fix(resource): handle optional stage attributes in vulnerability policy

Author: tembleking

.envrc

@@ -0,0 +1,6 @@
+export TF_ACC=true
+export TF_LOG=DEBUG
+dotenv_if_exists .env # You can create a .env file with your env vars for this project. You can also use .secrets if you are using act. See the line below.
+dotenv_if_exists .secrets # Used by [act](https://nektosact.com/) to load secrets into the pipelines
+strict_env
+env_vars_required SYSDIG_SECURE_API_TOKEN SYSDIG_MONITOR_API_TOKEN

.envrc.template

@@ -1,8 +1,8 @@
 *.dll
 *.exe
 .DS_Store
-.envrc
 .env
+.secrets
 .direnv/
 example.tf
 terraform.tfplan
@@ -54,4 +54,4 @@ oanc
 # Local test folder
 local-terraform-test/
 dist/
-.secrets
+

.gitignore

@@ -56,6 +56,10 @@ func resourceSysdigSecureVulnerabilityPolicy() *schema.Resource {
 			"stages": {
 				Type:     schema.TypeSet,
 				Optional: true,
+				Set: func(a any) int {
+					in := a.(map[string]any)
+					return schema.HashString(in["name"])
+				},
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"name": {
@@ -318,11 +322,19 @@ func vulnerabilityPolicyConfigsFromSet(set *schema.Set) []v2.Configuration {
 	for _, raw := range set.List() {
 		rawMap := raw.(map[string]any)
 
-		out = append(out, v2.Configuration{
-			Scope:              rawMap["scope"].(string),
-			Behaviour:          rawMap["failure_action"].(string),
-			UnknownImageAction: rawMap["unknown_image_action"].(string),
-		})
+		config := v2.Configuration{
+			Scope: rawMap["scope"].(string),
+		}
+
+		if raw, ok := rawMap["failure_action"]; ok {
+			config.Behaviour = raw.(string)
+		}
+
+		if raw, ok := rawMap["unknown_image_action"]; ok {
+			config.UnknownImageAction = raw.(string)
+		}
+
+		out = append(out, config)
 	}
 
 	return out

sysdig/resource_sysdig_secure_vulnerability_policy.go

@@ -93,7 +93,7 @@ resource "sysdig_secure_vulnerability_policy" "sample" {
   stages {
   	name = "admission_control"
   	configuration {
-      scope = "agent.tag.cluster = \"my-cluster\""
+      scope = "not kubernetes.namespace.name in (\"sysdig\", \"sysdig-agent\")"
       failure_action = "reject"
       unknown_image_action = "rejectAndScan"
     }