Add support for a KV V2 Secret Metadata resource (#1687)

Author: vinay-gopalan

internal/consts/consts.go

@@ -192,6 +192,11 @@ const (
 	FieldServersJSON                = "servers_json"
 	FieldUpgradeInfo                = "upgrade_info"
 	FieldUpgradeInfoJSON            = "upgrade_info_json"
+	FieldMaxVersions                = "max_versions"
+	FieldCASRequired                = "cas_required"
+	FieldDeleteVersionAfter         = "delete_version_after"
+	FieldCustomMetadata             = "custom_metadata"
+	FieldCustomMetadataJSON         = "custom_metadata_json"
 
 	/*
 		common environment variables

vault/resource_kv_secret_v2.go

@@ -5,14 +5,24 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"strings"
+	"time"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 )
 
+var kvMetadataFields = map[string]string{
+	consts.FieldMaxVersions:        consts.FieldMaxVersions,
+	consts.FieldCASRequired:        consts.FieldCASRequired,
+	consts.FieldDeleteVersionAfter: consts.FieldDeleteVersionAfter,
+	consts.FieldCustomMetadata:     consts.FieldData,
+}
+
 func kvSecretV2Resource(name string) *schema.Resource {
 	return &schema.Resource{
 		CreateContext: kvSecretV2Write,
@@ -100,6 +110,41 @@ func kvSecretV2Resource(name string) *schema.Resource {
 				Default:     false,
 				Description: "If set to true, permanently deletes all versions for the specified key.",
 			},
+
+			consts.FieldCustomMetadata: {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Computed:    true,
+				Description: "Custom metadata to be set for the secret.",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						consts.FieldMaxVersions: {
+							Type:        schema.TypeInt,
+							Optional:    true,
+							Description: "The number of versions to keep per key.",
+						},
+						consts.FieldCASRequired: {
+							Type:     schema.TypeBool,
+							Optional: true,
+							Description: "If true, all keys will require the cas " +
+								"parameter to be set on all write requests.",
+						},
+						consts.FieldDeleteVersionAfter: {
+							Type:     schema.TypeInt,
+							Optional: true,
+							Description: "If set, specifies the length of time before " +
+								"a version is deleted.",
+						},
+						consts.FieldData: {
+							Type:     schema.TypeMap,
+							Optional: true,
+							Description: "A map of arbitrary string to string valued " +
+								"user-provided metadata meant to describe the secret.",
+						},
+					},
+				},
+				MaxItems: 1,
+			},
 		},
 	}
 }
@@ -108,6 +153,20 @@ func getKVV2Path(mount, name, prefix string) string {
 	return fmt.Sprintf("%s/%s/%s", mount, prefix, name)
 }
 
+func getCustomMetadata(d *schema.ResourceData) map[string]interface{} {
+	data := map[string]interface{}{}
+
+	fieldPrefix := fmt.Sprintf("%s.0", consts.FieldCustomMetadata)
+	for vaultKey, stateKey := range kvMetadataFields {
+		fieldKey := fmt.Sprintf("%s.%s", fieldPrefix, stateKey)
+
+		if val, ok := d.GetOk(fieldKey); ok {
+			data[vaultKey] = val
+		}
+	}
+	return data
+}
+
 func kvSecretV2Write(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
@@ -140,6 +199,17 @@ func kvSecretV2Write(ctx context.Context, d *schema.ResourceData, meta interface
 
 	d.SetId(path)
 
+	// Write custom metadata for secret if provided
+	if _, ok := d.GetOk(consts.FieldCustomMetadata); ok {
+		cm := getCustomMetadata(d)
+
+		metadataPath := getKVV2Path(mount, name, consts.FieldMetadata)
+		log.Printf("[DEBUG] Writing custom metadata for secret at %s", path)
+		if _, err := client.Logical().Write(metadataPath, cm); err != nil {
+			return diag.Errorf("error writing custom metadata to %s, err=%s", metadataPath, err)
+		}
+	}
+
 	return kvSecretV2Read(ctx, d, meta)
 }
 
