Add support for custom CA certificates

[beyhan]

Hi @ljfranklin

We are using the terraform-resource and we are very happy with it. We would like to use the terraform-resource for infrastructures which are set up with custom certificates. Terraform supports custom CA certificates via the argument cacert_file. Currently, it's not possible to use this feature of terraform with the terraform-resource. It's possible to pass the argument cacert_file to terraform thru the terraform-resource but there is no way to provide the custom certificate file. There is a workaround for this by specifying the insecure argument but it's more secure by using the cacert_file option. It will be grate to have this supported by the terraform-resource.

[ljfranklin]

Hey @beyhan! To make it clear, this is the cacert_file option in the OpenStack Terraform Provider. I was hoping that maybe that field could be given either a filepath or the contents of the file, but no such luck. Ideally Terraform would allow you to pass the contents of your cert, then no changes would be required for the resource. I might take a crack at submitting a PR to Terraform in the next few days and see if they'll accept that change.

As a workaround, you could probably generate a cert file in a task and pass the relative path to the terraform resource:

- task: write-certfile
   # echo "$CA_CERT" > ca_cert.pem
- put: terraform
  params:
    vars:
      ca_cert_path: write-certfile/ca_cert.pem

Not 100% sure if this will work, but worth a try.

[beyhan]

@ljfranklin Thanks for the prompt response. Yes, it's the cacert_file option which you are referencing. I also was thinking about the suggested workaround. I will give it a try and write back.

[ljfranklin]

@beyhan started a PR hashicorp/terraform#10271 to see if the Terraform maintainers would accept such a change.

[beyhan]

@ljfranklin suggested workaround works. Task write-certfile has to define the written file as output which makes it available for the next step. Great that you started the PR on terraform side!

[ljfranklin]

Finally got the Terraform PR merged. The next Terraform release should allow you to specify the OpenStack CA either as a filepath or as the contents of the cert.