feat(vpn): add BGP filter resources and gateway/connection SDK updates - #1720
Open
steffenkoenig wants to merge 5 commits into
Open
feat(vpn): add BGP filter resources and gateway/connection SDK updates#1720steffenkoenig wants to merge 5 commits into
steffenkoenig wants to merge 5 commits into
Conversation
Reflects upcoming stackit-sdk-go vpn changes (stackitcloud/stackit-sdk-go#9324, pinned by commit since the SDK PR isn't tagged/released yet): - New stackit_vpn_bgp_filter and stackit_vpn_bgp_filter_rule resources and data sources, supporting the new gateway-scoped BGP route filtering API. - stackit_vpn_gateway gains an optional network_config block (predefined_network_prefix, routing_table_id). - stackit_vpn_connection's tunnel bgp block gains inbound_filter_id, linking a tunnel's BGP session to a stackit_vpn_bgp_filter, with tri-state set/clear/leave-untouched handling on update. - integrity_algorithms now accepts sha2_512 instead of sha1 (SDK enum change, no code change needed since values are derived dynamically). go.mod is pinned to the SDK PR's commit as a pseudo-version with a TODO(vpn-sdk-pin) marker to re-pin once the SDK PR merges and is tagged.
steffenkoenig
marked this pull request as draft
August 21, 2026 21:54
The vpn changes (BGP filter, network_config, inbound_filter_id) landed on stackit-sdk-go main and are now tagged as services/vpn/v0.15.0. Re-pin from the temporary commit pseudo-version to this release; no code changes needed since the tag points at the same content already implemented against.
The released stackit-sdk-go v0.15.0 kept `sha1` in PhaseIntegrityAlgorithmsInner alongside the new `sha2_512`, unlike the draft PR commit this was originally implemented against (which dropped `sha1`). No Go code change is needed since the provider already derives its integrity_algorithms validator values dynamically from the SDK enum, but the previously generated docs were stale and needed a refresh.
sha1 remains supported by the API but is deprecated. Add a schema description note and a plan-time diagnostic warning (on create/update) when a stackit_vpn_connection tunnel's phase1/phase2 integrity_algorithms includes sha1, pointing users toward sha2_256/sha2_384/sha2_512 instead.
steffenkoenig
marked this pull request as ready for review
August 21, 2026 22:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reflects vpn changes:
Checklist
make fmtexamples/directory)make generate-docs(will be checked by CI)make test(will be checked by CI)make lint(will be checked by CI)