Merge pull request #1163 from svanharmelen/f-cloudstack-vpn-resources

provider/cloudstack: adding vpn resources

builtin/providers/cloudstack/provider.go

@@ -30,7 +30,7 @@ func Provider() terraform.ResourceProvider {
 			"timeout": &schema.Schema{
 				Type:        schema.TypeInt,
 				Required:    true,
-				DefaultFunc: schema.EnvDefaultFunc("CLOUDSTACK_TIMEOUT", 180),
+				DefaultFunc: schema.EnvDefaultFunc("CLOUDSTACK_TIMEOUT", 300),
 			},
 		},
 
@@ -46,6 +46,9 @@ func Provider() terraform.ResourceProvider {
 			"cloudstack_nic":                  resourceCloudStackNIC(),
 			"cloudstack_port_forward":         resourceCloudStackPortForward(),
 			"cloudstack_vpc":                  resourceCloudStackVPC(),
+			"cloudstack_vpn_connection":       resourceCloudStackVPNConnection(),
+			"cloudstack_vpn_customer_gateway": resourceCloudStackVPNCustomerGateway(),
+			"cloudstack_vpn_gateway":          resourceCloudStackVPNGateway(),
 		},
 
 		ConfigureFunc: providerConfigure,

builtin/providers/cloudstack/provider_test.go

@@ -51,7 +51,8 @@ var CLOUDSTACK_NETWORK_1_OFFERING = ""
 var CLOUDSTACK_NETWORK_1_IPADDRESS = ""
 var CLOUDSTACK_NETWORK_2 = ""
 var CLOUDSTACK_NETWORK_2_IPADDRESS = ""
-var CLOUDSTACK_VPC_CIDR = ""
+var CLOUDSTACK_VPC_CIDR_1 = ""
+var CLOUDSTACK_VPC_CIDR_2 = ""
 var CLOUDSTACK_VPC_OFFERING = ""
 var CLOUDSTACK_VPC_NETWORK_CIDR = ""
 var CLOUDSTACK_VPC_NETWORK_OFFERING = ""

builtin/providers/cloudstack/resource_cloudstack_instance.go

@@ -95,18 +95,18 @@ func resourceCloudStackInstanceCreate(d *schema.ResourceData, meta interface{})
 		return e.Error()
 	}
 
-	// Retrieve the template UUID
-	templateid, e := retrieveUUID(cs, "template", d.Get("template").(string))
-	if e != nil {
-		return e.Error()
-	}
-
 	// Retrieve the zone object
 	zone, _, err := cs.Zone.GetZoneByName(d.Get("zone").(string))
 	if err != nil {
 		return err
 	}
 
+	// Retrieve the template UUID
+	templateid, e := retrieveTemplateUUID(cs, zone.Id, d.Get("template").(string))
+	if e != nil {
+		return e.Error()
+	}
+
 	// Create a new parameter struct
 	p := cs.VirtualMachine.NewDeployVirtualMachineParams(serviceofferingid, templateid, zone.Id)
 

builtin/providers/cloudstack/resource_cloudstack_ipaddress_test.go

@@ -132,6 +132,6 @@ resource "cloudstack_vpc" "foobar" {
 resource "cloudstack_ipaddress" "foo" {
   vpc = "${cloudstack_vpc.foobar.name}"
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resource_cloudstack_network_acl_rule_test.go

@@ -196,7 +196,7 @@ resource "cloudstack_network_acl_rule" "foo" {
     traffic_type = "ingress"
   }
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE)
 
@@ -233,6 +233,6 @@ resource "cloudstack_network_acl_rule" "foo" {
     traffic_type = "egress"
   }
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resource_cloudstack_network_acl_test.go

@@ -112,6 +112,6 @@ resource "cloudstack_network_acl" "foo" {
   description = "terraform-acl-text"
   vpc = "${cloudstack_vpc.foobar.name}"
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resource_cloudstack_network_test.go

@@ -186,7 +186,7 @@ resource "cloudstack_network" "foo" {
   aclid = "${cloudstack_network_acl.foo.id}"
   zone = "${cloudstack_vpc.foobar.zone}"
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE,
 	CLOUDSTACK_VPC_NETWORK_CIDR,

builtin/providers/cloudstack/resource_cloudstack_vpc_test.go

@@ -72,8 +72,8 @@ func testAccCheckCloudStackVPCAttributes(
 			return fmt.Errorf("Bad display text: %s", vpc.Displaytext)
 		}
 
