Skip to content

Commit e7976c3

Browse files
simioasimioa
committed
Add Kibana CA Certs optional parameter
1 parent 53e466a commit e7976c3

File tree

5 files changed

+58
-4
lines changed

5 files changed

+58
-4
lines changed

‎docs/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ Optional:
185185
Optional:
186186

187187
- `api_key` (String, Sensitive) API Key to use for authentication to Kibana
188+
- `ca_certs` (List of String) A list of paths to CA certificates to validate the certificate presented by the Kibana server.
188189
- `endpoints` (List of String, Sensitive) A comma-separated list of endpoints where the terraform provider will point to, this must include the http(s) schema and port number.
189190
- `insecure` (Boolean) Disable TLS certificate validation
190191
- `password` (String, Sensitive) Password to use for API authentication to Kibana.

‎internal/clients/config/kibana.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"os"
66
"strconv"
7+
"strings"
78

89
"github.com/disaster37/go-kibana-rest/v8"
910
fwdiags "github.com/hashicorp/terraform-plugin-framework/diag"
@@ -45,6 +46,14 @@ func newKibanaConfigFromSDK(d *schema.ResourceData, base baseConfig) (kibanaConf
4546
}
4647
}
4748

49+
if caCerts, ok := kibConfig["ca_certs"].([]interface{}); ok && len(caCerts) > 0 {
50+
for _, elem := range caCerts {
51+
if vStr, elemOk := elem.(string); elemOk {
52+
config.CAs = append(config.CAs, vStr)
53+
}
54+
}
55+
}
56+
4857
if insecure, ok := kibConfig["insecure"]; ok && insecure.(bool) {
4958
config.DisableVerifySSL = true
5059
}
@@ -69,6 +78,9 @@ func newKibanaConfigFromFramework(ctx context.Context, cfg ProviderConfiguration
6978
}
7079
var endpoints []string
7180
diags := kibConfig.Endpoints.ElementsAs(ctx, &endpoints, true)
81+
82+
var cas []string
83+
diags.Append(kibConfig.CACerts.ElementsAs(ctx, &cas, true)...)
7284
if diags.HasError() {
7385
return kibanaConfig{}, diags
7486
}
@@ -77,6 +89,10 @@ func newKibanaConfigFromFramework(ctx context.Context, cfg ProviderConfiguration
7789
config.Address = endpoints[0]
7890
}
7991

92+
if len(cas) > 0 {
93+
config.CAs = cas
94+
}
95+
8096
config.DisableVerifySSL = kibConfig.Insecure.ValueBool()
8197
}
8298

@@ -88,6 +104,9 @@ func (k kibanaConfig) withEnvironmentOverrides() kibanaConfig {
88104
k.Password = withEnvironmentOverride(k.Password, "KIBANA_PASSWORD")
89105
k.ApiKey = withEnvironmentOverride(k.ApiKey, "KIBANA_API_KEY")
90106
k.Address = withEnvironmentOverride(k.Address, "KIBANA_ENDPOINT")
107+
if caCerts, ok := os.LookupEnv("KIBANA_CA_CERTS"); ok {
108+
k.CAs = strings.Split(caCerts, ",")
109+
}
91110

92111
if insecure, ok := os.LookupEnv("KIBANA_INSECURE"); ok {
93112
if insecureValue, err := strconv.ParseBool(insecure); err == nil {
@@ -104,6 +123,7 @@ func (k kibanaConfig) toFleetConfig() fleetConfig {
104123
Username: k.Username,
105124
Password: k.Password,
106125
APIKey: k.ApiKey,
126+
CACerts: k.CAs,
107127
Insecure: k.DisableVerifySSL,
108128
}
109129
}

‎internal/clients/config/kibana_test.go

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,15 +57,17 @@ func Test_newKibanaConfigFromSDK(t *testing.T) {
5757
"endpoints": []interface{}{"example.com/kibana"},
5858
"username": "kibana",
5959
"password": "baltic",
60-
"insecure": true,
60+
"ca_certs": []interface{}{"internal", "lets_decrypt"},
61+
"insecure": false,
6162
},
6263
},
6364
},
6465
expectedConfig: kibanaConfig{
6566
Address: "example.com/kibana",
6667
Username: "kibana",
6768
Password: "baltic",
68-
DisableVerifySSL: true,
69+
CAs: []string{"internal", "lets_decrypt"},
70+
DisableVerifySSL: false,
6971
},
7072
}
7173
},
@@ -86,6 +88,7 @@ func Test_newKibanaConfigFromSDK(t *testing.T) {
8688
"endpoints": []interface{}{"example.com/kibana"},
8789
"username": "kibana",
8890
"password": "baltic",
91+
"ca_certs": []interface{}{"internal", "lets_decrypt"},
8992
"insecure": true,
9093
},
9194
},
@@ -95,12 +98,14 @@ func Test_newKibanaConfigFromSDK(t *testing.T) {
9598
"KIBANA_USERNAME": "elastic",
9699
"KIBANA_PASSWORD": "thin-lines",
97100
"KIBANA_INSECURE": "false",
101+
"KIBANA_CA_CERTS": "black,sea",
98102
},
99103
expectedConfig: kibanaConfig{
100104
Address: "example.com/cabana",
101105
Username: "elastic",
102106
Password: "thin-lines",
103107
DisableVerifySSL: false,
108+
CAs: []string{"black", "sea"},
104109
},
105110
}
106111
},
@@ -114,6 +119,7 @@ func Test_newKibanaConfigFromSDK(t *testing.T) {
114119
os.Unsetenv("KIBANA_ENDPOINT")
115120
os.Unsetenv("KIBANA_INSECURE")
116121
os.Unsetenv("KIBANA_API_KEY")
122+
os.Unsetenv("KIBANA_CA_CERTS")
117123

118124
args := tt.args()
119125
rd := schema.TestResourceDataRaw(t, map[string]*schema.Schema{
@@ -177,15 +183,20 @@ func Test_newKibanaConfigFromFramework(t *testing.T) {
177183
Endpoints: types.ListValueMust(types.StringType, []attr.Value{
178184
types.StringValue("example.com/kibana"),
179185
}),
180-
Insecure: types.BoolValue(true),
186+
CACerts: types.ListValueMust(types.StringType, []attr.Value{
187+
types.StringValue("internal"),
188+
types.StringValue("lets_decrypt"),
189+
}),
190+
Insecure: types.BoolValue(false),
181191
},
182192
},
183193
},
184194
expectedConfig: kibanaConfig{
185195
Address: "example.com/kibana",
186196
Username: "kibana",
187197
Password: "baltic",
188-
DisableVerifySSL: true,
198+
CAs: []string{"internal", "lets_decrypt"},
199+
DisableVerifySSL: false,
189200
},
190201
}
191202
},
@@ -206,6 +217,7 @@ func Test_newKibanaConfigFromFramework(t *testing.T) {
206217
Endpoints: types.ListValueMust(types.StringType, []attr.Value{
207218
types.StringValue("example.com/kibana"),
208219
}),
220+
CACerts: types.ListValueMust(types.StringType, []attr.Value{}),
209221
Insecure: types.BoolValue(true),
210222
},
211223
},
@@ -236,6 +248,10 @@ func Test_newKibanaConfigFromFramework(t *testing.T) {
236248
Endpoints: types.ListValueMust(types.StringType, []attr.Value{
237249
types.StringValue("example.com/kibana"),
238250
}),
251+
CACerts: types.ListValueMust(types.StringType, []attr.Value{
252+
types.StringValue("internal"),
253+
types.StringValue("lets_decrypt"),
254+
}),
239255
Insecure: types.BoolValue(true),
240256
},
241257
},
@@ -245,11 +261,13 @@ func Test_newKibanaConfigFromFramework(t *testing.T) {
245261
"KIBANA_USERNAME": "elastic",
246262
"KIBANA_PASSWORD": "thin-lines",
247263
"KIBANA_INSECURE": "false",
264+
"KIBANA_CA_CERTS": "black,sea",
248265
},
249266
expectedConfig: kibanaConfig{
250267
Address: "example.com/cabana",
251268
Username: "elastic",
252269
Password: "thin-lines",
270+
CAs: []string{"black", "sea"},
253271
DisableVerifySSL: false,
254272
},
255273
}
@@ -263,6 +281,7 @@ func Test_newKibanaConfigFromFramework(t *testing.T) {
263281
os.Unsetenv("KIBANA_PASSWORD")
264282
os.Unsetenv("KIBANA_API_KEY")
265283
os.Unsetenv("KIBANA_ENDPOINT")
284+
os.Unsetenv("KIBANA_CA_CERTS")
266285
os.Unsetenv("KIBANA_INSECURE")
267286

268287
args := tt.args()

‎internal/clients/config/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ type KibanaConnection struct {
3030
ApiKey types.String `tfsdk:"api_key"`
3131
Endpoints types.List `tfsdk:"endpoints"`
3232
Insecure types.Bool `tfsdk:"insecure"`
33+
CACerts types.List `tfsdk:"ca_certs"`
3334
}
3435

3536
type FleetConnection struct {

‎internal/schema/connection.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,11 @@ func GetKbFWConnectionBlock() fwschema.Block {
163163
Sensitive: true,
164164
ElementType: types.StringType,
165165
},
166+
"ca_certs": fwschema.ListAttribute{
167+
MarkdownDescription: "A list of paths to CA certificates to validate the certificate presented by the Kibana server.",
168+
Optional: true,
169+
ElementType: types.StringType,
170+
},
166171
"insecure": fwschema.BoolAttribute{
167172
MarkdownDescription: "Disable TLS certificate validation",
168173
Optional: true,
@@ -397,6 +402,14 @@ func GetKibanaConnectionSchema() *schema.Schema {
397402
Type: schema.TypeString,
398403
},
399404
},
405+
"ca_certs": {
406+
Description: "A list of paths to CA certificates to validate the certificate presented by the Kibana server.",
407+
Type: schema.TypeList,
408+
Optional: true,
409+
Elem: &schema.Schema{
410+
Type: schema.TypeString,
411+
},
412+
},
400413
"insecure": {
401414
Description: "Disable TLS certificate validation",
402415
Type: schema.TypeBool,

0 commit comments

Comments
 (0)