Add support for standard auth mount tune configuration to vault_auth_backend resource

[ianferguson]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Description

Currently, updates to default_lease_ttl_seconds, max_lease_ttl_seconds or listing_visibility attributes of the vault_auth_backend resource force creation of a new resource, which invalidates existing tokens previously issued by the backend, and can result in roles under that backend no longer exiting/not being recreated, leading to outages for users depending on that backend to login.

This PR follows up on the PR @leominov opened in #557, but implemented using the suggestion by @shwuandwing in this comment: #557 (comment)

It does not strictly speaking resolve #315, in that the existing parameters will still force a new resource, but it addresses the root issue but deprecating those existing parameters and introducing a tune configuration block consistent with what has been done in the vault_github_auth_backend and vault_jwt_auth_backend.

The common tune schema and implementation does allow for updating those values without forcing a new resource.

Relates #269
Relates #315
Relates #557

Release note for CHANGELOG:

- Adds support to `vault_auth_backend` for common backend tune parameters. Also allows updating Max TTL, Default TTL and Visibility Listing tuning settings on `vault_auth_backend` without forcing a new resource.

Output from acceptance testing:

> env TESTARGS="-run TestAccAuthBackend.*" make testacc
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run TestAccAuthBackend.* -timeout 120m
?       github.com/terraform-providers/terraform-provider-vault [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/coverage    [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/util    (cached) [no tests to run]
=== RUN   TestAccAuthBackend_importBasic
--- PASS: TestAccAuthBackend_importBasic (0.14s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   0.168s

> env TESTARGS="-run TestResourceAuth.*" make testacc
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./... |grep -v 'vendor') -v -run TestResourceAuth.* -timeout 120m
?       github.com/terraform-providers/terraform-provider-vault [no test files]
?       github.com/terraform-providers/terraform-provider-vault/cmd/coverage    [no test files]
testing: warning: no tests to run
PASS
ok      github.com/terraform-providers/terraform-provider-vault/util    (cached) [no tests to run]
=== RUN   TestResourceAuth
--- PASS: TestResourceAuth (0.23s)
=== RUN   TestResourceAuthTune
--- PASS: TestResourceAuthTune (0.21s)
=== RUN   TestResourceAuthTuneTtlConflict
--- PASS: TestResourceAuthTuneTtlConflict (0.02s)
=== RUN   TestResourceAuthMigrateToTune
--- PASS: TestResourceAuthMigrateToTune (0.23s)
PASS
ok      github.com/terraform-providers/terraform-provider-vault/vault   0.734s
...

[tyrannosaurus-becks]

Hi! Thanks for working on this, it's much appreciated.

I have a general question regarding this PR - is it fully backwards compatible? So, would folks who are presently using this need to make any changes to their configs?

[ianferguson]

@tyrannosaurus-becks thank you for the review! To answer you questions:

I have a general question regarding this PR - is it fully backwards compatible?

Yes!

So, would folks who are presently using this need to make any changes to their configs?

Current users will not need to make any changes, and users currently using the existing attributes will be able to move from the now deprecated attributes to the new/standard tune block attributes safely without generating a new resource.

I think this test case exercises a scenario where the user has just the configuration that exists today (the first step) as well as what happens when a user edits the configuration to use the same ttl attributes that are now in the tune block, in the second step of the test:

https://github.com/terraform-providers/terraform-provider-vault/pull/650/files#diff-e2b851590904030e7bfcdb6a3f03663fR302-R339

[tyrannosaurus-becks]

Fantastic! Thank you! I circled back to this and tested it all out and it looks great. Much appreciated.

[ianferguson]

@tyrannosaurus-becks thank you so much!

[Ninir]

@tyrannosaurus-becks can we add this PR to the Changelog? 🙏 it seems to be missing

[tyrannosaurus-becks]

@Ninir , whoops, oversight on my part! Just added, thanks for bringing this to my attention.

[Andor]

I think you need to update the documentation as well: mark old parameters as deprecated and provide the example.

[threemachines]

Agreed, this new tune parameter needs to be in the docs.

[ianferguson]

@Andor @threemachines I've opened #697 to update the documentation to match these changes, sorry about that.