-		if vpc.Cidr != CLOUDSTACK_VPC_CIDR {
+		if vpc.Cidr != CLOUDSTACK_VPC_CIDR_1 {
-			return fmt.Errorf("Bad VPC offering: %s", vpc.Cidr)
+			return fmt.Errorf("Bad VPC CIDR: %s", vpc.Cidr)
 		}
 
 		return nil
@@ -113,6 +113,6 @@ resource "cloudstack_vpc" "foo" {
   vpc_offering = "%s"
   zone = "%s"
 }`,
-	CLOUDSTACK_VPC_CIDR,
+	CLOUDSTACK_VPC_CIDR_1,
 	CLOUDSTACK_VPC_OFFERING,
 	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resource_cloudstack_vpn_connection.go

@@ -0,0 +1,95 @@
+package cloudstack
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackVPNConnection() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackVPNConnectionCreate,
+		Read:   resourceCloudStackVPNConnectionRead,
+		Delete: resourceCloudStackVPNConnectionDelete,
+
+		Schema: map[string]*schema.Schema{
+			"customergatewayid": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"vpngatewayid": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackVPNConnectionCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewCreateVpnConnectionParams(
+		d.Get("customergatewayid").(string),
+		d.Get("vpngatewayid").(string),
+	)
+
+	// Create the new VPN Connection
+	v, err := cs.VPN.CreateVpnConnection(p)
+	if err != nil {
+		return fmt.Errorf("Error creating VPN Connection: %s", err)
+	}
+
+	d.SetId(v.Id)
+
+	return resourceCloudStackVPNConnectionRead(d, meta)
+}
+
+func resourceCloudStackVPNConnectionRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Get the VPN Connection details
+	v, count, err := cs.VPN.GetVpnConnectionByID(d.Id())
+	if err != nil {
+		if count == 0 {
+			log.Printf("[DEBUG] VPN Connection does no longer exist")
+			d.SetId("")
+			return nil
+		}
+
+		return err
+	}
+
+	d.Set("customergatewayid", v.S2scustomergatewayid)
+	d.Set("vpngatewayid", v.S2svpngatewayid)
+
+	return nil
+}
+
+func resourceCloudStackVPNConnectionDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewDeleteVpnConnectionParams(d.Id())
+
+	// Delete the VPN Connection
+	_, err := cs.VPN.DeleteVpnConnection(p)
+	if err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"Invalid parameter id value=%s due to incorrect long value format, "+
+				"or entity does not exist", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error deleting VPN Connection: %s", err)
+	}
+
+	return nil
+}

