Skip to content

Commit b9a45a1

Browse files
wasagawasaga
authored
ci: add pre-commit action, regenerate docs (#38)
adds pre-commit action to ensure the repo is tidy.
1 parent 3bebbe1 commit b9a45a1

11 files changed

+402
-61
lines changed

‎.github/workflows/pre-commit.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: pre-commit
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
pre-commit:
8+
runs-on: [ubuntu-latest]
9+
steps:
10+
- name: Checkout
11+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
12+
13+
- name: Setup Go
14+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
15+
with:
16+
go-version: 1.23.x
17+
cache: false
18+
19+
- name: Setup Python
20+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38
21+
with:
22+
python-version: "3.12"
23+
24+
- name: Setup Pre-Commit
25+
run: python -m pip install pre-commit
26+
27+
- name: Run Pre-Commit
28+
run: pre-commit run --show-diff-on-failure --color=always

‎.pre-commit-config.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
repos:
2+
- repo: local
3+
hooks:
4+
- id: docs
5+
name: docs
6+
language: system
7+
entry: make docs
8+
types: ["go"]
9+
- id: go-mod-tidy
10+
name: go-mod-tidy
11+
language: system
12+
entry: bash -c 'go mod tidy'
13+
files: go\.mod|go\.sum$
14+
- id: lint
15+
name: lint
16+
language: system
17+
entry: make
18+
args: ["lint"]
19+
types: ["go"]
20+
pass_filenames: false

‎docs/data-sources/policies.md

+14
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,15 @@ List all policies
1515
<!-- schema generated by tfplugindocs -->
1616
## Schema
1717

18+
### Optional
19+
20+
- `limit` (Number) List limit.
21+
- `namespace_id` (String) Namespace to list policies in.
22+
- `offset` (Number) List offset.
23+
- `order_by` (String) List order by.
24+
- `query` (String) Query for policies.
25+
- `total_count` (Number) Total number of policies.
26+
1827
### Read-Only
1928

2029
- `policies` (Attributes List) (see [below for nested schema](#nestedatt--policies))
@@ -24,7 +33,12 @@ List all policies
2433

2534
Read-Only:
2635

36+
- `description` (String) Description of the policy.
37+
- `enforced` (Boolean) Whether the policy is enforced within the namespace hierarchy.
38+
- `explanation` (String) Explanation of the policy.
2739
- `id` (String) Unique identifier for the policy.
2840
- `name` (String) Name of the policy.
2941
- `namespace_id` (String) ID of the namespace the policy belongs to.
3042
- `ppl` (String) Policy Policy Language (PPL) string.
43+
- `rego` (List of String) Rego policies.
44+
- `remediation` (String) Remediation of the policy.

‎docs/data-sources/policy.md

+5
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ Policy for Pomerium.
2121

2222
### Read-Only
2323

24+
- `description` (String) Description of the policy.
25+
- `enforced` (Boolean) Whether the policy is enforced within the namespace hierarchy.
26+
- `explanation` (String) Explanation of the policy.
2427
- `name` (String) Name of the policy.
2528
- `namespace_id` (String) ID of the namespace the policy belongs to.
2629
- `ppl` (String) Policy Policy Language (PPL) string.
30+
- `rego` (List of String) Rego policies.
31+
- `remediation` (String) Remediation of the policy.

‎docs/data-sources/route.md

+64-2
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,72 @@ Route data source
1919

2020
- `id` (String) Unique identifier for the route.
2121

22+
### Optional
23+
24+
- `jwt_groups_filter` (Attributes) JWT Groups Filter (see [below for nested schema](#nestedatt--jwt_groups_filter))
25+
- `jwt_issuer_format` (String) Format for JWT issuer strings. Use 'IssuerHostOnly' for hostname without scheme or trailing slash, or 'IssuerURI' for complete URI including scheme and trailing slash.
26+
2227
### Read-Only
2328

