Skip to content

Commit 171dd67

Browse files
likexianlikexian
authored
Merge pull request #479 from Sherlock-Holo/lite-rule-optimize
refactor: refine tencentcloud_security_group_lite_rule
2 parents 0098f3b + 18b7549 commit 171dd67

7 files changed

+170
-54
lines changed

‎.travis.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,6 @@ matrix:
2929
- go: tip
3030

3131
env:
32-
global: GOFLAGS=-mod=vendor
32+
global:
33+
- GOFLAGS=-mod=vendor
34+
- GO111MODULE=on

‎CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ ENHANCEMENTS:
1111
* Data Source: `tencentcloud_mongodb_instances` add new argument `charge_type` and `auto_renew_flag` to support prepaid type.
1212
* Resource: `tencentcloud_mongodb_instance` supports prepaid type, new mongodb SDK version `2019-07-25` and standby instance.
1313
* Resource: `tencentcloud_mongodb_sharding_instance` supports prepaid type, new mongodb SDK version `2019-07-25` and standby instance.
14-
14+
* Resource: `tencentcloud_security_group_lite_rule` refine update process and doc.
1515

1616
## 1.39.0 (July 18, 2020)
1717

‎GNUmakefile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,8 @@ ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
131131
echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), getting..."
132132
git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
133133
endif
134+
ln -sf ../../../../ext/providers/tencentcloud/website/docs $(GOPATH)/src/github.com/hashicorp/terraform-website/content/source/docs/providers/tencentcloud
135+
ln -sf ../../../ext/providers/tencentcloud/website/tencentcloud.erb $(GOPATH)/src/github.com/hashicorp/terraform-website/content/source/layouts/tencentcloud.erb
134136
@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
135137

136138
website-lint:
@@ -155,6 +157,8 @@ ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
155157
echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), getting..."
156158
git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
157159
endif
160+
ln -sf ../../../../ext/providers/tencentcloud/website/docs $(GOPATH)/src/github.com/hashicorp/terraform-website/content/source/docs/providers/tencentcloud
161+
ln -sf ../../../ext/providers/tencentcloud/website/tencentcloud.erb $(GOPATH)/src/github.com/hashicorp/terraform-website/content/source/layouts/tencentcloud.erb
158162
@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
159163

160164
.PHONY: build sweep test testacc fmt fmtcheck lint tools test-compile doc hooks website website-lint website-test

‎tencentcloud/resource_tc_security_group_lite_rule.go

Lines changed: 86 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
Provide a resource to create security group some lite rules quickly.
33
4-
-> **NOTE:** It can't be used with tencentcloud_security_group_rule.
4+
-> **NOTE:** It can't be used with tencentcloud_security_group_rule, and don't create multiple tencentcloud_security_group_rule resources, otherwise it may cause problems.
55
66
Example Usage
77
@@ -170,36 +170,103 @@ func resourceTencentCloudSecurityGroupLiteRuleUpdate(d *schema.ResourceData, m i
170170
service := VpcService{client: m.(*TencentCloudClient).apiV3Conn}
171171

172172
var (
173-
ingress []VpcSecurityGroupLiteRule
174-
egress []VpcSecurityGroupLiteRule
173+
ingress []VpcSecurityGroupLiteRule
174+
egress []VpcSecurityGroupLiteRule
175+
deleteIngress bool
176+
deleteEgress bool
175177
)
176178

