Skip to content

Commit 5c22d78

Browse files
iac-agentVanHWZ
andauthored
feat(mqtt): [134192551]support x509_mode parameter for configuring X509 certificate mode (#4136)
* feat(mqtt): support `x509_mode` parameter for configuring X509 certificate mode --------- Co-authored-by: vincenthuangwz <van136682262@gmail.com>
1 parent 228133f commit 5c22d78

16 files changed

Lines changed: 755 additions & 56 deletions

File tree

.changelog/4136.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/tencentcloud_mqtt_instance: support `x509_mode` parameter for configuring X509 certificate mode
3+
```

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ require (
123123
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/ga2 v1.3.102
124124
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/gwlb v1.0.1127
125125
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/igtm v1.3.29
126-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.7
126+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.98
127127
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/oceanus v1.0.831
128128
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/region v1.3.40
129129
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tcss v1.1.50

go.sum

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -923,7 +923,6 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.42/go.mod h
923923
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.46/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
924924
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.50/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
925925
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.1.51/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
926-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.7/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
927926
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.8/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
928927
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.15/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
929928
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.3.16/go.mod h1:r5r4xbfxSaeR04b166HGsBa/R4U3SueirEUpXGuw+Q0=
@@ -1023,8 +1022,8 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/monitor v1.3.101 h1:r8P
10231022
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/monitor v1.3.101/go.mod h1:+cX4PEEehIIbyHy9plpXOTShlFWtc9OC1AWcmOrOMT8=
10241023
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mps v1.3.45 h1:35PD/GXaOl3QhL1fI5a3Q+jcenzR1PqfuGxltOeO48w=
10251024
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mps v1.3.45/go.mod h1:OrNv7U7R19HZySH5o+/ag3EyAH1tDIwb5z23K5fY5vw=
1026-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.7 h1:ms2KfUZ9OYiKx75dqPaOuBTj6QoCJC90FN10d1gr720=
1027-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.7/go.mod h1:YaxLTxKrYsem1/u6sciHzJVuxA78ZoBTz9BmNQp/jPU=
1025+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.98 h1:fhhDusB0ahB2Pu8ng0MuHAaNC+Y6yYl5K/btmUc4Z/c=
1026+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/mqtt v1.3.98/go.mod h1:dZ83BWokoZjrCdH2YpS7Q3vSsrJwh0uwwdVxIyyFKA4=
10281027
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/oceanus v1.0.831 h1:oyazF5wgAgoinGo/SDGfUReE3JFxqcpI6/pstWhK7yE=
