Skip to content

Commit ae7c55b

Browse files
amfisher-404slevenick
authored and
NandiniAgrawal15
committed
Add Managed Kafka Acl resource and tests. (GoogleCloudPlatform#14034)
Co-authored-by: Sam Levenick <slevenick@google.com>
1 parent daa324b commit ae7c55b

File tree

3 files changed

+319
-0
lines changed

3 files changed

+319
-0
lines changed

‎mmv1/products/managedkafka/Acl.yaml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
# API resource name
16+
name: 'Acl'
17+
# Resource description for the provider documentation.
18+
description: |
19+
A Managed Service for Apache Kafka ACL. Apache Kafka is a trademark owned by the Apache Software Foundation.
20+
21+
docs:
22+
id_format: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/acls/{{acl_id}}'
23+
base_url: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/acls'
24+
self_link: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/acls/{{acl_id}}'
25+
create_url: 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/acls?aclId={{acl_id}}'
26+
update_verb: 'PATCH'
27+
update_mask: true
28+
import_format:
29+
- 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/acls/{{%acl_id}}'
30+
31+
timeouts:
32+
insert_minutes: 20
33+
update_minutes: 20
34+
delete_minutes: 20
35+
36+
custom_code:
37+
post_create: 'templates/terraform/post_create/sleep.go.tmpl'
38+
post_update: 'templates/terraform/post_create/sleep.go.tmpl'
39+
40+
examples:
41+
- name: 'managedkafka_acl_basic'
42+
primary_resource_id: 'example'
43+
vars:
44+
acl_id: 'topic/mytopic'
45+
cluster_id: 'my-cluster'
46+
test_vars_overrides:
47+
'acl_id': '"topic/mytopic"'
48+
49+
parameters:
50+
- name: 'location'
51+
type: String
52+
description: "ID of the location of the Kafka resource. See
53+
https://cloud.google.com/managed-kafka/docs/locations for a list of
54+
supported locations."
55+
url_param_only: true
56+
required: true
57+
immutable: true
58+
- name: 'cluster'
59+
type: String
60+
description: "The cluster name."
61+
url_param_only: true
62+
required: true
63+
immutable: true
64+
- name: 'aclId'
65+
type: String
66+
description: "The ID to use for the acl, which will become the final
67+
component of the acl's name. The structure of `aclId` defines the Resource Pattern (resource_type,
68+
resource_name, pattern_type) of the acl. `aclId` is structured like one of the following:
69+
70+
For acls on the cluster:
71+
`cluster`
72+
73+
For acls on a single resource within the cluster:
74+
`topic/{resource_name}`
75+
`consumerGroup/{resource_name}`
76+
`transactionalId/{resource_name}`
77+
78+
For acls on all resources that match a prefix:
79+
`topicPrefixed/{resource_name}`
80+
`consumerGroupPrefixed/{resource_name}`
81+
`transactionalIdPrefixed/{resource_name}`
82+
83+
For acls on all resources of a given type (i.e. the wildcard literal '*''):
84+
`allTopics` (represents `topic/*`)
85+
`allConsumerGroups` (represents `consumerGroup/*`)
86+
`allTransactionalIds` (represents `transactionalId/*`)."
87+
url_param_only: true
88+
required: true
89+
immutable: true
90+
91+
properties:
92+
- name: 'name'
93+
type: String
94+
description: "The name of the acl. The `ACL_ID` segment is used when
95+
connecting directly to the cluster. Must be in the format `projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_ID/acls/ACL_ID`."
96+
output: true
97+
- name: 'aclEntries'
98+
type: Array
99+
is_set: true
100+
required: true
101+
description: "The acl entries that apply to the resource pattern. The maximum number of allowed
102+
entries is 100."
103+
item_type:
104+
type: NestedObject
105+
properties:
106+
- name: 'principal'
107+
type: String
108+
description: 'The principal. Specified as Google Cloud account, with the Kafka
109+
StandardAuthorizer prefix User:". For example: "User:test-kafka-client@test-project.iam.gserviceaccount.com".
110+
Can be the wildcard "User:*" to refer to all users.'
111+
required: true
112+
- name: 'permissionType'
113+
type: String
114+
default_value: "ALLOW"
115+
description: 'The permission type. Accepted values are (case insensitive): ALLOW, DENY.'
116+
- name: 'operation'
117+
type: String
118+
description: |
119+
The operation type. Allowed values are (case insensitive): ALL, READ,
120+
WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, DESCRIBE_CONFIGS,
121+
ALTER_CONFIGS, and IDEMPOTENT_WRITE. See https://kafka.apache.org/documentation/#operations_resources_and_protocols
122+
for valid combinations of resource_type and operation for different Kafka API requests.
123+
required: true
124+
- name: 'host'
125+
type: String
126+
default_value: "*"
127+
description: 'The host. Must be set to "*" for Managed Service for Apache Kafka.'
128+
- name: 'etag'
129+
type: Fingerprint
130+
output: true
131+
description: |
132+
`etag` is used for concurrency control. An `etag` is returned in the
133+
response to `GetAcl` and `CreateAcl`. Callers are required to put that etag
134+
in the request to `UpdateAcl` to ensure that their change will be applied
135+
to the same version of the acl that exists in the Kafka Cluster.
136+
137+
A terminal 'T' character in the etag indicates that the AclEntries were
138+
truncated due to repeated field limits.
139+
- name: 'resourceType'
140+
type: String
141+
description: |
142+
The acl resource type derived from the name. One of: CLUSTER, TOPIC, GROUP, TRANSACTIONAL_ID.
143+
output: true
144+
- name: 'resourceName'
145+
type: String
146+
description: |
147+
The acl resource name derived from the name. For cluster resource_type, this is always "kafka-cluster". Can be the wildcard literal "*".
148+
output: true
149+
- name: 'patternType'
150+
type: String
151+
description: "The acl pattern type derived from the name. One of: LITERAL, PREFIXED."
152+
output: true

