Merge pull request #17 from keyfactor-pub/store_fixes

feat: Certificate deployment resource

Author: spbsoluble

.github/workflows/release.yml

@@ -32,9 +32,9 @@ jobs:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v4
         with:
-          args: release --rm-dist
+          args: release --clean
         env:
           # GitHub sets the GITHUB_TOKEN secret automatically.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tests.yml

@@ -72,37 +72,37 @@ jobs:
       - run: go mod download
       - env:
           TF_ACC: "1"
-          KEYFACTOR_DEPLOY_CERT_STOREID1: "ef0b8005-63bf-42e8-aa3f-23bc94dcf611"
-          KEYFACTOR_DEPLOY_CERT_STOREID2: "ef0b8005-63bf-42e8-aa3f-23bc94dcf611"
-
           KEYFACTOR_HOSTNAME: ${{secrets.KEYFACTOR_HOSTNAME}}
           KEYFACTOR_USERNAME: ${{secrets.KEYFACTOR_USERNAME}}
           KEYFACTOR_PASSWORD: ${{secrets.KEYFACTOR_PASSWORD}}
           KEYFACTOR_DOMAIN: ${{secrets.KEYFACTOR_DOMAIN}}
 
-          KEYFACTOR_CERTIFICATE_ID: "26"
-          KEYFACTOR_CERTIFICATE_PASSWORD: ${{secrets.TEST_CERTIFICATE_PASS}}
-          KEYFACTOR_CERTIFICATE_TEMPLATE_NAME: "2YearTestWebServer"
-          KEYFACTOR_CERTIFICATE_CA_DOMAIN: "DC-CA.Command.local"
-          KEYFACTOR_CERTIFICATE_CA_NAME: "CommandCA1"
+          KEYFACTOR_CERTIFICATE_ID: ${{secrets.KEYFACTOR_CERTIFICATE_ID}}
+          KEYFACTOR_CERTIFICATE_PASSWORD: ${{secrets.KEYFACTOR_CERTIFICATE_PASSWORD}}
+          KEYFACTOR_CERTIFICATE_TEMPLATE_NAME: ${{secrets.KEYFACTOR_CERTIFICATE_TEMPLATE_NAME}}
+          KEYFACTOR_CERTIFICATE_CA_DOMAIN: ${{secrets.KEYFACTOR_CERTIFICATE_CA_DOMAIN}}
+          KEYFACTOR_CERTIFICATE_CA_NAME: ${{secrets.KEYFACTOR_CERTIFICATE_CA_NAME}}
 
-          KEYFACTOR_CERTIFICATE_STORE_ID: "ef0b8005-63bf-42e8-aa3f-23bc94dcf611"
-          KEYFACTOR_CERTIFICATE_STORE_CLIENT_MACHINE: "myorchestrator01"
-          KEYFACTOR_CERTIFICATE_STORE_ORCHESTRATOR_AGENT_ID: "c2b2084f-3d89-4ded-bb8b-b4e0e74d2b59"
-          KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID1: "2"
-          KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID2: "2"
+          KEYFACTOR_CERTIFICATE_STORE_ID: ${{secrets.KEYFACTOR_CERTIFICATE_STORE_ID}}
+          KEYFACTOR_CERTIFICATE_STORE_CLIENT_MACHINE: ${{secrets.KEYFACTOR_CERTIFICATE_STORE_CLIENT_MACHINE}}
+          KEYFACTOR_CERTIFICATE_STORE_ORCHESTRATOR_AGENT_ID: ${{secrets.KEYFACTOR_CERTIFICATE_STORE_ORCHESTRATOR_AGENT_ID}}
+          KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID1: ${{secrets.KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID1}}
+          KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID2: ${{secrets.KEYFACTOR_CERTIFICATE_STORE_CONTAINER_ID2}}
           KEYFACTOR_CERTIFICATE_STORE_PASS: ${{secrets.TEST_CERTSTORE_PASS}}
 
-          KEYFACTOR_SECURITY_ROLE_NAME: "TerraformTest"
+          KEYFACTOR_DEPLOY_CERT_STOREID1: ${{secrets.KEYFACTOR_DEPLOY_CERT_STOREID1}}
+          KEYFACTOR_DEPLOY_CERT_STOREID2: ${{secrets.KEYFACTOR_DEPLOY_CERT_STOREID2}}
+
+          KEYFACTOR_SECURITY_ROLE_NAME: ${{secrets.KEYFACTOR_SECURITY_ROLE_NAME}}
 
