feat: support using internal certs for the local auth endpoint by banschikovde · Pull Request #1626 · rancher/terraform-provider-rancher2

banschikovde · 2025-08-16T19:24:55Z

Issue

Resolves #1299

Problem

When enabling the local_auth_endpoint for a cluster, users could not opt into using the internally generated CA certificate.
Attempting to retrieve the CA certificate through a data.rancher2_cluster data source led to a dependency cycle, and only an external CA could be configured directly.

Solution

Added a use_internal_ca_certs boolean flag inside the local_auth_endpoint block, mutually exclusive with ca_certs.
Introduced logic to fetch the cluster’s internal CA and populate it when use_internal_ca_certs is true during create, update, and read operations.
Updated diff handling and helper functions so the flag is tracked in state and diffed correctly.
Expanded resource documentation and unit tests to cover the new behavior.

Testing

Engineering Testing

Ran make build to compile the provider.
Verified go test ./rancher2 -run TestExpandClusterV2LocalAuthEndpoint -count=1 -v after enabling the new flag.
Executed make test to confirm all unit tests pass with the new logic.

Automated Testing

Added unit tests for TestExpandClusterV2LocalAuthEndpoint and updated existing tests to assert state preservation of use_internal_ca_certs.
Existing unit test suite validates mutual exclusivity between ca_certs and use_internal_ca_certs.

QA Testing Considerations

Confirm that enabling use_internal_ca_certs on a cluster with local_auth_endpoint correctly pulls internal CA data without requiring explicit ca_certs.
Validate upgrade scenarios: clusters configured with ca_certs should behave unchanged, while toggling use_internal_ca_certs should swap to internal CA seamlessly.

Regressions Considerations

Potential regression in cluster diffing logic around local_auth_endpoint fields; verify that state refresh and plan outputs remain stable.
Low probability, but focus on any workflows combining use_internal_ca_certs with other cluster CA options.

matttrach · 2026-02-20T20:31:45Z

Hello @banschikovde, thanks for the contribution! sorry for the late response, is this still valuable? If so, please resolve any conflicts, rebase off of main and I will get it reviewed. Thank you!

matttrach · 2026-02-20T20:50:59Z

 						d.Clear("local_auth_endpoint")
 					} else {
-						d.SetNew("local_auth_endpoint", flattenClusterV2LocalAuthEndpoint(newConfig))
+						d.SetNew("local_auth_endpoint", newObj)


maybe I am missing something, but why are we cutting out the flattener here?

flattenClusterV2LocalAuthEndpoint serializes only API fields (ca_certs, enabled, fqdn) and does not include the Terraform-only use_internal_ca_certs flag. If we used the flattener here in CustomizeDiff, that flag would be stripped from the planned object. By passing newObj directly (which already is []interface{} from d.GetChange()), we preserve it.

matttrach · 2026-02-20T20:53:55Z

I really appreciate the test additions, thank you!

matttrach · 2026-05-12T16:06:00Z

please rebase and resolve any conflicts?

…point

banschikovde · 2026-05-29T12:38:45Z

@matttrach
Yes, this is still valuable! I've resolved the conflicts and rebased off main

matttrach · 2026-05-29T18:35:39Z

 Provides a Rancher v2 Cluster v2 resource. This can be used to create node-driver and custom RKE2 and K3s Clusters for Rancher v2 environments and retrieve their information. 
+=======
+Provides a Rancher v2 Cluster v2 resource. This can be used to create RKE2 and K3s Clusters for Rancher v2 environments and retrieve their information.
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


It looks like you have unresolved conflicts here.

matttrach · 2026-05-29T18:39:23Z

Please resolve the conflicts and Copilot suggestions.

Copilot

Pull request overview

This PR adds support for configuring rancher2_cluster_v2.local_auth_endpoint to use the cluster’s internally generated CA certificates, avoiding dependency cycles that occur when users try to source the CA via a data.rancher2_cluster lookup.

Changes:

Added use_internal_ca_certs to the local_auth_endpoint schema and implemented create/update/read logic to fetch and apply the internal CA when enabled.
Introduced a small helper (decodeCACertIfBase64) with unit tests to normalize CA cert formats when reading Rancher’s management cluster CA.
Updated docs and unit tests to cover/reflect the new flag behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
`rancher2/util_certs.go`	Adds helper to decode CA certs when Rancher returns base64-encoded data.
`rancher2/util_certs_test.go`	Adds unit coverage for the base64 decode helper.
`rancher2/structure_cluster_v2_test.go`	Updates cluster v2 structure test fixtures to include the new local auth endpoint flag in state.
`rancher2/structure_cluster_v2_local_auth_endpoint_test.go`	Updates local auth endpoint structure tests to include/use the new flag.
`rancher2/schema_cluster_v2_rke_config_local_auth_endpoint.go`	Extends the local auth endpoint schema with `use_internal_ca_certs` and marks `ca_certs` as computed.
`rancher2/resource_rancher2_cluster_v2.go`	Implements internal CA fetching and state/diff handling for `use_internal_ca_certs`.
`docs/resources/cluster_v2.md`	Documents the new flag and related behavior (but currently contains unresolved merge-conflict markers).