177-
if raw, ok := d.GetOk("ingress"); ok {
178-
ingressStrs := helper.InterfacesStrings(raw.([]interface{}))
179-
for _, ingressStr := range ingressStrs {
180-
liteRule, err := parseRule(ingressStr)
181-
if err != nil {
182-
return err
179+
if d.HasChange("ingress") {
180+
if raw, ok := d.GetOk("ingress"); ok {
181+
ingressStrs := helper.InterfacesStrings(raw.([]interface{}))
182+
for _, ingressStr := range ingressStrs {
183+
liteRule, err := parseRule(ingressStr)
184+
if err != nil {
185+
return err
186+
}
187+
ingress = append(ingress, liteRule)
183188
}
184-
ingress = append(ingress, liteRule)
189+
} else {
190+
old, _ := d.GetChange("ingress")
191+
ingressStrs := helper.InterfacesStrings(old.([]interface{}))
192+
for _, ingressStr := range ingressStrs {
193+
liteRule, err := parseRule(ingressStr)
194+
if err != nil {
195+
return err
196+
}
197+
ingress = append(ingress, liteRule)
198+
}
199+
200+
deleteIngress = true
185201
}
186202
}
187203

188-
if raw, ok := d.GetOk("egress"); ok {
189-
egressStrs := helper.InterfacesStrings(raw.([]interface{}))
190-
for _, egressStr := range egressStrs {
191-
liteRule, err := parseRule(egressStr)
192-
if err != nil {
193-
return err
204+
if d.HasChange("egress") {
205+
if raw, ok := d.GetOk("egress"); ok {
206+
egressStrs := helper.InterfacesStrings(raw.([]interface{}))
207+
for _, egressStr := range egressStrs {
208+
liteRule, err := parseRule(egressStr)
209+
if err != nil {
210+
return err
211+
}
212+
egress = append(egress, liteRule)
194213
}
195-
egress = append(egress, liteRule)
214+
} else {
215+
old, _ := d.GetChange("egress")
216+
egressStrs := helper.InterfacesStrings(old.([]interface{}))
217+
for _, egressStr := range egressStrs {
218+
liteRule, err := parseRule(egressStr)
219+
if err != nil {
220+
return err
221+
}
222+
egress = append(egress, liteRule)
223+
}
224+
225+
deleteEgress = true
196226
}
197227
}
198228

199-
if err := service.AttachLiteRulesToSecurityGroup(ctx, id, ingress, egress); err != nil {
200-
return err
229+
d.Partial(true)
230+
231+
if deleteIngress && deleteEgress {
232+
if err := service.DetachAllLiteRulesFromSecurityGroup(ctx, id); err != nil {
233+
return err
234+
}
235+
236+
d.Partial(false)
237+
238+
return resourceTencentCloudSecurityGroupLiteRuleRead(d, m)
239+
}
240+
241+
if deleteIngress {
242+
if err := service.DeleteLiteRules(ctx, id, ingress, true); err != nil {
243+
return err
244+
}
245+
246+
d.SetPartial("ingress")
247+
248+
ingress = nil
201249
}
202250

251+
if deleteEgress {
252+
if err := service.DeleteLiteRules(ctx, id, egress, false); err != nil {
253+
return err
254+
}
255+
256+
d.SetPartial("egress")
257+
258+
egress = nil
259+
}
260+
261+
// if both len == 0, means both rules are deleted
262+
if len(ingress) > 0 || len(egress) > 0 {
263+
if err := service.modifyLiteRulesInSecurityGroup(ctx, id, ingress, egress); err != nil {
264+
return err
265+
}
266+
}
267+
268+
d.Partial(false)
269+
203270
return resourceTencentCloudSecurityGroupLiteRuleRead(d, m)
204271
}
205272

‎tencentcloud/resource_tc_security_group_lite_rule_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ import (
1111
)
1212

1313
func TestAccTencentCloudSecurityGroupLiteRule_basic(t *testing.T) {
14+
t.Parallel()
15+
1416
var liteRuleId string
1517

1618
resource.Test(t, resource.TestCase{
@@ -41,6 +43,8 @@ func TestAccTencentCloudSecurityGroupLiteRule_basic(t *testing.T) {
4143
}
4244

4345
func TestAccTencentCloudSecurityGroupLiteRule_update(t *testing.T) {
46+
t.Parallel()
47+
4448
var liteRuleId string
4549

