terraform-provider: require kubernetes and microservice version (#2791)

.github/workflows/e2e-test-provider-example.yml

@@ -185,6 +185,9 @@ jobs:
             fi
           fi
 
+          # take the middle (2nd) supported Kubernetes version (default)
+          kubernetes_version="$(../build/constellation config kubernetes-versions | awk 'NR==3{print $1}')"
+
           cat > _override.tf <<EOF
           terraform {
             required_providers {
@@ -197,6 +200,8 @@ jobs:
           locals {
             name                = "${{ steps.create-prefix.outputs.prefix }}"
             version            = "${image_version}"
+            microservice_version= "${prefixed_version}"
+            kubernetes_version = "${kubernetes_version}"
           }
           module "${{ inputs.cloudProvider }}_iam" {
             source = "${iam_src}"

terraform-provider-constellation/docs/resources/cluster.md

@@ -63,10 +63,12 @@ resource "constellation_cluster" "azure_example" {
 ### Required
 
 - `attestation` (Attributes) Attestation comprises the measurements and SEV-SNP specific parameters. The output of the [constellation_attestation](../data-sources/attestation.md) data source provides sensible defaults. (see [below for nested schema](#nestedatt--attestation))
+- `constellation_microservice_version` (String) The version of Constellation's microservices used within the cluster.
 - `csp` (String) CSP (Cloud Service Provider) to use. (e.g. `azure`)
 See the [full list of CSPs](https://docs.edgeless.systems/constellation/overview/clouds) that Constellation supports.
 - `image` (Attributes) Constellation OS Image to use on the nodes. (see [below for nested schema](#nestedatt--image))
 - `init_secret` (String) Secret used for initialization of the cluster.
+- `kubernetes_version` (String) The Kubernetes version to use for the cluster. The supported versions are [v1.26.12 v1.27.9 v1.28.5].
 - `master_secret` (String) Hex-encoded 32-byte master secret for the cluster.
 - `master_secret_salt` (String) Hex-encoded 32-byte master secret salt for the cluster.
 - `measurement_salt` (String) Hex-encoded 32-byte measurement salt for the cluster.
@@ -79,11 +81,9 @@ See the [full list of CSPs](https://docs.edgeless.systems/constellation/overview
 
 - `api_server_cert_sans` (List of String) List of Subject Alternative Names (SANs) for the API server certificate. Usually, this will be the out-of-cluster endpoint and the in-cluster endpoint, if existing.
 - `azure` (Attributes) Azure-specific configuration. (see [below for nested schema](#nestedatt--azure))
-- `constellation_microservice_version` (String) The version of Constellation's microservices used within the cluster. When not set, the provider version is used.
 - `extra_microservices` (Attributes) Extra microservice settings. (see [below for nested schema](#nestedatt--extra_microservices))
 - `gcp` (Attributes) GCP-specific configuration. (see [below for nested schema](#nestedatt--gcp))
 - `in_cluster_endpoint` (String) The endpoint of the cluster. When not set, the out-of-cluster endpoint is used.
-- `kubernetes_version` (String) The Kubernetes version to use for the cluster. When not set, version v1.27.9 is used. The supported versions are [v1.26.12 v1.27.9 v1.28.5].
 - `license_id` (String) Constellation license ID. When not set, the community license is used.
 
 ### Read-Only

terraform-provider-constellation/examples/full/aws/main.tf

@@ -14,6 +14,8 @@ terraform {
 locals {
   name                 = "constell"
   version              = "vX.Y.Z"
+  kubernetes_version   = "vX.Y.Z"
+  microservice_version = "vX.Y.Z"
   csp                  = "aws"
   attestation_variant  = "aws-sev-snp"
   region               = "us-east-2"
@@ -95,6 +97,8 @@ resource "constellation_cluster" "aws_example" {
   uid                                = module.aws_infrastructure.uid
   image                              = data.constellation_image.bar.image
   attestation                        = data.constellation_attestation.foo.attestation
+  kubernetes_version                 = local.kubernetes_version
+  constellation_microservice_version = local.microservice_version
   init_secret                        = module.aws_infrastructure.init_secret
   master_secret                      = local.master_secret
   master_secret_salt                 = local.master_secret_salt

