Skip to content

Commit bfbff72

Browse files
tongyimingmikatong
tongyiming
and
mikatong
authored
fix(clb): [123456789] support config iap (#2978)
* clb support config iap * add changelog * update --------- Co-authored-by: mikatong <mikatong@tencent.com>
1 parent 1c3eaa0 commit bfbff72

File tree

5 files changed

+163
-1
lines changed

5 files changed

+163
-1
lines changed

‎.changelog/2978.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/tencentcloud_clb_listener_rule: support param `oauth`
3+
```

‎tencentcloud/services/clb/resource_tc_clb_listener_rule.go‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,29 @@ func ResourceTencentCloudClbListenerRule() *schema.Resource {
185185
Computed: true,
186186
Description: "Whether to enable QUIC. Note: QUIC can be enabled only for HTTPS domain names.",
187187
},
188+
"oauth": {
189+
Type: schema.TypeList,
190+
Optional: true,
191+
Computed: true,
192+
MaxItems: 1,
193+
Description: "OAuth configuration information.",
194+
Elem: &schema.Resource{
195+
Schema: map[string]*schema.Schema{
196+
"oauth_enable": {
197+
Type: schema.TypeBool,
198+
Optional: true,
199+
Computed: true,
200+
Description: "Enable or disable authentication. True: Enabled; False: Disabled.",
201+
},
202+
"oauth_failure_status": {
203+
Type: schema.TypeString,
204+
Optional: true,
205+
Computed: true,
206+
Description: "After all IAPs fail, the request is rejected or released. BYPASS: PASS; REJECT: Reject.",
207+
},
208+
},
209+
},
210+
},
188211
//computed
189212
"rule_id": {
190213
Type: schema.TypeString,
@@ -384,6 +407,41 @@ func resourceTencentCloudClbListenerRuleCreate(d *schema.ResourceData, meta inte
384407
return err
385408
}
386409
}
410+
411+
if dMap, ok := helper.InterfacesHeadMap(d, "oauth"); ok {
412+
modifyRuleRequest := clb.NewModifyRuleRequest()
413+
modifyRuleRequest.ListenerId = helper.String(listenerId)
414+
modifyRuleRequest.LoadBalancerId = helper.String(clbId)
415+
modifyRuleRequest.LocationId = helper.String(locationId)
416+
oauth := &clb.OAuth{}
417+
if v, ok := dMap["oauth_enable"]; ok {
418+
oauth.OAuthEnable = helper.Bool(v.(bool))
419+
}
420+
if v, ok := dMap["oauth_failure_status"]; ok {
421+
oauth.OAuthFailureStatus = helper.String(v.(string))
422+
}
423+
modifyRuleRequest.OAuth = oauth
424+
err := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
425+
response, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseClbClient().ModifyRule(modifyRuleRequest)
426+
if e != nil {
427+
return tccommon.RetryError(e)
428+
} else {
429+
log.Printf("[DEBUG]%s api[%s] success, request body [%s], response body [%s]\n",
430+
logId, request.GetAction(), request.ToJsonString(), response.ToJsonString())
431+
requestId := *response.Response.RequestId
432+
retryErr := waitForTaskFinish(requestId, meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseClbClient())
433+
if retryErr != nil {
434+
return resource.NonRetryableError(errors.WithStack(retryErr))
435+
}
436+
}
437+
return nil
438+
})
439+
if err != nil {
440+
log.Printf("[CRITAL]%s update CLB listener rule failed, reason:%+v", logId, err)
441+
return err
442+
}
443+
}
444+
387445
return resourceTencentCloudClbListenerRuleRead(d, meta)
388446
}
389447

@@ -493,6 +551,16 @@ func resourceTencentCloudClbListenerRuleRead(d *schema.ResourceData, meta interf
493551
_ = d.Set("certificate_ca_id", instance.Certificate.CertCaId)
