Add support for service-intentions config entries

CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2.11.0 (Unreleased)
+
+NEW FEATURES:
+
+* The `consul_config_entry` can now be used to manage Consul service intentions ([[#232](https://github.com/hashicorp/terraform-provider-consul/issues/232)] and [[#235](https://github.com/hashicorp/terraform-provider-consul/issues/235)]).
+
 ## 2.10.1 (October 22, 2020)
 
 BUG FIXES:

consul/resource_consul_config_entry.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"reflect"
 	"strings"
+	"time"
 
 	consulapi "github.com/hashicorp/consul/api"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
@@ -53,7 +54,7 @@ func resourceConsulConfigEntryUpdate(d *schema.ResourceData, meta interface{}) e
 
 	wOpts := &consulapi.WriteOptions{}
 	if _, _, err := configEntries.Set(configEntry, wOpts); err != nil {
-		return fmt.Errorf("Failed to set '%s' config entry: %#v", name, err)
+		return fmt.Errorf("Failed to set '%s' config entry: %v", name, err)
 	}
 	qOpts := &consulapi.QueryOptions{}
 	_, _, err = configEntries.Get(configEntry.GetKind(), configEntry.GetName(), qOpts)
@@ -208,7 +209,10 @@ func decodeConfigEntry(raw map[string]interface{}) (consulapi.ConfigEntry, error
 	}
 
 	decodeConf := &mapstructure.DecoderConfig{
-		DecodeHook:       mapstructure.StringToTimeDurationHookFunc(),
+		DecodeHook: mapstructure.ComposeDecodeHookFunc(
+			mapstructure.StringToTimeDurationHookFunc(),
+			mapstructure.StringToTimeHookFunc(time.RFC3339),
+		),
 		Result:           &entry,
 		WeaklyTypedInput: true,
 		ErrorUnused:      true,

consul/resource_consul_config_entry_test.go

@@ -23,7 +23,7 @@ func TestAccConsulConfigEntry_basic(t *testing.T) {
 	extraConf := ""
 	configJSONServiceDefaults := "{\"Expose\":{},\"MeshGateway\":{},\"Protocol\":\"https\"}"
 	configJSONProxyDefaults := "{\"Config\":{\"foo\":\"bar\"},\"Expose\":{},\"MeshGateway\":{}}"
-	configJSONServiceRouter := "{\"Routes\":[{\"Destination\":{\"Service\":\"admin\"},\"Match\":{\"HTTP\":{\"PathPrefix\":\"/admin\"}}}]}"
+	configJSONServiceRouter := "{\"Routes\":[{\"Destination\":{\"Namespace\":\"default\",\"Service\":\"admin\"},\"Match\":{\"HTTP\":{\"PathPrefix\":\"/admin\"}}}]}"
 	configJSONServiceSplitter := "{\"Splits\":[{\"ServiceSubset\":\"v1\",\"Weight\":90},{\"ServiceSubset\":\"v2\",\"Weight\":10}]}"
 	configJSONServiceResolver := "{\"DefaultSubset\":\"v1\",\"Subsets\":{\"v1\":{\"Filter\":\"Service.Meta.version == v1\"},\"v2\":{\"Filter\":\"Service.Meta.version == v2\"}}}"
 	configJSONIngressGateway := "{\"Listeners\":[{\"Port\":8000,\"Protocol\":\"http\",\"Services\":[{\"Hosts\":null,\"Name\":\"*\"}]}],\"TLS\":{\"Enabled\":true}}"
@@ -33,7 +33,7 @@ func TestAccConsulConfigEntry_basic(t *testing.T) {
 		extraConf = `Namespace: "default"`
 		configJSONServiceDefaults = "{\"Expose\":{},\"MeshGateway\":{},\"Namespace\":\"default\",\"Protocol\":\"https\"}"
 		configJSONProxyDefaults = "{\"Config\":{\"foo\":\"bar\"},\"Expose\":{},\"MeshGateway\":{},\"Namespace\":\"default\"}"
-		configJSONServiceRouter = "{\"Namespace\":\"default\",\"Routes\":[{\"Destination\":{\"Service\":\"admin\"},\"Match\":{\"HTTP\":{\"PathPrefix\":\"/admin\"}}}]}"
+		configJSONServiceRouter = "{\"Namespace\":\"default\",\"Routes\":[{\"Destination\":{\"Namespace\":\"default\",\"Service\":\"admin\"},\"Match\":{\"HTTP\":{\"PathPrefix\":\"/admin\"}}}]}"
 		configJSONServiceSplitter = "{\"Namespace\":\"default\",\"Splits\":[{\"ServiceSubset\":\"v1\",\"Weight\":90},{\"ServiceSubset\":\"v2\",\"Weight\":10}]}"
 		configJSONServiceResolver = "{\"DefaultSubset\":\"v1\",\"Namespace\":\"default\",\"Subsets\":{\"v1\":{\"Filter\":\"Service.Meta.version == v1\"},\"v2\":{\"Filter\":\"Service.Meta.version == v2\"}}}"
 		configJSONIngressGateway = "{\"Listeners\":[{\"Port\":8000,\"Protocol\":\"http\",\"Services\":[{\"Hosts\":null,\"Name\":\"*\",\"Namespace\":\"default\"}]}],\"Namespace\":\"default\",\"TLS\":{\"Enabled\":true}}"
@@ -119,6 +119,41 @@ func TestAccConsulConfigEntry_basic(t *testing.T) {
 					resource.TestCheckResourceAttr("consul_config_entry.terminating_gateway", "config_json", configJSONTerminatingGateway),
 				),
 			},
+			{
+				Config: testAccConsulConfigEntry_ServiceConfigL4(extraConf),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "name", "api-service"),
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "kind", "service-intentions"),
+				),
+			},
+			{
+				Config: testAccConsulConfigEntry_ServiceConfigL7(extraConf),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "name", "fort-knox"),
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "kind", "service-intentions"),
+				),
+			},
+			{
+				Config: testAccConsulConfigEntry_ServiceConfigL7b(extraConf),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "name", "api"),
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "kind", "service-intentions"),
+				),
+			},
+			{
+				Config: testAccConsulConfigEntry_ServiceConfigL7gRPC(extraConf),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "name", "billing"),
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "kind", "service-intentions"),
+				),
+			},
+			{
+				Config: testAccConsulConfigEntry_ServiceConfigL7Mixed(extraConf),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "name", "api"),
+					resource.TestCheckResourceAttr("consul_config_entry.service_intentions", "kind", "service-intentions"),
+				),
+			},
 		},
 	})
 }
@@ -230,7 +265,8 @@ resource "consul_config_entry" "service_router" {
 				}
 
