Skip to content

Commit 3e83979

Browse files
lyu571lyu571
authored
supprot the white/black IP list for es (#1282)
* supprot the white/black IP list for es * update docs * optimize code * fix set partial name * modified by review comments. Co-authored-by: nickyinluo <nickyinluo@tencent.com>
1 parent 3b2ce9f commit 3e83979

File tree

4 files changed

+115
-8
lines changed

4 files changed

+115
-8
lines changed

‎tencentcloud/resource_tc_elasticsearch_instance.go‎

Lines changed: 83 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,17 @@ resource "tencentcloud_elasticsearch_instance" "foo" {
2121
node_info_list {
2222
node_num = 2
2323
node_type = "ES.S1.MEDIUM4"
24-
encrypt = false
24+
encrypt = false
25+
}
26+
27+
es_acl {
28+
black_list = [
29+
"9.9.9.9",
30+
"8.8.8.8",
31+
]
32+
white_list = [
33+
"0.0.0.0",
34+
]
2535
}
2636
2737
tags = {
@@ -171,6 +181,33 @@ func resourceTencentCloudElasticsearchInstance() *schema.Resource {
171181
},
172182
},
173183
},
184+
"es_acl": {
185+
Type: schema.TypeList,
186+
Optional: true,
187+
Computed: true,
188+
MaxItems: 1,
189+
Description: "Kibana Access Control Configuration.",
190+
Elem: &schema.Resource{
191+
Schema: map[string]*schema.Schema{
192+
"black_list": {
193+
Type: schema.TypeSet,
194+
Optional: true,
195+
Computed: true,
196+
Description: "Blacklist of kibana access.",
197+
Elem: &schema.Schema{
198+
Type: schema.TypeString,
199+
},
200+
},
201+
"white_list": {
202+
Type: schema.TypeSet,
203+
Optional: true,
204+
Computed: true,
205+
Description: "Whitelist of kibana access.",
206+
Elem: &schema.Schema{Type: schema.TypeString},
207+
},
208+
},
209+
},
210+
},
174211
"license_type": {
175212
Type: schema.TypeString,
176213
Optional: true,
@@ -385,7 +422,7 @@ func resourceTencentCloudElasticsearchInstanceCreate(d *schema.ResourceData, met
385422
return retryError(errRet, InternalError)
386423
}
387424
if instance == nil || *instance.Status == ES_INSTANCE_STATUS_PROCESSING {
388-
return resource.RetryableError(errors.New("elasticsearch instance status is processing, retry..."))
425+
return resource.RetryableError(fmt.Errorf("elasticsearch instance status is processing, retry... status:%v", *instance.Status))
389426
}
390427
return nil
391428
})
@@ -478,6 +515,16 @@ func resourceTencentCloudElasticsearchInstanceRead(d *schema.ResourceData, meta
478515
}
479516
_ = d.Set("node_info_list", nodeInfoList)
480517

518+
if instance.EsAcl != nil {
519+
esAcls := make([]map[string]interface{}, 0, 1)
520+
esAcl := map[string]interface{}{
521+
"black_list": instance.EsAcl.BlackIpList,
522+
"white_list": instance.EsAcl.WhiteIpList,
523+
}
524+
esAcls = append(esAcls, esAcl)
525+
_ = d.Set("es_acl", esAcls)
526+
}
527+
481528
if len(instance.TagList) > 0 {
482529
tags := make(map[string]string)
483530
for _, tag := range instance.TagList {
@@ -505,7 +552,7 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
505552
instanceName := d.Get("instance_name").(string)
506553
// Update operation support at most one item at the same time
507554
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
508-
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, instanceName, "", 0, nil, nil)
555+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, instanceName, "", 0, nil, nil, nil)
509556
if errRet != nil {
510557
return retryError(errRet)
511558
}
@@ -519,7 +566,7 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
519566
if d.HasChange("password") {
520567
password := d.Get("password").(string)
521568
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
522-
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", password, 0, nil, nil)
569+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", password, 0, nil, nil, nil)
523570
if errRet != nil {
524571
return retryError(errRet)
525572
}
@@ -592,7 +639,7 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
592639
if d.HasChange("basic_security_type") {
593640
basicSecurityType := d.Get("basic_security_type").(int)
594641
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
595-
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", int64(basicSecurityType), nil, nil)
642+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", int64(basicSecurityType), nil, nil, nil)
596643
if errRet != nil {
597644
return retryError(errRet)
598645
}
@@ -614,7 +661,7 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
614661
NodeType: helper.String(value["node_type"].(string)),
615662
}
616663
err = resource.Retry(writeRetryTimeout, func() *resource.RetryError {
617-
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", 0, nil, info)
664+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", 0, nil, info, nil)
618665
if errRet != nil {
619666
return retryError(errRet)
620667
}
@@ -649,7 +696,7 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
649696
nodeInfoList = append(nodeInfoList, &dataDisk)
650697
}
651698
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
652-
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", 0, nodeInfoList, nil)
699+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", 0, nodeInfoList, nil, nil)
653700
if errRet != nil {
654701
return retryError(errRet)
655702
}
@@ -687,6 +734,35 @@ func resourceTencentCloudElasticsearchInstanceUpdate(d *schema.ResourceData, met
687734
}
688735
d.SetPartial("tags")
689736
}
737+
if d.HasChange("es_acl") {
738+
esAcl := es.EsAcl{}
739+
if aclMap, ok := helper.InterfacesHeadMap(d, "es_acl"); ok {
740+
if v, ok := aclMap["black_list"]; ok {
741+
blist := v.(*schema.Set).List()
742+
for _, d := range blist {
743+
esAcl.BlackIpList = append(esAcl.BlackIpList, helper.String(d.(string)))
744+
}
745+
}
746+
if v, ok := aclMap["white_list"]; ok {
747+
wlist := v.(*schema.Set).List()
748+
for _, d := range wlist {
749+
esAcl.WhiteIpList = append(esAcl.WhiteIpList, helper.String(d.(string)))
750+
}
751+
}
752+
}
753+
754+
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
755+
errRet := elasticsearchService.UpdateInstance(ctx, instanceId, "", "", 0, nil, nil, &esAcl)
756+
if errRet != nil {
757+
return retryError(errRet)
758+
}
759+
return nil
760+
})
761+
if err != nil {
762+
return err
763+
}
764+
d.SetPartial("es_acl")
765+
}
690766

