Merge pull request #21 from platform9/feat/vpnaas

feat(vpnaas): Neutron VPNaaS family (service, IKE/IPsec policies, endpoint group, site connection)

Author: PF9-pushkar

CHANGELOG.md

@@ -77,6 +77,13 @@ All notable changes to this project are documented here. The format is based on
   resource stops managing the quotas without resetting them to defaults (matching the upstream
   provider). Imported by a composite `<project_id>/<region>` ID (legacy bare `<project_id>` is
   also accepted). Cinder per-volume-type quotas (`volume_type_quota`) are not yet implemented.
+- VPNaaS (Neutron VPN extension) — Phase 3: `pcd_vpnaas_service`, `pcd_vpnaas_ike_policy`,
+  `pcd_vpnaas_ipsec_policy`, `pcd_vpnaas_endpoint_group`, and `pcd_vpnaas_site_connection`. Build a
+  site-to-site IPsec VPN: attach a service to a router, pair IKE/IPsec policies (with a nested
+  `lifetime` block) and local/peer endpoint groups, and connect with a site connection (nested
+  `dpd` block, sensitive `psk`). The service and site connection wait for the object to disappear
+  after delete (asynchronous teardown) so dependent routers/subnets can be destroyed in the same
+  apply. The provider-specific `value_specs` escape hatch is not implemented.
 
 - Registry documentation generation wired via `tfplugindocs` (`make generate`) — renders
   `docs/` for every resource and data source plus the provider index from schema

DECISIONS.md

@@ -40,6 +40,7 @@ yet passable on this lab (reason noted). Generated registry docs are not committ
 | DNS (Designate) | `pcd_dns_zone`, `pcd_dns_recordset` + `pcd_dns_zone` DS | **PENDING** — Phase 3, code-complete; async create/update/delete → wait-for-`ACTIVE`/404. Acc test (zone + recordset + import) + examples written. Designate is live on the lab (Step 0) and DNS needs no compute/storage backend, so this should pass live — not yet run this session (credentials unavailable). |
 | Key management (Barbican) | `pcd_keymanager_secret`, `pcd_keymanager_container` + `pcd_keymanager_secret` DS | **PENDING** — Phase 3, code-complete; write-only echo-only `payload`, URL-ref→UUID id handling, wait-for-`ACTIVE` only on create-with-payload. Acc test (secret + container + data source + import) + examples written. Barbican is live on the lab (Step 0) and needs no compute/storage backend, so this should pass live — not yet run this session (credentials unavailable). |
 | Network QoS (Neutron) | `pcd_networking_qos_policy`, `_qos_bandwidth_limit_rule`, `_qos_dscp_marking_rule`, `_qos_minimum_bandwidth_rule` + `_qos_policy` DS | **PENDING** — Phase 3, code-complete; rules nested under a policy with composite `<policy_id>/<rule_id>` import, tags via the attributes-tags extension (`qos/policies` type), `ForceNew` on `qos_policy_id`. Full-tree acc test (policy + all three rules + data source + import) + examples written. Depends only on the Neutron `qos` extension (no compute/storage backend), so this should pass live — not yet run this session (credentials unavailable). |
+| VPNaaS (Neutron) | `pcd_vpnaas_service`, `pcd_vpnaas_ike_policy`, `pcd_vpnaas_ipsec_policy`, `pcd_vpnaas_endpoint_group`, `pcd_vpnaas_site_connection` | **PENDING** — Phase 3, code-complete; new `internal/services/vpnaas` package reusing `NetworkV2Client` (VPNaaS is a Neutron extension). Service + site connection wait for 404 after delete (async teardown); policies/endpoint groups delete synchronously. Nested `lifetime` (IKE/IPsec) and `dpd` (connection) as `SingleNestedAttribute` (Optional+Computed, whole-object + per-field `UseStateForUnknown`); `psk` sensitive. Full-tree acc test (service + policies + endpoint groups + connection + rename + import) + examples written. Needs the Neutron `vpnaas` extension enabled on the lab; not yet run this session (credentials unavailable). **Deferrals:** `value_specs` escape hatch (not in the PCD port), nova/neutron-only fields upstream omits. Avoided two upstream bugs: the `phase_1_negotiation_mode` update-key typo and the `peer_cidrs []string` cast panic. |
 | Project quotas | `pcd_compute_quotaset` (Nova), `pcd_networking_quota` (Neutron), `pcd_blockstorage_quotaset` (Cinder) | **PENDING** — Phase 3, code-complete; every quota field `Optional+Computed` with `UseStateForUnknown` (partial management — only user-set/changed fields are PUT via `*int` omitempty; server echoes the rest). No create API (Create = Update+read). **Delete is a deliberate no-op** (matches upstream `RemoveFromState`: destroying stops management without resetting quotas). Composite `<project_id>/<region>` id with legacy bare-`project_id` import tolerance; `project_id`/`region` are `ForceNew`. Per-service acc test (create project → set quotas → verify via API → update → import) + examples written. Needs live validation on the fresh CE lab (credentials unavailable this session). **Scope note:** matches upstream field-for-field except two deliberate deferrals — see the Deferred section. |
 
 Both PENDING items are lab-side configuration gaps (Platform9 / lab-ops), not provider

examples/resources/pcd_vpnaas_endpoint_group/import.sh

@@ -0,0 +1 @@
+terraform import pcd_vpnaas_endpoint_group.peer <endpoint_group_id>

examples/resources/pcd_vpnaas_endpoint_group/resource.tf

@@ -0,0 +1,5 @@
+resource "pcd_vpnaas_endpoint_group" "peer" {
+  name      = "tf-example-peer-endpoints"
+  type      = "cidr"
+  endpoints = ["10.2.0.0/24", "10.3.0.0/24"]
+}

examples/resources/pcd_vpnaas_ike_policy/import.sh

@@ -0,0 +1 @@
+terraform import pcd_vpnaas_ike_policy.example <ike_policy_id>

examples/resources/pcd_vpnaas_ike_policy/resource.tf

@@ -0,0 +1,11 @@
+resource "pcd_vpnaas_ike_policy" "example" {
+  name                 = "tf-example-ike"
+  auth_algorithm       = "sha256"
+  encryption_algorithm = "aes-256"
+  pfs                  = "group14"
+
+  lifetime = {
+    units = "seconds"
+    value = 3600
+  }
+}

examples/resources/pcd_vpnaas_ipsec_policy/import.sh

@@ -0,0 +1 @@
+terraform import pcd_vpnaas_ipsec_policy.example <ipsec_policy_id>

examples/resources/pcd_vpnaas_ipsec_policy/resource.tf

@@ -0,0 +1,6 @@
+resource "pcd_vpnaas_ipsec_policy" "example" {
+  name                 = "tf-example-ipsec"
+  auth_algorithm       = "sha256"
+  encryption_algorithm = "aes-256"
+  pfs                  = "group14"
+}

examples/resources/pcd_vpnaas_service/import.sh

@@ -0,0 +1 @@
+terraform import pcd_vpnaas_service.example <service_id>

examples/resources/pcd_vpnaas_service/resource.tf

@@ -0,0 +1,8 @@
+resource "pcd_networking_router" "example" {
+  name = "tf-example-vpn-router"
+}
+
+resource "pcd_vpnaas_service" "example" {
+  name      = "tf-example-vpn"
+  router_id = pcd_networking_router.example.id
+}