494552
}
495553
}
554+
if instance.OAuth != nil {
555+
oath := make(map[string]interface{})
556+
if instance.OAuth.OAuthEnable != nil {
557+
oath["oauth_enable"] = instance.OAuth.OAuthEnable
558+
}
559+
if instance.OAuth.OAuthFailureStatus != nil {
560+
oath["oauth_failure_status"] = instance.OAuth.OAuthFailureStatus
561+
}
562+
_ = d.Set("oauth", []interface{}{oath})
563+
}
496564

497565
return nil
498566
}
@@ -547,6 +615,19 @@ func resourceTencentCloudClbListenerRuleUpdate(d *schema.ResourceData, meta inte
547615
url = d.Get("url").(string)
548616
request.Url = helper.String(url)
549617
}
618+
if d.HasChange("oauth") {
619+
changed = true
620+
if dMap, ok := helper.InterfacesHeadMap(d, "oauth"); ok {
621+
oauth := &clb.OAuth{}
622+
if v, ok := dMap["oauth_enable"]; ok {
623+
oauth.OAuthEnable = helper.Bool(v.(bool))
624+
}
625+
if v, ok := dMap["oauth_failure_status"]; ok {
626+
oauth.OAuthFailureStatus = helper.String(v.(string))
627+
}
628+
request.OAuth = oauth
629+
}
630+
}
550631

551632
if d.HasChange("forward_type") {
552633
changed = true

‎tencentcloud/services/clb/resource_tc_clb_listener_rule_test.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,44 @@ func TestAccTencentCloudClbListenerRuleResource_full(t *testing.T) {
118118
})
119119
}
120120

121+
func TestAccTencentCloudClbListenerRuleResource_oauth(t *testing.T) {
122+
t.Parallel()
123+
124+
resource.Test(t, resource.TestCase{
125+
PreCheck: func() {
126+
tcacctest.AccPreCheck(t)
127+
tcacctest.AccStepSetRegion(t, "ap-jakarta")
128+
},
129+
Providers: tcacctest.AccProviders,
130+
CheckDestroy: testAccCheckClbListenerRuleDestroy,
131+
Steps: []resource.TestStep{
132+
{
133+
Config: testAccClbListenerRule_oauth,
134+
Check: resource.ComposeTestCheckFunc(
135+
testAccCheckClbListenerRuleExists("tencentcloud_clb_listener_rule.rule_oauth"),
136+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.#", "1"),
137+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.0.oauth_enable", "true"),
138+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.0.oauth_failure_status", "REJECT"),
139+
),
140+
},
141+
{
142+
Config: testAccClbListenerRule_oauthUpdate,
143+
Check: resource.ComposeTestCheckFunc(
144+
testAccCheckClbListenerRuleExists("tencentcloud_clb_listener_rule.rule_oauth"),
145+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.#", "1"),
146+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.0.oauth_enable", "false"),
147+
resource.TestCheckResourceAttr("tencentcloud_clb_listener_rule.rule_oauth", "oauth.0.oauth_failure_status", "BYPASS"),
148+
),
149+
},
150+
{
151+
ResourceName: "tencentcloud_clb_listener_rule.rule_oauth",
152+
ImportState: true,
153+
ImportStateVerify: true,
154+
},
155+
},
156+
})
157+
}
158+
121159
func testAccCheckClbListenerRuleDestroy(s *terraform.State) error {
122160
logId := tccommon.GetLogId(tccommon.ContextNil)
123161
ctx := context.WithValue(context.TODO(), tccommon.LogIdKey, logId)
@@ -296,3 +334,37 @@ resource "tencentcloud_clb_listener_rule" "rule_full" {
296334
certificate_id = "%s"
297335
}
298336
`
337+
338+
const testAccClbListenerRule_oauth = `
339+
resource "tencentcloud_clb_listener_rule" "rule_oauth" {
340+
clb_id = "lb-az5cm2h7"
341+
listener_id = "lbl-egzxfxgj"
342+
domain = "abc.com"
343+
url = "/"
344+
session_expire_time = 30
345+
scheduler = "WRR"
346+
target_type = "TARGETGROUP"