‎mmv1/templates/terraform/examples/managedkafka_acl_basic.tf.tmpl‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "google_managed_kafka_cluster" "cluster" {
2+
cluster_id = "{{index $.Vars "cluster_id"}}"
3+
location = "us-central1"
4+
capacity_config {
5+
vcpu_count = 3
6+
memory_bytes = 3221225472
7+
}
8+
gcp_config {
9+
access_config {
10+
network_configs {
11+
subnet = "projects/${data.google_project.project.number}/regions/us-central1/subnetworks/default"
12+
}
13+
}
14+
}
15+
}
16+
17+
resource "google_managed_kafka_acl" "{{$.PrimaryResourceId}}" {
18+
acl_id = "{{index $.Vars "acl_id"}}"
19+
cluster = google_managed_kafka_cluster.cluster.cluster_id
20+
location = "us-central1"
21+
acl_entries {
22+
principal = "User:admin@my-project.iam.gserviceaccount.com"
23+
permission_type = "ALLOW"
24+
operation = "ALL"
25+
host = "*"
26+
}
27+
acl_entries {
28+
principal = "User:producer-client@my-project.iam.gserviceaccount.com"
29+
permission_type = "ALLOW"
30+
operation = "WRITE"
31+
host = "*"
32+
}
33+
}
34+
35+
data "google_project" "project" {
36+
}
37+

