Add support for synthetics global parameters

This adds support for creating synthetics global parameters, which are
used to store secrets used for synthetics monitors.

This implementation is based on what we already do for synthetics
private locations. This is mostly just a simple wrapper around API
calls, except we currently requery the resource after creating it or
updating it. This is because Kibana (at least in 9.0.0) has some
unexpected responses for /api/synthetics/params:

1. The POST request to create a parameter does not include the `value`
   field in the response.
2. The PUT request to update a parameter returns the new values for all
   fields, except for `value`, which contains the old secret.
3. None of the responses include the `share_across_spaces` value, which
   can only be inferred by checking of `namespaces` is `["*"]`.

We also use the undocumented `DELETE /api/synthetics/params` API that
the Kibana UI uses due to many quirks with the deletion APIs in various
versions of Kibana. I tested every single version of Kibana since the
parameter APIs were introduced (8.12.0) and this one is the only one
that works on all versions.

* `DELETE /api/synthetics/params/<id>` (from documentation)
    - Works on >=8.17.0.
    - HTTP 404 on 8.12.x through 8.16.x.
* `DELETE /api/synthetics/params/_bulk_delete` (from documentation)
    - HTTP 400 on 9.0.x with error message about URL parameters and body
      provided at the same time (`_bulk_delete` interpreted as parameter
      ID?).
    - HTTP 403 on 8.18.x with error message about missing `uptime-read` and
      `uptime-write` permissions despite having the `superuser` role.
    - HTTP 403 with no details on 8.17.x.
    - HTTP 404 on 8.12.x through 8.16.x.
* `POST /api/synthetics/params/_bulk_delete` (from comment in documentation
  example)
    - Works on >=8.17.0.
    - HTTP 404 on 8.12.x through 8.16.x.
* `DELETE /api/synthetics/params` (what the Kibana UI does)
    - Works on >=8.12.0.

Finally, this updates the Github Actions workflow to run the tests using
HTTP basic auth instead of API keys. On all versions of Kibana, the
params endpoint fails to return the current value when using API keys,
even if permissions are not restricted for the key. Explicitly granting
the key all permissions to Kibana does not work either.

Fixes: elastic#1152

Signed-off-by: Andrew Gunnerson <andrew.gunnerson@elastic.co>

Author: agunnerson-elastic

.github/workflows/test.yml

@@ -179,4 +179,5 @@ jobs:
           ELASTICSEARCH_USERNAME: "elastic"
           ELASTICSEARCH_PASSWORD: ${{ env.ELASTIC_PASSWORD }}
           KIBANA_ENDPOINT: "http://localhost:5601"
-          KIBANA_API_KEY: ${{ steps.get-api-key.outputs.apikey }}
+          KIBANA_USERNAME: "elastic"
+          KIBANA_PASSWORD: ${{ env.ELASTIC_PASSWORD }}

docs/resources/kibana_synthetics_parameter.md

@@ -0,0 +1,54 @@
+---
+subcategory: "Kibana"
+layout: ""
+page_title: "Elasticstack: elasticstack_kibana_synthetics_parameter Resource"
+description: |-
+  Creates or updates a Kibana synthetics parameter.
+---
+
+# Resource: elasticstack_kibana_synthetics_parameter
+
+Creates or updates a Kibana synthetics parameter.
+See [Working with secrets and sensitive values](https://www.elastic.co/docs/solutions/observability/synthetics/work-with-params-secrets)
+and [API docs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-synthetics)
+
+## Example Usage
+
+```terraform
+provider "elasticstack" {
+  kibana {}
+}
+
+resource "elasticstack_kibana_synthetics_parameter" "example" {
+  key         = "example_key"
+  value       = "example_value"
+  description = "Example description"
+  tags        = ["tag-a", "tag-b"]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key` (String) The key of the parameter.
+- `value` (String, Sensitive) The value associated with the parameter.
+
+### Optional
+
+- `description` (String) A description of the parameter.
+- `share_across_spaces` (Boolean) Whether the parameter should be shared across spaces.
+- `tags` (List of String) An array of tags to categorize the parameter.
+
+### Read-Only
+
+- `id` (String) Generated id for the parameter.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import elasticstack_kibana_synthetics_parameter.my_param <space id>/<param_id>
+```

examples/resources/elasticstack_kibana_synthetics_parameter/import.sh

@@ -0,0 +1 @@
+terraform import elasticstack_kibana_synthetics_parameter.my_param <space id>/<param_id>

