adding validation for tmc-block-rolebinding-subjects recipe schema

Signed-off-by: Vasundhara Shukla <vasundharas@vmware.com>

Author: Vasundharashukla

docs/resources/custom_policy.md

@@ -172,7 +172,7 @@ resource "tanzu-mission-control_custom_policy" "cluster_scoped_tmc-block-rolebin
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "Group"
             name = "subject-1"
           }
         }
@@ -513,7 +513,7 @@ resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_tmc-block-r
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "User"
             name = "subject-1"
           }
         }
@@ -848,7 +848,7 @@ resource "tanzu-mission-control_custom_policy" "organization_scoped_tmc-block-ro
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "ServiceAccount"
             name = "subject-1"
           }
         }

examples/resources/custom_policy/resource_cluster_group_tmc_block_rolebinding_subjects_custom_policy.tf

@@ -18,7 +18,7 @@ resource "tanzu-mission-control_custom_policy" "cluster_group_scoped_tmc-block-r
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "User"
             name = "subject-1"
           }
         }

examples/resources/custom_policy/resource_cluster_tmc_block_rolebinding_subjects_custom_policy.tf

@@ -20,7 +20,7 @@ resource "tanzu-mission-control_custom_policy" "cluster_scoped_tmc-block-rolebin
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "Group"
             name = "subject-1"
           }
         }

examples/resources/custom_policy/resource_organization_tmc_block_rolebinding_subjects_custom_policy.tf

@@ -18,7 +18,7 @@ resource "tanzu-mission-control_custom_policy" "organization_scoped_tmc-block-ro
         audit = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "ServiceAccount"
             name = "subject-1"
           }
         }

internal/resources/policy/kind/custom/recipe/tmc_block_rolebinding_subjects_flatten_test.go

@@ -35,7 +35,7 @@ func TestFlattenTMCBlockRolebindingSubjects(t *testing.T) {
 				Parameters: &policyrecipecustommodel.VmwareTanzuManageV1alpha1CommonPolicySpecCustomV1TMCBlockRoleBindingSubjectsParameters{
 					DisallowedSubjects: []*policyrecipecustommodel.VmwareTanzuManageV1alpha1CommonPolicySpecCustomV1TMCBlockRoleBindingSubjectsParametersDisallowedSubjects{
 						{
-							Kind: "nodes",
+							Kind: "User",
 							Name: "test",
 						},
 					},
@@ -54,7 +54,7 @@ func TestFlattenTMCBlockRolebindingSubjects(t *testing.T) {
 						map[string]interface{}{
 							disallowedSubjectsKey: []interface{}{
 								map[string]interface{}{
-									kindKey: "nodes",
+									kindKey: "User",
 									nameKey: "test",
 								},
 							},

internal/resources/policy/kind/custom/recipe/tmc_block_rolebinding_subjects_schema.go

@@ -9,6 +9,7 @@ package recipe
 
 import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 
 	"github.com/vmware/terraform-provider-tanzu-mission-control/internal/helper"
 	policyrecipecustommodel "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/policy/recipe/custom"
@@ -43,9 +44,10 @@ var TMCBlockRolebindingSubjects = &schema.Schema{
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									kindKey: {
-										Type:        schema.TypeString,
-										Description: "The kind of subject to disallow, can be User/Group/ServiceAccount.",
-										Required:    true,
+										Type:         schema.TypeString,
+										Description:  "The kind of subject to disallow, can be User/Group/ServiceAccount.",
+										Required:     true,
+										ValidateFunc: validation.StringInSlice([]string{"User", "Group", "ServiceAccount"}, false),
 									},
 									nameKey: {
 										Type:        schema.TypeString,
@@ -136,11 +138,11 @@ func expandDisallowedSubjects(data interface{}) (disallowedSubjects *policyrecip
 
 	disallowedSubjects = &policyrecipecustommodel.VmwareTanzuManageV1alpha1CommonPolicySpecCustomV1TMCBlockRoleBindingSubjectsParametersDisallowedSubjects{}
 
-	if v, ok := disallowedSubjectsData[labelKey]; ok {
+	if v, ok := disallowedSubjectsData[kindKey]; ok {
 		helper.SetPrimitiveValue(v, &disallowedSubjects.Kind, kindKey)
 	}
 
-	if v, ok := disallowedSubjectsData[labelValueKey]; ok {
+	if v, ok := disallowedSubjectsData[nameKey]; ok {
 		helper.SetPrimitiveValue(v, &disallowedSubjects.Name, nameKey)
 	}
 

internal/resources/policy/kind/custom/resource/resource_custom_policy_test.go

@@ -375,7 +375,7 @@ func (testConfig *testAcceptanceConfig) getTestCustomPolicyResourceInput(recipe
         audit              = false
         parameters {
           disallowed_subjects {
-            kind = "node"
+            kind = "User"
             name = "subject-1"
           }
         }