feat: allow unauthenticated usage and expose resource_control_id for Docker resources for terraform output

grulicht · web-flow · commit 0d04e076334c · 2025-11-30T21:30:05.000+01:00
diff --git a/docs/resources/docker_config.md b/docs/resources/docker_config.md
@@ -52,3 +52,4 @@ Use `terraform destroy` to remove the config.
 | Name | Description              |
 |------|--------------------------|
 | `id` | ID of the created Docker config (from Portainer) |
+| `resource_control_id` | ID of the automatically generated Portainer ResourceControl for this config |
diff --git a/docs/resources/docker_network.md b/docs/resources/docker_network.md
@@ -100,4 +100,5 @@ terraform apply
 
 | Name | Description                                                   |
 |------|---------------------------------------------------------------|
-| `id` | ID of the created Docker network (as returned by Portainer)  |
+| `id` | ID of the created Docker network (as returned by Portainer)   |
+| `resource_control_id` | ID of the automatically generated Portainer ResourceControl for this network |
diff --git a/docs/resources/docker_volume.md b/docs/resources/docker_volume.md
@@ -154,3 +154,4 @@ terraform destroy
 | Name | Description              |
 |------|--------------------------|
 | `id` | Unique identifier of the volume |
+| `resource_control_id` | ID of the automatically generated Portainer ResourceControl for this volume |
diff --git a/docs/resources/stack.md b/docs/resources/stack.md
@@ -376,4 +376,4 @@ terraform apply
 | Name | Description                     |
 |------|---------------------------------|
 | `id` | ID of the created stack         |
-
+| `resource_control_id` | ID of the automatically generated Portainer ResourceControl for this stack |
diff --git a/e2e-tests/user_admin/README.md b/e2e-tests/user_admin/README.md
@@ -17,7 +17,6 @@
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_portainer_api_key"></a> [portainer\_api\_key](#input\_portainer\_api\_key) | Default Portainer Admin API Key | `string` | `"some-fake-api-token"` | no |
 | <a name="input_portainer_password"></a> [portainer\_password](#input\_portainer\_password) | Portainer password | `string` | `"password123456789"` | no |
 | <a name="input_portainer_skip_ssl_verify"></a> [portainer\_skip\_ssl\_verify](#input\_portainer\_skip\_ssl\_verify) | Set to true to skip TLS certificate verification (useful for self-signed certs) | `bool` | `true` | no |
 | <a name="input_portainer_url"></a> [portainer\_url](#input\_portainer\_url) | Default Portainer URL | `string` | `"https://localhost:9443"` | no |
diff --git a/e2e-tests/user_admin/main.tf b/e2e-tests/user_admin/main.tf
@@ -8,6 +8,5 @@ terraform {
 
 provider "portainer" {
   endpoint        = var.portainer_url
-  api_key         = var.portainer_api_key
   skip_ssl_verify = var.portainer_skip_ssl_verify
 }
diff --git a/e2e-tests/user_admin/variables.tf b/e2e-tests/user_admin/variables.tf
@@ -4,11 +4,6 @@ variable "portainer_url" {
   default     = "https://localhost:9443"
 }
 
-variable "portainer_api_key" {
-  description = "Default Portainer Admin API Key"
-  default     = "some-fake-api-token"
-}
-
 variable "portainer_skip_ssl_verify" {
   description = "Set to true to skip TLS certificate verification (useful for self-signed certs)"
   type        = bool
diff --git a/examples/user_admin/README.md b/examples/user_admin/README.md
@@ -17,7 +17,6 @@
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_portainer_api_key"></a> [portainer\_api\_key](#input\_portainer\_api\_key) | Default Portainer Admin API Key | `string` | `"some-fake-api-token"` | no |
 | <a name="input_portainer_password"></a> [portainer\_password](#input\_portainer\_password) | Portainer password | `string` | `"password123456789"` | no |
 | <a name="input_portainer_skip_ssl_verify"></a> [portainer\_skip\_ssl\_verify](#input\_portainer\_skip\_ssl\_verify) | Set to true to skip TLS certificate verification (useful for self-signed certs) | `bool` | `true` | no |
 | <a name="input_portainer_url"></a> [portainer\_url](#input\_portainer\_url) | Default Portainer URL | `string` | `"https://localhost:9443"` | no |
diff --git a/examples/user_admin/main.tf b/examples/user_admin/main.tf
@@ -8,6 +8,5 @@ terraform {
 
 provider "portainer" {
   endpoint        = var.portainer_url
-  api_key         = var.portainer_api_key
   skip_ssl_verify = var.portainer_skip_ssl_verify
 }
diff --git a/examples/user_admin/variables.tf b/examples/user_admin/variables.tf
@@ -4,11 +4,6 @@ variable "portainer_url" {
   default     = "https://localhost:9443"
 }
 
