Terraform: convert login rule to generic provider - #69426
Conversation
Contributes to #69403.
rosstimothy
added
the
no-changelog
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfc9e19a82
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| Codec: tfdriver.ResourceCodecFuncs[loginrulev1.LoginRule]{ | ||
| SchemaFunc: schemav1.GenSchemaLoginRule, | ||
| ToStateFunc: schemav1.CopyLoginRuleToTerraform, | ||
| FromPlanFunc: schemav1.CopyLoginRuleFromTerraform, |
There was a problem hiding this comment.
When an existing rule is changed from traits_expression to traits_map (or the reverse), the schema marks both attributes Optional+Computed, so Terraform's proposed plan preserves the omitted attribute from prior state. The generic resource now sends that plan straight through CopyLoginRuleFromTerraform, whereas the deleted resourceTeleportLoginRule.ModifyPlan replaced priority/traits_* with config-normalized values before update. In that switch-over scenario, a Terraform apply that is meant to replace an expression with a filtering map can leave the old expression active (or fail backend validation), so SSO trait and role mapping may not match the applied configuration.
Useful? React with 👍 / 👎.
2 participants
Contributes to #69403.
Manual Test Plan
Test Environment
Local cluster with TF provider from this branch
Test Cases