Adding support for null BoolOption values to TF provider

CHANGELOG.md

@@ -19,6 +19,59 @@ Teleport 18 removes support for:
 - `tls-ecdhe-ecdsa-with-aes-128-cbc-sha256`
 - `tls-ecdhe-rsa-with-aes-128-cbc-sha256`
 
+#### Terraform provider role defaults
+
+The Terraform provider previously defaulted unset booleans to `false`, starting
+with v18 it will leave the fields empty and let Teleport pick the same default
+value as if you were applying the manifest with the web UI, `tctl create`, or
+the Kubernetes Operator.
+
+This might change the default options of role where not every option was
+explicitly set. For example:
+
+```
+resource "teleport_role" "one-option-set" {
+  version = "v7"
+  metadata = {
+    name        = "one-option-set"
+  }
+
+  spec = {
+    options = {
+      max_session_ttl = "7m"
+      # other boolean options were wrongly set to false by default
+    }
+  }
+}
+```
+
+This change does not affect you if you were not setting role options,
+or setting every role option in your Terraform code.
+
+After updating the Terraform provider to v18, `terraform plan` will display the
+role option differences, please review it and check that the default changes are
+acceptable. If they are not, you must set the options to `false`.
+
+Here's a plan example for the code above:
+```
+# teleport_role.one-option-set will be updated in-place
+~ resource "teleport_role" "one-option-set" {
+      id       = "one-option-set"
+    ~ spec     = {
+        ~ options = {
+            - cert_format               = "standard" -> null
+            - create_host_user          = false -> null
+            ~ desktop_clipboard         = false -> true
+            ~ desktop_directory_sharing = false -> true
+            - port_forwarding           = false -> null
+            ~ ssh_file_copy             = false -> true
+              # (4 unchanged attributes hidden)
+          }
+      }
+      # (3 unchanged attributes hidden)
+  }
+```
+
 #### AWS endpoint URL mode removed
 
 The AWS endpoint URL mode (`--endpoint-url`) has been removed for

integrations/terraform/Makefile

@@ -70,16 +70,6 @@ endif
 
 	mv ./tfschema/github.com/gravitational/teleport/api/types/types_terraform.go ./tfschema/
 
-	@protoc \
-		-I=../../api/proto \
-		-I=$(PROTOBUF_MOD_PATH) \
-		--plugin=$(PROTOC_GEN_TERRAFORM) \
-		--terraform_out=config=protoc-gen-terraform-teleport-token.yaml:./tfschema \
-		teleport/legacy/types/types.proto
-
-	mkdir -p ./tfschema/token
-	mv ./tfschema/github.com/gravitational/teleport/api/types/types_terraform.go ./tfschema/token/
-
 	@protoc \
 		-I=../../api/proto \
 		-I=$(PROTOBUF_MOD_PATH) \

integrations/terraform/gen/main.go

@@ -288,7 +288,6 @@ var (
 		Kind:                   "token",
 		HasStaticID:            false,
 		SchemaPackage:          "token",
-		SchemaPackagePath:      "github.com/gravitational/teleport/integrations/terraform/tfschema/token",
 		TerraformResourceType:  "teleport_provision_token",
 		HasCheckAndSetDefaults: true,
 	}

integrations/terraform/protoc-gen-terraform-teleport.yaml

@@ -22,6 +22,7 @@ types:
     - "UserV2"
     - "InstallerV1"
     - "DynamicWindowsDesktopV1"
+    - "ProvisionTokenV2"
 
 # id field is required for integration tests. It is not used by provider.
 # We have to add it manually (might be removed in the future versions).
@@ -82,6 +83,13 @@ injected_fields:
       computed: true
       plan_modifiers:
         - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
+  ProvisionTokenV2:
+    -
+      name: id
+      type: github.com/hashicorp/terraform-plugin-framework/types.StringType
+      computed: true
+      plan_modifiers:
+        - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
   RoleV6:
     -
       name: id
@@ -184,6 +192,10 @@ computed_fields:
     - "AppV3.Kind"
 
     # Auth preference
+    - "AuthPreferenceV2.Spec.AllowPasswordless"
+    - "AuthPreferenceV2.Spec.AllowHeadless"
+    - "AuthPreferenceV2.Spec.DisconnectExpiredCert"
+    - "AuthPreferenceV2.Spec.AllowLocalAuth"
     - "AuthPreferenceV2.Spec.SecondFactor"
     - "AuthPreferenceV2.Spec.Type"
     - "AuthPreferenceV2.Spec.LockingMode"
@@ -212,6 +224,11 @@ computed_fields:
     # Okta import rule
     - "OktaImportRuleV1.Kind"
 
