Merge branch 'master' into compute-manager-ds

CHANGELOG.md

@@ -1,3 +1,25 @@
+## 3.3.2 (September 22, 2023)
+
+IMPROVEMENTS:
+* Support on-demand connection init in the provider. This behavior is controlled with `on_demand_connection` flag and is useful is NSX manager is not available at the time of plan/apply ([#948](https://github.com/vmware/terraform-provider-nsxt/pull/948))
+* `resource/nsxt_policy_tier1_gateway`: Support `type` argument. This argument helps with auto-configuring route advertisements and provides the user experience that is consistent with UI on VMC ([#909](https://github.com/vmware/terraform-provider-nsxt/pull/909))
+* Improve debug logging by dumping NSX API requests and responses when `TF_LOG_PROVIDER_NSX_HTTP` env variable is set ([#963](https://github.com/vmware/terraform-provider-nsxt/pull/963))
+
+BUG FIXES:
+* `resource/nsxt_policy_security_policy`, `resource/nsxt_policy_gateway_policy`, `resource/nsxt_policy_ids_policy`: Fix rule ordering issue by auto-assigning `sequence_number`. ([#967](https://github.com/vmware/terraform-provider-nsxt/pull/967))
+* `resource/nsxt_policy_group`: Fix `group_type` assignment on VMC by using `node/version` API to determine underlying NSX version ([#970](https://github.com/vmware/terraform-provider-nsxt/pull/970))
+* `resource/nsxt_nat_rule`: Ensure compatibility with NSX 4.1.0 and above by replacing removed 'nat_pass' property with 'firewall_match' ([#950](https://github.com/vmware/terraform-provider-nsxt/pull/950))
+
+EXPERIMENTAL FEATURES:
+* `data/nsxt_policy_gateway_prefix_list`
+* `data/nsxt_policy_gateway_route_map`
+* `data/nsxt_policy_project`
+
+* `resource/nsxt_policy_vni_pool`
+* `resource/nsxt_policy_project`
+
+* Multitenancy support in selected resources, controlled by `context` argument
+* Fabric resources and data sources (detailed list coming with next feature release)
 
 ## 3.3.1 (May 30, 2023)
 

nsxt/data_source_nsxt_compute_collection.go

@@ -0,0 +1,85 @@
+/* Copyright © 2023 VMware, Inc. All Rights Reserved.
+   SPDX-License-Identifier: MPL-2.0 */
+
+package nsxt
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/vmware/vsphere-automation-sdk-go/services/nsxt-mp/nsx/fabric"
+	"github.com/vmware/vsphere-automation-sdk-go/services/nsxt-mp/nsx/model"
+)
+
+func dataSourceNsxtComputeCollection() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceNsxtComputeCollectionRead,
+
+		Schema: map[string]*schema.Schema{
+			"id":           getDataSourceIDSchema(),
+			"display_name": getDisplayNameSchema(),
+			"origin_type": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "ComputeCollection type like VC_Cluster. Here the Compute Manager type prefix would help in differentiating similar named Compute Collection types from different Compute Managers",
+			},
+			"origin_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Id of the compute manager from where this Compute Collection was discovered",
+			},
+			"cm_local_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Local Id of the compute collection in the Compute Manager",
+			},
+		},
+	}
+}
+
+func nullIfEmpty(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+func dataSourceNsxtComputeCollectionRead(d *schema.ResourceData, m interface{}) error {
+	connector := getPolicyConnector(m)
+	client := fabric.NewComputeCollectionsClient(connector)
+	objID := d.Get("id").(string)
+
+	objName := nullIfEmpty(d.Get("display_name").(string))
+	objOrigin := nullIfEmpty(d.Get("origin_id").(string))
+	objType := nullIfEmpty(d.Get("origin_type").(string))
+	objLocalID := nullIfEmpty(d.Get("cm_local_id").(string))
+
+	var obj model.ComputeCollection
+
+	if objID != "" {
+		// Get by id
+		objGet, err := client.Get(objID)
+		if err != nil {
+			return fmt.Errorf("failed to read ComputeCollection %s: %v", objID, err)
+		}
+		obj = objGet
+	} else {
+		objList, err := client.List(objLocalID, nil, nil, objName, nil, nil, nil, objOrigin, objType, nil, nil, nil, nil)
+		if err != nil {
+			return fmt.Errorf("failed to read Compute Collections: %v", err)
+		} else if *objList.ResultCount == 0 {
+			return fmt.Errorf("no Compute Collections that matched the specified parameters found")
+		} else if *objList.ResultCount > 1 {
+			return fmt.Errorf("found multiple Compute Collections that matched specified parameters")
+		}
+		obj = objList.Results[0]
+	}
+
+	d.SetId(*obj.ExternalId)
+	d.Set("display_name", obj.DisplayName)
+	d.Set("origin_type", obj.OriginType)
+	d.Set("origin_id", obj.OriginId)
+	d.Set("cm_local_id", obj.CmLocalId)
+
+	return nil
+}

