terraspace_plugin_azurerm 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8704700ce76610490c5f29da3091ea5b9b14489911095418deb51561920f2062
-  data.tar.gz: e60b1a62a544c6cbc21838c13c41c93541806786600c85620a650e45a0aa7ae2
+  metadata.gz: 8c595d865e64d26fdc4fa827ef247aae21266701bdf2afcf5438c6458d50d96e
+  data.tar.gz: a3bdfe44206f463c945d5f416c81529d77c9507b676f27654b1071aa6da0c7fd
 SHA512:
-  metadata.gz: f800a5c07d7ce75482b99b7ee459d8a87c9607e99086d149b83cc8cb81618a569906480df8c9b2457a81a4a4374eef0d2bcab7224998c894161f6e041e9444b3
-  data.tar.gz: 5ffcda4941b3b43d275d907861606b5c20f6cf76a570169c6369c2093e1a7dc4c0022180f7df6de33d1c135fdfcb73de61896f78ab186705f231fe1e73ac5a66
+  metadata.gz: 67fdfe608c63b99cea0b1dfa29cc131c68df2b8651428800fb9d085aba3747bd99d29757551b74828693d323f7378cd580bd38b5b195a43920f7c844d3409a70
+  data.tar.gz: b675685420ced87b9b21504b011d332987569a2cc94ff91de6cde41ca8e6a5dd72ec99e2551274de45bc1ed537c75e4a2c76e565e23018b8a86843cbd73c7416

data/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/).
 
+## [0.4.0] - 2022-01-05
+- [#11](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/11) fix tags config in README
+- [#13](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/13) data management and security features
+- [#8](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/8) Add config.tags
+
+## [0.3.3] - 2022-01-04
+- [#10](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/10) azure_secret support expansion automatically
+
+## [0.3.2] - 2021-11-29
+- [#9](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/9) change starter resource_group_name to have env
+
+## [0.3.1] - 2021-04-15
+- update azure_info dependency
+
 ## [0.3.0] - 2020-11-15
 - [#5](https://github.com/boltops-tools/terraspace_plugin_azurerm/pull/5) helper and secrets support
 - azure_secret helper

data/README.md

@@ -22,6 +22,8 @@ TerraspacePluginAzurerm.configure do |config|
 
   config.storage_account.sku.name = "Standard_LRS"
   config.storage_account.sku.tier = "Standard"
+
+  config.tags = {env: Terraspace.env, terraspace: true}
 end
 ```
 

data/lib/templates/hcl/project/config/terraform/backend.tf

@@ -2,7 +2,7 @@
 # This is useful because azure storage account names are not allowed special characters and are limited to 24 chars.
 terraform {
   backend "azurerm" {
-    resource_group_name  = "<%= expansion('terraform-resources-:LOCATION') %>"
+    resource_group_name  = "<%= expansion(':ENV-:LOCATION') %>"
     storage_account_name = "<%= expansion('ts:SUBSCRIPTION_HASH:LOCATION:ENV') %>"
     container_name       = "terraform-state"
     key                  = "<%= expansion(':LOCATION/:ENV/:BUILD_DIR/terraform.tfstate') %>"

data/lib/terraspace_plugin_azurerm/clients/options.rb

@@ -3,18 +3,6 @@ module TerraspacePluginAzurerm::Clients
     extend Memoist
 
     def client_options
-      o = base_client_options
-      o[:credentials] = credentials
-      o
-    end
-
-    def credentials
-      o = base_client_options
-      provider = MsRestAzure::ApplicationTokenProvider.new(o[:tenant_id], o[:client_id], o[:client_secret])
-      MsRest::TokenCredentials.new(provider)
-    end
-
-    def base_client_options
       # AZURE_* is used by ruby generally.
       # ARM_* is used by Terraform azurerm provider: https://www.terraform.io/docs/providers/azurerm/index.html
       # Favor ARM_ because this plugin is designed for Terraspace.
@@ -32,7 +20,7 @@ module TerraspacePluginAzurerm::Clients
       validate_base_options!(o)
       o
     end
-    memoize :base_client_options
+    memoize :client_options
 
     def validate_base_options!(options)
       vars = []

data/lib/terraspace_plugin_azurerm/clients/storage.rb

@@ -6,12 +6,10 @@ module TerraspacePluginAzurerm::Clients
     extend Memoist
 
     # Include SDK modules to ease access to Storage classes.
-    include Azure::Storage::Mgmt::V2019_06_01
-    include Azure::Storage::Mgmt::V2019_06_01::Models
+    include Azure::Storage::Profiles::Latest::Mgmt
+    include Azure::Storage::Profiles::Latest::Mgmt::Models
 
-    def storage_accounts
-      mgmt.storage_accounts
-    end
+    delegate :storage_accounts, :blob_services, :blob_containers, to: :mgmt
 
     def blob_containers
       BlobContainers.new(mgmt)
@@ -19,7 +17,7 @@ module TerraspacePluginAzurerm::Clients
     memoize :blob_containers
 
     def mgmt
-      client = StorageManagementClient.new(credentials)
+      client = Client.new(client_options)
       client.subscription_id = client_options[:subscription_id]
       client
     end

data/lib/terraspace_plugin_azurerm/interfaces/backend/resource_group_creator.rb

@@ -20,6 +20,7 @@ class TerraspacePluginAzurerm::Interfaces::Backend
       resource_group = ResourceGroup.new
       resource_group.name = @resource_group_name
       resource_group.location = config.location || AzureInfo.location
+      resource_group.tags = config.tags
       resource_groups.create_or_update(@resource_group_name, resource_group)
     end
 

data/lib/terraspace_plugin_azurerm/interfaces/backend/storage_account.rb

@@ -6,8 +6,11 @@ class TerraspacePluginAzurerm::Interfaces::Backend
     def create
       if exist?
         logger.debug "Storage Account #{@storage_account_name} already exists"
+        update_storage_account if config.storage_account.update_existing
+        set_blob_service_properties if config.storage_account.configure_data_protection_for_existing
       else
         create_storage_account
+        set_blob_service_properties
       end
     end
 
@@ -32,16 +35,29 @@ class TerraspacePluginAzurerm::Interfaces::Backend
       end
     end
 
+    def update_storage_account
+      logger.debug "Updating Storage Account #{@storage_account_name}..."
+      storage_accounts.update(@resource_group_name, @storage_account_name, storage_account_update_params)
+    end
+
     def create_storage_account
       logger.info "Creating Storage Account #{@storage_account_name}..."
-      storage_accounts.create(@resource_group_name, @storage_account_name, storage_account_params)
+      storage_accounts.create(@resource_group_name, @storage_account_name, storage_account_create_params)
     end
 
-    def storage_account_params
+    def storage_account_create_params
       params = StorageAccountCreateParameters.new
       params.location = config.location || azure_info.location # IE: eastus
       params.sku = sku
+      params.allow_blob_public_access = config.storage_account.allow_blob_public_access
       params.kind = Kind::StorageV2
+      params.tags = config.tags
+      params
+    end
+
+    def storage_account_update_params
+      params = StorageAccountUpdateParameters.new
+      params.allow_blob_public_access = config.storage_account.allow_blob_public_access
       params
     end
 
@@ -51,5 +67,27 @@ class TerraspacePluginAzurerm::Interfaces::Backend
       sku.tier = config.storage_account.sku.tier
       sku
     end
+
+    def set_blob_service_properties
+      blob_services.set_service_properties(@resource_group_name, @storage_account_name, blob_service_properties)
+    end
+
+    def blob_service_properties
+      props = BlobServiceProperties.new
+
+      sa = config.storage_account
+      policy = DeleteRetentionPolicy.new
+      policy.days = sa.container_delete_retention_policy.days || sa.delete_retention_policy.days
+      policy.enabled = sa.container_delete_retention_policy.enabled || sa.delete_retention_policy.enabled
+      props.container_delete_retention_policy = policy # containers
+
+      policy = DeleteRetentionPolicy.new
+      policy.days = sa.blob_delete_retention_policy.days || sa.delete_retention_policy.days
+      policy.enabled = sa.blob_delete_retention_policy.enabled || sa.delete_retention_policy.enabled
+      props.delete_retention_policy = policy # blobs
+
+      props.is_versioning_enabled = sa.is_versioning_enabled
+      props
+    end
   end
 end

data/lib/terraspace_plugin_azurerm/interfaces/config.rb

@@ -13,14 +13,36 @@ module TerraspacePluginAzurerm::Interfaces
     # must return an ActiveSupport::OrderedOptions
     def defaults
       c = ActiveSupport::OrderedOptions.new
+
       c.auto_create = true
       c.location = nil # AzureInfo.location not assigned here so it can be lazily inferred
+
       c.secrets = ActiveSupport::OrderedOptions.new
       c.secrets.vault = nil
+
       c.storage_account = ActiveSupport::OrderedOptions.new
+      c.storage_account.update_existing = false
       c.storage_account.sku = ActiveSupport::OrderedOptions.new
       c.storage_account.sku.name = "Standard_LRS"
       c.storage_account.sku.tier = "Standard"
+      c.storage_account.allow_blob_public_access = false # Azure default is true
+
+      # data protection management
+      c.storage_account.configure_data_protection_for_existing = false
+      c.storage_account.delete_retention_policy = ActiveSupport::OrderedOptions.new
+      c.storage_account.delete_retention_policy.days = 365
+      c.storage_account.delete_retention_policy.enabled = true
+      # overrides the setting above
+      c.storage_account.blob_delete_retention_policy = ActiveSupport::OrderedOptions.new
+      c.storage_account.blob_delete_retention_policy.days = nil
+      c.storage_account.blob_delete_retention_policy.enabled = nil
+      c.storage_account.container_delete_retention_policy = ActiveSupport::OrderedOptions.new
+      c.storage_account.container_delete_retention_policy.days = nil
+      c.storage_account.container_delete_retention_policy.enabled = nil
+      c.storage_account.is_versioning_enabled = true
+
+      c.tags = {}
+
       c
     end
   end

data/lib/terraspace_plugin_azurerm/interfaces/helper/secret/fetcher.rb

@@ -4,11 +4,14 @@ class TerraspacePluginAzurerm::Interfaces::Helper::Secret
   class Fetcher
     class Error < StandardError; end
     class VaultNotFoundError < Error; end
+    class VaultNotConfiguredError < Error; end
 
     include TerraspacePluginAzurerm::Logging
     include TerraspacePluginAzurerm::Clients::Options
+    extend Memoist
 
-    def initialize
+    def initialize(mod, options={})
+      @mod, @options = mod, options
       o = base_client_options
       @client_id     = o[:client_id]
       @client_secret = o[:client_secret]
@@ -20,16 +23,21 @@ class TerraspacePluginAzurerm::Interfaces::Helper::Secret
       get_secret(name, opts)
     end
 
-    def get_secret(name, vault: nil, version: nil)
+    def get_secret(name, options={})
+      vault = options[:vault]
+      version = options[:version]
       unless token
         return "ERROR: Unable to authorize and get the temporary token. Double check your ARM_ env variables."
       end
 
       version = "/#{version}" if version
+      check_vault_configured!(vault)
       vault_subdomain = vault.downcase
       # Using Azure REST API since the old gem doesnt support secrets https://github.com/Azure/azure-sdk-for-ruby
       # https://docs.microsoft.com/en-us/rest/api/keyvault/getsecret/getsecret
+      name = expansion(name) if expand?
       url = "https://#{vault_subdomain}.vault.azure.net/secrets/#{name}#{version}?api-version=7.1"
+      logger.debug "Azure vault url #{url}"
       uri = URI(url)
       req = Net::HTTP::Get.new(uri)
       req["Authorization"] = token
@@ -55,6 +63,23 @@ class TerraspacePluginAzurerm::Interfaces::Helper::Secret
       end
     end
 
+    def check_vault_configured!(vault)
+      return if vault
+      logger.error "ERROR: Vault has not been configured or vault option not passed in the azure_secret helper method.".color(:red)
+      logger.error <<~EOL
+        Please configure the Azure KeyVault you want to use.  Example:
+
+        config/plugins/azurerm.rb
+
+            TerraspacePluginAzurerm.configure do |config|
+              config.secrets.vault = "REPLACE_WITH_YOUR_VAULT_NAME"
+            end
+
+        Docs: https://terraspace.cloud/docs/helpers/azure/secrets/
+      EOL
+      raise VaultNotConfiguredError.new
+    end
+
     def send_request(uri, req)
       http = Net::HTTP.new(uri.host, uri.port)
       http.open_timeout = http.read_timeout = 30
@@ -108,5 +133,16 @@ class TerraspacePluginAzurerm::Interfaces::Helper::Secret
         @@token = false
       end
     end
+
+  private
+    delegate :expansion, to: :expander
+    def expander
+      TerraspacePluginAzurerm::Interfaces::Expander.new(@mod)
+    end
+    memoize :expander
+
+    def expand?
+      !(@options[:expansion] == false || @options[:expand] == false)
+    end
   end
 end

data/lib/terraspace_plugin_azurerm/interfaces/helper/secret.rb

@@ -6,8 +6,8 @@ module TerraspacePluginAzurerm::Interfaces::Helper
     include TerraspacePluginAzurerm::Logging
     include TerraspacePluginAzurerm::Clients::Options
 
-    def initialize(options={})
-      @options = options
+    def initialize(mod, options={})
+      @mod, @options = mod, options
       @base64 = options[:base64]
     end
 
@@ -19,7 +19,7 @@ module TerraspacePluginAzurerm::Interfaces::Helper
     end
 
     def fetcher
-      Fetcher.new
+      Fetcher.new(@mod, @options)
     end
     memoize :fetcher
   end

data/lib/terraspace_plugin_azurerm/interfaces/helper.rb

@@ -3,7 +3,7 @@ module TerraspacePluginAzurerm::Interfaces
     include Terraspace::Plugin::Helper::Interface
 
     def azure_secret(name, options={})
-      Secret.new(options).fetch(name, options)
+      Secret.new(@mod, options).fetch(name, options)
     end
     cache_helper :azure_secret
   end

data/lib/terraspace_plugin_azurerm/version.rb

@@ -1,3 +1,3 @@
 module TerraspacePluginAzurerm
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/terraspace_plugin_azurerm.gemspec

@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "azure-storage-blob"
-  spec.add_dependency "azure_info"
+  spec.add_dependency "azure_info", "~> 0.1.2"
   spec.add_dependency "azure_mgmt_resources"
   spec.add_dependency "azure_mgmt_storage"
   spec.add_dependency "memoist"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: terraspace_plugin_azurerm
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-11-15 00:00:00.000000000 Z
+date: 2022-01-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: azure-storage-blob
@@ -28,16 +28,16 @@ dependencies:
   name: azure_info
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.1.2
 - !ruby/object:Gem::Dependency
   name: azure_mgmt_resources
   requirement: !ruby/object:Gem::Requirement
@@ -179,7 +179,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Terraspace Azurerm Cloud Plugin