examples/resources/elasticstack_kibana_synthetics_parameter/resource.tf

@@ -0,0 +1,10 @@
+provider "elasticstack" {
+  kibana {}
+}
+
+resource "elasticstack_kibana_synthetics_parameter" "example" {
+  key         = "example_key"
+  value       = "example_value"
+  description = "Example description"
+  tags        = ["tag-a", "tag-b"]
+}

internal/kibana/synthetics/parameter/create.go

@@ -0,0 +1,49 @@
+package parameter
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/elastic/terraform-provider-elasticstack/internal/kibana/synthetics"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+func (r *Resource) Create(ctx context.Context, request resource.CreateRequest, response *resource.CreateResponse) {
+	kibanaClient := synthetics.GetKibanaClient(r, response.Diagnostics)
+	if kibanaClient == nil {
+		return
+	}
+
+	var plan tfModelV0
+	diags := request.Plan.Get(ctx, &plan)
+	response.Diagnostics.Append(diags...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	input := plan.toParameterConfig(false)
+
+	result, err := kibanaClient.KibanaSynthetics.Parameter.Add(ctx, input)
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("Failed to create parameter `%s`", input.Key), err.Error())
+		return
+	}
+
+	resourceId := result.Id
+
+	// We can't trust the response from the POST request. At least with Kibana
+	// 9.0.0, it responds without the `value` field set.
+	result, err = kibanaClient.KibanaSynthetics.Parameter.Get(ctx, resourceId)
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("Failed to get parameter after creation `%s`", resourceId), err.Error())
+		return
+	}
+
+	plan = toModelV0(*result)
+
+	diags = response.State.Set(ctx, plan)
+	response.Diagnostics.Append(diags...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+}

internal/kibana/synthetics/parameter/delete.go

@@ -0,0 +1,41 @@
+package parameter
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/elastic/terraform-provider-elasticstack/internal/kibana/synthetics"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+func (r *Resource) Delete(ctx context.Context, request resource.DeleteRequest, response *resource.DeleteResponse) {
+	kibanaClient := synthetics.GetKibanaClient(r, response.Diagnostics)
+	if kibanaClient == nil {
+		return
+	}
+
+	var plan tfModelV0
+	diags := request.State.Get(ctx, &plan)
+	response.Diagnostics.Append(diags...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	resourceId := plan.ID.ValueString()
+
+	compositeId, dg := tryReadCompositeId(resourceId)
+	response.Diagnostics.Append(dg...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	if compositeId != nil {
+		resourceId = compositeId.ResourceId
+	}
+
+	_, err := kibanaClient.KibanaSynthetics.Parameter.Delete(ctx, resourceId)
+	if err != nil {
+		response.Diagnostics.AddError(fmt.Sprintf("Failed to delete parameter `%s`", resourceId), err.Error())
+		return
+	}
+}

internal/kibana/synthetics/parameter/read.go

@@ -0,0 +1,58 @@
+package parameter
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/disaster37/go-kibana-rest/v8/kbapi"
+	"github.com/elastic/terraform-provider-elasticstack/internal/kibana/synthetics"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+func (r *Resource) Read(ctx context.Context, request resource.ReadRequest, response *resource.ReadResponse) {
+	kibanaClient := synthetics.GetKibanaClient(r, response.Diagnostics)
+	if kibanaClient == nil {
+		return
+	}
+
+	var state tfModelV0
+	diags := request.State.Get(ctx, &state)
+	response.Diagnostics.Append(diags...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	resourceId := state.ID.ValueString()
+
+	compositeId, dg := tryReadCompositeId(resourceId)
+	response.Diagnostics.Append(dg...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+
+	if compositeId != nil {
+		resourceId = compositeId.ResourceId
+	}
+
+	result, err := kibanaClient.KibanaSynthetics.Parameter.Get(ctx, resourceId)
+	if err != nil {
+		var apiError *kbapi.APIError
+		if errors.As(err, &apiError) && apiError.Code == 404 {
+			response.State.RemoveResource(ctx)
+			return
+		}
+
+		response.Diagnostics.AddError(fmt.Sprintf("Failed to get parameter `%s`", resourceId), err.Error())
+		return
+	}
+
+	state = toModelV0(*result)
+
+	// Set refreshed state
+	diags = response.State.Set(ctx, &state)
+	response.Diagnostics.Append(diags...)
+	if response.Diagnostics.HasError() {
+		return
+	}
+}

