Romsnacks opened a new pull request, #360:
URL: https://github.com/apache/cloudstack-terraform-provider/pull/360
## Summary
CloudStack's VPC-to-VPC site-to-site VPN requires one of the two VPN
connections to be **passive**: it waits for the other side to start the IPsec
negotiation. `cloudstack_vpn_connection` had no way to set this, so a
VPC-to-VPC tunnel could not be built with provider resources alone. People had
to call `createVpnConnection passive=true` outside Terraform (e.g. `cmk` in a
`local-exec`).
This PR adds an optional `passive` argument to `cloudstack_vpn_connection`:
- `passive` (bool, optional, default `false`). It is passed to
`createVpnConnection` through `SetPassive`, which is already in cloudstack-go
v2.19.1.
- It is `ForceNew`, because `updateVpnConnection` cannot change it.
- Read sets it from the API response, so drift detection and import pick it
up.
- The acceptance test now makes one of its two VPC-to-VPC connections
passive and checks the attribute on both.
- Docs are updated.
```hcl
resource "cloudstack_vpn_connection" "cloud_to_site" {
vpn_gateway_id = cloudstack_vpn_gateway.cloud.id
customer_gateway_id = cloudstack_vpn_customer_gateway.cloud_to_site.id
passive = true
}
```
## Testing
I tested this with OpenTofu against a real CloudStack zone, using two VPCs,
two VPN gateways, two customer gateways, and one passive plus one active
connection:
- `apply` created both connections. `listVpnConnections` returned `passive:
true` for one and `passive: false` for the other.
- A second `plan` showed no changes.
- After `state rm` and `import`, the connection came back with `passive =
true` and no changes planned.
- Changing `passive` planned a replacement.
- `destroy` was clean.
`go build` and `go vet` pass. I did not run the acceptance test suite
(`TF_ACC`) in CI conditions.
## How to test
- Acceptance test (needs a CloudStack with two VPCs allowed): `TF_ACC=1 go
test ./cloudstack -run TestAccCloudStackVPNConnection -v`. `_basic` checks that
`passive` is `true` on `bar-foo` and `false` on `foo-bar`.
- Manually: build two VPCs, each with a `cloudstack_vpn_gateway` and a
`cloudstack_vpn_customer_gateway` pointing at the other one. Create one
`cloudstack_vpn_connection` with `passive = true` and one without (`depends_on`
the passive one). Then run `cmk list vpnconnections filter=id,passive,state`.
Once a VM sends traffic across, the tunnel comes up as `Connected`.
## Compatibility
Existing connections read `passive = false` by default, so nothing changes
for them. If a connection was created passive outside Terraform, the next plan
will show a replacement until `passive = true` is set in the config.
---
This PR was created with AI assistance (Claude Code). I reviewed the change
and tested it against a live CloudStack environment.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