29+
- `allow_spdy` (Boolean) Allow SPDY.
30+
- `allow_websockets` (Boolean) Allow websockets.
31+
- `description` (String) Description of the route.
32+
- `enable_google_cloud_serverless_authentication` (Boolean) Enable Google Cloud serverless authentication.
2433
- `from` (String) From URL.
34+
- `host_path_regex_rewrite_pattern` (String) Host path regex rewrite pattern.
35+
- `host_path_regex_rewrite_substitution` (String) Host path regex rewrite substitution.
36+
- `host_rewrite` (String) Host rewrite.
37+
- `host_rewrite_header` (String) Host rewrite header.
38+
- `idle_timeout` (String) Idle timeout.
39+
- `idp_client_id` (String) IDP client ID.
40+
- `idp_client_secret` (String) IDP client secret.
41+
- `kubernetes_service_account_token` (String) Kubernetes service account token.
42+
- `kubernetes_service_account_token_file` (String) Path to the Kubernetes service account token file.
43+
- `logo_url` (String) URL to the logo image.
2544
- `name` (String) Name of the route.
2645
- `namespace_id` (String) ID of the namespace the route belongs to.
27-
- `policies` (List of String) List of policy IDs associated with the route.
28-
- `to` (List of String) To URLs.
46+
- `pass_identity_headers` (Boolean) Pass identity headers.
47+
- `path` (String) Path.
48+
- `policies` (Set of String) List of policy IDs associated with the route.
49+
- `prefix` (String) Prefix.
50+
- `prefix_rewrite` (String) Prefix rewrite.
51+
- `preserve_host_header` (Boolean) Preserve host header.
52+
- `regex` (String) Regex.
53+
- `regex_priority_order` (Number) Regex priority order.
54+
- `regex_rewrite_pattern` (String) Regex rewrite pattern.
55+
- `regex_rewrite_substitution` (String) Regex rewrite substitution.
56+
- `remove_request_headers` (Set of String) Remove request headers.
57+
- `rewrite_response_headers` (Attributes Set) Response header rewrite rules. (see [below for nested schema](#nestedatt--rewrite_response_headers))
58+
- `set_request_headers` (Map of String) Set request headers.
59+
- `set_response_headers` (Map of String) Set response headers.
60+
- `show_error_details` (Boolean) Show error details.
61+
- `stat_name` (String) Name of the stat.
62+
- `timeout` (String) Timeout.
63+
- `tls_client_key_pair_id` (String) Client key pair ID for TLS client authentication.
64+
- `tls_custom_ca_key_pair_id` (String) Custom CA key pair ID for TLS verification.
65+
- `tls_downstream_server_name` (String) TLS downstream server name.
66+
- `tls_skip_verify` (Boolean) TLS skip verify.
67+
- `tls_upstream_allow_renegotiation` (Boolean) TLS upstream allow renegotiation.
68+
- `tls_upstream_server_name` (String) TLS upstream server name.
69+
- `to` (Set of String) To URLs.
70+
71+
<a id="nestedatt--jwt_groups_filter"></a>
72+
### Nested Schema for `jwt_groups_filter`
73+
74+
Optional:
75+
76+
- `groups` (Set of String) Group IDs to include
77+
- `infer_from_ppl` (Boolean)
78+
79+
80+
<a id="nestedatt--rewrite_response_headers"></a>
81+
### Nested Schema for `rewrite_response_headers`
82+
83+
Required:
84+
85+
- `header` (String) Header name to rewrite
86+
- `value` (String) New value for the header
87+
88+
Optional:
89+
90+
- `prefix` (String) Prefix matcher for the header

‎docs/data-sources/routes.md

+73-2
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,89 @@ List all routes
1515
<!-- schema generated by tfplugindocs -->
1616
## Schema
1717

18+
### Optional
19+
20+
- `limit` (Number) List limit.
21+
- `namespace_id` (String) Namespace to list routes in.
22+
- `offset` (Number) List offset.
23+
- `order_by` (String) List order by.
24+
- `query` (String) Query for routes.
25+
- `total_count` (Number) Total number of routes.
26+
1827
### Read-Only
1928

2029
- `routes` (Attributes List) (see [below for nested schema](#nestedatt--routes))
2130

2231
<a id="nestedatt--routes"></a>
2332
### Nested Schema for `routes`
2433

34+
Optional:
35+
36+
- `jwt_groups_filter` (Attributes) JWT Groups Filter (see [below for nested schema](#nestedatt--routes--jwt_groups_filter))
37+
- `jwt_issuer_format` (String) Format for JWT issuer strings. Use 'IssuerHostOnly' for hostname without scheme or trailing slash, or 'IssuerURI' for complete URI including scheme and trailing slash.
38+
2539
Read-Only:
2640

