Skip to content

Commit 63fdc17

Browse files
SevenEarthSevenEarth
authored
fix(provider): [121324945] Update provider auth (#3039)
* add * add * add * add * add * add * add
1 parent 4e15065 commit 63fdc17

File tree

3 files changed

+58
-25
lines changed

3 files changed

+58
-25
lines changed

‎.changelog/3039.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
provider: update provider auth
3+
```

‎tencentcloud/provider.go

Lines changed: 52 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package tencentcloud
33
import (
44
"encoding/json"
55
"fmt"
6-
"io/ioutil"
76
"net/url"
87
"os"
98
"runtime"
@@ -272,13 +271,13 @@ func Provider() *schema.Provider {
272271
Type: schema.TypeString,
273272
Required: true,
274273
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_SAML_ASSERTION, nil),
275-
Description: "SAML assertion information encoded in base64. It can be sourced from the `PROVIDER_ASSUME_ROLE_SAML_ASSERTION`.",
274+
Description: "SAML assertion information encoded in base64. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION`.",
276275
},
277276
"principal_arn": {
278277
Type: schema.TypeString,
279278
Required: true,
280279
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN, nil),
281-
Description: "Player Access Description Name. It can be sourced from the `PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN`.",
280+
Description: "Player Access Description Name. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN`.",
282281
},
283282
"role_arn": {
284283
Type: schema.TypeString,
@@ -324,7 +323,7 @@ func Provider() *schema.Provider {
324323
Type: schema.TypeString,
325324
Required: true,
326325
DefaultFunc: schema.EnvDefaultFunc(PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN, nil),
327-
Description: "OIDC token issued by IdP. It can be sourced from the `PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN`.",
326+
Description: "OIDC token issued by IdP. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN`.",
328327
},
329328
"role_arn": {
330329
Type: schema.TypeString,
@@ -2245,6 +2244,7 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
22452244
forbiddenAccountIds []string
22462245
needSecret = true
22472246
needAccountFilter = false
2247+
err error
22482248
)
22492249

22502250
if v, ok := d.GetOk("secret_id"); ok {
@@ -2325,7 +2325,10 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
23252325
// get auth from CAM role name
23262326
if camRoleName != "" {
23272327
needSecret = false
2328-
_ = genClientWithCAM(&tcClient, camRoleName)
2328+
err = genClientWithCAM(&tcClient, camRoleName)
2329+
if err != nil {
2330+
return nil, fmt.Errorf("Get auth from CAM role name failed. Reason: %s", err.Error())
2331+
}
23292332
}
23302333

23312334
var (
@@ -2337,17 +2340,20 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
23372340
)
23382341

23392342
// get assume role from credential
2340-
if providerConfig["role-arn"] != nil {
2341-
assumeRoleArn = providerConfig["role-arn"].(string)
2343+
if v, ok := providerConfig["role-arn"].(string); ok && v != "" {
2344+
assumeRoleArn = v
23422345
}
23432346

2344-
if providerConfig["role-session-name"] != nil {
2345-
assumeRoleSessionName = providerConfig["role-session-name"].(string)
2347+
if v, ok := providerConfig["role-session-name"].(string); ok && v != "" {
2348+
assumeRoleSessionName = v
23462349
}
23472350

23482351
if assumeRoleArn != "" && assumeRoleSessionName != "" {
23492352
assumeRoleSessionDuration = 7200
2350-
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy, assumeRoleExternalId)
2353+
err = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy, assumeRoleExternalId)
2354+
if err != nil {
2355+
return nil, fmt.Errorf("Get auth from assume role by credential failed. Reason: %s", err.Error())
2356+
}
23512357
}
23522358

23532359
// get assume role from env
@@ -2376,19 +2382,30 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
23762382

23772383
if envSamlAssertion == "" && envPrincipalArn == "" && envWebIdentityToken == "" {
23782384
// use assume role
2379-
_ = genClientWithSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, "", assumeRoleExternalId)
2385+
err = genClientWithSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, "", assumeRoleExternalId)
2386+
if err != nil {
2387+
return nil, fmt.Errorf("Get auth from assume role by env failed. Reason: %s", err.Error())
2388+
}
23802389
} else if envSamlAssertion != "" && envPrincipalArn != "" && envWebIdentityToken != "" {
2381-
return nil, fmt.Errorf("can not set `TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION`, `TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN`, `TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN` at the same time.\n")
2390+
return nil, fmt.Errorf("Can not set `TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION`, `TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN`, `TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN` at the same time.\n")
23822391
} else if envSamlAssertion != "" && envPrincipalArn != "" {
23832392
// use assume role with saml
2384-
_ = genClientWithSamlSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envSamlAssertion, envPrincipalArn)
2393+
err = genClientWithSamlSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envSamlAssertion, envPrincipalArn)
2394+
if err != nil {
2395+
return nil, fmt.Errorf("Get auth from assume role with SAML by env failed. Reason: %s", err.Error())
2396+
}
2397+
23852398
needSecret = false
23862399
} else if envWebIdentityToken != "" {
23872400
// use assume role with oidc
2388-
_ = genClientWithOidcSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envWebIdentityToken)
2401+
err = genClientWithOidcSTS(&tcClient, envRoleArn, envSessionName, assumeRoleSessionDuration, envWebIdentityToken)
2402+
if err != nil {
2403+
return nil, fmt.Errorf("Get auth from assume role with OIDC by env failed. Reason: %s", err.Error())
2404+
}
2405+
23892406
needSecret = false
23902407
} else {
2391-
return nil, fmt.Errorf("get `assume_role` from env error.\n")
2408+
return nil, fmt.Errorf("Get `assume_role` from env error.\n")
23922409
}
23932410
}
23942411

@@ -2403,7 +2420,11 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
24032420
assumeRolePolicy = assumeRole["policy"].(string)
24042421
assumeRoleExternalId = assumeRole["external_id"].(string)
24052422

2406-
_ = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy, assumeRoleExternalId)
2423+
err = genClientWithSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRolePolicy, assumeRoleExternalId)
2424+
if err != nil {
2425+
return nil, fmt.Errorf("Get auth from assume role failed. Reason: %s", err.Error())
2426+
}
2427+
24072428
if camRoleName != "" {
24082429
needSecret = false
24092430
} else {
@@ -2429,7 +2450,11 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
24292450
assumeRoleSessionName = assumeRoleWithSaml["session_name"].(string)
24302451
assumeRoleSessionDuration = assumeRoleWithSaml["session_duration"].(int)
24312452

2432-
_ = genClientWithSamlSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleSamlAssertion, assumeRolePrincipalArn)
2453+
err = genClientWithSamlSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleSamlAssertion, assumeRolePrincipalArn)
2454+
if err != nil {
2455+
return nil, fmt.Errorf("Get auth from assume role with SAML failed. Reason: %s", err.Error())
2456+
}
2457+
24332458
needSecret = false
24342459
}
24352460
}
@@ -2444,7 +2469,11 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
24442469
assumeRoleSessionName = assumeRoleWithWebIdentity["session_name"].(string)
24452470
assumeRoleSessionDuration = assumeRoleWithWebIdentity["session_duration"].(int)
24462471

2447-
_ = genClientWithOidcSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleWebIdentityToken)
2472+
err = genClientWithOidcSTS(&tcClient, assumeRoleArn, assumeRoleSessionName, assumeRoleSessionDuration, assumeRoleWebIdentityToken)
2473+
if err != nil {
2474+
return nil, fmt.Errorf("Get auth from assume role with OIDC failed. Reason: %s", err.Error())
2475+
}
2476+
24482477
needSecret = false
24492478
}
24502479
}
@@ -2453,8 +2482,9 @@ func providerConfigure(d *schema.ResourceData) (interface{}, error) {