-          KEYFACTOR_SECURITY_IDENTITY_ACCOUNTNAME: 'COMMAND\\terraformer'
-          KEYFACTOR_SECURITY_IDENTITY_ROLE1: "EnrollPFX"
-          KEYFACTOR_SECURITY_IDENTITY_ROLE2: "Terraform"
+          KEYFACTOR_SECURITY_IDENTITY_ACCOUNTNAME: ${{secrets.KEYFACTOR_SECURITY_IDENTITY_ACCOUNTNAME}}
+          KEYFACTOR_SECURITY_IDENTITY_ROLE1: ${{secrets.KEYFACTOR_SECURITY_IDENTITY_ROLE1}}
+          KEYFACTOR_SECURITY_IDENTITY_ROLE2: ${{secrets.KEYFACTOR_SECURITY_IDENTITY_ROLE2}}
 
-          KEYFACTOR_TEMPLATE_ROLE_BINDING_ROLE_NAME: "Terraform"
-          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME1: "2YearTestWebServer"
-          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME2: "Workstation"
-          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME3: "User"
+          KEYFACTOR_TEMPLATE_ROLE_BINDING_ROLE_NAME: ${{secrets.KEYFACTOR_TEMPLATE_ROLE_BINDING_ROLE_NAME}}
+          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME1: ${{secrets.KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME1}}
+          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME2: ${{secrets.KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME2}}
+          KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME3: ${{secrets.KEYFACTOR_TEMPLATE_ROLE_BINDING_TEMPLATE_NAME3}}
 
         run: go test -v -cover ./keyfactor
         timeout-minutes: 10

.goreleaser.yml

@@ -28,7 +28,7 @@ builds:
   ignore:
     - goos: darwin
       goarch: '386'
-  binary: '{{ .ProjectName }}_v{{ .Version }}'
+  binary: '{{ .ProjectName }}'
 archives:
 - format: zip
   name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'

GNUmakefile

@@ -6,14 +6,15 @@ NAMESPACE=keyfactor
 WEBSITE_REPO=https://github.com/Keyfactor/terraform-provider-keyfactor
 NAME=keyfactor
 BINARY=terraform-provider-${NAME}
-VERSION=1.0.3
+VERSION=1.3.0
 OS_ARCH := $(shell go env GOOS)_$(shell go env GOARCH)
 BASEDIR := ~/.terraform.d/plugins
 INSTALLDIR := ${BASEDIR}/${HOSTNAME}/${NAMESPACE}/${NAME}/${VERSION}/${OS_ARCH}
 
 default: build
 
 build: fmtcheck
+	go mod tidy
 	go install
 
 tfdocs:
@@ -59,4 +60,17 @@ fmt:
 debug: install
 	@./scripts/gofmtcheck.sh
 
-.PHONY: build release install test testacc fmtcheck fmt
+setversion:
+	sed -i '' -e 's/VERSION = ".*"/VERSION = "$(VERSION)"/' keyfactor/version.go
+	@sed -i '' -e 's/TAG_VERSION=v*.*/TAG_VERSION=v$(VERSION)/' tag.sh
+
+vendor:
+	go mod vendor
+
+tag:
+	git tag -d v$(VERSION) || true
+	git push origin v$(VERSION) || true
+	git tag v$(VERSION) || true
+	git push origin v$(VERSION) || true
+
+.PHONY: build release install test testacc fmtcheck fmt tag setversion vendor

docs/data-sources/certificate.md

@@ -30,11 +30,12 @@ data "keyfactor_certificate" "protected_cert" {
 
 ### Required
 
-- `id` (Number) Keyfactor certificate ID
+- `id` (Number) Keyfactor certificate identifier.
 
 ### Optional
 
-- `key_password` (String, Sensitive) Password to protect certificate and private key with
+- `collection_id` (Number) Optional certificate collection identifier used to ensure user access to the certificate.
+- `key_password` (String, Sensitive) Optional, used to read the private key if it is password protected.
 - `metadata` (Map of String) Metadata key-value pairs to be attached to certificate
 
 ### Read-Only

docs/data-sources/certificate_store.md

@@ -53,7 +53,6 @@ output "iis_personal_metadata" {
 ### Read-Only
 
 - `agent_id` (String) String indicating the Keyfactor Command GUID of the orchestrator for the created store.
-- `certificates` (List of Number) A list of certificate IDs associated with the certificate store.
 - `client_machine` (String) Client machine name; value depends on certificate store type. See API reference guide
 - `container_id` (Number) Container identifier of the store's associated certificate store container.
 - `store_path` (String) Path to the new certificate store on a target. Format varies depending on type.