Comments suppressed due to low confidence (1)

docs/resources/cluster_v2.md:544

This HCL example block still contains unresolved Git merge-conflict markers. Resolve the conflict and remove the marker lines so the example is valid.

<<<<<<< HEAD
  }

  fleet_agent_deployment_customization {
    scheduling_customization {

+<<<<<<< HEAD
 Provides a Rancher v2 Cluster v2 resource. This can be used to create node-driver and custom RKE2 and K3s Clusters for Rancher v2 environments and retrieve their information. 
+=======
+Provides a Rancher v2 Cluster v2 resource. This can be used to create RKE2 and K3s Clusters for Rancher v2 environments and retrieve their information.
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


+<<<<<<< HEAD
 You can configure a Priority Class and or Pod Disruption Budget to be automatically deployed for the cattle cluster agent and fleet agent when provisioning or updating downstream clusters. 
+=======
+You can configure a Priority Class and or Pod Disruption Budget to be automatically deployed for the cattle cluster agent when provisioning or updating downstream clusters.
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


+<<<<<<< HEAD
 The example below demonstrates how to set the `scheduling_customization` field to deploy a Priority Class and Pod Disruption Budget for both the cattle cluster agent and fleet agent.
+=======
+The example below demonstrates how to set the `scheduling_customization` field to deploy a Priority Class and Pod Disruption Budget. Currently, this field is only supported for the cluster agent.
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


+<<<<<<< HEAD
    }
  } 
+=======
+      }
+    }
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


+<<<<<<< HEAD
 * `override_resource_requirements` - (Optional, list) Override resource requirements overrides the default value for requests and/or limits. 
 + `scheduling_customization` - (Optional, list) Supported in Rancher 2.11.0 and above for `cluster_agent_deployment_customization`, and in Rancher 2.14.0 and above for `fleet_agent_deployment_customization`. Defines the configuration of a Priority Class and or Pod Disruption Budget, and requires the `cluster-agent-scheduling-customization` feature to be enabled.
+=======
+* `override_resource_requirements` - (Optional, list) Override resource requirements overrides the default value for requests and/or limits.
+ `scheduling_customization` - (Optional, list) Supported in Rancher 2.11.0 and above. Defines the configuration of a Priority Class and or Pod Disruption Budget. Currently only supported in the `cluster_agent_deployment_customization` field, and requires the `cattle_cluster_agent_scheduling_customization` feature to be enabled.
+>>>>>>> 7e799591 (feat(cluster_v2): add use_internal_ca_certs option for local_auth_endpoint)


+func getClusterCACert(c *Config, clusterV1ID string) (string, error) {
+	if c == nil {
+		return "", fmt.Errorf("provider config is nil")
+	}
+	if clusterV1ID == "" {
+		return "", fmt.Errorf("cluster_v1_id is empty")
+	}
+	client, err := c.ManagementClient()
+	if err != nil {
+		return "", err
+	}
+	cluster := &Cluster{}
+	err = client.APIBaseClient.ByID(managementClient.ClusterType, clusterV1ID, cluster)
+	if err != nil {
+		return "", err
+	}
+	return decodeCACertIfBase64(cluster.CACert), nil
+}


+func setClusterV2LocalAuthEndpointInternalFlag(d *schema.ResourceData, c *Config, cluster *ClusterV2) error {
+	if cluster == nil || c == nil {
+		return fmt.Errorf("setting local auth endpoint internal flag: missing data")
+	}
+	lae := cluster.Spec.LocalClusterAuthEndpoint
+	useInternal := false
+	if cluster.Status.ClusterName != "" && lae.CACerts != "" {
+		caCert, err := getClusterCACert(c, cluster.Status.ClusterName)
+		if err != nil {
+			return err
+		}
+		if lae.CACerts == caCert {
+			useInternal = true
+		}
+	}
+	if v, ok := d.Get("local_auth_endpoint").([]interface{}); ok && len(v) > 0 {
+		if m, ok := v[0].(map[string]interface{}); ok {
+			m["use_internal_ca_certs"] = useInternal
+			d.Set("local_auth_endpoint", []interface{}{m})
+		}
+	}
+	return nil
+}


