Add nomad_acl_bootstrap resource

nomad/provider.go

@@ -173,6 +173,7 @@ func Provider() *schema.Provider {
 		ResourcesMap: map[string]*schema.Resource{
 			"nomad_acl_auth_method":                  resourceACLAuthMethod(),
 			"nomad_acl_binding_rule":                 resourceACLBindingRule(),
+			"nomad_acl_bootstrap":                    resourceACLBootstrap(),
 			"nomad_acl_policy":                       resourceACLPolicy(),
 			"nomad_acl_role":                         resourceACLRole(),
 			"nomad_acl_token":                        resourceACLToken(),

nomad/resource_acl_bootstrap.go

@@ -0,0 +1,101 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nomad
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/nomad/api"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func resourceACLBootstrap() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceACLBootstrapCreate,
+		Delete: resourceACLBootstrapDelete,
+		Read:   resourceACLBootstrapRead,
+		Exists: resourceACLBootstrapExists,
+
+		Schema: map[string]*schema.Schema{
+			"accessor_id": {
+				Description: "Nomad-generated ID for this token.",
+				Computed:    true,
+				Type:        schema.TypeString,
+			},
+			"bootstrap_token": {
+				Description: "The value that grants access to Nomad.",
+				Computed:    true,
+				Optional:    true,
+				Sensitive:   true,
+				Type:        schema.TypeString,
+			},
+		},
+	}
+}
+
+func resourceACLBootstrapCreate(d *schema.ResourceData, meta interface{}) error {
+	providerConfig := meta.(ProviderConfig)
+	client := providerConfig.client
+
+	token := api.BootstrapRequest{
+		BootstrapSecret: d.Get("bootstrap_token").(string),
+	}
+	// create our token
+	log.Println("[DEBUG] Creating ACL Bootstrap token")
+	resp, _, err := client.ACLTokens().BootstrapOpts(token.BootstrapSecret, nil)
+	if err != nil {
+		return fmt.Errorf("error bootstrapping the cluster: %w", err)
+	}
+	log.Printf("[DEBUG] Created ACL token AccessorID %q", resp.AccessorID)
+	d.SetId(resp.AccessorID)
+
+	return resourceACLBootstrapRead(d, meta)
+}
+
+// not implemented as a cluster bootstrap can't be reverted
+func resourceACLBootstrapDelete(d *schema.ResourceData, meta interface{}) error {
+	return nil
+}
+
+func resourceACLBootstrapRead(d *schema.ResourceData, meta interface{}) error {
+	providerConfig := meta.(ProviderConfig)
+	client := providerConfig.client
+	accessor := d.Id()
+
+	// retrieve the token
+	log.Printf("[DEBUG] Reading ACL bootstrap token %q", accessor)
+	token, _, err := client.ACLTokens().Info(accessor, nil)
+	if err != nil {
+		// we have Exists, so no need to handle 404
+		return fmt.Errorf("error reading ACL token %q: %s", accessor, err.Error())
+	}
+	log.Printf("[DEBUG] Read ACL bootstrap token %q", accessor)
+
+	d.Set("accessor_id", token.AccessorID)
+	d.Set("bootstrap_token", token.SecretID)
+
+	return nil
+}
+
+func resourceACLBootstrapExists(d *schema.ResourceData, meta interface{}) (bool, error) {
+	providerConfig := meta.(ProviderConfig)
+	client := providerConfig.client
+
+	accessor := d.Id()
+	log.Printf("[DEBUG] Checking if ACL token %q exists", accessor)
+	_, _, err := client.ACLTokens().Info(accessor, nil)
+	if err != nil {
+		// As of Nomad 0.4.1, the API client returns an error for 404
+		// rather than a nil result, so we must check this way.
+		if strings.Contains(err.Error(), "404") {
+			return false, nil
+		}
+
+		return true, fmt.Errorf("error checking for ACL token %q: %#v", accessor, err)
+	}
+
+	return true, nil
+}

nomad/resource_acl_bootstrap_test.go

@@ -0,0 +1,64 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package nomad
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+func TestResourceACLBootstrap_basic(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		Providers: testProviders,
+		PreCheck:  func() { testAccPreCheck(t) },
+		Steps: []resource.TestStep{
+			{
+				Config: testResourceACLBootstrap_initialConfig(),
+				Check:  testResourceACLBootstrap_initialCheck(),
+			},
+		},
+		// Note: We don't include CheckDestroy because bootstrap cannot be reverted
+	})
+}
+
+func testResourceACLBootstrap_initialConfig() string {
+	return `
+resource "nomad_acl_bootstrap" "test" {
+}
+`
+}
+
+func testResourceACLBootstrap_initialCheck() resource.TestCheckFunc {
+	return resource.ComposeTestCheckFunc(
+		testResourceACLBootstrapExists("nomad_acl_bootstrap.test"),
+		resource.TestCheckResourceAttrSet("nomad_acl_bootstrap.test", "accessor_id"),
+		resource.TestCheckResourceAttrSet("nomad_acl_bootstrap.test", "bootstrap_token"),
+	)
+}
+
+func testResourceACLBootstrapExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		providerConfig := testProvider.Meta().(ProviderConfig)
+		client := providerConfig.client
+
+		_, _, err := client.ACLTokens().Info(rs.Primary.ID, nil)
+		if err != nil {
+			return fmt.Errorf("ACL bootstrap token doesn't exist: %s", err)
+		}
+
+		return nil
+	}
+}