nsxt/data_source_nsxt_compute_collection_test.go

@@ -0,0 +1,40 @@
+/* Copyright © 2017 VMware, Inc. All Rights Reserved.
+   SPDX-License-Identifier: MPL-2.0 */
+
+package nsxt
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccDataSourceNsxtComputeCollection_basic(t *testing.T) {
+	ComputeCollectionName := getComputeCollectionName()
+	testResourceName := "data.nsxt_compute_collection.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNSXComputeCollectionReadTemplate(ComputeCollectionName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(testResourceName, "display_name", ComputeCollectionName),
+					resource.TestCheckResourceAttr(testResourceName, "origin_type", "VC_Cluster"),
+					resource.TestCheckResourceAttrSet(testResourceName, "id"),
+					resource.TestCheckResourceAttrSet(testResourceName, "origin_id"),
+					resource.TestCheckResourceAttrSet(testResourceName, "cm_local_id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccNSXComputeCollectionReadTemplate(name string) string {
+	return fmt.Sprintf(`
+data "nsxt_compute_collection" "test" {
+  display_name = "%s"
+}`, name)
+}

nsxt/data_source_nsxt_edge_cluster_test.go

@@ -15,7 +15,7 @@ func TestAccDataSourceNsxtEdgeCluster_basic(t *testing.T) {
 	testResourceName := "data.nsxt_edge_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_firewall_section_test.go

@@ -18,7 +18,7 @@ func TestAccDataSourceNsxtFirewallSection_basic(t *testing.T) {
 	testResourceName := "data.nsxt_firewall_section.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtFirewallSectionDeleteByName(name)

nsxt/data_source_nsxt_ip_pool_test.go

@@ -18,7 +18,7 @@ func TestAccDataSourceNsxtIPPool_basic(t *testing.T) {
 	testResourceName := "data.nsxt_ip_pool.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_logical_tier0_router_test.go

@@ -15,7 +15,7 @@ func TestAccDataSourceNsxtLogicalTier0Router_basic(t *testing.T) {
 	testResourceName := "data.nsxt_logical_tier0_router.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_logical_tier1_router_test.go

@@ -18,7 +18,7 @@ func TestAccDataSourceNsxtLogicalTier1Router_basic(t *testing.T) {
 	testResourceName := "data.nsxt_logical_tier1_router.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtTier1RouterDeleteByName(routerName)

nsxt/data_source_nsxt_mac_pool_test.go

@@ -15,7 +15,7 @@ func TestAccDataSourceNsxtMacPool_basic(t *testing.T) {
 	testResourceName := "data.nsxt_mac_pool.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_management_cluster_test.go

@@ -13,7 +13,7 @@ func TestAccDataSourceNsxtManagementCluster_basic(t *testing.T) {
 	testResourceName := "data.nsxt_management_cluster.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_ns_group_test.go

@@ -18,7 +18,7 @@ func TestAccDataSourceNsxtNsGroup_basic(t *testing.T) {
 	testResourceName := "data.nsxt_ns_group.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtNsGroupDeleteByName(groupName)

nsxt/data_source_nsxt_ns_groups_test.go

@@ -21,7 +21,7 @@ func TestAccDataSourceNsxtNsGroups_basic(t *testing.T) {
 	checkResourceName := "nsxt_ns_group.check"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtNsGroupDeleteByName(groupName)

nsxt/data_source_nsxt_ns_service_test.go

@@ -18,7 +18,7 @@ func TestAccDataSourceNsxtNsService_basic(t *testing.T) {
 	testResourceName := "data.nsxt_ns_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtNsServiceDeleteByName(serviceName)
@@ -45,7 +45,7 @@ func TestAccDataSourceNsxtNsService_systemOwned(t *testing.T) {
 	testResourceName := "data.nsxt_ns_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/data_source_nsxt_ns_services_test.go

@@ -21,7 +21,7 @@ func TestAccDataSourceNsxtNsServices_basic(t *testing.T) {
 	checkResourceName := "nsxt_ns_group.check"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtNsServiceDeleteByName(serviceName)

nsxt/data_source_nsxt_switching_profile_test.go

@@ -19,7 +19,7 @@ func TestAccDataSourceNsxtSwitchingProfile_basic(t *testing.T) {
 	testResourceName := "data.nsxt_switching_profile.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccDataSourceNsxtSwitchingProfileDeleteByName(profileName)

nsxt/data_source_nsxt_transport_zone_test.go

@@ -15,7 +15,7 @@ func TestAccDataSourceNsxtTransportZone_basic(t *testing.T) {
 	testResourceName := "data.nsxt_transport_zone.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{

nsxt/provider.go

@@ -295,6 +295,7 @@ func Provider() *schema.Provider {
 			"nsxt_compute_manager":                  dataSourceNsxtComputeManager(),
 			"nsxt_transport_node_realization":       dataSourceNsxtTransportNodeRealization(),
 			"nsxt_failure_domain":                   dataSourceNsxtFailureDomain(),
+			"nsxt_compute_collection":               dataSourceNsxtComputeCollection(),
 		},
 