builtin/providers/cloudstack/resource_cloudstack_vpn_connection_test.go

@@ -0,0 +1,142 @@
+package cloudstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackVPNConnection_basic(t *testing.T) {
+	var vpnConnection cloudstack.VpnConnection
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackVPNConnectionDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackVPNConnection_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackVPNConnectionExists(
+						"cloudstack_vpn_connection.foo-bar", &vpnConnection),
+					testAccCheckCloudStackVPNConnectionExists(
+						"cloudstack_vpn_connection.bar-foo", &vpnConnection),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackVPNConnectionExists(
+	n string, vpnConnection *cloudstack.VpnConnection) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN Connection ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+		v, _, err := cs.VPN.GetVpnConnectionByID(rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		if v.Id != rs.Primary.ID {
+			return fmt.Errorf("VPN Connection not found")
+		}
+
+		*vpnConnection = *v
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackVPNConnectionDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_vpn_connection" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN Connection ID is set")
+		}
+
+		p := cs.VPN.NewDeleteVpnConnectionParams(rs.Primary.ID)
+		_, err := cs.VPN.DeleteVpnConnection(p)
+
+		if err != nil {
+			return fmt.Errorf(
+				"Error deleting VPN Connection (%s): %s",
+				rs.Primary.ID, err)
+		}
+	}
+
+	return nil
+}
+
+var testAccCloudStackVPNConnection_basic = fmt.Sprintf(`
+resource "cloudstack_vpc" "foo" {
+  name = "terraform-vpc-foo"
+  cidr = "%s"
+  vpc_offering = "%s"
+  zone = "%s"
+}
+
+resource "cloudstack_vpc" "bar" {
+  name = "terraform-vpc-bar"
+  cidr = "%s"
+  vpc_offering = "%s"
+  zone = "%s"
+}
+
+resource "cloudstack_vpn_gateway" "foo" {
+    vpc = "${cloudstack_vpc.foo.name}"
+}
+
+resource "cloudstack_vpn_gateway" "bar" {
+    vpc = "${cloudstack_vpc.bar.name}"
+}
+
+resource "cloudstack_vpn_customer_gateway" "foo" {
+    name = "terraform-foo"
+    cidr = "${cloudstack_vpc.foo.cidr}"
+    esp_policy = "aes256-sha1"
+    gateway = "${cloudstack_vpn_gateway.foo.public_ip}"
+    ike_policy = "aes256-sha1"
+    ipsec_psk = "terraform"
+}
+
+resource "cloudstack_vpn_customer_gateway" "bar" {
+    name = "terraform-bar"
+    cidr = "${cloudstack_vpc.bar.cidr}"
+    esp_policy = "aes256-sha1"
+    gateway = "${cloudstack_vpn_gateway.bar.public_ip}"
+    ike_policy = "aes256-sha1"
+    ipsec_psk = "terraform"
+}
+
+resource "cloudstack_vpn_connection" "foo-bar" {
+    customergatewayid = "${cloudstack_vpn_customer_gateway.foo.id}"
+    vpngatewayid = "${cloudstack_vpn_gateway.bar.id}"
+}
+
+resource "cloudstack_vpn_connection" "bar-foo" {
+    customergatewayid = "${cloudstack_vpn_customer_gateway.bar.id}"
+    vpngatewayid = "${cloudstack_vpn_gateway.foo.id}"
+}`,
+	CLOUDSTACK_VPC_CIDR_1,
+	CLOUDSTACK_VPC_OFFERING,
+	CLOUDSTACK_ZONE,
+	CLOUDSTACK_VPC_CIDR_2,
+	CLOUDSTACK_VPC_OFFERING,
+	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway.go