4650
resource.Test(t, resource.TestCase{

‎tencentcloud/service_tencentcloud_vpc.go

Lines changed: 71 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1404,40 +1404,32 @@ func (me *VpcService) modifyLiteRulesInSecurityGroup(ctx context.Context, sgId s
14041404
request.SecurityGroupId = &sgId
14051405
request.SecurityGroupPolicySet = new(vpc.SecurityGroupPolicySet)
14061406

1407-
for _, in := range ingress {
1407+
for i := range egress {
14081408
policy := &vpc.SecurityGroupPolicy{
1409-
Protocol: helper.String(in.protocol),
1410-
CidrBlock: helper.String(in.cidrIp),
1411-
Action: helper.String(in.action),
1409+
Protocol: &egress[i].protocol,
1410+
CidrBlock: &egress[i].cidrIp,
1411+
Action: &egress[i].action,
14121412
}
14131413

1414-
if in.port != "" {
1415-
policy.Port = helper.String(in.port)
1414+
if egress[i].port != "" {
1415+
policy.Port = &egress[i].port
14161416
}
14171417

1418-
request.SecurityGroupPolicySet.Ingress = append(request.SecurityGroupPolicySet.Ingress, policy)
1418+
request.SecurityGroupPolicySet.Egress = append(request.SecurityGroupPolicySet.Egress, policy)
14191419
}
14201420

1421-
for _, eg := range egress {
1421+
for i := range ingress {
14221422
policy := &vpc.SecurityGroupPolicy{
1423-
Protocol: helper.String(eg.protocol),
1424-
CidrBlock: helper.String(eg.cidrIp),
1425-
Action: helper.String(eg.action),
1423+
Protocol: &ingress[i].protocol,
1424+
CidrBlock: &ingress[i].cidrIp,
1425+
Action: &ingress[i].action,
14261426
}
14271427

1428-
if eg.port != "" {
1429-
policy.Port = helper.String(eg.port)
1428+
if ingress[i].port != "" {
1429+
policy.Port = &ingress[i].port
14301430
}
14311431

1432-
request.SecurityGroupPolicySet.Egress = append(request.SecurityGroupPolicySet.Egress, policy)
1433-
}
1434-
1435-
// delete all rules
1436-
if len(request.SecurityGroupPolicySet.Ingress) == 0 && len(request.SecurityGroupPolicySet.Egress) == 0 {
1437-
request.SecurityGroupPolicySet.Ingress = nil
1438-
request.SecurityGroupPolicySet.Egress = nil
1439-
// 0 means delete all rules
1440-
request.SecurityGroupPolicySet.Version = helper.String("0")
1432+
request.SecurityGroupPolicySet.Ingress = append(request.SecurityGroupPolicySet.Ingress, policy)
14411433
}
14421434

14431435
return resource.Retry(writeRetryTimeout, func() *resource.RetryError {
@@ -1453,19 +1445,55 @@ func (me *VpcService) modifyLiteRulesInSecurityGroup(ctx context.Context, sgId s
14531445
})
14541446
}
14551447

1456-
func (me *VpcService) AttachLiteRulesToSecurityGroup(ctx context.Context, sgId string, ingress, egress []VpcSecurityGroupLiteRule) error {
1448+
func (me *VpcService) DeleteLiteRules(ctx context.Context, sgId string, rules []VpcSecurityGroupLiteRule, isIngress bool) error {
14571449
logId := getLogId(ctx)
14581450