+    # Provision token
+    - "ProvisionTokenV2.Spec.AWSIIDTTL"
+    - "ProvisionTokenV2.Kind"
+    - "ProvisionTokenV2.Metadata.Name"
+
     # Role
     - "RoleV6.Spec.Options.MaxSessionTTL"
     - "RoleV6.Spec.Options.CertificateFormat"
@@ -241,6 +258,12 @@ computed_fields:
     - "RoleV6.Spec.Allow.KubernetesResources.Verbs"
     - "RoleV6.Spec.Options.BPF"
     - "RoleV6.Kind"
+    - "RoleV6.Spec.Options"
+    - "RoleV6.Spec.Options.SSHFileCopy"
+    - "RoleV6.Spec.Options.CreateDatabaseUser"
+    - "RoleV6.Spec.Options.CreateDesktopUser"
+    - "RoleV6.Spec.Options.DesktopClipboard"
+    - "RoleV6.Spec.Options.DesktopDirectorySharing"
 
     # SAML connector
     - "SAMLConnectorV2.Spec.Audience"
@@ -320,6 +343,12 @@ required_fields:
     - "OktaImportRuleV1.Metadata.Name"
     - "OktaImportRuleV1.Version"
 
+    # Provision token
+    - "ProvisionTokenV2.Spec"
+    - "ProvisionTokenV2.Spec.Options"
+    - "ProvisionTokenV2.Spec.Roles"
+    - "ProvisionTokenV2.Version"
+
     # Role
     - "RoleV6.Metadata.Name"
     - "RoleV6.Version"
@@ -362,6 +391,7 @@ required_fields:
 
 # These fields must be marked as sensitive
 sensitive_fields:
+    - "ProvisionTokenV2.Metadata.Name"
     - "SAMLConnectorV2.Spec.Cert"
     - "SAMLConnectorV2.Spec.SigningKeyPair.PrivateKey"
     - "SAMLConnectorV2.Spec.EncryptionKeyPair.PrivateKey"
@@ -385,6 +415,11 @@ plan_modifiers:
     ServerV2.Metadata.Name:
       - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
       - "github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()"
+    ProvisionTokenV2.Metadata.Name:
+      - "github.com/hashicorp/terraform-plugin-framework/tfsdk.RequiresReplace()"
+      - "github.com/hashicorp/terraform-plugin-framework/tfsdk.UseStateForUnknown()"
+    RoleV6.Spec.Options:
+      - "DefaultRoleOptions()"
 
 validators:
   # Expires must be in the future
@@ -410,6 +445,8 @@ validators:
     - UseVersionBetween(3,3)
   OktaImportRuleV1.Version:
     - UseVersionBetween(1,1)
+  ProvisionTokenV2.Version:
+    - UseVersionBetween(2,2)
   RoleV6.Version:
     - UseVersionBetween(3,7)
   SAMLConnectorV2.Version:

integrations/terraform/tfschema/custom_types.go

@@ -33,13 +33,15 @@ import (
 // GenSchemaBoolOptions returns Terraform schema for BoolOption type
 func GenSchemaBoolOption(_ context.Context, attr tfsdk.Attribute) tfsdk.Attribute {
 	return tfsdk.Attribute{
-		Optional:    true,
-		Type:        types.BoolType,
-		Description: attr.Description,
+		Optional:      true,
+		Type:          types.BoolType,
+		Description:   attr.Description,
+		Computed:      attr.Computed,
+		PlanModifiers: attr.PlanModifiers,
 	}
 }
 
-// GenSchemaBoolOptions returns Terraform schema for Traits type
+// GenSchemaTraits returns Terraform schema for Traits type
 func GenSchemaTraits(_ context.Context, attr tfsdk.Attribute) tfsdk.Attribute {
 	return tfsdk.Attribute{
 		Optional: true,
@@ -63,8 +65,11 @@ func CopyFromBoolOption(diags diag.Diagnostics, tf attr.Value, o **apitypes.Bool
 		diags.AddError("Error reading from Terraform object", fmt.Sprintf("Can not convert %T to types.Bool", tf))
 		return
 	}
-	value := apitypes.BoolOption{Value: v.Value}
-	*o = &value
+
+	if !v.Null && !v.Unknown {
+		value := apitypes.BoolOption{Value: v.Value}
+		*o = &value
+	}
 }
 
 func CopyToBoolOption(diags diag.Diagnostics, o *apitypes.BoolOption, t attr.Type, v attr.Value) attr.Value {
@@ -78,6 +83,8 @@ func CopyToBoolOption(diags diag.Diagnostics, o *apitypes.BoolOption, t attr.Typ
 		return value
 	}
 
+	value.Null = false
+	value.Unknown = false
 	value.Value = o.Value
 
 	return value