@@ -0,0 +1,193 @@
+package cloudstack
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackVPNCustomerGateway() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackVPNCustomerGatewayCreate,
+		Read:   resourceCloudStackVPNCustomerGatewayRead,
+		Update: resourceCloudStackVPNCustomerGatewayUpdate,
+		Delete: resourceCloudStackVPNCustomerGatewayDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"cidr": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"esp_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"gateway": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"ike_policy": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"ipsec_psk": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+			},
+
+			"dpd": &schema.Schema{
+				Type:     schema.TypeBool,
+				Optional: true,
+				Computed: true,
+			},
+
+			"esp_lifetime": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+
+			"ike_lifetime": &schema.Schema{
+				Type:     schema.TypeInt,
+				Optional: true,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackVPNCustomerGatewayCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewCreateVpnCustomerGatewayParams(
+		d.Get("cidr").(string),
+		d.Get("esp_policy").(string),
+		d.Get("gateway").(string),
+		d.Get("ike_policy").(string),
+		d.Get("ipsec_psk").(string),
+	)
+
+	p.SetName(d.Get("name").(string))
+
+	if dpd, ok := d.GetOk("dpd"); ok {
+		p.SetDpd(dpd.(bool))
+	}
+
+	if esplifetime, ok := d.GetOk("esp_lifetime"); ok {
+		p.SetEsplifetime(esplifetime.(int))
+	}
+
+	if ikelifetime, ok := d.GetOk("ike_lifetime"); ok {
+		p.SetIkelifetime(ikelifetime.(int))
+	}
+
+	// Create the new VPN Customer Gateway
+	v, err := cs.VPN.CreateVpnCustomerGateway(p)
+	if err != nil {
+		return fmt.Errorf("Error creating VPN Customer Gateway %s: %s", d.Get("name").(string), err)
+	}
+
+	d.SetId(v.Id)
+
+	return resourceCloudStackVPNCustomerGatewayRead(d, meta)
+}
+
+func resourceCloudStackVPNCustomerGatewayRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Get the VPN Customer Gateway details
+	v, count, err := cs.VPN.GetVpnCustomerGatewayByID(d.Id())
+	if err != nil {
+		if count == 0 {
+			log.Printf(
+				"[DEBUG] VPN Customer Gateway %s does no longer exist", d.Get("name").(string))
+			d.SetId("")
+			return nil
+		}
+
+		return err
+	}
+
+	d.Set("name", v.Name)
+	d.Set("cidr", v.Cidrlist)
+	d.Set("esp_policy", v.Esppolicy)
+	d.Set("gateway", v.Gateway)
+	d.Set("ike_policy", v.Ikepolicy)
+	d.Set("ipsec_psk", v.Ipsecpsk)
+	d.Set("dpd", v.Dpd)
+	d.Set("esp_lifetime", v.Esplifetime)
+	d.Set("ike_lifetime", v.Ikelifetime)
+
+	return nil
+}
+
+func resourceCloudStackVPNCustomerGatewayUpdate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewUpdateVpnCustomerGatewayParams(
+		d.Get("cidr").(string),
+		d.Get("esp_policy").(string),
+		d.Get("gateway").(string),
+		d.Id(),
+		d.Get("ike_policy").(string),
+		d.Get("ipsec_psk").(string),
+	)
+
+	p.SetName(d.Get("name").(string))
+
+	if dpd, ok := d.GetOk("dpd"); ok {
+		p.SetDpd(dpd.(bool))
+	}
+
+	if esplifetime, ok := d.GetOk("esp_lifetime"); ok {
+		p.SetEsplifetime(esplifetime.(int))
+	}
+
+	if ikelifetime, ok := d.GetOk("ike_lifetime"); ok {
+		p.SetIkelifetime(ikelifetime.(int))
+	}
+
+	// Update the VPN Customer Gateway
+	_, err := cs.VPN.UpdateVpnCustomerGateway(p)
+	if err != nil {
+		return fmt.Errorf("Error updating VPN Customer Gateway %s: %s", d.Get("name").(string), err)
+	}
+
+	return resourceCloudStackVPNCustomerGatewayRead(d, meta)
+}
+
+func resourceCloudStackVPNCustomerGatewayDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewDeleteVpnCustomerGatewayParams(d.Id())
+
+	// Delete the VPN Customer Gateway
+	_, err := cs.VPN.DeleteVpnCustomerGateway(p)
+	if err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"Invalid parameter id value=%s due to incorrect long value format, "+
+				"or entity does not exist", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error deleting VPN Customer Gateway %s: %s", d.Get("name").(string), err)
+	}
+
+	return nil
+}