347+
forward_type = "HTTPS"
348+
oauth {
349+
oauth_enable = true
350+
oauth_failure_status = "REJECT"
351+
}
352+
}
353+
`
354+
355+
const testAccClbListenerRule_oauthUpdate = `
356+
resource "tencentcloud_clb_listener_rule" "rule_oauth" {
357+
clb_id = "lb-az5cm2h7"
358+
listener_id = "lbl-egzxfxgj"
359+
domain = "abc.com"
360+
url = "/"
361+
session_expire_time = 30
362+
scheduler = "WRR"
363+
target_type = "TARGETGROUP"
364+
forward_type = "HTTPS"
365+
oauth {
366+
oauth_enable = false
367+
oauth_failure_status = "BYPASS"
368+
}
369+
}
370+
`

‎tencentcloud/services/clb/service_tencentcloud_clb.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2451,7 +2451,7 @@ func waitTaskReady(ctx context.Context, client *clb.Client, reqeustId string) er
24512451
} else if status == 1 {
24522452
return resource.NonRetryableError(fmt.Errorf("Task[%s] failed", reqeustId))
24532453
} else {
2454-
return resource.RetryableError(fmt.Errorf("Task[%s] status: %s", reqeustId, status))
2454+
return resource.RetryableError(fmt.Errorf("Task[%s] status: %d", reqeustId, status))
24552455
}
24562456
})
24572457
if err != nil {

‎website/docs/r/clb_listener_rule.html.markdown‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,11 +83,17 @@ The following arguments are supported:
8383
* `health_check_type` - (Optional, String) Type of health check. Valid value is `CUSTOM`, `PING`, `TCP`, `HTTP`, `HTTPS`, `GRPC`, `GRPCS`.
8484
* `health_check_unhealth_num` - (Optional, Int) Unhealthy threshold of health check, and the default is `3`. If the unhealthy result is returned 3 consecutive times, indicates that the forwarding is abnormal. The value range is [2-10]. NOTES: TCP/UDP/TCP_SSL listener allows direct configuration, HTTP/HTTPS listener needs to be configured in `tencentcloud_clb_listener_rule`.
8585
* `http2_switch` - (Optional, Bool) Indicate to apply HTTP2.0 protocol or not.
86+
* `oauth` - (Optional, List) OAuth configuration information.
8687
* `quic` - (Optional, Bool) Whether to enable QUIC. Note: QUIC can be enabled only for HTTPS domain names.
8788
* `scheduler` - (Optional, String) Scheduling method of the CLB listener rules. Valid values: `WRR`, `IP HASH`, `LEAST_CONN`. The default is `WRR`. NOTES: TCP/UDP/TCP_SSL listener allows direct configuration, HTTP/HTTPS listener needs to be configured in `tencentcloud_clb_listener_rule`.
8889
* `session_expire_time` - (Optional, Int) Time of session persistence within the CLB listener. NOTES: Available when scheduler is specified as `WRR`, and not available when listener protocol is `TCP_SSL`. NOTES: TCP/UDP/TCP_SSL listener allows direct configuration, HTTP/HTTPS listener needs to be configured in `tencentcloud_clb_listener_rule`.
8990
* `target_type` - (Optional, String, ForceNew) Backend target type. Valid values: `NODE`, `TARGETGROUP`. `NODE` means to bind ordinary nodes, `TARGETGROUP` means to bind target group.
9091

92+
The `oauth` object supports the following:
93+
94+
* `oauth_enable` - (Optional, Bool) Enable or disable authentication. True: Enabled; False: Disabled.
95+
* `oauth_failure_status` - (Optional, String) After all IAPs fail, the request is rejected or released. BYPASS: PASS; REJECT: Reject.
96+
9197
## Attributes Reference
9298

9399
In addition to all arguments above, the following attributes are exported:

0 commit comments

Comments
 (0)