@@ -184,13 +254,63 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 				if err := d.Set(consts.FieldMetadata, serializeDataMapToString(v)); err != nil {
 					return diag.FromErr(err)
 				}
+
+				// Read & Set custom metadata
+				if _, ok := v[consts.FieldCustomMetadata]; ok {
+					cm, err := readKVV2Metadata(d, client)
+					if err != nil {
+						return diag.FromErr(err)
+					}
+
+					if err := d.Set(consts.FieldCustomMetadata, []interface{}{cm}); err != nil {
+						return diag.FromErr(err)
+					}
+				}
 			}
 		}
+
 	}
 
 	return nil
 }
 
+func readKVV2Metadata(d *schema.ResourceData, client *api.Client) (map[string]interface{}, error) {
+	path := strings.Replace(d.Id(), consts.FieldData, consts.FieldMetadata, 1)
+
+	log.Printf("[DEBUG] Reading metadata for KVV2 secret at %s", path)
+	resp, err := client.Logical().Read(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp == nil {
+		log.Printf("[DEBUG] no metadata found for secret")
+		return nil, nil
+	}
+
+	data := map[string]interface{}{}
+
+	for vaultKey, tfKey := range kvMetadataFields {
+		if val, ok := resp.Data[vaultKey]; ok {
+			// the delete_version_after field is written to
+			// Vault as an integer but is returned as a string
+			// of the format "3h12m10s"
+			if vaultKey == consts.FieldDeleteVersionAfter {
+				t, err := time.ParseDuration(val.(string))
+				if err != nil {
+					return nil, fmt.Errorf("error parsing duration, err=%s", err)
+				}
+				val = t.Seconds()
+			}
+
+			data[tfKey] = val
+
+		}
+	}
+
+	return data, nil
+}
+
 func kvSecretV2Delete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {

vault/resource_kv_secret_v2_test.go

@@ -21,18 +21,35 @@ func TestAccKVSecretV2(t *testing.T) {
 		PreCheck:  func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
-				Config: testKVSecretV2Config(mount, name),
+				Config: testKVSecretV2Config_initial(mount, name),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(resourceName, consts.FieldMount, mount),
 					resource.TestCheckResourceAttr(resourceName, consts.FieldName, name),
-					resource.TestCheckResourceAttr(resourceName, "cas", "1"),
 					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", mount, name)),
 					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
 					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
 					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
 					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
 				),
 			},
+			{
+				Config: testKVSecretV2Config_updated(mount, name),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldMount, mount),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldName, name),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", mount, name)),
+					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
+					resource.TestCheckResourceAttr(resourceName, "data.zip", "zoop"),
+					resource.TestCheckResourceAttr(resourceName, "data.foo", "baz"),
+					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.cas_required", "false"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.%", "2"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.extra", "cheese"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.pizza", "please"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.delete_version_after", "0"),
+					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.max_versions", "5"),
+				),
+			},
 			{
 				ResourceName:      resourceName,
 				ImportState:       true,
@@ -47,25 +64,54 @@ func TestAccKVSecretV2(t *testing.T) {
 	})
 }
 
-func testKVSecretV2Config(mount, name string) string {
+func testKVSecretV2Config_initial(mount, name string) string {
 	ret := fmt.Sprintf(`
 %s
 