1459-
// if we want to delete a direction rules, we must delete all and then attach we want rules again
1460-
if len(ingress) == 0 || len(egress) == 0 {
1461-
if err := me.DetachAllLiteRulesFromSecurityGroup(ctx, sgId); err != nil {
1462-
log.Printf("[CRITAL]%s attach lite rules to security group failed, reason: %v", logId, err)
1463-
return err
1451+
request := vpc.NewDeleteSecurityGroupPoliciesRequest()
1452+
request.SecurityGroupId = &sgId
1453+
request.SecurityGroupPolicySet = new(vpc.SecurityGroupPolicySet)
1454+
1455+
polices := make([]*vpc.SecurityGroupPolicy, 0, len(rules))
1456+
1457+
for i := range rules {
1458+
policy := &vpc.SecurityGroupPolicy{
1459+
Protocol: &rules[i].protocol,
1460+
CidrBlock: &rules[i].cidrIp,
1461+
Action: &rules[i].action,
1462+
}
1463+
1464+
if rules[i].port != "" {
1465+
policy.Port = &rules[i].port
14641466
}
1467+
1468+
polices = append(polices, policy)
14651469
}
14661470

1471+
if isIngress {
1472+
request.SecurityGroupPolicySet.Ingress = polices
1473+
} else {
1474+
request.SecurityGroupPolicySet.Egress = polices
1475+
}
1476+
1477+
return resource.Retry(writeRetryTimeout, func() *resource.RetryError {
1478+
ratelimit.Check(request.GetAction())
1479+
1480+
if _, err := me.client.UseVpcClient().DeleteSecurityGroupPolicies(request); err != nil {
1481+
log.Printf("[CRITAL]%s api[%s] fail, request body [%s], reason[%v]",
1482+
logId, request.GetAction(), request.ToJsonString(), err)
1483+
1484+
return retryError(err)
1485+
}
1486+
1487+
return nil
1488+
})
1489+
}
1490+
1491+
func (me *VpcService) AttachLiteRulesToSecurityGroup(ctx context.Context, sgId string, ingress, egress []VpcSecurityGroupLiteRule) error {
1492+
logId := getLogId(ctx)
1493+
14671494
if err := me.modifyLiteRulesInSecurityGroup(ctx, sgId, ingress, egress); err != nil {
14681495
log.Printf("[CRITAL]%s attach lite rules to security group failed, reason: %v", logId, err)
1496+
14691497
return err
14701498
}
14711499

@@ -1552,12 +1580,23 @@ func (me *VpcService) DescribeSecurityGroupPolices(ctx context.Context, sgId str
15521580
func (me *VpcService) DetachAllLiteRulesFromSecurityGroup(ctx context.Context, sgId string) error {
15531581
logId := getLogId(ctx)
15541582

1555-
if err := me.modifyLiteRulesInSecurityGroup(ctx, sgId, nil, nil); err != nil {
1556-
log.Printf("[CRITAL]%s detach all lite rules from security group failed, reason: %v", logId, err)
1557-
return err
1583+
request := vpc.NewModifySecurityGroupPoliciesRequest()
1584+
request.SecurityGroupId = &sgId
1585+
request.SecurityGroupPolicySet = &vpc.SecurityGroupPolicySet{
1586+
Version: helper.String("0"),
15581587
}
15591588

1560-
return nil
1589+
return resource.Retry(writeRetryTimeout, func() *resource.RetryError {
1590+
ratelimit.Check(request.GetAction())
1591+
1592+
if _, err := me.client.UseVpcClient().ModifySecurityGroupPolicies(request); err != nil {
1593+
log.Printf("[CRITAL]%s api[%s] fail, request body [%s], reason[%v]",
1594+
logId, request.GetAction(), request.ToJsonString(), err)
1595+
return retryError(err)
1596+
}
1597+
1598+
return nil
1599+
})
15611600
}
15621601

15631602
type securityGroupRuleBasicInfo struct {

‎website/docs/r/security_group_lite_rule.html.markdown

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ description: |-
1010

1111
Provide a resource to create security group some lite rules quickly.
1212

13-
-> **NOTE:** It can't be used with tencentcloud_security_group_rule.
13+
-> **NOTE:** It can't be used with tencentcloud_security_group_rule, and don't create multiple tencentcloud_security_group_rule resources, otherwise it may cause problems.
1414

1515
## Example Usage
1616

0 commit comments

Comments
 (0)