Skip to content

Commit e884ffb

Browse files
bruceybianbruceybian
authored
create vpn connection to support destination routing tunnel type (#2409)
* create vpn connection to support destination routing tunnel type * add changelog 2409.txt
1 parent 1e4e0a1 commit e884ffb

File tree

5 files changed

+151
-44
lines changed

5 files changed

+151
-44
lines changed

‎.changelog/2409.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/tencentcloud_vpn_connection: Support creating routing type vpn connection.
3+
```

‎tencentcloud/extension_vpc.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,18 @@ var VPN_IKE_EXCHANGE_MODE = []string{
238238
VPN_IKE_EXCHANGE_MODE_MAIN,
239239
}
240240

241+
const (
242+
ROUTE_TYPE_STATIC = "STATIC"
243+
ROUTE_TYPE_STATIC_ROUTE = "StaticRoute"
244+
ROUTE_TYPE_POLICY = "Policy"
245+
)
246+
247+
var VPN_CONNECTION_ROUTE_TYPE = []string{
248+
ROUTE_TYPE_STATIC,
249+
ROUTE_TYPE_STATIC_ROUTE,
250+
ROUTE_TYPE_POLICY,
251+
}
252+
241253
const (
242254
VPN_IKE_IDENTITY_ADDRESS = "ADDRESS"
243255
VPN_IKE_IDENTITY_FQDN = "FQDN"

‎tencentcloud/resource_tc_vpn_connection.go‎

Lines changed: 50 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,10 @@ func resourceTencentCloudVpnConnection() *schema.Resource {
6666
Description: "Pre-shared key of the VPN connection.",
6767
},
6868
"security_group_policy": {
69-
Type: schema.TypeSet,
70-
Required: true,
71-
Description: "Security group policy of the VPN connection.",
69+
Type: schema.TypeSet,
70+
Optional: true,
71+
Description: "SPD policy group, for example: {\"10.0.0.5/24\":[\"172.123.10.5/16\"]}, 10.0.0.5/24 is the vpc intranet segment, and 172.123.10.5/16 is the IDC network segment. " +
72+
"Users specify which network segments in the VPC can communicate with which network segments in your IDC.",
7273
Elem: &schema.Resource{
7374
Schema: map[string]*schema.Schema{
7475
"local_cidr_block": {
@@ -232,9 +233,12 @@ func resourceTencentCloudVpnConnection() *schema.Resource {
232233
Description: "Encrypt proto of the VPN connection.",
233234
},
234235
"route_type": {
235-
Type: schema.TypeString,
236-
Computed: true,
237-
Description: "Route type of the VPN connection.",
236+
Type: schema.TypeString,
237+
Optional: true,
238+
Computed: true,
239+
ForceNew: true,
240+
ValidateFunc: validateAllowedStringValue(VPN_CONNECTION_ROUTE_TYPE),
241+
Description: "Route type of the VPN connection. Valid value: `STATIC`, `StaticRoute`, `Policy`.",
238242
},
239243
"state": {
240244
Type: schema.TypeString,
@@ -313,26 +317,28 @@ func resourceTencentCloudVpnConnectionCreate(d *schema.ResourceData, meta interf
313317
if v, ok := d.GetOk("dpd_timeout"); ok {
314318
request.DpdTimeout = helper.String(strconv.Itoa(v.(int)))
315319
}
316-
//set up SecurityPolicyDatabases
317320

318-
sgps := d.Get("security_group_policy").(*schema.Set).List()
319-
if len(sgps) < 1 {
320-
return fmt.Errorf("Para `security_group_policy` should be set at least one.")
321-
}
322-
323-
request.SecurityPolicyDatabases = make([]*vpc.SecurityPolicyDatabase, 0, len(sgps))
324-
for _, v := range sgps {
325-
m := v.(map[string]interface{})
326-
var sgp vpc.SecurityPolicyDatabase
327-
local := m["local_cidr_block"].(string)
328-
sgp.LocalCidrBlock = &local
329-
// list
330-
remoteCidrBlocks := m["remote_cidr_block"].(*schema.Set).List()
331-
for _, vv := range remoteCidrBlocks {
332-
remoteCidrBlock := vv.(string)
333-
sgp.RemoteCidrBlock = append(sgp.RemoteCidrBlock, &remoteCidrBlock)
321+
if v, ok := d.GetOk("route_type"); ok {
322+
request.RouteType = helper.String(v.(string))
323+
}
324+
325+
//set up SecurityPolicyDatabases
326+
if v, ok := d.GetOk("security_group_policy"); ok {