 `, kvV2MountConfig(mount))
 
 	ret += fmt.Sprintf(`
 resource "vault_kv_secret_v2" "test" {
-  mount                      = vault_mount.kvv2.path
-  name                       = "%s"
-  cas                        = 1
-  delete_all_versions        = true
-  data_json                  = jsonencode(
-  {
-    zip       = "zap",
-    foo       = "bar",
-    flag      = false
-  }
+  mount               = vault_mount.kvv2.path
+  name                = "%s"
+  delete_all_versions = true
+  data_json = jsonencode(
+    {
+      zip  = "zap",
+      foo  = "bar",
+      flag = false
+    }
+  )
+}`, name)
+
+	return ret
+}
+
+func testKVSecretV2Config_updated(mount, name string) string {
+	ret := fmt.Sprintf(`
+%s
+
+`, kvV2MountConfig(mount))
+
+	ret += fmt.Sprintf(`
+resource "vault_kv_secret_v2" "test" {
+  mount               = vault_mount.kvv2.path
+  name                = "%s"
+  delete_all_versions = true
+  data_json = jsonencode(
+    {
+      zip  = "zoop",
+      foo  = "baz",
+      flag = false
+    }
   )
+  custom_metadata {
+    max_versions = 5
+    data = {
+      extra = "cheese",
+      pizza = "please"
+    }
+  }
 }`, name)
 
 	return ret

website/docs/r/kv_secret_backend_v2.html.md

@@ -25,7 +25,7 @@ resource "vault_mount" "kvv2" {
   description = "KV Version 2 secret engine mount"
 }
 
-resource "vault_kv_secret_backend_v2" "config" {
+resource "vault_kv_secret_backend_v2" "example" {
   mount                = vault_mount.kvv2.path
   max_versions         = 5
   delete_version_after = 12600
@@ -65,8 +65,9 @@ No additional attributes are exported by this resource.
 
 ## Import
 
-The KV-V2 secret backend can be imported using the `path`, e.g.
+The KV-V2 secret backend can be imported using its unique ID,
+the `${mount}/config`, e.g.
 
 ```
-$ terraform import vault_kv_secret_backend_v2.config kvv2/config
+$ terraform import vault_kv_secret_backend_v2.example kvv2/config
 ```

website/docs/r/kv_secret_v2.html.md

@@ -23,7 +23,7 @@ resource "vault_mount" "kvv2" {
   description = "KV Version 2 secret engine mount"
 }
 
-resource "vault_kv_secret_v2" "secret" {
+resource "vault_kv_secret_v2" "example" {
   mount                      = vault_mount.kvv2.path
   name                       = "secret"
   cas                        = 1
@@ -34,6 +34,13 @@ resource "vault_kv_secret_v2" "secret" {
     foo       = "bar"
   }
   )
+  custom_metadata {
+    max_versions = 5
+    data = {
+      foo = "vault@example.com",
+      bar = "12345"
+    }
+  }
 }
 ```
 
@@ -69,13 +76,29 @@ The following arguments are supported:
 * `data_json` - (Required) JSON-encoded string that will be
   written as the secret data at the given path.
 
+* `custom_metadata` - (Optional) A nested block that allows configuring metadata for the
+  KV secret. Refer to the
+  [Configuration Options](#custom-metadata-configuration-options) for more info.
+
 ## Required Vault Capabilities
 
 Use of this resource requires the `create` or `update` capability
 (depending on whether the resource already exists) on the given path,
 the `delete` capability if the resource is removed from configuration,
 and the `read` capability for drift detection (by default).
 
+### Custom Metadata Configuration Options
+
+* `max_versions` - (Optional) The number of versions to keep per key.
+
+* `cas_required` - (Optional) If true, all keys will require the cas
+  parameter to be set on all write requests.
+
+* `delete_version_after` - (Optional) If set, specifies the length of time before
+  a version is deleted. Accepts duration in integer seconds.
+
+* `data` - (Optional) A string to string map describing the secret.
+
 ## Attributes Reference
 
 The following attributes are exported in addition to the above:
@@ -94,5 +117,5 @@ serialized as JSON.
 KV-V2 secrets can be imported using the `path`, e.g.
 
 ```
-$ terraform import vault_kv_secret_v2.secret kvv2/data/secret
+$ terraform import vault_kv_secret_v2.example kvv2/data/secret
 ```