10291028
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/oceanus v1.0.831/go.mod h1:2WuTlTnKCnZoa6l0JxY9GNfo0UG6nU7AEsljF8rMMsM=
10301029
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/organization v1.3.89 h1:blUboAc01iSj9pcQzHi1dazs8ZzZdchJLFUKr9TbAtQ=
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
schema: spec-driven
2+
created: 2026-05-25
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
## Context
2+
3+
`tencentcloud_mqtt_instance` 是管理 MQTT 实例的 Terraform 资源,支持 CRUD 操作。云 API `ModifyInstance` 接口支持 `X509Mode` 参数用于设置 TLS 认证模式,`DescribeInstance` 响应中返回 `X509Mode` 字段。
4+
5+
SDK 中相关定义:
6+
- `ModifyInstanceRequestParams.X509Mode *string` — TLS:单向认证 / mTLS:双向认证 / BYOC:一机一证
7+
- `DescribeInstanceResponseParams.X509Mode *string` — 同上
8+
9+
注意:`CreateInstance` 接口不支持 `X509Mode` 参数,因此需要在创建完成后通过 `ModifyInstance` 设置。
10+
11+
## Goals / Non-Goals
12+
13+
**Goals:**
14+
-`tencentcloud_mqtt_instance` 资源中新增 `x509_mode` 参数(Optional, Computed, TypeString)
15+
- 在 Create 中,等待实例 RUNNING 后通过 ModifyInstance 设置 `X509Mode`
16+
- 在 Update 中,当 `x509_mode` 发生变更时通过 ModifyInstance 更新
17+
- 在 Read 中,从 DescribeInstance 响应读取并设置到 state
18+
- 更新单元测试
19+
20+
**Non-Goals:**
21+
- 不支持在 CreateInstance 接口中直接设置(API 不支持)
22+
- 不修改其他 MQTT 相关资源
23+
24+
## Decisions
25+
26+
1. **Schema 定义**: `x509_mode``TypeString``Optional: true``Computed: true`。Optional 因为用户可以选择性配置;Computed 因为可从 API 读回。
27+
28+
2. **Create 实现**: 复用已有的 "创建后 ModifyInstance" 模式。在实例创建并等待 RUNNING 状态后,与 `automatic_activation`/`authorization_policy` 一起通过 ModifyInstance 设置。
29+
30+
3. **Update 实现**: 将 `x509_mode` 加入 mutableArgs 列表,在 ModifyInstance 请求中设置 `request.X509Mode`
31+
32+
4. **Read 实现**: 当 `respData.X509Mode` 不为 nil 时,设置到 state。
33+
34+
## Risks / Trade-offs
35+
36+
- [风险] 创建后立即修改可能在极端情况下失败 → 已有重试机制覆盖
37+
- [风险] `X509Mode` 设置为 `mTLS``BYOC` 时可能需要先配置证书 → 由用户确保前置条件满足
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
## Why
2+
3+
MQTT 实例的 ModifyInstance 接口和 DescribeInstance 接口支持 `X509Mode` 字段(TLS 认证模式:TLS 单向认证 / mTLS 双向认证 / BYOC 一机一证),需要在 Terraform 资源 `tencentcloud_mqtt_instance` 中支持该参数,使用户可以通过 Terraform 配置和修改实例的 X509 认证模式。
4+
5+
## What Changes
6+
7+
-`tencentcloud_mqtt_instance` 资源的 Schema 中新增 `x509_mode` 参数(Optional, Computed, TypeString),可选值为 `TLS``mTLS``BYOC`
8+
- 在资源的 Create 方法中,创建实例并等待 RUNNING 状态后,通过 ModifyInstance 接口设置 `x509_mode`
9+
- 在资源的 Update 方法中,当 `x509_mode` 发生变更时,通过 ModifyInstance 接口更新
10+
- 在资源的 Read 方法中,从 DescribeInstance 响应中读取 `X509Mode` 并设置到 state
11+
12+
## Capabilities
13+
14+
### New Capabilities
15+
16+
- `mqtt-instance-x509-mode`: 为 tencentcloud_mqtt_instance 资源新增 x509_mode 参数,支持通过 ModifyInstance 设置和修改 X509 认证模式,通过 DescribeInstance 读取当前值
17+
18+
### Modified Capabilities
19+
20+
## Impact
21+
22+
- `tencentcloud/services/mqtt/resource_tc_mqtt_instance.go`: 新增 schema 字段,修改 Create/Read/Update 逻辑
23+
- `tencentcloud/services/mqtt/resource_tc_mqtt_instance_test.go`: 新增单元测试
24+
- `.changelog/4136.txt`: 更新 changelog
Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
## ADDED Requirements
2+
3+
### Requirement: X509Mode 参数支持
4+
5+
资源 `tencentcloud_mqtt_instance` 必须支持 `x509_mode` 参数(Optional, Computed, TypeString),可选值为 `TLS`(单向认证)、`mTLS`(双向认证)、`BYOC`(一机一证),通过 ModifyInstance 接口设置和更新,通过 DescribeInstance 接口读取。
