feat(vpn): add BGP filter resources and gateway/connection SDK updates

docs/data-sources/vpn_bgp_filter.md

@@ -0,0 +1,36 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_vpn_bgp_filter Data Source - stackit"
+subcategory: ""
+description: |-
+  VPN BGP filter data source schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on datasource level.
+---
+
+# stackit_vpn_bgp_filter (Data Source)
+
+VPN BGP filter data source schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on datasource level.
+
+## Example Usage
+
+```terraform
+data "stackit_vpn_bgp_filter" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  filter_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `filter_id` (String) The server-generated UUID of the BGP filter.
+- `gateway_id` (String) The UUID of the parent VPN gateway.
+- `project_id` (String) STACKIT project ID associated with the BGP filter.
+
+### Read-Only
+
+- `display_name` (String) A user-friendly name for the filter.
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`gateway_id`,`filter_id`".
+- `region` (String) STACKIT region name the resource is located in.

docs/data-sources/vpn_bgp_filter_rule.md

@@ -0,0 +1,62 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_vpn_bgp_filter_rule Data Source - stackit"
+subcategory: ""
+description: |-
+  VPN BGP filter rule data source schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on datasource level.
+---
+
+# stackit_vpn_bgp_filter_rule (Data Source)
+
+VPN BGP filter rule data source schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on datasource level.
+
+## Example Usage
+
+```terraform
+data "stackit_vpn_bgp_filter_rule" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  filter_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  rule_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `filter_id` (String) The UUID of the parent `stackit_vpn_bgp_filter`.
+- `gateway_id` (String) The UUID of the parent VPN gateway.
+- `project_id` (String) STACKIT project ID associated with the BGP filter rule.
+- `rule_id` (String) The server-generated UUID of the rule.
+
+### Read-Only
+
+- `action` (String) The action to take if the route matches all criteria.
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`gateway_id`,`filter_id`,`rule_id`".
+- `match` (Attributes) Matching criteria. (see [below for nested schema](#nestedatt--match))
+- `region` (String) STACKIT region name the resource is located in.
+- `sequence` (Number) The evaluation order of the rule.
+- `set` (Attributes) BGP attributes applied when `action` is `PERMIT`. (see [below for nested schema](#nestedatt--set))
+
+<a id="nestedatt--match"></a>
+### Nested Schema for `match`
+
+Read-Only:
+
+- `as_path_contains_any` (List of Number) Matches if the AS-PATH contains any one of the listed ASNs.
+- `communities` (List of String) Matches if the route carries any one of these BGP standard communities.
+- `first_asn` (Number) Matches if the first ASN in the AS-PATH equals this ASN.
+- `max_prefix_length` (Number) Maximum subnet mask length for matched prefixes.
+- `min_prefix_length` (Number) Minimum subnet mask length for matched prefixes.
+- `peer` (String) Matches the exact IPv4 address of the BGP neighbor that advertised the route.
+- `prefixes` (List of String) List of IPv4 networks to match.
+
+
+<a id="nestedatt--set"></a>
+### Nested Schema for `set`
+
+Read-Only:
+
+- `local_preference` (Number) BGP LOCAL_PREF set on the route.

docs/data-sources/vpn_connection.md

@@ -58,6 +58,7 @@ Read-Only:
 
 Read-Only:
 
+- `inbound_filter_id` (String) UUID of the `stackit_vpn_bgp_filter` applied for inbound route filtering on this tunnel's BGP peering session, if any.
 - `remote_asn` (Number) Remote AS number.
 
 
@@ -111,6 +112,7 @@ Read-Only:
 
 Read-Only:
 
+- `inbound_filter_id` (String) UUID of the `stackit_vpn_bgp_filter` applied for inbound route filtering on this tunnel's BGP peering session, if any.
 - `remote_asn` (Number) Remote AS number.
 