‎mmv1/third_party/terraform/services/managedkafka/resource_managed_kafka_acl_test.go‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
package managedkafka_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
7+
"github.com/hashicorp/terraform-provider-google/google/acctest"
8+
)
9+
10+
func TestAccManagedKafkaAcl_update(t *testing.T) {
11+
t.Parallel()
12+
13+
context := map[string]interface{}{
14+
"random_suffix": acctest.RandString(t, 10),
15+
}
16+
17+
acctest.VcrTest(t, resource.TestCase{
18+
PreCheck: func() { acctest.AccTestPreCheck(t) },
19+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
20+
CheckDestroy: testAccCheckManagedKafkaAclDestroyProducer(t),
21+
Steps: []resource.TestStep{
22+
{
23+
Config: testAccManagedKafkaAcl_full(context),
24+
},
25+
{
26+
ResourceName: "google_managed_kafka_acl.example",
27+
ImportState: true,
28+
ImportStateVerify: true,
29+
ImportStateVerifyIgnore: []string{"cluster", "location", "acl_id"},
30+
},
31+
{
32+
Config: testAccManagedKafkaAcl_update(context),
33+
},
34+
{
35+
ResourceName: "google_managed_kafka_acl.example",
36+
ImportState: true,
37+
ImportStateVerify: true,
38+
ImportStateVerifyIgnore: []string{"cluster", "location", "acl_id"},
39+
},
40+
},
41+
})
42+
}
43+
44+
func testAccManagedKafkaAcl_full(context map[string]interface{}) string {
45+
return acctest.Nprintf(`
46+
resource "google_managed_kafka_cluster" "example" {
47+
cluster_id = "tf-test-my-cluster%{random_suffix}"
48+
location = "us-central1"
49+
capacity_config {
50+
vcpu_count = 3
51+
memory_bytes = 3221225472
52+
}
53+
gcp_config {
54+
access_config {
55+
network_configs {
56+
subnet = "projects/${data.google_project.project.number}/regions/us-central1/subnetworks/default"
57+
}
58+
}
59+
}
60+
}
61+
62+
resource "google_managed_kafka_acl" "example" {
63+
cluster = google_managed_kafka_cluster.example.cluster_id
64+
acl_id = "topic/tf-test-my-acl%{random_suffix}"
65+
location = "us-central1"
66+
acl_entries {
67+
principal = "User:admin@my-project.iam.gserviceaccount.com"
68+
permission_type = "ALLOW"
69+
operation = "ALL"
70+
host = "*"
71+
}
72+
acl_entries {
73+
principal = "User:producer-client@my-project.iam.gserviceaccount.com"
74+
permission_type = "ALLOW"
75+
operation = "WRITE"
76+
host = "*"
77+
}
78+
}
79+
80+
data "google_project" "project" {
81+
}
82+
`, context)
83+
}
84+
85+
func testAccManagedKafkaAcl_update(context map[string]interface{}) string {
86+
return acctest.Nprintf(`
87+
resource "google_managed_kafka_cluster" "example" {
88+
cluster_id = "tf-test-my-cluster%{random_suffix}"
89+
location = "us-central1"
90+
capacity_config {
91+
vcpu_count = 3
92+
memory_bytes = 3221225472
93+
}
94+
gcp_config {
95+
access_config {
96+
network_configs {
97+
subnet = "projects/${data.google_project.project.number}/regions/us-central1/subnetworks/default"
98+
}
99+
}
100+
}
101+
}
102+
103+
resource "google_managed_kafka_acl" "example" {
104+
cluster = google_managed_kafka_cluster.example.cluster_id
105+
acl_id = "topic/tf-test-my-acl%{random_suffix}"
106+
location = "us-central1"
107+
acl_entries {
108+
principal = "User:admin@project.iam.gserviceaccount.com"
109+
permission_type = "ALLOW"
110+
operation = "ALL"
111+
host = "*"
112+
}
113+
acl_entries {
114+
principal = "User:producer-client@my-project.iam.gserviceaccount.com"
115+
permission_type = "ALLOW"
116+
operation = "WRITE"
117+
host = "*"
118+
}
119+
acl_entries {
120+
principal = "User:producer-client@my-project.iam.gserviceaccount.com"
121+
permission_type = "ALLOW"
122+
operation = "CREATE"
123+
host = "*"
124+
}
125+
}
126+
127+
data "google_project" "project" {
128+
}
129+
`, context)
130+
}

0 commit comments

Comments
 (0)