+	testClusterV2LocalAuthEndpointInterfaceUseInternal = []interface{}{
+		map[string]interface{}{
+			"ca_certs":              "ca_certs",
+			"enabled":               true,
+			"fqdn":                  "fqdn",
+			"use_internal_ca_certs": true,
+		},


 		{
-			testClusterV2LocalAuthEndpointInterface,
+			testClusterV2LocalAuthEndpointInterfaceUseInternal,
 			testClusterV2LocalAuthEndpointConf,
 		},


jiaqiluo · 2026-06-01T22:22:38Z

Hi @banschikovde,
To my knowledge, the internally generated CA certificate is generally expected to issue certificates only for internal names, such as node hostnames or cluster-local service names.

In your use case, are you using that CA certificate to issue a certificate for the local authentication endpoint? If so, how did you accomplish that?

Could you provide some details about your use case and the approach you took? Thanks!

banschikovde force-pushed the feature/add-use_internal_ca_certs-for-local-auth-endpoint- branch 2 times, most recently from 80bd398 to 908cb37 Compare August 16, 2025 20:38

matttrach added the area/authentication This appears to be related to authentication. label Feb 20, 2026

matttrach requested a review from a team February 20, 2026 20:40

matttrach added the area/provisioning This seems to be related to provisioning a cluster within Rancher. label Feb 20, 2026

matttrach changed the title ~~feat: add use_internal_ca_certs option for local_auth_endpoint~~ feat: support using internal certs for the local auth endpoint Feb 20, 2026

matttrach mentioned this pull request Feb 20, 2026

feat: support using internal certs for the local auth endpoint #2052

Open

github-actions Bot mentioned this pull request Feb 20, 2026

[release/v14] feat: support using internal certs for the local auth endpoint #2053

Open

matttrach added the release/v14 Targets release v14.x correlating to Rancher's v2.14.x label Feb 20, 2026

matttrach reviewed Feb 20, 2026

View reviewed changes

matttrach added the internal/pr-tracked label Mar 6, 2026

matttrach removed the internal/pr-tracked label Apr 7, 2026

This was referenced Apr 27, 2026

feat: support using internal certs for the local auth endpoint #2172

Closed

[release/v14] feat: support using internal certs for the local auth endpoint #2173

Closed

banschikovde added 5 commits May 29, 2026 15:24

feat(cluster_v2): add use_internal_ca_certs option for local_auth_end…

bcefafe

…point

chore(cluster_v2): run gofmt on local_auth_endpoint files

9bf954e

fix(cluster_v2): correct use_internal_ca_certs schema and update tests

8d68546

chore(cluster_v2): decode internal CA certs for local auth endpoint

e9b9727

fix(cluster_v2): mark ca_certs field as computed

4a7e500

banschikovde force-pushed the feature/add-use_internal_ca_certs-for-local-auth-endpoint- branch from 908cb37 to 4a7e500 Compare May 29, 2026 12:37

matttrach requested changes May 29, 2026

View reviewed changes

matttrach requested a review from Copilot May 29, 2026 18:39

Copilot started reviewing on behalf of matttrach May 29, 2026 18:39 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support using internal certs for the local auth endpoint#1626

feat: support using internal certs for the local auth endpoint#1626
banschikovde wants to merge 5 commits into
rancher:mainfrom
banschikovde:feature/add-use_internal_ca_certs-for-local-auth-endpoint-

banschikovde commented Aug 16, 2025

Uh oh!

matttrach commented Feb 20, 2026

Uh oh!

matttrach Feb 20, 2026

Uh oh!

banschikovde Feb 21, 2026

Uh oh!

matttrach Feb 20, 2026

Uh oh!

matttrach commented May 12, 2026

Uh oh!

banschikovde commented May 29, 2026

Uh oh!

matttrach May 29, 2026

Uh oh!

matttrach commented May 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jiaqiluo commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

banschikovde commented Aug 16, 2025

Issue

Problem

Solution

Testing

Engineering Testing

Automated Testing

QA Testing Considerations

Regressions Considerations

Uh oh!

matttrach commented Feb 20, 2026

Uh oh!

matttrach Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

banschikovde Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

matttrach Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

matttrach commented May 12, 2026

Uh oh!

banschikovde commented May 29, 2026

Uh oh!

matttrach May 29, 2026

Choose a reason for hiding this comment

Uh oh!

matttrach commented May 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jiaqiluo commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants