Skip to content

Commit 0fa5521

Browse files
KagashinoKagashino
authored
Merge pull request #682 from tencentcloudstack/feat/tke-support-auth-options
feat: tke - cluster support authentication options.
2 parents ede9959 + 401e8f2 commit 0fa5521

File tree

10 files changed

+1797
-53
lines changed

10 files changed

+1797
-53
lines changed

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ require (
2727
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ckafka v1.0.199
2828
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/clb v1.0.199
2929
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cloudaudit v1.0.199
30-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.234
30+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.264
3131
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cvm v1.0.199
3232
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cynosdb v1.0.199
3333
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/dayu v1.0.199
@@ -47,7 +47,7 @@ require (
4747
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tag v1.0.199
4848
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tcaplusdb v1.0.199
4949
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tcr v1.0.199
50-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.234
50+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.264
5151
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/vod v1.0.199
5252
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/vpc v1.0.199
5353
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/wss v1.0.199

‎go.sum‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,8 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cloudaudit v1.0.199/go.
469469
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.194/go.mod h1:7sCQWVkxcsR38nffDW057DRGk8mUjK1Ing/EFOK8s8Y=
470470
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.234 h1:yAtw4jVBsQZ/KcM2nMHRzcpIfSXRw0Alt7wVTR9OodM=
471471
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.234/go.mod h1:7sCQWVkxcsR38nffDW057DRGk8mUjK1Ing/EFOK8s8Y=
472+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.264 h1:USf7I8ohzoqCwAcCHz5rz0hD57mmNXZgrLfxFLx1WmA=
473+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.264/go.mod h1:7sCQWVkxcsR38nffDW057DRGk8mUjK1Ing/EFOK8s8Y=
472474
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cvm v1.0.199 h1:ajgJogYSIQ5u1PIbiV5nsvr5K0fYpm1/T7Dy+mxEM6U=
473475
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cvm v1.0.199/go.mod h1:AqyM/ZZMD7q5mHBqNY9YImbSpEpoEe7E/vrTbUWX+po=
474476
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/cynosdb v1.0.199 h1:L0twFkJMOZzLkX08w8S14nX6oanD8YxMQDIaYXVim6A=
@@ -510,6 +512,8 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tcr v1.0.199 h1:ku4oDXW
510512
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tcr v1.0.199/go.mod h1:SEUO10oGtg+4AGCfpJDn9ynf47P+ZiyvhzOyXLt0mOY=
511513
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.234 h1:bJU0a3yEir4BHTiIHgLvsVqDAFeuHe/r3PML3V92R/o=
512514
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.234/go.mod h1:ij3CHdPvqI2aSMcl7+jdI0yCO7oOiywKTAa55qmO2iI=
515+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.264 h1:nKf15bAypO5ZY8cF4qNvU3ttgaiquuniK5WEhFt36X8=
516+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.0.264/go.mod h1:ij3CHdPvqI2aSMcl7+jdI0yCO7oOiywKTAa55qmO2iI=
513517
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/vod v1.0.199 h1:6Yt74l4pA5QtzhwMNIEUt0spXdSBKH744DDqTHJOCP0=
514518
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/vod v1.0.199/go.mod h1:Yw6OQ33z3s4k0HVYTNSffB12qOzEJ2Zf1Vj4+5S3sRs=
515519
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/vpc v1.0.199 h1:UDZ59pvaqjDy2QIsMsv9hxm0BEJLmPIbHF1ms0MqaRk=

‎tencentcloud/resource_tc_kubernetes_cluster.go‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1118,6 +1118,32 @@ func resourceTencentCloudTkeCluster() *schema.Resource {
11181118
},
11191119
Description: "create tke cluster by existed instances.",
11201120
},
1121+
"auth_options": {
1122+
Type: schema.TypeList,
1123+
Optional: true,
1124+
MaxItems: 1,
1125+
Elem: &schema.Resource{
1126+
Schema: map[string]*schema.Schema{
1127+
"jwks_uri": {
1128+
Type: schema.TypeString,
1129+
Optional: true,
1130+
Description: "Specify service-account-jwks-uri.",
1131+
},
1132+
"issuer": {
1133+
Type: schema.TypeString,
1134+
Optional: true,
1135+
Description: "Specify service-account-issuer.",
1136+
},
1137+
"auto_create_discovery_anonymous_auth": {
1138+
Type: schema.TypeBool,
1139+
Optional: true,
1140+
Description: "If set to `true`, the rbac rule will be created automatically which allow anonymous user to access '/.well-known/openid-configuration' and '/openid/v1/jwks'.",
1141+
},
1142+
1143+
},
1144+
},
1145+
Description: "Specify cluster authentication configuration. Only available for managed cluster and `cluster_version` >= 1.20.",
1146+
},
11211147
"tags": {
11221148
Type: schema.TypeMap,
11231149
Optional: true,
@@ -1518,6 +1544,37 @@ func tkeGetNodePoolGlobalConfig(d *schema.ResourceData) *tke.ModifyClusterAsGrou
15181544
return request
15191545
}
15201546

