Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add cn_validations property to pki_secret_backend_role #1820

Merged
merged 1 commit into from
Nov 26, 2024
Merged

Add cn_validations property to pki_secret_backend_role #1820

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ FEATURES:
* Update `vault_database_secret_backend_connection`to support `password_authentication` for PostgreSQL, allowing to encrypt password before being passed to PostgreSQL ([#2371](https://github.com/hashicorp/terraform-provider-vault/pull/2371))
* Add support for `external_id` field for the `vault_aws_auth_backend_sts_role` resource ([#2370](https://github.com/hashicorp/terraform-provider-vault/pull/2370))
* Add support for ACME configuration with the `vault_pki_secret_backend_config_acme` resource. Requires Vault 1.14+ ([#2157](https://github.com/hashicorp/terraform-provider-vault/pull/2157)).
* Update `vault_pki_secret_backend_role` to support the `cn_validations` role field ([#1820](https://github.com/hashicorp/terraform-provider-vault/pull/1820)).

## 4.5.0 (Nov 19, 2024)

Expand Down
2 changes: 1 addition & 1 deletion internal/consts/consts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -444,7 +444,7 @@ const (
FieldDefaultDirectoryPolicy = "default_directory_policy"
FieldDnsResolver = "dns_resolver"
FieldEabPolicy = "eab_policy"

FieldCnValidations = "cn_validations"
/*
common environment variables
*/
Expand Down
13 changes: 10 additions & 3 deletions vault/resource_pki_secret_backend_role.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ var pkiSecretListFields = []string{
consts.FieldAllowedSerialNumbers,
consts.FieldExtKeyUsage,
consts.FieldExtKeyUsageOIDs,
consts.FieldCnValidations,
}

var pkiSecretBooleanFields = []string{
Expand Down Expand Up @@ -423,9 +424,15 @@ func pkiSecretBackendRoleResource() *schema.Resource {
Required: false,
Optional: true,
Description: "Defines allowed Subject serial numbers.",
Elem: &schema.Schema{
Type: schema.TypeString,
},
Elem: &schema.Schema{Type: schema.TypeString},
},
consts.FieldCnValidations: {
Type: schema.TypeList,
Required: false,
Optional: true,
Computed: true,
Description: "Specify validations to run on the Common Name field of the certificate.",
Elem: &schema.Schema{Type: schema.TypeString},
},
consts.FieldAllowedUserIds: {
Type: schema.TypeList,
Expand Down
7 changes: 7 additions & 0 deletions vault/resource_pki_secret_backend_role_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,9 @@ func TestPkiSecretBackendRole_basic(t *testing.T) {
resource.TestCheckResourceAttr(resourceName, "not_before_duration", "45m"),
resource.TestCheckResourceAttr(resourceName, "policy_identifiers.#", "1"),
resource.TestCheckResourceAttr(resourceName, "policy_identifiers.0", "1.2.3.4"),
resource.TestCheckResourceAttr(resourceName, "cn_validations.#", "2"),
resource.TestCheckTypeSetElemAttr(resourceName, "cn_validations.*", "email"),
resource.TestCheckTypeSetElemAttr(resourceName, "cn_validations.*", "hostname"),
}
resource.Test(t, resource.TestCase{
ProviderFactories: providerFactories,
Expand Down Expand Up @@ -320,6 +323,8 @@ func TestPkiSecretBackendRole_basic(t *testing.T) {
resource.TestCheckResourceAttr(resourceName, "policy_identifiers.0", "1.2.3.4"),
resource.TestCheckResourceAttr(resourceName, "basic_constraints_valid_for_non_ca", "false"),
resource.TestCheckResourceAttr(resourceName, "not_before_duration", "45m"),
resource.TestCheckResourceAttr(resourceName, "cn_validations.#", "1"),
resource.TestCheckTypeSetElemAttr(resourceName, "cn_validations.*", "disabled"),
),
},
{
Expand Down Expand Up @@ -391,6 +396,7 @@ resource "vault_pki_secret_backend_role" "test" {
basic_constraints_valid_for_non_ca = false
not_before_duration = "45m"
allowed_serial_numbers = ["*"]
cn_validations = ["email", "hostname"]
bmhughes marked this conversation as resolved.
Show resolved Hide resolved
}
`, path, name, roleTTL, maxTTL, extraConfig)
}
Expand Down Expand Up @@ -446,6 +452,7 @@ resource "vault_pki_secret_backend_role" "test" {
basic_constraints_valid_for_non_ca = false
not_before_duration = "45m"
allowed_serial_numbers = ["*"]
cn_validations = ["disabled"]
}`, path, name, policyIdentifiers)
}

Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/pki_secret_backend_role.html.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,8 @@ The following arguments are supported:

* `client_flag` - (Optional) Flag to specify certificates for client use

* `cn_validations` - (Optional) Validations to run on the Common Name field of the certificate, choices: `email`, `hostname`, `disabled`

* `code_signing_flag` - (Optional) Flag to specify certificates for code signing use

* `email_protection_flag` - (Optional) Flag to specify certificates for email protection use
Expand Down