 		ResourcesMap: map[string]*schema.Resource{
@@ -428,6 +429,7 @@ func Provider() *schema.Provider {
 			"nsxt_transport_node":                          resourceNsxtTransportNode(),
 			"nsxt_failure_domain":                          resourceNsxtFailureDomain(),
 			"nsxt_cluster_virtual_ip":                      resourceNsxtClusterVirualIP(),
+			"nsxt_policy_host_transport_node_profile":      resourceNsxtPolicyHostTransportNodeProfile(),
 		},
 
 		ConfigureFunc: providerConfigure,
@@ -794,7 +796,14 @@ func (processor logRequestProcessor) Process(req *http.Request) error {
 	if err != nil {
 		log.Fatal(err)
 	}
-	log.Printf("Issuing request towards NSX:\n%s", reqDump)
+
+	// Replace sensitive information in HTTP headers
+	authHeaderRegexp := regexp.MustCompile("(?i)Authorization:.*")
+	cspHeaderRegexp := regexp.MustCompile("(?i)Csp-Auth-Token:.*")
+	replaced := authHeaderRegexp.ReplaceAllString(string(reqDump), "<Omitted Authorization header>")
+	replaced = cspHeaderRegexp.ReplaceAllString(replaced, "<Omitted Csp-Auth-Token header>")
+
+	log.Printf("Issuing request towards NSX:\n%s", replaced)
 	return nil
 }
 

nsxt/resource_nsxt_algorithm_type_ns_service_test.go

@@ -20,7 +20,7 @@ func TestAccResourceNsxtAlgorithmTypeNsService_basic(t *testing.T) {
 	updatedDestPort := "21"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXAlgServiceCheckDestroy(state, updateServiceName)
@@ -58,7 +58,7 @@ func TestAccResourceNsxtAlgorithmTypeNsService_importBasic(t *testing.T) {
 	serviceName := getAccTestResourceName()
 	testResourceName := "nsxt_algorithm_type_ns_service.test"
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXAlgServiceCheckDestroy(state, serviceName)

nsxt/resource_nsxt_dhcp_relay_profile_test.go

@@ -18,7 +18,7 @@ func TestAccResourceNsxtDhcpRelayProfile_basic(t *testing.T) {
 	testResourceName := "nsxt_dhcp_relay_profile.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpRelayProfileCheckDestroy(state, updatePrfName)
@@ -53,7 +53,7 @@ func TestAccResourceNsxtDhcpRelayProfile_importBasic(t *testing.T) {
 	testResourceName := "nsxt_dhcp_relay_profile.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpRelayProfileCheckDestroy(state, prfName)

nsxt/resource_nsxt_dhcp_relay_service_test.go

@@ -18,7 +18,7 @@ func TestAccResourceNsxtDhcpRelayService_basic(t *testing.T) {
 	testResourceName := "nsxt_dhcp_relay_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpRelayServiceCheckDestroy(state, prfName)
@@ -51,7 +51,7 @@ func TestAccResourceNsxtDhcpRelayService_importBasic(t *testing.T) {
 	testResourceName := "nsxt_dhcp_relay_service.test"
 
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpRelayServiceCheckDestroy(state, prfName)

nsxt/resource_nsxt_dhcp_server_ip_pool_test.go

@@ -27,7 +27,7 @@ func TestAccResourceNsxtDhcpServerIPPool_basic(t *testing.T) {
 	updatedLeaseTime := "1000000"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpServerIPPoolCheckDestroy(state, updatedName)
@@ -94,7 +94,7 @@ func TestAccResourceNsxtDhcpServerIPPool_noOpts(t *testing.T) {
 	end2 := "1.1.1.160"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXDhcpServerIPPoolCheckDestroy(state, updatedName)
@@ -140,7 +140,7 @@ func TestAccResourceNsxtDhcpServerIPPool_Import(t *testing.T) {
 	edgeClusterName := getEdgeClusterName()
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestMP(t); testAccPreCheck(t) },
+		PreCheck:  func() { testAccOnlyLocalManager(t); testAccTestDeprecated(t); testAccPreCheck(t) },
 		Providers: testAccProviders,
 		CheckDestroy: func(state *terraform.State) error {
 			return testAccNSXNATRuleCheckDestroy(state, name)