New data source - cloudflare_origin_ca_root_certificate

cloudflare/data_source_origin_ca_root_certificate.go

@@ -0,0 +1,48 @@
+package cloudflare
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cloudflare/cloudflare-go"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
+)
+
+func dataSourceCloudflareOriginCARootCertificate() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceCloudflareOriginCARootCertificateRead,
+
+		Schema: map[string]*schema.Schema{
+			"algorithm": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validation.StringInSlice([]string{"rsa", "ecc"}, true),
+			},
+
+			"cert_pem": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+		},
+	}
+}
+
+func dataSourceCloudflareOriginCARootCertificateRead(d *schema.ResourceData, meta interface{}) error {
+	algorithm := strings.ToLower(fmt.Sprintf("%v", d.Get("algorithm")))
+	certBytes, err := cloudflare.OriginCARootCertificate(algorithm)
+	if err != nil {
+		return fmt.Errorf("failed to fetch Cloudflare IP ranges: %s", err)
+	}
+
+	cert := string(certBytes[:])
+
+	d.SetId(stringChecksum(cert))
+
+	if err := d.Set("cert_pem", cert); err != nil {
+		return fmt.Errorf("error setting cert_pem: %s", err)
+	}
+
+	return nil
+}

cloudflare/data_source_origin_ca_root_certificate_test.go

@@ -0,0 +1,50 @@
+package cloudflare
+
+import (
+	"encoding/pem"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/terraform"
+)
+
+func TestAccCloudflareOriginCARootCertificate(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudflareOriginCARootCertConfig,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCloudflareOriginCARootCert("data.cloudflare_origin_ca_root_certificate.ecc"),
+					testAccCloudflareOriginCARootCert("data.cloudflare_origin_ca_root_certificate.rsa"),
+				),
+			},
+		},
+	})
+}
+
+func testAccCloudflareOriginCARootCert(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		r := s.RootModule().Resources[n]
+		cert := r.Primary.Attributes["cert_pem"]
+
+		p, _ := pem.Decode([]byte(cert))
+		if p == nil || p.Type != "CERTIFICATE" {
+			return fmt.Errorf("invalid certificate: %s", cert)
+		}
+
+		return nil
+	}
+}
+
+const testAccCloudflareOriginCARootCertConfig = `
+data "cloudflare_origin_ca_root_certificate" "rsa" {
+	algorithm = "RSA"
+}
+
+data "cloudflare_origin_ca_root_certificate" "ecc" {
+	algorithm = "ecc"
+}
+`

cloudflare/provider.go

@@ -96,6 +96,7 @@ func Provider() terraform.ResourceProvider {
 		DataSourcesMap: map[string]*schema.Resource{
 			"cloudflare_api_token_permission_groups": dataSourceCloudflareApiTokenPermissionGroups(),
 			"cloudflare_ip_ranges":                   dataSourceCloudflareIPRanges(),
+			"cloudflare_origin_ca_root_certificate":  dataSourceCloudflareOriginCARootCertificate(),
 			"cloudflare_waf_groups":                  dataSourceCloudflareWAFGroups(),
 			"cloudflare_waf_packages":                dataSourceCloudflareWAFPackages(),
 			"cloudflare_waf_rules":                   dataSourceCloudflareWAFRules(),

website/cloudflare.erb

@@ -28,6 +28,9 @@
             <li<%= sidebar_current("docs-cloudflare-datasource-ip_ranges") %>>
               <a href="/docs/providers/cloudflare/d/ip_ranges.html">cloudflare_ip_ranges</a>
             </li>
+            <li<%= sidebar_current("docs-cloudflare-datasource-origin_ca_root_certificate") %>>
+              <a href="/docs/providers/cloudflare/d/origin_ca_root_certificate.html">cloudflare_origin_ca_root_certificate</a>
+            </li>
             <li<%= sidebar_current("docs-cloudflare-datasource-waf-groups") %>>
                 <a href="/docs/providers/cloudflare/d/waf_groups.html">cloudflare_waf_groups</a>
             </li>

website/docs/d/origin_ca_root_certificate.html.md

@@ -0,0 +1,29 @@
+---
+layout: "cloudflare"
+page_title: "Cloudflare: cloudflare_origin_ca_root_certificate"
+sidebar_current: "docs-cloudflare-datasource-origin_ca_root_certificate"
+description: |-
+  Get Cloudflare Origin CA root certificate.
+---
+
+# cloudflare_origin_ca_root_certificate
+
+Use this data source to get the [Origin CA root certificate][1] for a given algorithm.
+
+## Example Usage
+
+```hcl
+data "cloudflare_origin_ca_root_certificate" "origin_ca" {
+  algorithm = "<algorithm>"
+}
+```
+
+## Arguments Reference
+
+- `algorithm` - (Required) The name of the algorithm used when creating an Origin CA certificate. Currently-supported values are "rsa" and "ecc" (case-insensitive).
+
+## Attributes Reference
+
+- `cert_pem` - The Origin CA root certificate in PEM format.
+
+[1]: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca#4-required-for-some-add-cloudflare-origin-ca-root-certificates