691767
d.Partial(false)
692768

‎tencentcloud/resource_tc_elasticsearch_instance_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ func TestAccTencentCloudNeedFixElasticsearchInstance_basic(t *testing.T) {
8383
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "web_node_type_info.0.node_type", "ES.S1.MEDIUM8"),
8484
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "node_info_list.0.node_type", "ES.S1.MEDIUM8"),
8585
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "node_info_list.0.disk_size", "200"),
86+
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "es_public_acl.#", "1"),
87+
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "es_public_acl.0.white_list.#", "1"),
88+
resource.TestCheckResourceAttr("tencentcloud_elasticsearch_instance.foo", "es_public_acl.0.black_list.#", "1"),
8689
),
8790
},
8891
{
@@ -208,6 +211,15 @@ resource "tencentcloud_elasticsearch_instance" "foo" {
208211
node_type = "ES.S1.MEDIUM8"
209212
disk_size = 200
210213
}
214+
215+
es_public_acl {
216+
white_list {
217+
"0.0.0.0"
218+
}
219+
black_list {
220+
"1.1.1.1"
221+
}
222+
}
211223
212224
tags = {
213225
test = "test"

‎tencentcloud/service_tencentcloud_elasticsearch.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func (me *ElasticsearchService) DeleteInstance(ctx context.Context, instanceId s
9595
}
9696

9797
// UpdateInstance FIXME: use *Request instead of these suck params
98-
func (me *ElasticsearchService) UpdateInstance(ctx context.Context, instanceId, instanceName, password string, basicSecurityType int64, nodeList []*es.NodeInfo, nodeTypeInfo *es.WebNodeTypeInfo) error {
98+
func (me *ElasticsearchService) UpdateInstance(ctx context.Context, instanceId, instanceName, password string, basicSecurityType int64, nodeList []*es.NodeInfo, nodeTypeInfo *es.WebNodeTypeInfo, esAcl *es.EsAcl) error {
9999
logId := getLogId(ctx)
100100
request := es.NewUpdateInstanceRequest()
101101
request.InstanceId = &instanceId
@@ -114,6 +114,9 @@ func (me *ElasticsearchService) UpdateInstance(ctx context.Context, instanceId,
114114
if nodeTypeInfo != nil {
115115
request.WebNodeTypeInfo = nodeTypeInfo
116116
}
117+
if esAcl != nil {
118+
request.EsAcl = esAcl
119+
}
117120
ratelimit.Check(request.GetAction())
118121
_, err := me.client.UseEsClient().UpdateInstance(request)
119122
if err != nil {

‎website/docs/r/elasticsearch_instance.html.markdown‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,16 @@ resource "tencentcloud_elasticsearch_instance" "foo" {
3434
encrypt = false
3535
}
3636
37+
es_acl {
38+
black_list = [
39+
"9.9.9.9",
40+
"8.8.8.8",
41+
]
42+
white_list = [
43+
"0.0.0.0",
44+
]
45+
}
46+
3747
tags = {
3848
test = "test"
3949
}
@@ -53,6 +63,7 @@ The following arguments are supported:
5363
* `charge_period` - (Optional, Int, ForceNew) The tenancy of the prepaid instance, and uint is month. NOTE: it only works when charge_type is set to `PREPAID`.
5464
* `charge_type` - (Optional, String, ForceNew) The charge type of instance. Valid values are `PREPAID` and `POSTPAID_BY_HOUR`.
5565
* `deploy_mode` - (Optional, Int, ForceNew) Cluster deployment mode. Valid values are `0` and `1`. `0` is single-AZ deployment, and `1` is multi-AZ deployment. Default value is `0`.
66+
* `es_acl` - (Optional, List) Kibana Access Control Configuration.
5667
* `instance_name` - (Optional, String) Name of the instance, which can contain 1 to 50 English letters, Chinese characters, digits, dashes(-), or underscores(_).
5768
* `license_type` - (Optional, String) License type. Valid values are `oss`, `basic` and `platinum`. The default value is `platinum`.
5869
* `multi_zone_infos` - (Optional, List, ForceNew) Details of AZs in multi-AZ deployment mode (which is required when deploy_mode is `1`).
@@ -61,6 +72,11 @@ The following arguments are supported:
6172
* `tags` - (Optional, Map) A mapping of tags to assign to the instance. For tag limits, please refer to [Use Limits](https://intl.cloud.tencent.com/document/product/651/13354).
6273
* `web_node_type_info` - (Optional, List) Visual node configuration.
6374

75+
The `es_acl` object supports the following:
76+
77+
* `black_list` - (Optional, Set) Blacklist of kibana access.
78+
* `white_list` - (Optional, Set) Whitelist of kibana access.
79+
6480
The `multi_zone_infos` object supports the following:
6581

6682
* `availability_zone` - (Required, String) Availability zone.

0 commit comments

Comments
 (0)