terraform-provider-constellation/examples/full/azure/main.tf

@@ -14,6 +14,8 @@ terraform {
 locals {
   name                 = "constell"
   version              = "vX.Y.Z"
+  kubernetes_version   = "vX.Y.Z"
+  microservice_version = "vX.Y.Z"
   csp                  = "azure"
   attestation_variant  = "azure-sev-snp"
   location             = "northeurope"
@@ -90,6 +92,8 @@ resource "constellation_cluster" "azure_example" {
   uid                                = module.azure_infrastructure.uid
   image                              = data.constellation_image.bar.image
   attestation                        = data.constellation_attestation.foo.attestation
+  kubernetes_version                 = local.kubernetes_version
+  constellation_microservice_version = local.microservice_version
   init_secret                        = module.azure_infrastructure.init_secret
   master_secret                      = local.master_secret
   master_secret_salt                 = local.master_secret_salt

terraform-provider-constellation/examples/full/gcp/main.tf

@@ -14,6 +14,8 @@ terraform {
 locals {
   name                 = "constell"
   version              = "vX.Y.Z"
+  kubernetes_version   = "vX.Y.Z"
+  microservice_version = "vX.Y.Z"
   csp                  = "gcp"
   attestation_variant  = "gcp-sev-es"
   region               = "europe-west3"
@@ -94,6 +96,8 @@ resource "constellation_cluster" "gcp_example" {
   uid                                = module.gcp_infrastructure.uid
   image                              = data.constellation_image.bar.image
   attestation                        = data.constellation_attestation.foo.attestation
+  kubernetes_version                 = local.kubernetes_version
+  constellation_microservice_version = local.microservice_version
   init_secret                        = module.gcp_infrastructure.init_secret
   master_secret                      = local.master_secret
   master_secret_salt                 = local.master_secret_salt

terraform-provider-constellation/internal/provider/BUILD.bazel

@@ -94,6 +94,7 @@ go_test(
         "//internal/config",
         "//internal/constants",
         "//internal/semver",
+        "//internal/versions",
         "//terraform-provider-constellation/internal/data",
         "@com_github_hashicorp_terraform_plugin_framework//attr",
         "@com_github_hashicorp_terraform_plugin_framework//providerserver",

terraform-provider-constellation/internal/provider/cluster_resource.go

@@ -160,14 +160,14 @@ func (r *ClusterResource) Schema(_ context.Context, _ resource.SchemaRequest, re
 			},
 			"image": newImageAttributeSchema(attributeInput),
 			"kubernetes_version": schema.StringAttribute{
-				MarkdownDescription: fmt.Sprintf("The Kubernetes version to use for the cluster. When not set, version %s is used. The supported versions are %s.", versions.Default, versions.SupportedK8sVersions()),
+				MarkdownDescription: fmt.Sprintf("The Kubernetes version to use for the cluster. The supported versions are %s.", versions.SupportedK8sVersions()),
-				Description:         fmt.Sprintf("The Kubernetes version to use for the cluster. When not set, version %s is used. The supported versions are %s.", versions.Default, versions.SupportedK8sVersions()),
+				Description:         fmt.Sprintf("The Kubernetes version to use for the cluster. The supported versions are %s.", versions.SupportedK8sVersions()),
-				Optional:            true,
+				Required:            true,
 			},
 			"constellation_microservice_version": schema.StringAttribute{
-				MarkdownDescription: "The version of Constellation's microservices used within the cluster. When not set, the provider version is used.",
+				MarkdownDescription: "The version of Constellation's microservices used within the cluster.",
-				Description:         "The version of Constellation's microservices used within the cluster. When not set, the provider version is used.",
+				Description:         "The version of Constellation's microservices used within the cluster.",
-				Optional:            true,
+				Required:            true,
 			},
 			"out_of_cluster_endpoint": schema.StringAttribute{
 				MarkdownDescription: "The endpoint of the cluster. Typically, this is the public IP of a loadbalancer.",
@@ -470,13 +470,13 @@ func (r *ClusterResource) ModifyPlan(ctx context.Context, req resource.ModifyPla
 		}
 
 		// Warn the user about possibly destructive changes in case microservice changes are to be applied.
-		currVer, diags := r.getMicroserviceVersion(ctx, &currentState)
+		currVer, diags := r.getMicroserviceVersion(&currentState)
 		resp.Diagnostics.Append(diags...)
 		if resp.Diagnostics.HasError() {
 			return
 		}
 