41+
- `allow_spdy` (Boolean) Allow SPDY.
42+
- `allow_websockets` (Boolean) Allow websockets.
43+
- `description` (String) Description of the route.
44+
- `enable_google_cloud_serverless_authentication` (Boolean) Enable Google Cloud serverless authentication.
2745
- `from` (String) From URL.
46+
- `host_path_regex_rewrite_pattern` (String) Host path regex rewrite pattern.
47+
- `host_path_regex_rewrite_substitution` (String) Host path regex rewrite substitution.
48+
- `host_rewrite` (String) Host rewrite.
49+
- `host_rewrite_header` (String) Host rewrite header.
2850
- `id` (String) Unique identifier for the route.
51+
- `idle_timeout` (String) Idle timeout.
52+
- `idp_client_id` (String) IDP client ID.
53+
- `idp_client_secret` (String) IDP client secret.
54+
- `kubernetes_service_account_token` (String) Kubernetes service account token.
55+
- `kubernetes_service_account_token_file` (String) Path to the Kubernetes service account token file.
56+
- `logo_url` (String) URL to the logo image.
2957
- `name` (String) Name of the route.
3058
- `namespace_id` (String) ID of the namespace the route belongs to.
31-
- `policies` (List of String) List of policy IDs associated with the route.
32-
- `to` (List of String) To URLs.
59+
- `pass_identity_headers` (Boolean) Pass identity headers.
60+
- `path` (String) Path.
61+
- `policies` (Set of String) List of policy IDs associated with the route.
62+
- `prefix` (String) Prefix.
63+
- `prefix_rewrite` (String) Prefix rewrite.
64+
- `preserve_host_header` (Boolean) Preserve host header.
65+
- `regex` (String) Regex.
66+
- `regex_priority_order` (Number) Regex priority order.
67+
- `regex_rewrite_pattern` (String) Regex rewrite pattern.
68+
- `regex_rewrite_substitution` (String) Regex rewrite substitution.
69+
- `remove_request_headers` (Set of String) Remove request headers.
70+
- `rewrite_response_headers` (Attributes Set) Response header rewrite rules. (see [below for nested schema](#nestedatt--routes--rewrite_response_headers))
71+
- `set_request_headers` (Map of String) Set request headers.
72+
- `set_response_headers` (Map of String) Set response headers.
73+
- `show_error_details` (Boolean) Show error details.
74+
- `stat_name` (String) Name of the stat.
75+
- `timeout` (String) Timeout.
76+
- `tls_client_key_pair_id` (String) Client key pair ID for TLS client authentication.
77+
- `tls_custom_ca_key_pair_id` (String) Custom CA key pair ID for TLS verification.
78+
- `tls_downstream_server_name` (String) TLS downstream server name.
79+
- `tls_skip_verify` (Boolean) TLS skip verify.
80+
- `tls_upstream_allow_renegotiation` (Boolean) TLS upstream allow renegotiation.
81+
- `tls_upstream_server_name` (String) TLS upstream server name.
82+
- `to` (Set of String) To URLs.
83+
84+
<a id="nestedatt--routes--jwt_groups_filter"></a>
85+
### Nested Schema for `routes.jwt_groups_filter`
86+
87+
Optional:
88+
89+
- `groups` (Set of String) Group IDs to include
90+
- `infer_from_ppl` (Boolean)
91+
92+
93+
<a id="nestedatt--routes--rewrite_response_headers"></a>
94+
### Nested Schema for `routes.rewrite_response_headers`
95+
96+
Required:
97+
98+
- `header` (String) Header name to rewrite
99+
- `value` (String) New value for the header
100+
101+
Optional:
102+
103+
- `prefix` (String) Prefix matcher for the header

‎docs/data-sources/service_accounts.md

+4
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ List all service accounts
1515
<!-- schema generated by tfplugindocs -->
1616
## Schema
1717

18+
### Optional
19+
20+
- `namespace_id` (String) Namespace of the service accounts.
21+
1822
### Read-Only
1923

2024
- `service_accounts` (Attributes List) (see [below for nested schema](#nestedatt--service_accounts))

