Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CIS - Delete filter on deletion of Firewall Rules #3963

Merged
merged 3 commits into from
Aug 17, 2022
Merged

CIS - Delete filter on deletion of Firewall Rules #3963

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6c143a3
delete filter along with firewall rule
Aug 11, 2022
d10d1f6
added partial check
Aug 17, 2022
07a2e54
removed optional
Aug 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions ibm/service/cis/data_source_ibm_cis_domain.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,10 +58,12 @@ func DataSourceIBMCISDomain() *schema.Resource {
cisDomainVerificationKey: {
Type: schema.TypeString,
Computed: true,
Optional: true,
},
cisDomainCnameSuffix: {
Type: schema.TypeString,
Computed: true,
Optional: true,
},
},
}
Expand Down Expand Up @@ -98,8 +100,11 @@ func dataSourceIBMCISDomainRead(d *schema.ResourceData, meta interface{}) error
d.Set(cisDomainOriginalNameServers, zone.OriginalNameServers)
d.Set(cisDomainID, *zone.ID)
d.Set(cisDomainType, *zone.Type)
d.Set(cisDomainVerificationKey, *zone.VerificationKey)
d.Set(cisDomainCnameSuffix, *zone.CnameSuffix)

if cisDomainType == "partial" {
d.Set(cisDomainVerificationKey, *zone.VerificationKey)
d.Set(cisDomainCnameSuffix, *zone.CnameSuffix)
}
zoneFound = true
}
}
Expand Down
11 changes: 8 additions & 3 deletions ibm/service/cis/resource_ibm_cis_domain.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,10 +71,12 @@ func ResourceIBMCISDomain() *schema.Resource {
cisDomainVerificationKey: {
Type: schema.TypeString,
Computed: true,
Optional: true,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this marked as optional we are just setting the value in Read method

},
cisDomainCnameSuffix: {
Type: schema.TypeString,
Computed: true,
Optional: true,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as above

},
},
Create: resourceCISdomainCreate,
Expand Down Expand Up @@ -135,8 +137,11 @@ func resourceCISdomainRead(d *schema.ResourceData, meta interface{}) error {
d.Set(cisDomainNameServers, result.Result.NameServers)
d.Set(cisDomainOriginalNameServers, result.Result.OriginalNameServers)
d.Set(cisDomainType, result.Result.Type)
d.Set(cisDomainVerificationKey, result.Result.VerificationKey)
d.Set(cisDomainCnameSuffix, result.Result.CnameSuffix)

if cisDomainType == "partial" {
d.Set(cisDomainVerificationKey, result.Result.VerificationKey)
d.Set(cisDomainCnameSuffix, result.Result.CnameSuffix)
}

return nil
}
Expand Down Expand Up @@ -207,7 +212,7 @@ func ResourceIBMCISDomainValidator() *validate.ResourceValidator {
ValidateFunctionIdentifier: validate.ValidateAllowedStringValue,
Type: validate.TypeString,
Optional: true,
AllowedValues: "full, parital"})
AllowedValues: "full, partial"})

ibmCISDomainResourceValidator := validate.ResourceValidator{
ResourceName: ibmCISDomain,
Expand Down
15 changes: 15 additions & 0 deletions ibm/service/cis/resource_ibm_cis_firewall_rules.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,21 @@ func ResourceIBMCISFirewallrulesDelete(context context.Context, d *schema.Resour
return diag.FromErr(fmt.Errorf("[ERROR] Error deleting the custom resolver %s:%s", err, response))
}

if id, ok := d.GetOk(cisFilterID); ok {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use same filterID forother rules. If we delete the filterID will not be other firewall rules not effected?
If user create a filter using Terraform is the destroy not handled to remove filter

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No we can not use same filter for other rules. It throws an error on creating a new rule with an already mapped filterID.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, destroy handles filter deletion but it does not cover old filters.


cisFilterClient, err := meta.(conns.ClientSession).CisFiltersSession()
if err != nil {
return nil
}

filter_id := id.(string)
filterOpt := cisFilterClient.NewDeleteFiltersOptions(xAuthtoken, crn, zoneID, filter_id)
_, _, err = cisFilterClient.DeleteFilters(filterOpt)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if a template deletes filter as part of destroy and when a firewall rule makes again same delete call willnot that fail with 404?
should we handle this case?
Can you write tempalte
which creates filter and use that filter in rule and then run destroy

if err != nil {
return diag.FromErr(fmt.Errorf("[ERROR] Error deleting Filter: %s", err))
}
}

d.SetId("")
return nil
}
Expand Down
2 changes: 1 addition & 1 deletion website/docs/r/cis_firewall_rules.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ description: |-
# ibm_cis_firewall_rules


Create, update, or delete a firewall rules for a domain that you included in your IBM Cloud Internet Services instance and a CIS domain resource. For more information, about CIS firewall rules resource, see [using fields, functions, and expressions](https://cloud.ibm.com/docs/cis?topic=cis-fields-and-expressions).
Create, update, or delete a firewall rules for a domain that you included in your IBM Cloud Internet Services instance and a CIS domain resource. For more information, about CIS firewall rules resource, see [using fields, functions, and expressions](https://cloud.ibm.com/docs/cis?topic=cis-fields-and-expressions). Note - Deletion of Firewall Rules will result in deletion of the respective Filter too.

## Example usage

Expand Down