builtin/providers/cloudstack/resource_cloudstack_vpn_customer_gateway_test.go

@@ -0,0 +1,223 @@
+package cloudstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackVPNCustomerGateway_basic(t *testing.T) {
+	var vpnCustomerGateway cloudstack.VpnCustomerGateway
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackVPNCustomerGatewayDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackVPNCustomerGateway_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackVPNCustomerGatewayExists(
+						"cloudstack_vpn_customer_gateway.foo", &vpnCustomerGateway),
+					testAccCheckCloudStackVPNCustomerGatewayAttributes(&vpnCustomerGateway),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "name", "terraform-foo"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "name", "terraform-bar"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "ike_policy", "aes256-sha1"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "esp_policy", "aes256-sha1"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccCloudStackVPNCustomerGateway_update(t *testing.T) {
+	var vpnCustomerGateway cloudstack.VpnCustomerGateway
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackVPNCustomerGatewayDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackVPNCustomerGateway_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackVPNCustomerGatewayExists(
+						"cloudstack_vpn_customer_gateway.foo", &vpnCustomerGateway),
+					testAccCheckCloudStackVPNCustomerGatewayAttributes(&vpnCustomerGateway),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "name", "terraform-foo"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "name", "terraform-bar"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "ike_policy", "aes256-sha1"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "esp_policy", "aes256-sha1"),
+				),
+			},
+
+			resource.TestStep{
+				Config: testAccCloudStackVPNCustomerGateway_update,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackVPNCustomerGatewayExists(
+						"cloudstack_vpn_customer_gateway.foo", &vpnCustomerGateway),
+					testAccCheckCloudStackVPNCustomerGatewayAttributes(&vpnCustomerGateway),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "name", "terraform-foo-bar"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "name", "terraform-bar-foo"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.foo", "ike_policy", "3des-md5"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_customer_gateway.bar", "esp_policy", "3des-md5"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackVPNCustomerGatewayExists(
+	n string, vpnCustomerGateway *cloudstack.VpnCustomerGateway) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN CustomerGateway ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+		v, _, err := cs.VPN.GetVpnCustomerGatewayByID(rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		if v.Id != rs.Primary.ID {
+			return fmt.Errorf("VPN CustomerGateway not found")
+		}
+
+		*vpnCustomerGateway = *v
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackVPNCustomerGatewayAttributes(
+	vpnCustomerGateway *cloudstack.VpnCustomerGateway) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+
+		if vpnCustomerGateway.Esppolicy != "aes256-sha1" {
+			return fmt.Errorf("Bad ESP policy: %s", vpnCustomerGateway.Esppolicy)
+		}
+
+		if vpnCustomerGateway.Ikepolicy != "aes256-sha1" {
+			return fmt.Errorf("Bad IKE policy: %s", vpnCustomerGateway.Ikepolicy)
+		}
+
+		if vpnCustomerGateway.Ipsecpsk != "terraform" {
+			return fmt.Errorf("Bad IPSEC pre-shared key: %s", vpnCustomerGateway.Ipsecpsk)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackVPNCustomerGatewayDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_vpn_customer_gateway" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN Customer Gateway ID is set")
+		}
+
+		p := cs.VPN.NewDeleteVpnCustomerGatewayParams(rs.Primary.ID)
+		_, err := cs.VPN.DeleteVpnCustomerGateway(p)
+
+		if err != nil {
+			return fmt.Errorf(
+				"Error deleting VPN Customer Gateway (%s): %s",
+				rs.Primary.ID, err)
+		}
+	}
+
+	return nil
+}
+
+var testAccCloudStackVPNCustomerGateway_basic = fmt.Sprintf(`
+resource "cloudstack_vpc" "foo" {
+  name = "terraform-vpc-foo"
+  cidr = "%s"
+  vpc_offering = "%s"
+  zone = "%s"
+}
+
+resource "cloudstack_vpc" "bar" {
+  name = "terraform-vpc-bar"
+  cidr = "%s"
+  vpc_offering = "%s"
+  zone = "%s"
+}
+
+resource "cloudstack_vpn_gateway" "foo" {
+    vpc = "${cloudstack_vpc.foo.name}"
+}
+
+resource "cloudstack_vpn_gateway" "bar" {
+    vpc = "${cloudstack_vpc.bar.name}"
+}
+
+resource "cloudstack_vpn_customer_gateway" "foo" {
+    name = "terraform-foo"
+    cidr = "${cloudstack_vpc.foo.cidr}"
+    esp_policy = "aes256-sha1"
+    gateway = "${cloudstack_vpn_gateway.foo.public_ip}"
+    ike_policy = "aes256-sha1"
+    ipsec_psk = "terraform"
+}
+
+resource "cloudstack_vpn_customer_gateway" "bar" {
+    name = "terraform-bar"
+    cidr = "${cloudstack_vpc.bar.cidr}"
+    esp_policy = "aes256-sha1"
+    gateway = "${cloudstack_vpn_gateway.bar.public_ip}"
+    ike_policy = "aes256-sha1"
+    ipsec_psk = "terraform"
+}`,
+	CLOUDSTACK_VPC_CIDR_1,
+	CLOUDSTACK_VPC_OFFERING,
+	CLOUDSTACK_ZONE,
+	CLOUDSTACK_VPC_CIDR_2,
+	CLOUDSTACK_VPC_OFFERING,
+	CLOUDSTACK_ZONE)
+
+var testAccCloudStackVPNCustomerGateway_update = fmt.Sprintf(`
+resource "cloudstack_vpn_customer_gateway" "foo" {
+    name = "terraform-foo-bar"
+    cidr = "${cloudstack_vpc.foo.cidr}"
+    esp_policy = "3des-md5"
+    gateway = "${cloudstack_vpn_gateway.foo.public_ip}"
+    ike_policy = "3des-md5"
+    ipsec_psk = "terraform"
+}
+
+resource "cloudstack_vpn_customer_gateway" "bar" {
+    name = "terraform-bar-foo"
+    cidr = "${cloudstack_vpc.bar.cidr}"
+    esp_policy = "3des-md5"
+    gateway = "${cloudstack_vpn_gateway.bar.public_ip}"
+    ike_policy = "3des-md5"
+    ipsec_psk = "terraform"
+}`)

builtin/providers/cloudstack/resource_cloudstack_vpn_gateway.go

@@ -0,0 +1,97 @@
+package cloudstack
+
+import (
+	"fmt"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func resourceCloudStackVPNGateway() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceCloudStackVPNGatewayCreate,
+		Read:   resourceCloudStackVPNGatewayRead,
+		Delete: resourceCloudStackVPNGatewayDelete,
+
+		Schema: map[string]*schema.Schema{
+			"vpc": &schema.Schema{
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"public_ip": &schema.Schema{
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func resourceCloudStackVPNGatewayCreate(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Retrieve the VPC UUID
+	vpcid, e := retrieveUUID(cs, "vpc", d.Get("vpc").(string))
+	if e != nil {
+		return e.Error()
+	}
+
+	// Create a new parameter struct
+	p := cs.VPN.NewCreateVpnGatewayParams(vpcid)
+
+	// Create the new VPN Gateway
+	v, err := cs.VPN.CreateVpnGateway(p)
+	if err != nil {
+		return fmt.Errorf("Error creating VPN Gateway for VPC %s: %s", d.Get("vpc").(string), err)
+	}
+
+	d.SetId(v.Id)
+
+	return resourceCloudStackVPNGatewayRead(d, meta)
+}
+
+func resourceCloudStackVPNGatewayRead(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Get the VPN Gateway details
+	v, count, err := cs.VPN.GetVpnGatewayByID(d.Id())
+	if err != nil {
+		if count == 0 {
+			log.Printf(
+				"[DEBUG] VPN Gateway for VPC %s does no longer exist", d.Get("vpc").(string))
+			d.SetId("")
+			return nil
+		}
+
+		return err
+	}
+
+	d.Set("public_ip", v.Publicip)
+
+	return nil
+}
+
+func resourceCloudStackVPNGatewayDelete(d *schema.ResourceData, meta interface{}) error {
+	cs := meta.(*cloudstack.CloudStackClient)
+
+	// Create a new parameter struct
+	p := cs.VPN.NewDeleteVpnGatewayParams(d.Id())
+
+	// Delete the VPN Gateway
+	_, err := cs.VPN.DeleteVpnGateway(p)
+	if err != nil {
+		// This is a very poor way to be told the UUID does no longer exist :(
+		if strings.Contains(err.Error(), fmt.Sprintf(
+			"Invalid parameter id value=%s due to incorrect long value format, "+
+				"or entity does not exist", d.Id())) {
+			return nil
+		}
+
+		return fmt.Errorf("Error deleting VPN Gateway for VPC %s: %s", d.Get("vpc").(string), err)
+	}
+
+	return nil
+}