 				Destination = {
-					Service = consul_config_entry.admin_service_defaults.name
+					Namespace = "default"
+					Service   = consul_config_entry.admin_service_defaults.name
 				}
 			}
 			# NOTE: a default catch-all will send unmatched traffic to "web"
@@ -380,3 +416,260 @@ resource "consul_config_entry" "terminating_gateway" {
 }
 `, extraConf, extraConf)
 }
+
+func testAccConsulConfigEntry_ServiceConfigL4(extraConf string) string {
+	return fmt.Sprintf(`
+resource "consul_config_entry" "service_intentions" {
+	name = "api-service"
+	kind = "service-intentions"
+
+	config_json = jsonencode({
+		%s
+		Sources = [
+			{
+				%s
+				Action     = "allow"
+				Name       = "frontend-webapp"
+				Precedence = 9
+				Type       = "consul"
+			},
+            {
+				%s
+				Action     = "allow"
+				Name       = "nightly-cronjob"
+				Precedence = 9
+				Type       = "consul"
+			}
+		]
+	})
+}
+`, extraConf, extraConf, extraConf)
+}
+
+func testAccConsulConfigEntry_ServiceConfigL7(extraConf string) string {
+	return fmt.Sprintf(`
+resource "consul_config_entry" "sd" {
+	name = "fort-knox"
+	kind = "service-defaults"
+
+	config_json = jsonencode({
+		%s
+		Protocol = "http"
+	})
+}
+
+resource "consul_config_entry" "service_intentions" {
+	name = consul_config_entry.sd.name
+	kind = "service-intentions"
+
+	config_json = jsonencode({
+		%s
+		Sources = [
+			{
+				%s
+				Name        = "contractor-webapp"
+				Permissions = [
+					{
+						Action = "allow"
+						HTTP   = {
+							Methods   = ["GET", "HEAD"]
+							PathExact = "/healtz"
+						}
+					}
+				]
+				Precedence = 9
+				Type       = "consul"
+			},
+			{
+				%s
+				Name        = "admin-dashboard-webapp",
+				Permissions = [
+					{
+						Action = "deny",
+						HTTP = {
+							PathPrefix= "/debugz"
+						}
+					},
+					{
+						Action= "allow"
+						HTTP = {
+							PathPrefix= "/"
+						}
+					}
+				],
+				Precedence = 9
+				Type       = "consul"
+			}
+		]
+	})
+}
+`, extraConf, extraConf, extraConf, extraConf)
+}
+
+func testAccConsulConfigEntry_ServiceConfigL7b(extraConf string) string {
+	return fmt.Sprintf(`
+resource "consul_config_entry" "sd" {
+	name = "api"
+	kind = "service-defaults"
+
+	config_json = jsonencode({
+		%s
+		Protocol = "http"
+	})
+}
+
+resource "consul_config_entry" "service_intentions" {
+	name = consul_config_entry.sd.name
+	kind = "service-intentions"
+
+	config_json = jsonencode({
+		%s
+		Sources = [
+			{
+				%s
+				Name        = "admin-dashboard"
+				Permissions = [
+					{
+						Action = "allow"
+						HTTP = {
+							Methods    = ["GET", "PUT", "POST", "DELETE", "HEAD"]
+							PathPrefix = "/v2"
+						}
+					}
+				],
+				Precedence = 9
+				Type = "consul"
+			},
+			{
+				%s
+				Name = "report-generator"
+				Permissions = [
+					{
+						Action = "allow"
+						HTTP = {
+							Methods = ["GET"]
+							PathPrefix = "/v2/widgets"
+						}
+					}
+				],
+				Precedence = 9,
+				Type = "consul"
+			}
+		]
+	})
+}
+`, extraConf, extraConf, extraConf, extraConf)
+}
+
+func testAccConsulConfigEntry_ServiceConfigL7gRPC(extraConf string) string {
+	return fmt.Sprintf(`
+resource "consul_config_entry" "sd" {
+	name = "billing"
+	kind = "service-defaults"
+
+	config_json = jsonencode({
+		%s
+		Protocol = "grpc"
+	})
+}
+
+resource "consul_config_entry" "service_intentions" {
+	name = consul_config_entry.sd.name
+	kind = "service-intentions"
+
+	config_json = jsonencode({
+		%s
+		Sources = [
+			{
+				%s
+				Name = "frontend-web"
+				Permissions = [
+					{
+						Action = "deny"
+						HTTP = {
+							PathExact = "/mycompany.BillingService/IssueRefund"
+						}
+					},
+					{
+						Action = "allow"
+						HTTP = {
+							PathPrefix = "/mycompany.BillingService/"
+						}
+					}
+				],
+				Precedence = 9
+				Type = "consul"
+			},
+			{
+				%s
+				Name = "support-portal"
+				Permissions = [
+					{
+						Action = "allow"
+						HTTP = {
+							PathPrefix = "/mycompany.BillingService/"
+						}
+					}
+				],
+				Precedence = 9
+				Type = "consul"
+			}
+		]
+	})
+}
+`, extraConf, extraConf, extraConf, extraConf)
+}
+
+func testAccConsulConfigEntry_ServiceConfigL7Mixed(extraConf string) string {
+	return fmt.Sprintf(`
+resource "consul_config_entry" "sd" {
+	name = "api"
+	kind = "service-defaults"
+
+	config_json = jsonencode({
+		%s
+		Protocol = "grpc"
+	})
+}
+
+resource "consul_config_entry" "service_intentions" {
+	name = consul_config_entry.sd.name
+	kind = "service-intentions"
+
+	config_json = jsonencode({
+		%s
+		Sources = [
+			{
+				%s
+				Action     = "deny"
+				Name       = "hackathon-project"
+				Precedence = 9
+				Type       = "consul"
+			},
+			{
+				%s
+				Action     = "allow"
+				Name       = "web"
+				Precedence = 9
+				Type       = "consul"
+			},
+			{
+				%s
+				Name = "nightly-reconciler"
+				Permissions = [
+					{
+						Action = "allow"
+						HTTP = {
+							Methods   = ["POST"]
+							PathExact = "/v1/reconcile-data"
+						}
+					}
+				]
+				Precedence = 9
+				Type       = "consul"
+			}
+		]
+	})
+}
+`, extraConf, extraConf, extraConf, extraConf, extraConf)
+}

consul/resource_consul_intention.go

@@ -18,6 +18,9 @@ func resourceConsulIntention() *schema.Resource {
 			State: schema.ImportStatePassthrough,
 		},
 
+		DeprecationMessage: `The consul_intention resource is deprecated in favor of the consul_config_entry resource.
+Please see https://registry.terraform.io/providers/hashicorp/consul/latest/docs/guides/upgrading#upgrading-to-2110 on instructions to upgrade.`,
+
 		Schema: map[string]*schema.Schema{
 			"source_name": {
 				Type:     schema.TypeString,
@@ -39,11 +42,13 @@ func resourceConsulIntention() *schema.Resource {
 
 			"destination_name": {
 				Type:     schema.TypeString,
+				ForceNew: true,
 				Required: true,
 			},
 
 			"destination_namespace": {
 				Type:     schema.TypeString,
+				ForceNew: true,
 				Optional: true,
 				Default:  "default",
 			},