 

docs/data-sources/vpn_gateway.md

@@ -34,6 +34,7 @@ data "stackit_vpn_gateway" "example" {
 - `display_name` (String) A user-friendly name for the VPN gateway.
 - `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`gateway_id`".
 - `labels` (Map of String) Map of custom labels (key-value string pairs).
+- `network_config` (Attributes) Network configuration for the VPN gateway. (see [below for nested schema](#nestedatt--network_config))
 - `plan_id` (String) The service plan identifier (e.g. `p500`). For guidance on finding available plans, see [List available service plans](https://docs.stackit.cloud/products/network/connectivity-hybrid-multi-cloud/vpn/getting-started/gateway-create/#list-available-service-plans).
 - `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
 - `routing_type` (String) Routing architecture. Possible values are: `POLICY_BASED`, `ROUTE_BASED`, `BGP_ROUTE_BASED`.
@@ -54,3 +55,12 @@ Read-Only:
 
 - `local_asn` (Number) Local ASN for BGP (private ASN range, 64512-4294967294).
 - `override_advertised_routes` (List of String) List of IPv4 CIDRs to advertise via BGP. If omitted, SNA network ranges are advertised.
+
+
+<a id="nestedatt--network_config"></a>
+### Nested Schema for `network_config`
+
+Read-Only:
+
+- `predefined_network_prefix` (List of String) The IPv4 network prefix (CIDR notation) allocated for the VPN gateway. Must have a prefix length of /28 or larger. Cannot be changed after the gateway is created.
+- `routing_table_id` (String) Custom routing table ID for the VPN gateway. If omitted, a default routing table is assigned.

docs/resources/vpn_bgp_filter.md

@@ -0,0 +1,53 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_vpn_bgp_filter Resource - stackit"
+subcategory: ""
+description: |-
+  VPN BGP filter resource schema. A named BGP route filter attached to a VPN gateway. A filter holds an ordered set of rules (see stackit_vpn_bgp_filter_rule); a route is evaluated against each rule in sequence order and the first match decides the outcome. An implicit deny is applied after the last rule, so an empty filter denies every route. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+---
+
+# stackit_vpn_bgp_filter (Resource)
+
+VPN BGP filter resource schema. A named BGP route filter attached to a VPN gateway. A filter holds an ordered set of rules (see `stackit_vpn_bgp_filter_rule`); a route is evaluated against each rule in sequence order and the first match decides the outcome. An implicit deny is applied after the last rule, so an empty filter denies every route. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+## Example Usage
+
+```terraform
+resource "stackit_vpn_bgp_filter" "example" {
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  display_name = "example-bgp-filter"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `display_name` (String) A user-friendly name for the filter. Display only - not enforced unique across a gateway.
+- `gateway_id` (String) The UUID of the parent VPN gateway.
+- `project_id` (String) STACKIT project ID associated with the BGP filter.
+
+### Optional
+
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+
+### Read-Only
+
+- `filter_id` (String) The server-generated UUID of the BGP filter.
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`gateway_id`,`filter_id`".
+
+## Import
+
+Import is supported using the following syntax:
+
+In Terraform v1.5.0 and later, the [` + "`" + `import` + "`" + ` block](https://developer.hashicorp.com/terraform/language/import) can be used with the ` + "`" + `id` + "`" + ` attribute, for example:
+
+```terraform
+# Only use the import statement, if you want to import an existing VPN BGP filter
+import {
+  to = stackit_vpn_bgp_filter.example
+  id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,eu01,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
+```