-variable "portainer_api_key" {
-  description = "Default Portainer Admin API Key"
-  default     = "some-fake-api-token"
-}
-
 variable "portainer_skip_ssl_verify" {
   description = "Set to true to skip TLS certificate verification (useful for self-signed certs)"
   type        = bool
diff --git a/internal/provider.go b/internal/provider.go
@@ -215,8 +215,12 @@ func configureProvider(ctx context.Context, d *schema.ResourceData) (interface{}
 	password := d.Get("api_password").(string)
 	skipSSL := d.Get("skip_ssl_verify").(bool)
 
-	if (apiKey == "" && (user == "" || password == "")) || (apiKey != "" && (user != "" || password != "")) {
-		return nil, diag.Errorf("You must specify either 'api_key' or both 'api_user' and 'api_password', but not both.")
+	if apiKey != "" && (user != "" || password != "") {
+		return nil, diag.Errorf("you must specify either 'api_key' or 'api_user'/'api_password', not both")
+	}
+
+	if (user == "" && password != "") || (user != "" && password == "") {
+		return nil, diag.Errorf("'api_user' and 'api_password' must be specified together")
 	}
 
 	transport := &http.Transport{
diff --git a/internal/resource_docker_config.go b/internal/resource_docker_config.go
@@ -13,7 +13,7 @@ func resourceDockerConfig() *schema.Resource {
 	return &schema.Resource{
 		Create: resourceDockerConfigCreate,
 		Read:   resourceDockerConfigRead,
-		Update: nil, // resourceDockerConfigUpdate,
+		Update: resourceDockerConfigUpdate,
 		Delete: resourceDockerConfigDelete,
 		Importer: &schema.ResourceImporter{
 			State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
@@ -40,7 +40,7 @@ func resourceDockerConfig() *schema.Resource {
 			"name": {
 				Type:     schema.TypeString,
 				Required: true,
-				ForceNew: true,
+				// ForceNew: true,
 			},
 			"data": {
 				Type:      schema.TypeString,
@@ -60,6 +60,10 @@ func resourceDockerConfig() *schema.Resource {
 				Elem:     &schema.Schema{Type: schema.TypeString},
 				ForceNew: true,
 			},
+			"resource_control_id": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -96,6 +100,15 @@ func findExistingDockerConfigByName(client *APIClient, endpointID int, name stri
 	return "", nil
 }
 
+type dockerConfigCreateResponse struct {
+	ID        string `json:"ID"`
+	Portainer struct {
+		ResourceControl struct {
+			Id int `json:"Id"`
+		} `json:"ResourceControl"`
+	} `json:"Portainer"`
+}
+
 func resourceDockerConfigCreate(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*APIClient)
 	endpointID := d.Get("endpoint_id").(int)
@@ -122,9 +135,7 @@ func resourceDockerConfigCreate(d *schema.ResourceData, meta interface{}) error
 		}
 	}
 
-	var response struct {
-		ID string `json:"Id"`
-	}
+	var response dockerConfigCreateResponse
 
 	path := fmt.Sprintf("/endpoints/%d/docker/configs/create", endpointID)
 	resp, err := client.DoRequest(http.MethodPost, path, nil, payload)
@@ -143,6 +154,11 @@ func resourceDockerConfigCreate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	d.SetId(response.ID)
+
+	if response.Portainer.ResourceControl.Id != 0 {
+		_ = d.Set("resource_control_id", response.Portainer.ResourceControl.Id)
+	}
+
 	return nil
 }
 
