feat(albwaf): onboard WAF - #1612
Conversation
6cbea1f to
3a169c3
Compare
| mapvalidator.KeysAre( | ||
| stringvalidator.RegexMatches( | ||
| // Regex validates that no stackit- prefix is used | ||
| regexp.MustCompile(`^(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9_.-]{0,6}[a-zA-Z0-9]|(?:[a-rt-zA-Z0-9][a-zA-Z0-9_.-]{7}|s[a-su-zA-Z0-9_.-][a-zA-Z0-9_.-]{6}|st[b-zA-Z0-9_.-][a-zA-Z0-9_.-]{5}|sta[a-bd-zA-Z0-9_.-][a-zA-Z0-9_.-]{4}|stac[a-jl-zA-Z0-9_.-][a-zA-Z0-9_.-]{3}|stack[a-hj-zA-Z0-9_.-][a-zA-Z0-9_.-]{2}|stacki[a-su-zA-Z0-9_.-][a-zA-Z0-9_.-]|stackit[a-zA-Z0-9_.])[a-zA-Z0-9_.-]{0,54}[a-zA-Z0-9])$`), |
There was a problem hiding this comment.
This regex is ridiculously complex, but only because negative lookaheads not possible are using regexp.MustCompile.
d9fa9f6 to
5b601ad
Compare
| } | ||
| } | ||
| return &waf.UpdateWAFPayload{ | ||
| Name: model.Name.ValueString(), |
There was a problem hiding this comment.
Is the name in the update required? Based on the API docs, the update payload doesn't support a name attribute
There was a problem hiding this comment.
Not sure what you mean. Name is part of the path parameters and thus required
There was a problem hiding this comment.
Yes, but the path parameters are usually not set in the payload itself. For example, projectId and region are also part of the path parameters, but they aren't set here, what is also correct.
Looks like the payload is wrong generated. Here in the spec, you can see that name, region and projectId are actually readOnly attributes:
https://github.com/stackitcloud/stackit-api-specifications/blob/166aed4c740698347e3e1c71e69341f77ebd7abb/services/alb-waf/v1beta/alb-waf.json#L898-L920
This should be reported to the service team, so that they update their API spec accordingly.
There was a problem hiding this comment.
Ah yeah, i see now that the name is already declared in the first UpdateWAF call.
There was a problem hiding this comment.
Im simply gonna remove that argument, as it works without it anyway.
5b601ad to
ff1b28b
Compare
| //go:embed testdata/managed-rule-set.tf | ||
| managedRuleSetConfig string | ||
| //go:embed testdata/resource-max.tf | ||
| wafConfig string |
There was a problem hiding this comment.
In the acc tests the resources should be in independent tests. So for the managed rule set, it should remain like before and for the new waf_configuration, there should be a new test terraform config added with a separate test function.
Otherwise it will be difficult in the future to maintain it, when the test config grows with each new resource. In the new test config for waf_config, you can also add a waf_managed_rule_set. But there you don't need to add checks for the waf_managed_ruleset.
See for example the test configs of kms: https://github.com/stackitcloud/terraform-provider-stackit/tree/770998656083e829003cc3ed1c067739cc3033d3/stackit/internal/services/kms/testdata
There was a problem hiding this comment.
I see. I re-added the deleted test and minimized the checks for waf managed rule set from the max test
Relates to STACKITTPR-749
Relates to STACKITTPR-749
Relates to STACKITTPR-749
aefc49a to
a4e8a7d
Compare
Relates to STACKITTPR-749
a4e8a7d to
577c44b
Compare
Relates to STACKITTPR-749
Merging this branch changes the coverage (1 decrease, 1 increase)
Coverage by fileChanged files (no unit tests)
Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code. Changed unit test files
|
2 participants
Relates to STACKITTPR-749
Description
Onboards WAF
Checklist
make fmtexamples/directory)make generate-docs(will be checked by CI)make test(will be checked by CI)make lint(will be checked by CI)