make csr optional for origin ca

[jacobbednarz]

In the past, the CSR was required as it was the only method of generating
certificates. That isn't the case anymore and in some scenarios, we don't need
to enforce the CSR as we may be importing. Instead of enforcing this at the
schema level, we can make it optional and apply it within the Create should
it be present.

Fixes #950

As a bonus I've also fixed a bug with the requested_validity not being
persisted within the state which prevents storing unnecessary null values.

[spkane]

Using provider 2.18.0 my current terraform reports No changes. Infrastructure is up-to-date., but just changing over to the provider compiled from this branch results it wanting to recreate an existing origin_ca_cert which appears to be due to the requested_validity change.

      - requested_validity = 5471 -> null # forces replacement
        # (3 unchanged attributes hidden)
    }

I haven't tested the CSR portion yet, since I ran into this first.

[spkane]

My HCL looks like this:

resource "cloudflare_origin_ca_certificate" "example" {
  csr                = tls_cert_request.example.cert_request_pem
  hostnames          = [ "*.example.com", "example.com" ]
  request_type       = "origin-rsa"
}

I tried changing it to this:

resource "cloudflare_origin_ca_certificate" "example" {
  csr                = tls_cert_request.example.cert_request_pem
  hostnames          = [ "*.example.com", "example.com" ]
  request_type       = "origin-rsa"
  requested_validity = 5471
}

which resulted in this error:

Error: expected requested_validity to be one of [7 30 90 365 730 1095 5475], got 5471

And, of course, changing it to 5475 resulted in it wanting to delete and recreate the resource again.

[jacobbednarz]

i can't see why we'd need request_validity to recreate the resource -- i've removed it in 6595c82

[steven-xufan]

Hi, since request_validity is now saved in the state, the validity decreases every day (if we run terraform plan) and it is showing up as changes now. Is that expected?

[BojanZelic]

I've been seeing resources get recreated because of the request_validity change aswell

Getting around it via:

resource "cloudflare_origin_ca_certificate" "cloudflare_origin" {
  hostnames          = ["hostname"]
  request_type       = "origin-rsa"
  requested_validity = 365

  lifecycle {
    ignore_changes = [ requested_validity ]
  }
}

for now.