internal/kibana/synthetics/parameter/resource.go

@@ -0,0 +1,45 @@
+package parameter
+
+import (
+	"context"
+
+	"github.com/elastic/terraform-provider-elasticstack/internal/clients"
+	"github.com/elastic/terraform-provider-elasticstack/internal/kibana/synthetics"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+const resourceName = synthetics.MetadataPrefix + "parameter"
+
+// Ensure provider defined types fully satisfy framework interfaces
+var _ resource.Resource = &Resource{}
+var _ resource.ResourceWithConfigure = &Resource{}
+var _ resource.ResourceWithImportState = &Resource{}
+var _ synthetics.ESApiClient = &Resource{}
+
+type Resource struct {
+	client *clients.ApiClient
+	synthetics.ESApiClient
+}
+
+func (r *Resource) GetClient() *clients.ApiClient {
+	return r.client
+}
+
+func (r *Resource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = parameterSchema()
+}
+
+func (r *Resource) ImportState(ctx context.Context, request resource.ImportStateRequest, response *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), request, response)
+}
+
+func (r *Resource) Configure(ctx context.Context, request resource.ConfigureRequest, response *resource.ConfigureResponse) {
+	client, diags := clients.ConvertProviderData(request.ProviderData)
+	response.Diagnostics.Append(diags...)
+	r.client = client
+}
+
+func (r *Resource) Metadata(ctx context.Context, request resource.MetadataRequest, response *resource.MetadataResponse) {
+	response.TypeName = request.ProviderTypeName + resourceName
+}

internal/kibana/synthetics/parameter/resource_test.go

@@ -0,0 +1,89 @@
+package parameter_test
+
+import (
+	"testing"
+
+	"github.com/elastic/terraform-provider-elasticstack/internal/acctest"
+	"github.com/elastic/terraform-provider-elasticstack/internal/versionutils"
+	"github.com/hashicorp/go-version"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+const (
+	providerConfig = `
+provider "elasticstack" {
+	kibana {}
+}
+`
+)
+
+var (
+	minKibanaParameterAPIVersion = version.Must(version.NewVersion("8.12.0"))
+)
+
+func TestSyntheticParameterResource(t *testing.T) {
+	resourceId := "elasticstack_kibana_synthetics_parameter.test"
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { acctest.PreCheck(t) },
+		ProtoV6ProviderFactories: acctest.Providers,
+		Steps: []resource.TestStep{
+			// Create and Read testing
+			{
+				SkipFunc: versionutils.CheckIfVersionIsUnsupported(minKibanaParameterAPIVersion),
+				Config: providerConfig + `
+resource "elasticstack_kibana_synthetics_parameter" "test" {
+	key = "test-key"
+	value = "test-value"
+	description = "Test description"
+	tags = ["a", "b"]
+}
+`,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceId, "key", "test-key"),
+					resource.TestCheckResourceAttr(resourceId, "value", "test-value"),
+					resource.TestCheckResourceAttr(resourceId, "description", "Test description"),
+					resource.TestCheckResourceAttr(resourceId, "tags.#", "2"),
+					resource.TestCheckResourceAttr(resourceId, "tags.0", "a"),
+					resource.TestCheckResourceAttr(resourceId, "tags.1", "b"),
+				),
+			},
+			// ImportState testing
+			{
+				SkipFunc:          versionutils.CheckIfVersionIsUnsupported(minKibanaParameterAPIVersion),
+				ResourceName:      resourceId,
+				ImportState:       true,
+				ImportStateVerify: true,
+				Config: providerConfig + `
+resource "elasticstack_kibana_synthetics_parameter" "test" {
+	key = "test-key"
+	value = "test-value"
+	description = "Test description"
+	tags = ["a", "b"]
+}
+`,
+			},
+			// Update and Read testing
+			{
+				SkipFunc: versionutils.CheckIfVersionIsUnsupported(minKibanaParameterAPIVersion),
+				Config: providerConfig + `
+resource "elasticstack_kibana_synthetics_parameter" "test" {
+	key = "test-key-2"
+	value = "test-value-2"
+	description = "Test description 2"
+	tags = ["c", "d", "e"]
+}
+`,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceId, "key", "test-key-2"),
+					resource.TestCheckResourceAttr(resourceId, "value", "test-value-2"),
+					resource.TestCheckResourceAttr(resourceId, "description", "Test description 2"),
+					resource.TestCheckResourceAttr(resourceId, "tags.#", "3"),
+					resource.TestCheckResourceAttr(resourceId, "tags.0", "c"),
+					resource.TestCheckResourceAttr(resourceId, "tags.1", "d"),
+					resource.TestCheckResourceAttr(resourceId, "tags.2", "e"),
+				),
+			},
+			// Delete testing automatically occurs in TestCase
+		},
+	})
+}