Merge pull request #881 from dazoakley/insecure-tls

Add the option to ignore TLS certificate errors when calling the PD API.

pagerduty/config.go

@@ -1,6 +1,7 @@
 package pagerduty
 
 import (
+	"crypto/tls"
 	"fmt"
 	"log"
 	"net/http"
@@ -37,6 +38,9 @@ type Config struct {
 	// UserAgent for API Client
 	UserAgent string
 
+	// Do not verify TLS certs for HTTPS requests - useful if you're behind a corporate proxy
+	InsecureTls bool
+
 	APITokenType *pagerduty.AuthTokenType
 
 	AppOauthScopedTokenParams *persistentconfig.AppOauthScopedTokenParams
@@ -72,7 +76,12 @@ func (c *Config) Client() (*pagerduty.Client, error) {
 	var httpClient *http.Client
 	httpClient = http.DefaultClient
 	httpClient.Timeout = 1 * time.Minute
-	httpClient.Transport = logging.NewTransport("PagerDuty", http.DefaultTransport)
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	if c.InsecureTls {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	httpClient.Transport = logging.NewTransport("PagerDuty", transport)
 
 	apiUrl := c.ApiUrl
 	if c.ApiUrlOverride != "" {
@@ -125,7 +134,12 @@ func (c *Config) SlackClient() (*pagerduty.Client, error) {
 
 	var httpClient *http.Client
 	httpClient = http.DefaultClient
-	httpClient.Transport = logging.NewTransport("PagerDuty", http.DefaultTransport)
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	if c.InsecureTls {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	httpClient.Transport = logging.NewTransport("PagerDuty", transport)
 
 	config := &pagerduty.Config{
 		BaseURL:    c.AppUrl,

pagerduty/config_test.go

@@ -65,3 +65,16 @@ func TestConfigCustomAppUrl(t *testing.T) {
 		t.Fatalf("error: expected the client to not fail: %v", err)
 	}
 }
+
+// Test config with InsecureTls setting
+func TestConfigInsecureTls(t *testing.T) {
+	config := Config{
+		Token:               "foo",
+		InsecureTls:         true,
+		SkipCredsValidation: true,
+	}
+
+	if _, err := config.Client(); err != nil {
+		t.Fatalf("error: expected the client to not fail: %v", err)
+	}
+}

pagerduty/provider.go

@@ -77,6 +77,12 @@ func Provider(isMux bool) *schema.Provider {
 				Optional: true,
 				Default:  "",
 			},
+
+			"insecure_tls": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 		},
 
 		DataSourcesMap: map[string]*schema.Resource{
@@ -230,6 +236,7 @@ func providerConfigureContextFunc(_ context.Context, data *schema.ResourceData,
 		UserAgent:           fmt.Sprintf("(%s %s) Terraform/%s", runtime.GOOS, runtime.GOARCH, terraformVersion),
 		ApiUrlOverride:      data.Get("api_url_override").(string),
 		ServiceRegion:       serviceRegion,
+		InsecureTls:         data.Get("insecure_tls").(bool),
 	}
 
 	useAuthTokenType := pagerduty.AuthTokenTypeAPIToken

pagerdutyplugin/config.go

@@ -2,6 +2,7 @@ package pagerduty
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"log"
 	"net/http"
@@ -44,6 +45,9 @@ type Config struct {
 	// Region where the server of the service is deployed
 	ServiceRegion string
 
+	// Do not verify TLS certs for HTTPS requests - useful if you're behind a corporate proxy
+	InsecureTls bool
+
 	// Parameters for fine-grained access control
 	AppOauthScopedToken *AppOauthScopedToken
 
@@ -73,7 +77,12 @@ func (c *Config) Client(ctx context.Context) (*pagerduty.Client, error) {
 
 	httpClient := http.DefaultClient
 	httpClient.Timeout = 1 * time.Minute
-	httpClient.Transport = logging.NewTransport("PagerDuty", http.DefaultTransport)
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	if c.InsecureTls {
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+	httpClient.Transport = logging.NewTransport("PagerDuty", transport)
 
 	apiURL := c.APIURL
 	if c.APIURLOverride != "" {

pagerdutyplugin/config_test.go

@@ -66,3 +66,16 @@ func TestConfigCustomAppUrl(t *testing.T) {
 		t.Fatalf("error: expected the client to not fail: %v", err)
 	}
 }
+
+// Test config with InsecureTls
+func TestConfigInsecureTls(t *testing.T) {
+	config := Config{
+		Token:               "foo",
+		InsecureTls:         true,
+		SkipCredsValidation: true,
+	}
+
+	if _, err := config.Client(context.Background()); err != nil {
+		t.Fatalf("error: expected the client to not fail: %v", err)
+	}
+}

pagerdutyplugin/provider.go

@@ -42,6 +42,7 @@ func (p *Provider) Schema(_ context.Context, _ provider.SchemaRequest, resp *pro
 			"skip_credentials_validation": schema.BoolAttribute{Optional: true},
 			"token":                       schema.StringAttribute{Optional: true},
 			"user_token":                  schema.StringAttribute{Optional: true},
+			"insecure_tls":                schema.BoolAttribute{Optional: true},
 		},
 		Blocks: map[string]schema.Block{
 			"use_app_oauth_scoped_token": useAppOauthScopedTokenBlock,
@@ -101,6 +102,7 @@ func (p *Provider) Configure(ctx context.Context, req provider.ConfigureRequest,
 	}
 
 	skipCredentialsValidation := args.SkipCredentialsValidation.Equal(types.BoolValue(true))
+	insecureTls := args.InsecureTls.Equal(types.BoolValue(true))
 
 	config := Config{
 		APIURL:              "https://api." + regionAPIURL + "pagerduty.com",
@@ -111,6 +113,7 @@ func (p *Provider) Configure(ctx context.Context, req provider.ConfigureRequest,
 		TerraformVersion:    req.TerraformVersion,
 		APIURLOverride:      args.APIURLOverride.ValueString(),
 		ServiceRegion:       serviceRegion,
+		InsecureTls:         insecureTls,
 	}
 
 	if !args.UseAppOauthScopedToken.IsNull() {
@@ -194,6 +197,7 @@ type providerArguments struct {
 	ServiceRegion             types.String `tfsdk:"service_region"`
 	APIURLOverride            types.String `tfsdk:"api_url_override"`
 	UseAppOauthScopedToken    types.List   `tfsdk:"use_app_oauth_scoped_token"`
+	InsecureTls               types.Bool   `tfsdk:"insecure_tls"`
 }
 
 type SchemaGetter interface {

website/docs/index.html.markdown

@@ -58,6 +58,7 @@ The following arguments are supported:
 * `skip_credentials_validation` - (Optional) Skip validation of the token against the PagerDuty API.
 * `service_region` - (Optional) The PagerDuty service region to use. Default to empty (uses US region). Supported value: `eu`. This setting also affects configuration of `use_app_oauth_scoped_token` for setting Region of *App Oauth token credentials*. It can also be sourced from the `PAGERDUTY_SERVICE_REGION` environment variable.
 * `api_url_override` - (Optional) It can be used to set a custom proxy endpoint as PagerDuty client api url overriding `service_region` setup.
+* `insecure_tls` - (Optional) Can be used to disable TLS certificate checking when calling the PagerDuty API. This can be useful if you're behind a corporate proxy.
 
 The `use_app_oauth_scoped_token` block contains the following arguments: