[fixes 254] Add mTLS support with client cert and key. by scr-oath · Pull Request #211 · hashicorp/terraform-provider-http

scr-oath · 2022-12-16T01:54:55Z

This PR is to support mTLS support for the http data source, by allowing the client_cert and client_key to be passed.

See also [fixes 31700] Add mTLS support for http backend by way of client cert & key, as well as enterprise cacert. terraform#31699
See also mTLS support is needed for http provider as well in order to fetch resources #254

… in the test.

…nd ca cert to be the data. See also hashicorp/terraform-provider-http#211

… & key, as well as enterprise cacert. (#31699) * Add mTLS support for http backend by way of client cert & key, as well as enterprise cacert. * Fix style. * Skip cert validation to be sure error is related to missing client cert; not untrusted server cert. * Remove misplaced err check. * Fix the size of test using http backend. * Just for correctness, include all certs in the pem encoded cert - sometimes certs come with a chain of their signers. * Adjusted names as recommended in PR comments. * Adjusted names to be full-length and more descriptive. * Added full-fledged testing with mTLS http server * Fix goimports. * Fix the names of the backend config. * Exclusive lock for write and delete. * Revert "Fix goimports." This reverts commit 7d40f60. * goimports just for server test. * Added the go:generation for the mock. * Move the TLS configuration out to make it more readable - don't replace the HTTPClient as the retryablehttp already creates one - just configure its TLS. * Just switch the client/data params - felt more natural this way. * Update internal/backend/remote-state/http/backend.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/backend/remote-state/http/testdata/gencerts.sh Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/backend/remote-state/http/backend.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/backend/remote-state/http/backend.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/backend/remote-state/http/backend.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * Update internal/backend/remote-state/http/backend.go Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com> * the location of the file name is not sensitive. * Added error if only one of client_certificate_pem and client_private_key_pem are set. * Remove testify from test cases; use t.Error* for assert and t.Fatal* for require. * Fixed import consistency * Just use default openssl. * Since file(...) is so trivial to use, changed the client cert, key, and ca cert to be the data. See also hashicorp/terraform-provider-http#211 Co-authored-by: Sheridan C Rawlins <scr@ouryahoo.com> Co-authored-by: kmoe <5575356+kmoe@users.noreply.github.com>

scr-oath · 2023-01-29T00:17:49Z

@kmoe can you help merge this one too? It's for non-backend http to use mTLS as well

dlanoire · 2023-03-14T10:16:34Z

Hello. Do you now why this merge request is pending because this is a very usefull feature?

bendbennett · 2023-03-23T13:31:58Z

Hi @scr-oath and @dlanoire 👋

I have approved the workflow but I'm afraid that reviewing this PR is currently on-hold as we need to triage the changes and our team’s focus is currently elsewhere at the moment.

scr-oath · 2023-03-23T14:56:53Z

@bendbennett

Hi @scr-oath and @dlanoire 👋

I have approved the workflow but I'm afraid that reviewing this PR is currently on-hold as we need to triage the changes and our team’s focus is currently elsewhere at the moment.

I just ran make generate to appease the diff checker - do you know what the ETA might be for triage? Will this be looked at / considered even if lower priority than current attention?

bendbennett · 2023-03-23T15:08:46Z

@scr-oath I have added this PR to our triage list and will endeavour to discuss this as a team in an upcoming triage meeting. The PR will be considered but it is hard to give a definitive answer on ETA.

…regex, just add the either|or match.

bendbennett · 2023-03-27T15:55:56Z

Hi @scr-oath 👋

Thank you for submitting this PR and opening the associated issue. We have just discussed this PR at our triage meeting and have come to the conclusion that we'd like to hold off on reviewing and potentially merging until we have a clearer idea on the level of community interest in these changes.

We have to consider each enhancement request (issue) or PR on the basis of community interest alongside the consequences of increasing the surface area of the provider. We will leave the issue and PR open and will revisit if there is community interest signalled by up votes.

linde · 2024-05-14T05:58:07Z

+1 that this is needed, definitely situations where you need to connect with client certs.

ElfoLiNk · 2025-02-20T14:59:55Z

Hi @scr-oath,

I see that this now has conflicts. It would be great to have it reviewed and merged.

@austinvalle, could you take a look?

Thanks!

scr-oath · 2025-02-20T16:56:24Z

Wow, almost two years old; sheesh… yeah, I'll try to dust this off and resolve conflicts.

DONE

larryboymi · 2025-03-07T16:25:13Z

Would love this to get merged... is it being considered?

ansgarm · 2025-03-25T16:31:10Z

Hi everyone 👋
Just wanted to give a short update that we're planning to accept / add this. We're going to look into a way to not include the private key in the repository to not trip our security scanners, but other than that this PR is already looking pretty good!

…ng ones.

scr-oath · 2025-03-26T17:31:02Z

ok - took a few tries but got all testify uses deleted resulting in ZERO changes to go.mod 😎

… checking code.

…gned cert.

scr-oath · 2025-03-26T17:45:54Z

Whew… ok - done with self-reviews and style corrections… I think this is pretty close to minimal now

ansgarm

Thanks so much, @scr-oath!

One small thing and we're good to go 🚀 (Sorry I missed that in my earlier review)

Co-authored-by: Ansgar Mertens <mertens.ansgar@gmail.com>

ansgarm

Add mTLS support with client cert and key.

95487c9

scr-oath requested a review from a team as a code owner December 16, 2022 01:54

github-actions Bot added the size/XL label Dec 16, 2022

Use the file function to load the data from files rather than reading…

525c344

… in the test.

scr-oath added a commit to scr-oath/terraform that referenced this pull request Dec 16, 2022

Since file(...) is so trivial to use, changed the client cert, key, a…

ba0844a

…nd ca cert to be the data. See also hashicorp/terraform-provider-http#211

Merge remote-tracking branch 'origin' into add-mTLS

e4d9847

github-actions Bot added the dependencies label Mar 23, 2023

Fix test expectations.

4996cd0

scr-oath changed the title ~~Add mTLS support with client cert and key.~~ [fixes 254] Add mTLS support with client cert and key. Mar 23, 2023

make generate.

66cad33

github-actions Bot added the documentation label Mar 23, 2023

bendbennett added the tf-devex-triage label Mar 23, 2023

I guess the error message could say EITHER tls OR x509; since it's a …

a1d83a7

…regex, just add the either|or match.

bendbennett removed the tf-devex-triage label Mar 27, 2023

Merge remote-tracking branch 'origin' into add-mTLS

37a0970

scr-oath added 2 commits March 26, 2025 08:29

Merge remote-tracking branch 'origin' into add-mTLS

df6e954

Mint the self-signed certificate/key on-the-fly for testing.

ca4c904

github-actions Bot removed the size/XL label Mar 26, 2025

scr-oath added 3 commits March 26, 2025 10:22

Fix the description of the various fields.

0d9c053

Revert the choice of resource and terraform to using the plugin-testi…

e0cc6f8

…ng ones.

go mod tidy.

592a05c

scr-oath force-pushed the add-mTLS branch from 0cc36cd to df26dc7 Compare March 26, 2025 17:29

Remove another require.

5692bdc

scr-oath force-pushed the add-mTLS branch from df26dc7 to 5692bdc Compare March 26, 2025 17:29

scr-oath requested a review from ansgarm March 26, 2025 17:31

scr-oath added 9 commits March 26, 2025 10:32

One of the merges must have inadvertantly removed this bit of version…

e579aa7

… checking code.

Updated the readme to agree with descriptions.

e7e0639

Move tf version back where it was originally.

fc8e23b

and another place for the version checks.

9e22b3f

Added check in the new test as well.

cbd420a

Try to remove changes that I didn't intend.

09e7de0

comment was different on one of the skip versions instances.

fd3bfc7

Use AddError style to remove the added require.

2ae70f3

Added a comment on the firing up of test server that requires self-si…

aeb81fb

…gned cert.

ansgarm reviewed Mar 27, 2025

View reviewed changes

Comment thread internal/provider/data_source_http.go

ansgarm reviewed Mar 27, 2025

View reviewed changes

Comment thread internal/provider/cert_test.go

ansgarm added this to the v3.5.0 milestone Mar 27, 2025

Apply suggestions from code review

5e86b5d

Co-authored-by: Ansgar Mertens <mertens.ansgar@gmail.com>

scr-oath requested a review from ansgarm March 27, 2025 14:58

ansgarm approved these changes Mar 27, 2025

View reviewed changes

ansgarm merged commit 5d77f98 into hashicorp:main Mar 28, 2025
4 checks passed

scr-oath deleted the add-mTLS branch March 28, 2025 16:05

ansgarm added a commit that referenced this pull request Mar 31, 2025

add changie for #211

a98b97b

ansgarm added a commit that referenced this pull request Mar 31, 2025

add changie for #211

b44eeeb

ansgarm added a commit that referenced this pull request Mar 31, 2025

add changie for #211 (#513)

53afbb5

github-actions Bot locked as resolved and limited conversation to collaborators Apr 28, 2025

Conversation

scr-oath commented Dec 16, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

scr-oath commented Jan 29, 2023

Uh oh!

dlanoire commented Mar 14, 2023

Uh oh!

bendbennett commented Mar 23, 2023

Uh oh!

scr-oath commented Mar 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bendbennett commented Mar 23, 2023

Uh oh!

bendbennett commented Mar 27, 2023

Uh oh!

linde commented May 14, 2024

Uh oh!

ElfoLiNk commented Feb 20, 2025

Uh oh!

scr-oath commented Feb 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

larryboymi commented Mar 7, 2025

Uh oh!

ansgarm commented Mar 25, 2025

Uh oh!

scr-oath commented Mar 26, 2025

Uh oh!

scr-oath commented Mar 26, 2025

Uh oh!

ansgarm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ansgarm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

scr-oath commented Dec 16, 2022 •

edited

Loading

scr-oath commented Mar 23, 2023 •

edited

Loading

scr-oath commented Feb 20, 2025 •

edited

Loading