24532482
if os.Getenv(POD_OIDC_TKE_REGION) != "" && os.Getenv(POD_OIDC_TKE_WEB_IDENTITY_TOKEN_FILE) != "" && os.Getenv(POD_OIDC_TKE_PROVIDER_ID) != "" && os.Getenv(POD_OIDC_TKE_ROLE_ARN) != "" {
24542483
err := genClientWithPodOidc(&tcClient)
24552484
if err != nil {
2456-
return nil, err
2485+
return nil, fmt.Errorf("Get auth from enable pod OIDC failed. Reason: %s", err.Error())
24572486
}
2487+
24582488
needSecret = false
24592489
} else {
24602490
return nil, fmt.Errorf("Can not get `TKE_REGION`, `TKE_WEB_IDENTITY_TOKEN_FILE`, `TKE_PROVIDER_ID`, `TKE_ROLE_ARN`. Must config serviceAccountName for pod.\n")
@@ -2623,7 +2653,7 @@ func getConfigFromProfile(d *schema.ResourceData, ProfileKey string) (interface{
26232653
providerConfig = make(map[string]interface{})
26242654
_, err = os.Stat(credentialPath)
26252655
if !os.IsNotExist(err) {
2626-
data, err := ioutil.ReadFile(credentialPath)
2656+
data, err := os.ReadFile(credentialPath)
26272657
if err != nil {
26282658
return nil, err
26292659
}
@@ -2643,7 +2673,7 @@ func getConfigFromProfile(d *schema.ResourceData, ProfileKey string) (interface{
26432673

26442674
_, err = os.Stat(configurePath)
26452675
if !os.IsNotExist(err) {
2646-
data, err := ioutil.ReadFile(configurePath)
2676+
data, err := os.ReadFile(configurePath)
26472677
if err != nil {
26482678
return nil, err
26492679
}
@@ -2707,7 +2737,7 @@ func getCallerIdentity(tcClient *TencentCloudClient) (indentity *sdksts.GetCalle
27072737
}
27082738

27092739
if response == nil || response.Response == nil {
2710-
return nil, fmt.Errorf("get GetCallerIdentity failed")
2740+
return nil, fmt.Errorf("Get GetCallerIdentity failed, Response is nil.")
27112741
}
27122742

27132743
indentity = response.Response

‎website/docs/index.html.markdown

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -395,11 +395,11 @@ The nested `assume_role_with_saml` block supports the following:
395395
* `role_arn` - (Required) The ARN of the role to assume. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_ARN` environment variable.
396396
* `session_name` - (Required) The session name to use when making the AssumeRole call. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME` environment variable.
397397
* `session_duration` - (Required) The duration of the session when making the AssumeRole call. Its value ranges from 0 to 43200(seconds), and default is 7200 seconds. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION` environment variable.
398-
* `saml_assertion` - (Required) SAML assertion information encoded in base64. It can be sourced from the `PROVIDER_ASSUME_ROLE_SAML_ASSERTION`.
399-
* `principal_arn` - (Required) Player Access Description Name. It can be sourced from the `PROVIDER_ASSUME_ROLE_PRINCIPAL_ARN`.
398+
* `saml_assertion` - (Required) SAML assertion information encoded in base64. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SAML_ASSERTION`.
399+
* `principal_arn` - (Required) Player Access Description Name. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_PRINCIPAL_ARN`.
400400

401401
The nested `assume_role_with_web_identity` block supports the following:
402402
* `role_arn` - (Required) The ARN of the role to assume. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_ARN` environment variable.
403403
* `session_name` - (Required) The session name to use when making the AssumeRole call. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_NAME` environment variable.
404404
* `session_duration` - (Required) The duration of the session when making the AssumeRole call. Its value ranges from 0 to 43200(seconds), and default is 7200 seconds. It can also be sourced from the `TENCENTCLOUD_ASSUME_ROLE_SESSION_DURATION` environment variable.
405-
* `web_identity_token` - (Required) OIDC token issued by IdP. It can be sourced from the `PROVIDER_ASSUME_ROLE_WEB_IDENTITY_TOKEN`.
405+
* `web_identity_token` - (Required) OIDC token issued by IdP. It can be sourced from the `TENCENTCLOUD_ASSUME_ROLE_WEB_IDENTITY_TOKEN`.

0 commit comments

Comments
 (0)