builtin/providers/cloudstack/resource_cloudstack_vpn_gateway_test.go

@@ -0,0 +1,101 @@
+package cloudstack
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+	"github.com/xanzy/go-cloudstack/cloudstack"
+)
+
+func TestAccCloudStackVPNGateway_basic(t *testing.T) {
+	var vpnGateway cloudstack.VpnGateway
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckCloudStackVPNGatewayDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccCloudStackVPNGateway_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudStackVPNGatewayExists(
+						"cloudstack_vpn_gateway.foo", &vpnGateway),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_gateway.foo", "vpc", "terraform-vpc"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCloudStackVPNGatewayExists(
+	n string, vpnGateway *cloudstack.VpnGateway) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN Gateway ID is set")
+		}
+
+		cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+		v, _, err := cs.VPN.GetVpnGatewayByID(rs.Primary.ID)
+
+		if err != nil {
+			return err
+		}
+
+		if v.Id != rs.Primary.ID {
+			return fmt.Errorf("VPN Gateway not found")
+		}
+
+		*vpnGateway = *v
+
+		return nil
+	}
+}
+
+func testAccCheckCloudStackVPNGatewayDestroy(s *terraform.State) error {
+	cs := testAccProvider.Meta().(*cloudstack.CloudStackClient)
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "cloudstack_vpn_gateway" {
+			continue
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No VPN Gateway ID is set")
+		}
+
+		p := cs.VPN.NewDeleteVpnGatewayParams(rs.Primary.ID)
+		_, err := cs.VPN.DeleteVpnGateway(p)
+
+		if err != nil {
+			return fmt.Errorf(
+				"Error deleting VPN Gateway (%s): %s",
+				rs.Primary.ID, err)
+		}
+	}
+
+	return nil
+}
+
+var testAccCloudStackVPNGateway_basic = fmt.Sprintf(`
+resource "cloudstack_vpc" "foo" {
+  name = "terraform-vpc"
+  display_text = "terraform-vpc-text"
+  cidr = "%s"
+  vpc_offering = "%s"
+  zone = "%s"
+}
+
+resource "cloudstack_vpn_gateway" "foo" {
+    vpc = "${cloudstack_vpc.foo.name}"
+}`,
+	CLOUDSTACK_VPC_CIDR_1,
+	CLOUDSTACK_VPC_OFFERING,
+	CLOUDSTACK_ZONE)

builtin/providers/cloudstack/resources.go

@@ -40,8 +40,6 @@ func retrieveUUID(cs *cloudstack.CloudStackClient, name, value string) (uuid str
 		uuid, err = cs.VPC.GetVPCOfferingID(value)
 	case "vpc":
 		uuid, err = cs.VPC.GetVPCID(value)
-	case "template":
-		uuid, err = cs.Template.GetTemplateID(value, "executable")
 	case "network":
 		uuid, err = cs.Network.GetNetworkID(value)
 	case "zone":
@@ -71,6 +69,22 @@ func retrieveUUID(cs *cloudstack.CloudStackClient, name, value string) (uuid str
 	return uuid, nil
 }
 
+func retrieveTemplateUUID(cs *cloudstack.CloudStackClient, zoneid, value string) (uuid string, e *retrieveError) {
+	// If the supplied value isn't a UUID, try to retrieve the UUID ourselves
+	if isUUID(value) {
+		return value, nil
+	}
+
+	log.Printf("[DEBUG] Retrieving UUID of template: %s", value)
+
+	uuid, err := cs.Template.GetTemplateID(value, "executable", zoneid)
+	if err != nil {
+		return uuid, &retrieveError{name: "template", value: value, err: err}
+	}
+
+	return uuid, nil
+}
+
 func isUUID(s string) bool {
 	re := regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`)
 	return re.MatchString(s)

website/source/docs/providers/cloudstack/r/egress_firewall.html.markdown

@@ -58,4 +58,4 @@ The `rule` block supports:
 
 The following attributes are exported:
 
-* `ID` - The network ID for which the egress firewall rules are created.
+* `id` - The network ID for which the egress firewall rules are created.

website/source/docs/providers/cloudstack/r/firewall.html.markdown

@@ -58,4 +58,4 @@ The `rule` block supports:
 
 The following attributes are exported:
 
-* `ID` - The IP address ID for which the firewall rules are created.
+* `id` - The IP address ID for which the firewall rules are created.

website/source/docs/providers/cloudstack/r/network_acl_rule.html.markdown

@@ -66,4 +66,4 @@ The `rule` block supports:
 
 The following attributes are exported:
 
-* `ID` - The ACL ID for which the rules are created.
+* `id` - The ACL ID for which the rules are created.

website/source/docs/providers/cloudstack/r/vpn_connection.html.markdown

@@ -0,0 +1,38 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_vpn_connection"
+sidebar_current: "docs-cloudstack-resource-vpn-connection"
+description: |-
+  Creates a site to site VPN connection.
+---
+
+# cloudstack\_vpn\_connection
+
+Creates a site to site VPN connection.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "cloudstack_vpn_connection" "default" {
+    customergatewayid = "xxx"
+    vpngatewayid = "xxx"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `customergatewayid` - (Required) The Customer Gateway ID to connect.
+    Changing this forces a new resource to be created.
+
+* `vpngatewayid` - (Required) The VPN Gateway ID to connect.
+    Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ID of the VPN Connection.

