lb_subnet_ids": acctest.Representation{RepType: acctest.Optional, Create: []string{`${oci_core_subnet.clusterSubnet_1.id}`, `${oci_core_subnet.clusterSubnet_2.id}`}},
@@ -98,6 +100,9 @@ var (
98100
"is_kubernetes_dashboard_enabled": acctest.Representation{RepType: acctest.Optional, Create: `true`},
99101
"is_tiller_enabled": acctest.Representation{RepType: acctest.Optional, Create: `true`},
100102
}
103+
ContainerengineClusterOptionsAdmissionControllerOptionsRepresentation = map[string]interface{}{
104+
"is_pod_security_policy_enabled": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `false`},
105+
}
101106
ContainerengineClusterOptionsKubernetesNetworkConfigRepresentation = map[string]interface{}{
102107
"pods_cidr": acctest.Representation{RepType: acctest.Optional, Create: `10.1.0.0/16`},
103108
"services_cidr": acctest.Representation{RepType: acctest.Optional, Create: `10.2.0.0/16`},
@@ -114,6 +119,9 @@ var (
114119
"username_claim": acctest.Representation{RepType: acctest.Optional, Create: `sub`},
115120
"username_prefix": acctest.Representation{RepType: acctest.Optional, Create: `oidc:`},
116121
}
122+
ContainerengineClusterOptionsOpenIdConnectDiscoveryRepresentation = map[string]interface{}{
123+
"is_open_id_connect_discovery_enabled": acctest.Representation{RepType: acctest.Optional, Create: `false`, Update: `true`},
124+
}
117125
ContainerengineClusterOptionsPersistentVolumeConfigRepresentation = map[string]interface{}{
118126
"defined_tags": acctest.Representation{RepType: acctest.Optional, Create: `${map("${oci_identity_tag_namespace.tag-namespace1.name}.${oci_identity_tag.tag1.name}", "value")}`, Update: `${map("${oci_identity_tag_namespace.tag-namespace1.name}.${oci_identity_tag.tag1.name}", "updatedValue")}`},
119127
"freeform_tags": acctest.Representation{RepType: acctest.Optional, Create: map[string]string{"Department": "Finance"}, Update: map[string]string{"Department": "Accounting"}},
@@ -201,8 +209,6 @@ func TestContainerengineClusterResource_basic(t *testing.T) {
201209
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.#", "1"),
202210
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.0.is_kubernetes_dashboard_enabled", "true"),
203211
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.0.is_tiller_enabled", "true"),
204-
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.#", "1"),
205-
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
206212
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.#", "1"),
207213
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.0.pods_cidr", "10.1.0.0/16"),
208214
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.0.services_cidr", "10.2.0.0/16"),
@@ -219,6 +225,9 @@ func TestContainerengineClusterResource_basic(t *testing.T) {
219225
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_token_authentication_config.0.signing_algorithms.#", "1"),
220226
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_token_authentication_config.0.username_claim", "RS256"),
221227
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_token_authentication_config.0.username_prefix", "oidc:"),
228+
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
229+
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_discovery.#", "1"),
230+
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_discovery.0.is_open_id_connect_discovery_enabled", "false"),
222231
resource.TestCheckResourceAttr(resourceName, "options.0.persistent_volume_config.#", "1"),
223232
resource.TestCheckResourceAttr(resourceName, "options.0.persistent_volume_config.0.freeform_tags.%", "1"),
224233
resource.TestCheckResourceAttr(resourceName, "options.0.service_lb_config.#", "1"),
@@ -263,12 +272,13 @@ func TestContainerengineClusterResource_basic(t *testing.T) {
263272
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.#", "1"),
264273
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.0.is_kubernetes_dashboard_enabled", "true"),
265274
resource.TestCheckResourceAttr(resourceName, "options.0.add_ons.0.is_tiller_enabled", "true"),
266-
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.#", "1"),
267-
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
268275
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.#", "1"),
269276
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.0.pods_cidr", "10.1.0.0/16"),
270277
resource.TestCheckResourceAttr(resourceName, "options.0.kubernetes_network_config.0.services_cidr", "10.2.0.0/16"),
271278
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_token_authentication_config.#", "0"),
279+
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
280+
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_discovery.#", "1"),
281+
resource.TestCheckResourceAttr(resourceName, "options.0.open_id_connect_discovery.0.is_open_id_connect_discovery_enabled", "true"),
272282
resource.TestCheckResourceAttr(resourceName, "options.0.persistent_volume_config.#", "1"),
273283
resource.TestCheckResourceAttr(resourceName, "options.0.persistent_volume_config.0.freeform_tags.%", "1"),
274284
resource.TestCheckResourceAttr(resourceName, "options.0.service_lb_config.#", "1"),
@@ -317,8 +327,6 @@ func TestContainerengineClusterResource_basic(t *testing.T) {
317327
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.add_ons.#", "1"),
318328
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.add_ons.0.is_kubernetes_dashboard_enabled", "true"),
319329
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.add_ons.0.is_tiller_enabled", "true"),
320-
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.admission_controller_options.#", "1"),
321-
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
322330
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.kubernetes_network_config.#", "1"),
323331
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.kubernetes_network_config.0.pods_cidr", "10.1.0.0/16"),
324332
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.kubernetes_network_config.0.services_cidr", "10.2.0.0/16"),
@@ -335,6 +343,9 @@ func TestContainerengineClusterResource_basic(t *testing.T) {
335343
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.open_id_connect_token_authentication_config.0.signing_algorithms.#", "1"),
336344
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.open_id_connect_token_authentication_config.0.username_claim", "usernameClaim2"),
337345
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.open_id_connect_token_authentication_config.0.username_prefix", "usernamePrefix2"),
346+
resource.TestCheckResourceAttr(resourceName, "options.0.admission_controller_options.0.is_pod_security_policy_enabled", "false"),
347+
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.open_id_connect_discovery.#", "1"),
348+
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.open_id_connect_discovery.0.is_open_id_connect_discovery_enabled", "true"),
338349
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.persistent_volume_config.#", "1"),
339350
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.persistent_volume_config.0.freeform_tags.%", "1"),
340351
resource.TestCheckResourceAttr(datasourceName, "clusters.0.options.0.service_lb_config.#", "1"),

0 commit comments

Comments
 (0)