docs/resources/vpn_bgp_filter_rule.md

@@ -0,0 +1,88 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_vpn_bgp_filter_rule Resource - stackit"
+subcategory: ""
+description: |-
+  VPN BGP filter rule resource schema. A single rule within a stackit_vpn_bgp_filter. All non-empty fields within match are AND-combined. Rules within a filter are evaluated in sequence order (lower first); the first matching rule decides the outcome. An implicit deny follows the last rule. A filter may hold at most 10 rules. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+---
+
+# stackit_vpn_bgp_filter_rule (Resource)
+
+VPN BGP filter rule resource schema. A single rule within a `stackit_vpn_bgp_filter`. All non-empty fields within `match` are AND-combined. Rules within a filter are evaluated in `sequence` order (lower first); the first matching rule decides the outcome. An implicit deny follows the last rule. A filter may hold at most 10 rules. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+## Example Usage
+
+```terraform
+resource "stackit_vpn_bgp_filter_rule" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  filter_id  = stackit_vpn_bgp_filter.example.filter_id
+  action     = "PERMIT"
+
+  match = {
+    prefixes          = ["10.0.0.0/16"]
+    max_prefix_length = 24
+  }
+
+  set = {
+    local_preference = 150
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `action` (String) The action to take if the route matches all criteria. Possible values are: `PERMIT`, `DENY`.
+- `filter_id` (String) The UUID of the parent `stackit_vpn_bgp_filter`.
+- `gateway_id` (String) The UUID of the parent VPN gateway.
+- `project_id` (String) STACKIT project ID associated with the BGP filter rule.
+
+### Optional
+
+- `match` (Attributes) Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). (see [below for nested schema](#nestedatt--match))
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+- `sequence` (Number) The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. If omitted on creation, the server auto-assigns the next value.
+- `set` (Attributes) Optional BGP attributes to apply when `action` is `PERMIT`. Ignored for `DENY` rules. (see [below for nested schema](#nestedatt--set))
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`gateway_id`,`filter_id`,`rule_id`".
+- `rule_id` (String) The server-generated UUID of the rule.
+
+<a id="nestedatt--match"></a>
+### Nested Schema for `match`
+
+Optional:
+
+- `as_path_contains_any` (List of Number) Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list).
+- `communities` (List of String) Matches if the route carries any one of these BGP standard communities. Format is `asn:value` per RFC 1997.
+- `first_asn` (Number) Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN.
+- `max_prefix_length` (Number) Maximum subnet mask length for matched prefixes.
+- `min_prefix_length` (Number) Minimum subnet mask length for matched prefixes.
+- `peer` (String) Matches the exact IPv4 address of the BGP neighbor that advertised the route.
+- `prefixes` (List of String) List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to min/max prefix length refinement).
+
+
+<a id="nestedatt--set"></a>
+### Nested Schema for `set`
+
+Optional:
+
+- `local_preference` (Number) BGP LOCAL_PREF to set on the route. Higher values are preferred during best-path selection. Default BGP LOCAL_PREF is 100.
+
+## Import
+
+Import is supported using the following syntax:
+
+In Terraform v1.5.0 and later, the [` + "`" + `import` + "`" + ` block](https://developer.hashicorp.com/terraform/language/import) can be used with the ` + "`" + `id` + "`" + ` attribute, for example:
+
+```terraform
+# Only use the import statement, if you want to import an existing VPN BGP filter rule
+import {
+  to = stackit_vpn_bgp_filter_rule.example
+  id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,eu01,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}
+```

docs/resources/vpn_connection.md

@@ -106,7 +106,7 @@ Optional:
 Required:
 
 - `encryption_algorithms` (List of String) Encryption algorithms for Phase 1. Possible values are: `aes256`, `aes128gcm16`, `aes256gcm16`.
-- `integrity_algorithms` (List of String) Integrity algorithms for Phase 1. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`.
+- `integrity_algorithms` (List of String) Integrity algorithms for Phase 1. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`. `sha1` is deprecated and may be removed in a future API version; prefer `sha2_256`, `sha2_384`, or `sha2_512`.
 
 Optional:
 
@@ -120,7 +120,7 @@ Optional:
 Required:
 
 - `encryption_algorithms` (List of String) Encryption algorithms for Phase 2. Possible values are: `aes256`, `aes128gcm16`, `aes256gcm16`.
-- `integrity_algorithms` (List of String) Integrity algorithms for Phase 2. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`.
+- `integrity_algorithms` (List of String) Integrity algorithms for Phase 2. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`. `sha1` is deprecated and may be removed in a future API version; prefer `sha2_256`, `sha2_384`, or `sha2_512`.
 
 Optional:
 
@@ -137,6 +137,10 @@ Required:
 
 - `remote_asn` (Number) Remote ASN for BGP peering (private ASN range, 64512-4294967294).
 