6+
7+
#### Scenario: Create instance with x509_mode specified
8+
- **WHEN** 用户在资源配置中指定 `x509_mode`
9+
- **THEN** 系统先创建实例并等待 RUNNING 状态
10+
- **AND** 然后通过 ModifyInstance 接口设置 `X509Mode` 字段
11+
12+
#### Scenario: Create instance without x509_mode
13+
- **WHEN** 用户未指定 `x509_mode`
14+
- **THEN** 不通过 ModifyInstance 设置 `X509Mode`(除非有其他需要 Modify 的参数)
15+
- **AND** Read 时从 DescribeInstance 读取 API 返回的默认值
16+
17+
#### Scenario: Read x509_mode from DescribeInstance response
18+
- **WHEN** 执行资源的 Read 操作
19+
- **THEN** 从 DescribeInstance 响应中读取 `X509Mode` 字段
20+
- **AND** 如果不为 nil,设置到 state
21+
22+
#### Scenario: Update x509_mode
23+
- **WHEN** 用户修改 `x509_mode` 的值
24+
- **THEN** 通过 ModifyInstance 接口更新 `X509Mode` 字段
25+
- **AND** 通过 Read(DescribeInstance)验证更新成功
26+
27+
#### Scenario: Import existing instance with x509_mode
28+
- **WHEN** 用户导入已有 MQTT 实例
29+
- **THEN** 正确读取并填充 `x509_mode` 到 state
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## 1. Schema 与 CRUD 逻辑
2+
3+
- [x] 1.1 在 `tencentcloud/services/mqtt/resource_tc_mqtt_instance.go` 的 Schema 中新增 `x509_mode` 参数(Optional, Computed, TypeString)
4+
- [x] 1.2 在 Create 方法中,等待实例 RUNNING 后通过 ModifyInstance 设置 `X509Mode`
5+
- [x] 1.3 在 Update 方法中,当 `x509_mode` 变更时通过 ModifyInstance 更新
6+
- [x] 1.4 在 Read 方法中,从 DescribeInstance 响应读取 `X509Mode` 并设置到 state
7+
8+
## 2. 单元测试
9+
10+
- [x] 2.1 在 `tencentcloud/services/mqtt/resource_tc_mqtt_instance_test.go` 中新增 `x509_mode` 相关的单元测试(Read 正常值、Read nil、Schema 定义验证)
11+
12+
## 3. 文档与变更记录
13+
14+
- [x] 3.1 更新 `.changelog/4136.txt``x509_mode` 参数说明
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# mqtt-instance-x509-mode Specification
2+
3+
## Purpose
4+
支持通过 `tencentcloud_mqtt_instance` 资源的 `x509_mode` 参数配置 MQTT 实例的 X509 认证模式(TLS/mTLS/BYOC)。
5+
6+
## Requirements
7+
### Requirement: X509Mode 参数支持
8+
9+
资源 `tencentcloud_mqtt_instance` 必须支持 `x509_mode` 参数(Optional, Computed, TypeString),可选值为 `TLS`(单向认证)、`mTLS`(双向认证)、`BYOC`(一机一证),通过 ModifyInstance 接口设置和更新,通过 DescribeInstance 接口读取。
10+
11+
#### Scenario: Create instance with x509_mode specified
12+
- **WHEN** 用户在资源配置中指定 `x509_mode`
13+
- **THEN** 系统先创建实例并等待 RUNNING 状态
14+
- **AND** 然后通过 ModifyInstance 接口设置 `X509Mode` 字段
15+
16+
#### Scenario: Create instance without x509_mode
17+
- **WHEN** 用户未指定 `x509_mode`
18+
- **THEN** 不通过 ModifyInstance 设置 `X509Mode`
19+
- **AND** Read 时从 DescribeInstance 读取 API 返回的默认值
20+
21+
#### Scenario: Read x509_mode from DescribeInstance response
22+
- **WHEN** 执行资源的 Read 操作
23+
- **THEN** 从 DescribeInstance 响应中读取 `X509Mode` 字段并设置到 state
24+
25+
#### Scenario: Update x509_mode
26+
- **WHEN** 用户修改 `x509_mode` 的值
27+
- **THEN** 通过 ModifyInstance 接口更新 `X509Mode` 字段
28+
29+
#### Scenario: Import existing instance with x509_mode
30+
- **WHEN** 用户导入已有 MQTT 实例
31+
- **THEN** 正确读取并填充 `x509_mode` 到 state

tencentcloud/services/mqtt/resource_tc_mqtt_instance.go

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,13 @@ func ResourceTencentCloudMqttInstance() *schema.Resource {
119119
Default: false,
120120
Description: "Indicate whether to force delete the instance. Default is `false`. If set true, the instance will be permanently deleted instead of being moved into the recycle bin. Note: only works for `PREPAID` instance.",
121121
},
122+
123+
"x509_mode": {
124+
Type: schema.TypeString,
125+
Optional: true,
126+
Computed: true,
127+
Description: "X509 certificate mode. Valid values: `TLS` (one-way authentication), `mTLS` (two-way authentication), `BYOC` (one device one certificate).",
128+
},
122129
},
123130
}
124131
}
@@ -237,6 +244,7 @@ func ResourceTencentCloudMqttInstanceCreate(d *schema.ResourceData, meta interfa
237244
var (
238245
isAutomaticActivation bool
239246
isAuthorizationPolicy bool
247+
x509Mode string
240248
)
241249

242250
if v, ok := d.GetOkExists("automatic_activation"); ok {
@@ -247,12 +255,19 @@ func ResourceTencentCloudMqttInstanceCreate(d *schema.ResourceData, meta interfa
247255
isAuthorizationPolicy = v.(bool)
248256
}
249257

250-
// open automatic_activation or authorization_policy
251-
if isAutomaticActivation || isAuthorizationPolicy {
258+
if v, ok := d.GetOk("x509_mode"); ok {
259+
x509Mode = v.(string)
260+
}
261+
262+
// open automatic_activation or authorization_policy or set x509_mode
263+
if isAutomaticActivation || isAuthorizationPolicy || x509Mode != "" {
252264
modifyRequest := mqttv20240516.NewModifyInstanceRequest()
253265
modifyRequest.InstanceId = &instanceId
254266
modifyRequest.AutomaticActivation = helper.Bool(isAutomaticActivation)
255267
modifyRequest.AuthorizationPolicy = helper.Bool(isAuthorizationPolicy)
268+
if x509Mode != "" {
269+
modifyRequest.X509Mode = helper.String(x509Mode)
270+
}
256271
reqErr := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
257272
result, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseMqttV20240516Client().ModifyInstanceWithContext(ctx, modifyRequest)
258273
if e != nil {
@@ -346,6 +361,10 @@ func ResourceTencentCloudMqttInstanceRead(d *schema.ResourceData, meta interface
346361
_ = d.Set("authorization_policy", respData.AuthorizationPolicy)
347362
}
348363

364+
if respData.X509Mode != nil {
365+
_ = d.Set("x509_mode", respData.X509Mode)
366+
}
367+
349368
forceDelete := false
350369
if v, ok := d.GetOkExists("force_delete"); ok {
351370
forceDelete = v.(bool)
@@ -380,7 +399,7 @@ func ResourceTencentCloudMqttInstanceUpdate(d *schema.ResourceData, meta interfa
380399
}
381400

382401
needChange := false
383-
mutableArgs := []string{"name", "remark", "sku_code", "device_certificate_provision_type", "automatic_activation", "authorization_policy"}
402+
mutableArgs := []string{"name", "remark", "sku_code", "device_certificate_provision_type", "automatic_activation", "authorization_policy", "x509_mode"}
384403
for _, v := range mutableArgs {
385404
if d.HasChange(v) {
386405
needChange = true
@@ -411,6 +430,10 @@ func ResourceTencentCloudMqttInstanceUpdate(d *schema.ResourceData, meta interfa
411430
request.AuthorizationPolicy = helper.Bool(v.(bool))
412431
}
413432

433+
if v, ok := d.GetOk("x509_mode"); ok {
434+
request.X509Mode = helper.String(v.(string))
435+
}
436+
414437
reqErr := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
415438
result, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseMqttV20240516Client().ModifyInstanceWithContext(ctx, request)
416439
if e != nil {

0 commit comments

Comments
 (0)