‎docs/index.md

+105
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,117 @@
33
page_title: "pomerium Provider"
44
subcategory: ""
55
description: |-
6+
Pomerium Provider
7+
The Pomerium provider enables management of Pomerium Enterprise resources through Terraform. It provides resources and data sources for managing policies, routes, namespaces, and other Pomerium Enterprise features.
8+
Example Usage
69
10+
terraform {
11+
required_providers {
12+
pomerium = {
13+
source = "pomerium/pomerium"
14+
version = "~> 0.0.7"
15+
}
16+
}
17+
}
18+
19+
provider "pomerium" {
20+
api_url = "https://console-api.your-domain.com"
21+
# Choose one authentication method:
22+
service_account_token = var.pomerium_service_account_token
23+
# shared_secret_b64 = var.shared_secret_b64
24+
}
25+
26+
Authentication Methods
27+
The provider supports two authentication methods:
28+
Service Account Token (Recommended)
29+
Uses a Pomerium Enterprise Service Account token for authentication. This method provides fine-grained access control at the namespace level.
30+
31+
provider "pomerium" {
32+
api_url = "https://console-api.your-domain.com"
33+
service_account_token = var.pomerium_service_account_token
34+
}
35+
36+
Bootstrap Service Account
37+
Uses the Enterprise Console's shared secret for authentication. Requires BOOTSTRAP_SERVICE_ACCOUNT=true in the Enterprise Console configuration.
38+
39+
provider "pomerium" {
40+
api_url = "https://console-api.your-domain.com"
41+
shared_secret_b64 = var.shared_secret_b64
42+
}
43+
44+
Schema
45+
Required
46+
api_url (String) - The URL of your Pomerium Enterprise Console API endpoint.
47+
Optional
48+
service_account_token (String, Sensitive) - A Pomerium Enterprise Service Account token. Mutually exclusive with shared_secret_b64.shared_secret_b64 (String, Sensitive) - The base64-encoded shared secret from your Pomerium Enterprise Console. Mutually exclusive with service_account_token.tls_insecure_skip_verify (Boolean) - Skip TLS certificate verification. Should only be used in testing environments.
49+
~> Note: You must specify either service_account_token or shared_secret_b64, but not both.
750
---
851

952
# pomerium Provider
1053

54+
# Pomerium Provider
55+
56+
The Pomerium provider enables management of Pomerium Enterprise resources through Terraform. It provides resources and data sources for managing policies, routes, namespaces, and other Pomerium Enterprise features.
57+
58+
## Example Usage
59+
60+
```terraform
61+
terraform {
62+
required_providers {
63+
pomerium = {
64+
source = "pomerium/pomerium"
65+
version = "~> 0.0.7"
66+
}
67+
}
68+
}
69+
70+
provider "pomerium" {
71+
api_url = "https://console-api.your-domain.com"
72+
# Choose one authentication method:
73+
service_account_token = var.pomerium_service_account_token
74+
# shared_secret_b64 = var.shared_secret_b64
75+
}
76+
```
77+
78+
## Authentication Methods
79+
80+
The provider supports two authentication methods:
81+
82+
### Service Account Token (Recommended)
83+
84+
Uses a Pomerium Enterprise Service Account token for authentication. This method provides fine-grained access control at the namespace level.
85+
86+
```terraform
87+
provider "pomerium" {
88+
api_url = "https://console-api.your-domain.com"
89+
service_account_token = var.pomerium_service_account_token
90+
}
91+
```
92+
93+
### Bootstrap Service Account
94+
95+
Uses the Enterprise Console's shared secret for authentication. Requires `BOOTSTRAP_SERVICE_ACCOUNT=true` in the Enterprise Console configuration.
96+
97+
```terraform
98+
provider "pomerium" {
99+
api_url = "https://console-api.your-domain.com"
100+
shared_secret_b64 = var.shared_secret_b64
101+
}
102+
```
103+
104+
## Schema
105+
106+
### Required
107+
108+
- `api_url` (String) - The URL of your Pomerium Enterprise Console API endpoint.
109+
110+
### Optional
111+
112+
- `service_account_token` (String, Sensitive) - A Pomerium Enterprise Service Account token. Mutually exclusive with `shared_secret_b64`.
113+
- `shared_secret_b64` (String, Sensitive) - The base64-encoded shared secret from your Pomerium Enterprise Console. Mutually exclusive with `service_account_token`.
114+
- `tls_insecure_skip_verify` (Boolean) - Skip TLS certificate verification. Should only be used in testing environments.
11115

116+
~> **Note:** You must specify either `service_account_token` or `shared_secret_b64`, but not both.
12117

13118

14119

0 commit comments

Comments
 (0)