1547+
func tkeGetAuthOptions (d *schema.ResourceData) *tke.ModifyClusterAuthenticationOptionsRequest {
1548+
raw, ok := d.GetOk("auth_options")
1549+
options := raw.([]interface{})
1550+
1551+
if !ok || len(options) == 0 {
1552+
return nil
1553+
}
1554+
1555+
option := options[0].(map[string]interface{})
1556+
request := tke.NewModifyClusterAuthenticationOptionsRequest()
1557+
request.ClusterId = helper.String(d.Id())
1558+
1559+
request.ServiceAccounts = &tke.ServiceAccountAuthenticationOptions{
1560+
AutoCreateDiscoveryAnonymousAuth: helper.Bool(false),
1561+
}
1562+
1563+
if v, ok := option["auto_create_discovery_anonymous_auth"]; ok {
1564+
request.ServiceAccounts.AutoCreateDiscoveryAnonymousAuth = helper.Bool(v.(bool))
1565+
}
1566+
1567+
if v, ok := option["issuer"]; ok {
1568+
request.ServiceAccounts.Issuer = helper.String(v.(string))
1569+
}
1570+
1571+
if v, ok := option["jwks_uri"]; ok {
1572+
request.ServiceAccounts.JWKSURI = helper.String(v.(string))
1573+
}
1574+
1575+
return request
1576+
}
1577+
15211578
// upgradeClusterInstances upgrade instances, upgrade type try seq:major, hot.
15221579
func upgradeClusterInstances(tkeService TkeService, ctx context.Context, id string) error {
15231580
// get all available instances for upgrade
@@ -2551,6 +2608,14 @@ func resourceTencentCloudTkeClusterUpdate(d *schema.ResourceData, meta interface
25512608
d.SetPartial("node_pool_global_config")
25522609
}
25532610

2611+
if d.HasChange("auth_options") {
2612+
request := tkeGetAuthOptions(d)
2613+
if err := tkeService.ModifyClusterAuthenticationOptions(ctx, request); err != nil {
2614+
return err
2615+
}
2616+
d.SetPartial("auth_options")
2617+
}
2618+
25542619
d.Partial(false)
25552620
if err := resourceTencentCloudTkeClusterRead(d, meta); err != nil {
25562621
log.Printf("[WARN]%s resource.kubernetes_cluster.read after update fail , %s", logId, err.Error())

‎tencentcloud/service_tencentcloud_tke.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1380,3 +1380,47 @@ func (me *TkeService) DescribeClusterNodePoolGlobalConfig(ctx context.Context, c
13801380

13811381
return
13821382
}
1383+
1384+
// DescribeClusterAuthenticationOptions
1385+
// Field `ServiceAccounts.AutoCreateDiscoveryAnonymousAuth` will always return null by design
1386+
// For argument consistency, we will not fetch this options when tf reading tke cluster resource
1387+
func (me *TkeService) DescribeClusterAuthenticationOptions(ctx context.Context, id string) (options *tke.ServiceAccountAuthenticationOptions, state string, errRet error) {
1388+
logId := getLogId(ctx)
1389+
request := tke.NewDescribeClusterAuthenticationOptionsRequest()
1390+
request.ClusterId = helper.String(id)
1391+
defer func() {
1392+
if errRet != nil {
1393+
log.Printf("[CRITAL]%s api[%s] fail, reason[%s]\n", logId, request.GetAction(), errRet.Error())
1394+
}
1395+
}()
1396+
1397+
ratelimit.Check(request.GetAction())
1398+
res, err := me.client.UseTkeClient().DescribeClusterAuthenticationOptions(request)
1399+
if err != nil {
1400+
errRet = err
1401+
}
1402+
1403+
if res.Response != nil {
1404+
state = *res.Response.LatestOperationState
1405+
options = res.Response.ServiceAccounts
1406+
}
1407+
1408+
return
1409+
}
1410+
1411+
1412+
func (me *TkeService) ModifyClusterAuthenticationOptions(ctx context.Context, request *tke.ModifyClusterAuthenticationOptionsRequest) (errRet error) {
1413+
logId := getLogId(ctx)
1414+
defer func() {
1415+
if errRet != nil {
1416+
log.Printf("[CRITAL]%s api[%s] fail, reason[%s]\n", logId, request.GetAction(), errRet.Error())
1417+
}
1418+
}()
1419+
1420+
ratelimit.Check(request.GetAction())
1421+
_, err := me.client.UseTkeClient().ModifyClusterAuthenticationOptions(request)
1422+
if err != nil {
1423+
errRet = err
1424+
}
1425+
return
1426+
}

‎vendor/github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common/http/request.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)