-		plannedVer, diags := r.getMicroserviceVersion(ctx, &plannedState)
+		plannedVer, diags := r.getMicroserviceVersion(&plannedState)
 		resp.Diagnostics.Append(diags...)
 		if resp.Diagnostics.HasError() {
 			return
@@ -718,14 +718,14 @@ func (r *ClusterResource) apply(ctx context.Context, data *ClusterResourceModel,
 	}
 
 	// parse Constellation microservice version
-	microserviceVersion, convertDiags := r.getMicroserviceVersion(ctx, data)
+	microserviceVersion, convertDiags := r.getMicroserviceVersion(data)
 	diags.Append(convertDiags...)
 	if diags.HasError() {
 		return diags
 	}
 
 	// parse Kubernetes version
-	k8sVersion, getDiags := r.getK8sVersion(ctx, data)
+	k8sVersion, getDiags := r.getK8sVersion(data)
 	diags.Append(getDiags...)
 	if diags.HasError() {
 		return diags
@@ -1163,34 +1163,24 @@ func (r *ClusterResource) convertSecrets(data ClusterResourceModel) (secretInput
 
 // getK8sVersion returns the Kubernetes version from the Terraform state if set, and the default
 // version otherwise.
-func (r *ClusterResource) getK8sVersion(ctx context.Context, data *ClusterResourceModel) (versions.ValidK8sVersion, diag.Diagnostics) {
+func (r *ClusterResource) getK8sVersion(data *ClusterResourceModel) (versions.ValidK8sVersion, diag.Diagnostics) {
 	diags := diag.Diagnostics{}
-	var k8sVersion versions.ValidK8sVersion
+	k8sVersion, err := versions.NewValidK8sVersion(data.KubernetesVersion.ValueString(), true)
-	var err error
-	if data.KubernetesVersion.ValueString() != "" {
-		k8sVersion, err = versions.NewValidK8sVersion(data.KubernetesVersion.ValueString(), true)
 	if err != nil {
 		diags.AddAttributeError(
-				path.Root("kubernetes_vesion"),
+			path.Root("kubernetes_version"),
 			"Invalid Kubernetes version",
 			fmt.Sprintf("Parsing Kubernetes version: %s", err))
 		return "", diags
 	}
-	} else {
-		tflog.Info(ctx, fmt.Sprintf("No Kubernetes version specified. Using default version %s.", versions.Default))
-		k8sVersion = versions.Default
-	}
 	return k8sVersion, diags
 }
 
 // getK8sVersion returns the Microservice version from the Terraform state if set, and the default
 // version otherwise.
-func (r *ClusterResource) getMicroserviceVersion(ctx context.Context, data *ClusterResourceModel) (semver.Semver, diag.Diagnostics) {
+func (r *ClusterResource) getMicroserviceVersion(data *ClusterResourceModel) (semver.Semver, diag.Diagnostics) {
 	diags := diag.Diagnostics{}
-	var ver semver.Semver
+	ver, err := semver.New(data.MicroserviceVersion.ValueString())
-	var err error
-	if data.MicroserviceVersion.ValueString() != "" {
-		ver, err = semver.New(data.MicroserviceVersion.ValueString())
 	if err != nil {
 		diags.AddAttributeError(
 			path.Root("constellation_microservice_version"),
@@ -1198,10 +1188,6 @@ func (r *ClusterResource) getMicroserviceVersion(ctx context.Context, data *Clus
 			fmt.Sprintf("Parsing microservice version: %s", err))
 		return semver.Semver{}, diags
 	}
-	} else {
-		tflog.Info(ctx, fmt.Sprintf("No Microservice version specified. Using default version %s.", r.providerData.Version))
-		ver = r.providerData.Version
-	}
 	if err := config.ValidateMicroserviceVersion(r.providerData.Version, ver); err != nil {
 		diags.AddAttributeError(
 			path.Root("constellation_microservice_version"),

terraform-provider-constellation/internal/provider/cluster_resource_test.go

@@ -8,10 +8,12 @@ package provider
 
 import (
 	"context"
+	"fmt"
 	"regexp"
 	"testing"
 