+Optional:
+
+- `inbound_filter_id` (String) UUID of a `stackit_vpn_bgp_filter` to apply for inbound route filtering on this tunnel's BGP peering session. If omitted, no inbound filtering is applied.
+
 
 <a id="nestedatt--tunnel1--peering"></a>
 ### Nested Schema for `tunnel1.peering`
@@ -171,7 +175,7 @@ Optional:
 Required:
 
 - `encryption_algorithms` (List of String) Encryption algorithms for Phase 1. Possible values are: `aes256`, `aes128gcm16`, `aes256gcm16`.
-- `integrity_algorithms` (List of String) Integrity algorithms for Phase 1. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`.
+- `integrity_algorithms` (List of String) Integrity algorithms for Phase 1. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`. `sha1` is deprecated and may be removed in a future API version; prefer `sha2_256`, `sha2_384`, or `sha2_512`.
 
 Optional:
 
@@ -185,7 +189,7 @@ Optional:
 Required:
 
 - `encryption_algorithms` (List of String) Encryption algorithms for Phase 2. Possible values are: `aes256`, `aes128gcm16`, `aes256gcm16`.
-- `integrity_algorithms` (List of String) Integrity algorithms for Phase 2. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`.
+- `integrity_algorithms` (List of String) Integrity algorithms for Phase 2. Possible values are: `sha1`, `sha2_256`, `sha2_384`, `sha2_512`. `sha1` is deprecated and may be removed in a future API version; prefer `sha2_256`, `sha2_384`, or `sha2_512`.
 
 Optional:
 
@@ -202,6 +206,10 @@ Required:
 
 - `remote_asn` (Number) Remote ASN for BGP peering (private ASN range, 64512-4294967294).
 
+Optional:
+
+- `inbound_filter_id` (String) UUID of a `stackit_vpn_bgp_filter` to apply for inbound route filtering on this tunnel's BGP peering session. If omitted, no inbound filtering is applied.
+
 
 <a id="nestedatt--tunnel2--peering"></a>
 ### Nested Schema for `tunnel2.peering`

docs/resources/vpn_gateway.md

@@ -23,6 +23,10 @@ resource "stackit_vpn_gateway" "example" {
     tunnel1 = "eu01-1"
     tunnel2 = "eu01-2"
   }
+
+  network_config = {
+    predefined_network_prefix = ["10.20.0.0/28"]
+  }
 }
 ```
 
@@ -41,6 +45,7 @@ resource "stackit_vpn_gateway" "example" {
 
 - `bgp` (Attributes) BGP configuration. Only applicable when routing_type is BGP_ROUTE_BASED. (see [below for nested schema](#nestedatt--bgp))
 - `labels` (Map of String) Map of custom labels (key-value string pairs).
+- `network_config` (Attributes) Network configuration for the VPN gateway. (see [below for nested schema](#nestedatt--network_config))
 - `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
 
 ### Read-Only
@@ -68,6 +73,15 @@ Optional:
 
 - `override_advertised_routes` (List of String) List of IPv4 CIDRs to advertise via BGP. If omitted, SNA network ranges are advertised.
 
+
+<a id="nestedatt--network_config"></a>
+### Nested Schema for `network_config`
+
+Optional:
+
+- `predefined_network_prefix` (List of String) The IPv4 network prefix (CIDR notation) allocated for the VPN gateway. Must have a prefix length of /28 or larger. Cannot be changed after the gateway is created.
+- `routing_table_id` (String) Custom routing table ID for the VPN gateway. If omitted, a default routing table is assigned.
+
 ## Import
 
 Import is supported using the following syntax:

examples/data-sources/stackit_vpn_bgp_filter/data-source.tf

@@ -0,0 +1,5 @@
+data "stackit_vpn_bgp_filter" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  filter_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}

examples/data-sources/stackit_vpn_bgp_filter_rule/data-source.tf

@@ -0,0 +1,6 @@
+data "stackit_vpn_bgp_filter_rule" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  filter_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  rule_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}

examples/resources/stackit_vpn_bgp_filter/import-by-string-id.tf

@@ -0,0 +1,5 @@
+# Only use the import statement, if you want to import an existing VPN BGP filter
+import {
+  to = stackit_vpn_bgp_filter.example
+  id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,eu01,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+}

examples/resources/stackit_vpn_bgp_filter/resource.tf

@@ -0,0 +1,5 @@
+resource "stackit_vpn_bgp_filter" "example" {
+  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  gateway_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  display_name = "example-bgp-filter"
+}