327+
sgps := v.(*schema.Set).List()
328+
request.SecurityPolicyDatabases = make([]*vpc.SecurityPolicyDatabase, 0, len(sgps))
329+
for _, v := range sgps {
330+
m := v.(map[string]interface{})
331+
var sgp vpc.SecurityPolicyDatabase
332+
local := m["local_cidr_block"].(string)
333+
sgp.LocalCidrBlock = &local
334+
// list
335+
remoteCidrBlocks := m["remote_cidr_block"].(*schema.Set).List()
336+
for _, vv := range remoteCidrBlocks {
337+
remoteCidrBlock := vv.(string)
338+
sgp.RemoteCidrBlock = append(sgp.RemoteCidrBlock, &remoteCidrBlock)
339+
}
340+
request.SecurityPolicyDatabases = append(request.SecurityPolicyDatabases, &sgp)
334341
}
335-
request.SecurityPolicyDatabases = append(request.SecurityPolicyDatabases, &sgp)
336342
}
337343

338344
//set up IKEOptionsSpecification
@@ -397,6 +403,7 @@ func resourceTencentCloudVpnConnectionCreate(d *schema.ResourceData, meta interf
397403
if v, ok := d.GetOk("health_check_remote_ip"); ok {
398404
request.HealthCheckRemoteIp = helper.String(v.(string))
399405
}
406+
400407
var response *vpc.CreateVpnConnectionResponse
401408
err = resource.Retry(readRetryTimeout, func() *resource.RetryError {
402409
result, e := meta.(*TencentCloudClient).apiV3Conn.UseVpcClient().CreateVpnConnection(request)
@@ -573,7 +580,9 @@ func resourceTencentCloudVpnConnectionRead(d *schema.ResourceData, meta interfac
573580
_ = d.Set("customer_gateway_id", *connection.CustomerGatewayId)
574581
_ = d.Set("pre_share_key", *connection.PreShareKey)
575582
//set up SPD
576-
_ = d.Set("security_group_policy", flattenVpnSPDList(connection.SecurityPolicyDatabaseSet))
583+
if *connection.RouteType != ROUTE_TYPE_STATIC_ROUTE {
584+
_ = d.Set("security_group_policy", flattenVpnSPDList(connection.SecurityPolicyDatabaseSet))
585+
}
577586

578587
//set up IKE
579588
_ = d.Set("ike_proto_encry_algorithm", *connection.IKEOptionsSpecification.PropoEncryAlgorithm)
@@ -673,25 +682,24 @@ func resourceTencentCloudVpnConnectionUpdate(d *schema.ResourceData, meta interf
673682

674683
//set up SecurityPolicyDatabases
675684
if d.HasChange("security_group_policy") {
676-
sgps := d.Get("security_group_policy").(*schema.Set).List()
677-
if len(sgps) < 1 {
678-
return fmt.Errorf("Para `security_group_policy` should be set at least one.")
679-
}
680-
request.SecurityPolicyDatabases = make([]*vpc.SecurityPolicyDatabase, 0, len(sgps))
681-
for _, v := range sgps {
682-
m := v.(map[string]interface{})
683-
var sgp vpc.SecurityPolicyDatabase
684-
local := m["local_cidr_block"].(string)
685-
sgp.LocalCidrBlock = &local
686-
// list
687-
remoteCidrBlocks := m["remote_cidr_block"].(*schema.Set).List()
688-
for _, vv := range remoteCidrBlocks {
689-
remoteCidrBlock := vv.(string)
690-
sgp.RemoteCidrBlock = append(sgp.RemoteCidrBlock, &remoteCidrBlock)
685+
if v, ok := d.GetOk("security_group_policy"); ok {
686+
sgps := v.(*schema.Set).List()
687+
request.SecurityPolicyDatabases = make([]*vpc.SecurityPolicyDatabase, 0, len(sgps))
688+
for _, v := range sgps {
689+
m := v.(map[string]interface{})
690+
var sgp vpc.SecurityPolicyDatabase
691+
local := m["local_cidr_block"].(string)
692+
sgp.LocalCidrBlock = &local
693+
// list
694+
remoteCidrBlocks := m["remote_cidr_block"].(*schema.Set).List()
695+
for _, vv := range remoteCidrBlocks {
696+
remoteCidrBlock := vv.(string)
697+
sgp.RemoteCidrBlock = append(sgp.RemoteCidrBlock, &remoteCidrBlock)
698+
}
699+
request.SecurityPolicyDatabases = append(request.SecurityPolicyDatabases, &sgp)
691700
}
692-
request.SecurityPolicyDatabases = append(request.SecurityPolicyDatabases, &sgp)
701+
changeFlag = true
693702
}
694-
changeFlag = true
695703
}
696704

697705