website/source/docs/providers/cloudstack/r/vpn_customer_gateway.html.markdown

@@ -0,0 +1,59 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_vpn_customer_gateway"
+sidebar_current: "docs-cloudstack-resource-vpn-customer-gateway"
+description: |-
+  Creates a site to site VPN local customer gateway.
+---
+
+# cloudstack\_vpn\_customer\_gateway
+
+Creates a site to site VPN local customer gateway.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "cloudstack_vpn_customer_gateway" "default" {
+    name = "test-vpc"
+    cidr = "10.0.0.0/8"
+    esp_policy = "aes256-sha1"
+    gateway = "192.168.0.1"
+    ike_policy = "aes256-sha1"
+    ipsec_psk = "terraform"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `name` - (Required) The name of the VPN Customer Gateway.
+
+* `cidr` - (Required) The CIDR block that needs to be routed through this gateway.
+
+* `esp_policy` - (Required) The ESP policy to use for this VPN Customer Gateway.
+
+* `gateway` - (Required) The public IP address of the related VPN Gateway.
+
+* `ike_policy` - (Required) The IKE policy to use for this VPN Customer Gateway.
+
+* `ipsec_psk` - (Required) The IPSEC pre-shared key used for this gateway.
+
+* `dpd` - (Optional) If DPD is enabled for the related VPN connection (defaults false)
+
+* `esp_lifetime` - (Optional) The ESP lifetime of phase 2 VPN connection to this
+    VPN Customer Gateway in seconds (defaults 86400)
+
+* `ike_lifetime` - (Optional) The IKE lifetime of phase 2 VPN connection to this
+    VPN Customer Gateway in seconds (defaults 86400)
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ID of the VPN Customer Gateway.
+* `dpd` - Enable or disable DPD is enabled for the related VPN connection.
+* `esp_lifetime` - The ESP lifetime of phase 2 VPN connection to this VPN Customer Gateway.
+* `ike_lifetime` - The IKE lifetime of phase 2 VPN connection to this VPN Customer Gateway.

website/source/docs/providers/cloudstack/r/vpn_gateway.html.markdown

@@ -0,0 +1,35 @@
+---
+layout: "cloudstack"
+page_title: "CloudStack: cloudstack_vpn_gateway"
+sidebar_current: "docs-cloudstack-resource-vpn-gateway"
+description: |-
+  Creates a site to site VPN local gateway.
+---
+
+# cloudstack\_vpn\_gateway
+
+Creates a site to site VPN local gateway.
+
+## Example Usage
+
+Basic usage:
+
+```
+resource "cloudstack_vpn_gateway" "default" {
+    vpc = "test-vpc"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `vpc` - (Required) The name of the VPC for which to create the VPN Gateway.
+    Changing this forces a new resource to be created.
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `id` - The ID of the VPN Gateway.
+* `public_ip` - The public IP address associated with the VPN Gateway.

website/source/layouts/cloudstack.erb

@@ -56,6 +56,18 @@
                         <li<%= sidebar_current("docs-cloudstack-resource-vpc") %>>
                             <a href="/docs/providers/cloudstack/r/vpc.html">cloudstack_vpc</a>
                         </li>
+
+                        <li<%= sidebar_current("docs-cloudstack-resource-vpn-gateway") %>>
+                            <a href="/docs/providers/cloudstack/r/vpn_gateway.html">cloudstack_vpn_gateway</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-cloudstack-resource-vpn-customer-gateway") %>>
+                            <a href="/docs/providers/cloudstack/r/vpn_customer_gateway.html">cloudstack_vpn_customer_gateway</a>
+                        </li>
+
+                        <li<%= sidebar_current("docs-cloudstack-resource-vpn-connection") %>>
+                            <a href="/docs/providers/cloudstack/r/vpn_connection.html">cloudstack_vpn_connection</a>
+                        </li>
                     </ul>
                 </li>
             </ul>