@@ -174,6 +190,11 @@ func resourceDockerConfigRead(d *schema.ResourceData, meta interface{}) error {
 			Labels     map[string]string      `json:"Labels"`
 			Templating map[string]interface{} `json:"Templating"`
 		} `json:"Spec"`
+		Portainer struct {
+			ResourceControl struct {
+				Id int `json:"Id"`
+			} `json:"ResourceControl"`
+		} `json:"Portainer"`
 	}
 
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
@@ -195,6 +216,11 @@ func resourceDockerConfigRead(d *schema.ResourceData, meta interface{}) error {
 		}
 	}
 	_ = d.Set("templating", templ)
+
+	if result.Portainer.ResourceControl.Id != 0 {
+		_ = d.Set("resource_control_id", result.Portainer.ResourceControl.Id)
+	}
+
 	return nil
 }
 
diff --git a/internal/resource_docker_network.go b/internal/resource_docker_network.go
@@ -29,7 +29,7 @@ func resourceDockerNetwork() *schema.Resource {
 				if err != nil {
 					return nil, fmt.Errorf("invalid endpoint ID: %w", err)
 				}
-				d.Set("endpoint_id", endpointID)
+				_ = d.Set("endpoint_id", endpointID)
 				d.SetId(parts[1])
 				return []*schema.ResourceData{d}, nil
 			},
@@ -91,10 +91,24 @@ func resourceDockerNetwork() *schema.Resource {
 					},
 				},
 			},
+			"resource_control_id": {
+				Type:     schema.TypeInt,
+				Computed: true,
+			},
 		},
 	}
 }
 
+type dockerNetworkCreateResponse struct {
+	ID        string `json:"Id"`
+	Warning   string `json:"Warning"`
+	Portainer struct {
+		ResourceControl struct {
+			Id int `json:"Id"`
+		} `json:"ResourceControl"`
+	} `json:"Portainer"`
+}
+
 func resourceDockerNetworkCreate(d *schema.ResourceData, meta interface{}) error {
 	client := meta.(*APIClient)
 	endpointID := d.Get("endpoint_id").(int)
@@ -168,9 +182,7 @@ func resourceDockerNetworkCreate(d *schema.ResourceData, meta interface{}) error
 	}
 	payload["IPAM"] = ipam
 
-	var response struct {
-		ID string `json:"Id"`
-	}
+	var response dockerNetworkCreateResponse
 
 	headers := map[string]string{}
 	if nodeID, ok := d.GetOk("swarm_node_id"); ok && nodeID.(string) != "" {
@@ -190,10 +202,15 @@ func resourceDockerNetworkCreate(d *schema.ResourceData, meta interface{}) error
 	}
 
 	if err := json.NewDecoder(resp.Body).Decode(&response); err != nil {
-		return err
+		return fmt.Errorf("failed to decode docker network create response: %w", err)
 	}
 
 	d.SetId(response.ID)
+
+	if response.Portainer.ResourceControl.Id != 0 {
+		_ = d.Set("resource_control_id", response.Portainer.ResourceControl.Id)
+	}
+
 	return nil
 }
 
@@ -304,6 +321,11 @@ func resourceDockerNetworkRead(d *schema.ResourceData, meta interface{}) error {
 			Options map[string]string        `json:"Options"`
 			Config  []map[string]interface{} `json:"Config"`
 		} `json:"IPAM"`
+		Portainer struct {
+			ResourceControl struct {
+				Id int `json:"Id"`
+			} `json:"ResourceControl"`
+		} `json:"Portainer"`
 	}
 
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
@@ -388,6 +410,10 @@ func resourceDockerNetworkRead(d *schema.ResourceData, meta interface{}) error {
 
 	_ = d.Set("ipam_config", result.IPAM.Config)
 
+	if result.Portainer.ResourceControl.Id != 0 {
+		_ = d.Set("resource_control_id", result.Portainer.ResourceControl.Id)
+	}
+
 	return nil
 }
 
diff --git a/internal/resource_docker_volume.go b/internal/resource_docker_volume.go
diff --git a/internal/resource_stack.go b/internal/resource_stack.go

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,5 @@ terraform {`
`8`	`8`
`9`	`9`	`provider "portainer" {`
`10`	`10`	`endpoint = var.portainer_url`
`11`		`- api_key = var.portainer_api_key`
`12`	`11`	`skip_ssl_verify = var.portainer_skip_ssl_verify`
`13`	`12`	`}`