if d.HasChange("dpd_enable") {

‎tencentcloud/resource_tc_vpn_connection_test.go‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,36 @@ func TestAccTencentCloudVpnConnectionResource_basic(t *testing.T) {
115115
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "enable_health_check", "false"),
116116
),
117117
},
118+
{
119+
Config: testAccVpnConnectionConfigUpdate3,
120+
Check: resource.ComposeTestCheckFunc(
121+
testAccCheckVpnConnectionExists("tencentcloud_vpn_connection.connection"),
122+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "name", "vpn_connection_test2"),
123+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "pre_share_key", "testt"),
124+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "tags.test", "testt"),
125+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_proto_encry_algorithm", "3DES-CBC"),
126+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_proto_authen_algorithm", "SHA"),
127+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_local_identity", "ADDRESS"),
128+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_remote_identity", "ADDRESS"),
129+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_dh_group_name", "GROUP2"),
130+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_exchange_mode", "AGGRESSIVE"),
131+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ike_sa_lifetime_seconds", "86401"),
132+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ipsec_encrypt_algorithm", "3DES-CBC"),
133+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ipsec_integrity_algorithm", "SHA1"),
134+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ipsec_pfs_dh_group", "NULL"),
135+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ipsec_sa_lifetime_seconds", "7200"),
136+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "ipsec_sa_lifetime_traffic", "2570"),
137+
resource.TestCheckResourceAttrSet("tencentcloud_vpn_connection.connection", "net_status"),
138+
resource.TestCheckResourceAttrSet("tencentcloud_vpn_connection.connection", "state"),
139+
resource.TestCheckResourceAttrSet("tencentcloud_vpn_connection.connection", "encrypt_proto"),
140+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "route_type", "StaticRoute"),
141+
resource.TestCheckResourceAttrSet("tencentcloud_vpn_connection.connection", "vpn_proto"),
142+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "dpd_enable", "1"),
143+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "dpd_timeout", "40"),
144+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "dpd_action", "restart"),
145+
resource.TestCheckResourceAttr("tencentcloud_vpn_connection.connection", "enable_health_check", "false"),
146+
),
147+
},
118148
},
119149
})
120150
}
@@ -378,3 +408,57 @@ resource "tencentcloud_vpn_connection" "connection" {
378408
enable_health_check = false
379409
}
380410
`
411+
412+
const testAccVpnConnectionConfigUpdate3 = `
413+
resource "tencentcloud_vpn_customer_gateway" "cgw" {
414+
name = "terraform_test"
415+
public_ip_address = "1.3.3.3"
416+
}
417+
418+
# Create VPC and Subnet
419+
data "tencentcloud_vpc_instances" "foo" {
420+
name = "Default-VPC"
421+
}
422+
423+
resource "tencentcloud_vpn_gateway" "vpn" {
424+
name = "terraform_update"
425+
vpc_id = data.tencentcloud_vpc_instances.foo.instance_list.0.vpc_id
426+
bandwidth = 5
427+
zone = "ap-guangzhou-3"
428+
429+
tags = {
430+
test = "test"
431+
}
432+
}
433+
resource "tencentcloud_vpn_connection" "connection" {
434+
name = "vpn_connection_test2"
435+
vpc_id = data.tencentcloud_vpc_instances.foo.instance_list.0.vpc_id
436+
vpn_gateway_id = tencentcloud_vpn_gateway.vpn.id
437+
customer_gateway_id = tencentcloud_vpn_customer_gateway.cgw.id
438+
pre_share_key = "testt"
439+
ike_proto_encry_algorithm = "3DES-CBC"
440+
ike_proto_authen_algorithm = "SHA"
441+
ike_local_identity = "ADDRESS"
442+
ike_exchange_mode = "AGGRESSIVE"
443+
ike_local_address = tencentcloud_vpn_gateway.vpn.public_ip_address
444+
ike_remote_identity = "ADDRESS"
445+
ike_remote_address = tencentcloud_vpn_customer_gateway.cgw.public_ip_address
446+
ike_dh_group_name = "GROUP2"
447+
ike_sa_lifetime_seconds = 86401
448+
ike_version = "IKEV2"
449+
ipsec_encrypt_algorithm = "3DES-CBC"
450+
ipsec_integrity_algorithm = "SHA1"
451+
ipsec_sa_lifetime_seconds = 7200
452+
ipsec_pfs_dh_group = "NULL"
453+
ipsec_sa_lifetime_traffic = 2570
454+
dpd_enable = 1
455+
dpd_timeout = "40"
456+
dpd_action = "restart"
457+
route_type = "StaticRoute"
458+
459+
tags = {
460+
test = "testt"
461+
}
462+
enable_health_check = false
463+
}
464+
`

‎website/docs/r/vpn_connection.html.markdown‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ The following arguments are supported:
5252
* `customer_gateway_id` - (Required, String, ForceNew) ID of the customer gateway.
5353
* `name` - (Required, String) Name of the VPN connection. The length of character is limited to 1-60.
5454
* `pre_share_key` - (Required, String) Pre-shared key of the VPN connection.
55-
* `security_group_policy` - (Required, Set) Security group policy of the VPN connection.
5655
* `vpn_gateway_id` - (Required, String, ForceNew) ID of the VPN gateway.
5756
* `dpd_action` - (Optional, String) The action after DPD timeout. Valid values: clear (disconnect) and restart (try again). It is valid when DpdEnable is 1.
5857
* `dpd_enable` - (Optional, Int) Specifies whether to enable DPD. Valid values: 0 (disable) and 1 (enable).
@@ -77,6 +76,8 @@ The following arguments are supported:
7776
* `ipsec_pfs_dh_group` - (Optional, String) PFS DH group. Valid value: `GROUP1`, `GROUP2`, `GROUP5`, `GROUP14`, `GROUP24`, `NULL`. Default value is `NULL`.
7877
* `ipsec_sa_lifetime_seconds` - (Optional, Int) SA lifetime of the IPSEC operation specification, unit is second. Valid value ranges: [180~604800]. Default value is 3600 seconds.
7978
* `ipsec_sa_lifetime_traffic` - (Optional, Int) SA lifetime of the IPSEC operation specification, unit is KB. The value should not be less then 2560. Default value is 1843200.
79+
* `route_type` - (Optional, String, ForceNew) Route type of the VPN connection. Valid value: `STATIC`, `StaticRoute`, `Policy`.
80+
* `security_group_policy` - (Optional, Set) SPD policy group, for example: {"10.0.0.5/24":["172.123.10.5/16"]}, 10.0.0.5/24 is the vpc intranet segment, and 172.123.10.5/16 is the IDC network segment. Users specify which network segments in the VPC can communicate with which network segments in your IDC.
8081
* `tags` - (Optional, Map) A list of tags used to associate different resources.
8182
* `vpc_id` - (Optional, String, ForceNew) ID of the VPC. Required if vpn gateway is not in `CCN` type, and doesn't make sense for `CCN` vpn gateway.
8283

@@ -94,7 +95,6 @@ In addition to all arguments above, the following attributes are exported:
9495
* `encrypt_proto` - Encrypt proto of the VPN connection.
9596
* `is_ccn_type` - Indicate whether is ccn type. Modification of this field only impacts force new logic of `vpc_id`. If `is_ccn_type` is true, modification of `vpc_id` will be ignored.
9697
* `net_status` - Net status of the VPN connection. Valid value: `AVAILABLE`.
97-
* `route_type` - Route type of the VPN connection.
9898
* `state` - State of the connection. Valid value: `PENDING`, `AVAILABLE`, `DELETING`.
9999
* `vpn_proto` - Vpn proto of the VPN connection.
100100

0 commit comments

Comments
 (0)