 	"github.com/edgelesssys/constellation/v2/internal/semver"
+	"github.com/edgelesssys/constellation/v2/internal/versions"
 	"github.com/edgelesssys/constellation/v2/terraform-provider-constellation/internal/data"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
@@ -21,10 +23,12 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+var providerVersion = semver.NewFromInt(2, 15, 0, "")
+
 func TestMicroserviceConstraint(t *testing.T) {
 	sut := &ClusterResource{
 		providerData: data.ProviderData{
-			Version: semver.NewFromInt(2, 15, 0, ""),
+			Version: providerVersion,
 		},
 	}
 	testCases := []struct {
@@ -50,7 +54,7 @@ func TestMicroserviceConstraint(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			_, diags := sut.getMicroserviceVersion(context.Background(), &ClusterResourceModel{
+			_, diags := sut.getMicroserviceVersion(&ClusterResourceModel{
 				MicroserviceVersion: basetypes.NewStringValue(tc.version),
 			})
 			require.Equal(t, tc.expectedErrorCount, diags.ErrorsCount())
@@ -208,7 +212,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "aws") + `
+					Config: fullClusterTestingConfig(t, "aws") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "aws"
 						name                    = "constell"
@@ -225,8 +229,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0.0/24"
 						  ip_cidr_service = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*Master secret must be a hex-encoded 32-byte.*"),
 				},
 			},
@@ -236,7 +242,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "aws") + `
+					Config: fullClusterTestingConfig(t, "aws") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "aws"
 						name                    = "constell"
@@ -253,8 +259,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0.0/24"
 						  ip_cidr_service = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*Master secret salt must be a hex-encoded 32-byte.*"),
 				},
 			},
@@ -264,7 +272,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "aws") + `
+					Config: fullClusterTestingConfig(t, "aws") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "aws"
 						name                    = "constell"
@@ -281,8 +289,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0.0/24"
 						  ip_cidr_service = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*Measurement salt must be a hex-encoded 32-byte.*"),
 				},
 			},
@@ -292,7 +302,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "aws") + `
+					Config: fullClusterTestingConfig(t, "aws") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "aws"
 						name                    = "constell"
@@ -309,8 +319,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0x.0/xxx"
 						  ip_cidr_service = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*Node IP CIDR must be a valid CIDR.*"),
 				},
 			},
@@ -320,7 +332,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "aws") + `
+					Config: fullClusterTestingConfig(t, "aws") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "aws"
 						name                    = "constell"
@@ -337,8 +349,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0.0/24"
 						  ip_cidr_service = "0.0.0x.0/xxx"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*Service IP CIDR must be a valid CIDR.*"),
 				},
 			},
@@ -348,7 +362,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "azure") + `
+					Config: fullClusterTestingConfig(t, "azure") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "azure"
 						name                    = "constell"
@@ -365,8 +379,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_node    = "0.0.0.0/24"
 						  ip_cidr_service = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*When csp is set to 'azure', the 'azure' configuration must be set.*"),
 				},
 			},
@@ -376,7 +392,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "gcp") + `
+					Config: fullClusterTestingConfig(t, "gcp") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 						csp                     = "gcp"
 						name                    = "constell"
@@ -394,8 +410,10 @@ func TestAccClusterResource(t *testing.T) {
 						  ip_cidr_service = "0.0.0.0/24"
 						  ip_cidr_pod    = "0.0.0.0/24"
 						}
+						kubernetes_version = "%s"
+						constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*When csp is set to 'gcp', the 'gcp' configuration must be set.*"),
 				},
 			},
@@ -405,7 +423,7 @@ func TestAccClusterResource(t *testing.T) {
 			PreCheck:                 bazelPreCheck,
 			Steps: []resource.TestStep{
 				{
-					Config: fullClusterTestingConfig(t, "gcp") + `
+					Config: fullClusterTestingConfig(t, "gcp") + fmt.Sprintf(`
 					resource "constellation_cluster" "test" {
 							csp                     = "gcp"
 							name                    = "constell"
@@ -426,8 +444,10 @@ func TestAccClusterResource(t *testing.T) {
 									project_id = "test"
 									service_account_key = "eyJ0ZXN0IjogInRlc3QifQ=="
 							}
+							kubernetes_version = "%s"
+							constellation_microservice_version = "%s"
 					  }
-				`,
+				`, versions.Default, providerVersion.String()),
 					ExpectError: regexp.MustCompile(".*When csp is set to 'gcp', 'ip_cidr_pod' must be set.*"),
 				},
 			},