Skip to content

Conversation

@mridang
Copy link
Collaborator

@mridang mridang commented Jan 8, 2026

This pull request adds support for TLS certificate verification control and custom transport headers to the Zitadel Terraform provider.

This changeset adds two new optional provider configuration parameters: insecure_skip_verify_tls allows connecting to ZITADEL instances with self-signed or untrusted TLS certificates for development and testing environments, while transport_headers enables custom headers for both HTTP (authentication) and gRPC (API) requests to support proxy authentication scenarios like GCP IAP.

Example:

provider "zitadel" {
  domain                   = "my-instance.zitadel.cloud"
  insecure_skip_verify_tls = true  # Development environments only
  
  transport_headers = {
    "Proxy-Authorization" = "Bearer ${var.proxy_token}"
  }
  
  jwt_profile_json = file("service-account.json")
}

Closes #228
Closes #259

Definition of Ready

  • Short description of the feature/issue is added in the pr description
  • PR is linked to the corresponding user story
  • Acceptance criteria are met
  • All open todos and follow ups are defined in a new ticket and justified
  • Deviations from the acceptance criteria and design are agreed with the PO and documented.
  • No debug or dead code
  • My code has no repetitions
  • All non-functional requirements are met
  • The generic lifecycle acceptance test passes for affected resources.
  • Examples are up-to-date and meaningful. The provider version is incremented.
  • Docs are generated.
  • Code is generated where possible.

@mridang mridang self-assigned this Jan 8, 2026
@mridang mridang force-pushed the feat/add-custom-headers-insecure-tls-support branch 2 times, most recently from 258e064 to cced3c3 Compare January 8, 2026 21:19
@mridang mridang force-pushed the feat/add-custom-headers-insecure-tls-support branch from cced3c3 to 5560ad9 Compare January 8, 2026 21:24
@codecov
Copy link

codecov bot commented Jan 8, 2026

Codecov Report

❌ Patch coverage is 65.85366% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.51%. Comparing base (8fb6b35) to head (5560ad9).
⚠️ Report is 56 commits behind head on main.

Files with missing lines Patch % Lines
zitadel/helper/client.go 0.00% 7 Missing ⚠️
zitadel/provider.go 79.41% 5 Missing and 2 partials ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main     #333       +/-   ##
===========================================
- Coverage   57.68%   38.51%   -19.18%     
===========================================
  Files         221      284       +63     
  Lines       25868    30625     +4757     
===========================================
- Hits        14923    11795     -3128     
- Misses       7427    17125     +9698     
+ Partials     3518     1705     -1813     
Flag Coverage Δ
acceptance-tests 38.51% <65.85%> (-19.18%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@mridang mridang enabled auto-merge (squash) January 8, 2026 22:10
@mridang mridang merged commit 6a7b300 into main Jan 8, 2026
3 of 4 checks passed
@mridang mridang deleted the feat/add-custom-headers-insecure-tls-support branch January 8, 2026 22:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support extra request headers for the terraform provider Add Option to Disable TLS Certificate Verification in Zitadel Terraform Provider

2 participants