docs/resources/certificate.md

@@ -14,7 +14,7 @@ description: |-
 
 ```terraform
 provider "keyfactor" {
-  username = "COMMAND\\your_username"
+  username = "your_username"
   password = "your_api_password"
   hostname = "mykfinstance.kfdelivery.com"
   domain   = "mydomain.com"
@@ -89,6 +89,7 @@ resource "keyfactor_certificate" "kf_csr_cert" {
 
 ### Optional
 
+- `collection_id` (Number) Optional certificate collection identifier used to ensure user access to the certificate.
 - `csr` (String) Base-64 encoded certificate signing request (CSR)
 - `dns_sans` (List of String) List of DNS names to use as subjects of the certificate
 - `ip_sans` (List of String) List of DNS names to use as subjects of the certificate

docs/resources/certificate_deployment.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "keyfactor_certificate_deployment Resource - terraform-provider-keyfactor"
+subcategory: ""
+description: |-
+  
+---
+
+# keyfactor_certificate_deployment (Resource)
+
+
+
+## Example Usage
+
+```terraform
+provider "keyfactor" {
+  username = "COMMAND\\your_username"
+  password = "your_api_password"
+  hostname = "mykfinstance.kfdelivery.com"
+  domain   = "mydomain.com"
+}
+
+## PFX Enrollment
+resource "keyfactor_certificate" "pfx_cert" {
+  subject = {
+    subject_common_name = "ShortlivedTest7622-test"
+  }
+  dns_sans = ["ShortlivedTest7622-test"]
+
+  key_password          = "don't put secrets in code!" // Please don't use this password in production pass in an environmental variable or something
+  certificate_authority = "<test_domain>\\<test_ca>"
+  certificate_template  = "<my_template>"
+}
+
+# Deploy the created PFX certificate to all created cert stores
+resource "keyfactor_certificate_deployment" "pfx_cert" {
+  certificate_id       = keyfactor_certificate.pfx_cert.id # ID of the certificate to deploy
+  certificate_store_id = "<my_certstore_id>"               # ID of the certificate store to deploy to
+  certificate_alias    = "<my_cert_alias>"                 # Alias to use for the certificate in the store
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `certificate_alias` (String) A string providing an alias to be used for the certificate upon entry into the certificate store. The function of the alias varies depending on the certificate store type. Please ensure that the alias is lowercase, or problems can arise in Terraform Plan.
+- `certificate_id` (Number) Keyfactor certificate ID
+- `certificate_store_id` (String) A string containing the GUID for the certificate store to which the certificate should be added.
+
+### Optional
+
+- `key_password` (String, Sensitive) Password that protects PFX certificate, if the certificate was enrolled using PFX enrollment, or is password protected in general. This value cannot change, and Terraform will throw an error if a change is attempted.
+
+### Read-Only
+
+- `id` (String) A unique identifier for this certificate deployment.
+
+

docs/resources/certificate_store.md

@@ -60,7 +60,6 @@ resource "keyfactor_certificate_store" "iis_trusted_roots" {
 
 ### Read-Only
 
-- `certificates` (List of Number) A list of certificate IDs associated with the certificate store.
 - `id` (String) Keyfactor certificate store GUID.
 
 ## Import

examples/resources/keyfactor_certificate/resource.tf

@@ -1,5 +1,5 @@
 provider "keyfactor" {
-  username = "COMMAND\\your_username"
+  username = "your_username"
   password = "your_api_password"
   hostname = "mykfinstance.kfdelivery.com"
   domain   = "mydomain.com"
@@ -19,7 +19,7 @@ resource "keyfactor_certificate" "PFXCertificate" {
 
   # Optional SANs
   ip_sans      = ["192.168.123.2", "172.51.2.4"] # Optional IP SANs
-  dns_sans     = ["meow.example.com", "meow2"]   # Optional DNS SANs
+  dns_sans     = ["san1.example.com", "san2"]   # Optional DNS SANs
   key_password = "my certificate password!"
   # The password for the certificate. Note: This is bad practice, use TF_VAR_<variable_name> instead.
   certificate_authority = "COMMAND\\MY_CA_01" # Keyfactor CA to use to handle the certificate request.