Add support for network polices

[bobbyiliev]

Fixes #666 😈

Adding a new materialize_network_policy resource:

resource "materialize_network_policy" "office_policy" {
  name = "office_access_policy"
  
  rule {
    name      = "new_york"
    action    = "allow"
    direction = "ingress"
    address   = "8.2.3.4/28"
  }

  rule {
    name      = "minnesota"
    action    = "allow"
    direction = "ingress"
    address   = "2.3.4.5/32"
  }

  comment = "Network policy for office locations"
}

Also adding a data source to allow users to retrieve all network policies:

data "materialize_network_policy" "all" {}

This also adds support for the new CREATENETWORKPOLICY system privilege, eg:

resource "materialize_role" "test" {
	name = "test_role"
}

resource "materialize_grant_system_privilege" "role_createnetworkpolicy" {
  role_name = materialize_role.test.name
  privilege = "CREATENETWORKPOLICY"
}

[SangJunBak]

Overall lgtm!

[SangJunBak]

Noticed the casing here is different from the standard. Is that on purpose

[SangJunBak]

nit: Noticed we use d.SetId in some places and SetId in other places. Any reason why we don't use d.SetId(transformIdWithRegion... here?

[bobbyiliev]

Ah yes, I've created that SetId helper function for all data sources that accept database or schema names. But in this case this is not needed so better to use d.SetId directly!

terraform-provider-materialize/pkg/datasources/utils.go

Lines 10 to 21 in 4f61ea1

	func SetId(region, resource, databaseName, schemaName string, d *schema.ResourceData) {
	var id string
	if databaseName != "" && schemaName != "" {
	id = fmt.Sprintf("%s|%s|%s", databaseName, schemaName, resource)
	} else if databaseName != "" {
	id = fmt.Sprintf("%s|%s", databaseName, resource)
	} else {
	id = resource
	}
	d.SetId(utils.TransformIdWithRegion(region, id))
	}

[ParkMyCar]

High quality as always, thanks for getting this one across the line Bobby!

[ParkMyCar]

I'm unfamiliar with the Terraform provider, is region a field we typically allow folks to specify?

[bobbyiliev]

Yep, this was introduced last year when we refactored the provider, this allows users to manage cross region instances within the same terraform project.

For example:

resource "materialize_database" "database" {
  name    = "example_database"
  comment = "database comment"
}

# Create in separate region
resource "materialize_database" "database_us_west" {
  name    = "example_database"
  comment = "database comment"
  region  = "aws/us-west-2"
}

the first one will create the db in the default region defined in the provider configuration, but the second one overrides the region and will create the db in aws/us-west-2 if it is enabled.

[ParkMyCar]

just double checking, is this kind of upgrade a breaking change? /compatible with how we're changing the version of the terraform provider?

[bobbyiliev]

Yep, this minor version upgrade should be ok, it was needed because of a recent dependabot commit:

4f61ea1

Kind of sneaking the bump into this PR 😅

[ParkMyCar]

is it worth making this a builtin view?

[bobbyiliev]

Actually, this will be quite helpful!

[ParkMyCar]

Did you mean to leave this in?

[ParkMyCar]

similar to above, did you mean to leave this in?

[bobbyiliev]

Thank you both @SangJunBak @ParkMyCar for the review! Very much appreciated 🙇