Merge branch 'master' into turnstile

.changelog/2388.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/cloudflare_ruleset: ensure custom cache keys using query parameters are defined as known values for state handling
+```

.changelog/2395.txt

@@ -0,0 +1,3 @@
+```release-note:dependency
+provider: bumps github.com/hashicorp/terraform-plugin-mux from 0.9.0 to 0.10.0
+```

.changelog/2397.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/cloudflare_logpush_job: Fix schema for logpush job `dataset` field
+```

.changelog/2398.txt

@@ -0,0 +1,3 @@
+```release-note:dependency
+provider: bumps github.com/cloudflare/cloudflare-go from 0.65.0 to 0.66.0
+```

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -43,9 +43,14 @@ body:
     label: Terraform configuration files
     description: |
       No need for code block backticks, this will be rendered as HCL automatically. 
+      
       Avoid using `for` loops, dynamics or data sources in your examples as they 
       do not make for a good reproduction test case and may contain bugs in the 
       expressions used.
+      
+      If you cannot provide your exact configuration due to sensitivity, please
+      provide a minimal reproduction case that demonstrates your issue with the setup
+      you are using.
     placeholder: |
       resource "example_resource" "my_resource" {
         # ..
@@ -65,7 +70,8 @@ body:
       Be sure to redact or sanitise any sensitive information (such as API keys or tokens) in 
       your logs. https://jacobbednarz.com/tf-log-redactor/ is an online tool that will handle
       redacting the sensitive Cloudflare details from your log output for you if you don't want
-      to manually do it.
+      to manually do it. Provider versions newer than v3.32.0 automatically redacts all Cloudflare
+      credentials.
   validations:
     required: true
 - type: textarea

.github/workflows/issue-sync.yml

@@ -25,6 +25,7 @@ jobs:
               echo "issue_number=${{ github.event.issue.number }}" >> $GITHUB_ENV
           fi
       - run: go run cmd/sync-github-issue-to-jira/main.go ${{ env.issue_number }}
+        if: ${{ github.event.label.name == 'triage/accepted' || github.event_name == 'workflow_dispatch' }}
         working-directory: ./tools
         env:
           GITHUB_OWNER: cloudflare

.github/workflows/stale.yml

@@ -27,3 +27,4 @@ jobs:
           days-before-pr-close: 7
           any-of-issue-labels: 'triage/needs-information,triage/not-reproducible,triage/unresolved,workflow/pending-contributor-response,workflow/pending-op-response'
           exempt-pr-labels: 'workflow/pending-upstream-library,workflow/pending-public-documentation,workflow/pending-cloudflare-response,workflow/pending-maintainer-response'
+          exempt-draft-pr: true

CHANGELOG.md

@@ -1,4 +1,19 @@
-## 4.4.0 (Unreleased)
+## 4.5.0 (Unreleased)
+
+ENHANCEMENTS:
+
+* resource/cloudflare_logpush_job: Fix schema for logpush job `dataset` field ([#2397](https://github.com/cloudflare/terraform-provider-cloudflare/issues/2397))
+
+BUG FIXES:
+
+* resource/cloudflare_ruleset: ensure custom cache keys using query parameters are defined as known values for state handling ([#2388](https://github.com/cloudflare/terraform-provider-cloudflare/issues/2388))
+
+DEPENDENCIES:
+
+* provider: bumps github.com/cloudflare/cloudflare-go from 0.65.0 to 0.66.0 ([#2398](https://github.com/cloudflare/terraform-provider-cloudflare/issues/2398))
+* provider: bumps github.com/hashicorp/terraform-plugin-mux from 0.9.0 to 0.10.0 ([#2395](https://github.com/cloudflare/terraform-provider-cloudflare/issues/2395))
+
+## 4.4.0 (19th April, 2023)
 
 NOTES:
 

docs/resources/logpush_job.md

@@ -110,7 +110,7 @@ resource "cloudflare_logpush_job" "example_job" {
 
 ### Required
 
-- `dataset` (String) Uniquely identifies a resource (such as an s3 bucket) where data will be pushed. Additional configuration parameters supported by the destination may be included. See [Logpush destination documentation](https://developers.cloudflare.com/logs/reference/logpush-api-configuration#destination). Available values: `access_requests`, `firewall_events`, `http_requests`, `spectrum_events`, `nel_reports`, `audit_logs`, `gateway_dns`, `gateway_http`, `gateway_network`, `dns_logs`, `network_analytics_logs`, `workers_trace_events`.
+- `dataset` (String) The kind of the dataset to use with the logpush job. Available values: `access_requests`, `firewall_events`, `http_requests`, `spectrum_events`, `nel_reports`, `audit_logs`, `gateway_dns`, `gateway_http`, `gateway_network`, `dns_logs`, `network_analytics_logs`, `workers_trace_events`.
 - `destination_conf` (String) Uniquely identifies a resource (such as an s3 bucket) where data will be pushed. Additional configuration parameters supported by the destination may be included. See [Logpush destination documentation](https://developers.cloudflare.com/logs/reference/logpush-api-configuration#destination).
 
 ### Optional

go.mod

@@ -4,7 +4,7 @@ go 1.20
 
 require (
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/cloudflare/cloudflare-go v0.65.0
+	github.com/cloudflare/cloudflare-go v0.66.0
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/google/uuid v1.3.0
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -37,7 +37,7 @@ require (
 	github.com/hashicorp/terraform-plugin-framework v1.2.0
 	github.com/hashicorp/terraform-plugin-framework-validators v0.10.0
 	github.com/hashicorp/terraform-plugin-log v0.8.0
-	github.com/hashicorp/terraform-plugin-mux v0.9.0
+	github.com/hashicorp/terraform-plugin-mux v0.10.0
 	github.com/hashicorp/terraform-plugin-testing v1.2.0
 	github.com/stretchr/testify v1.8.2
 )

go.sum

@@ -19,8 +19,8 @@ github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkE
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cloudflare/cloudflare-go v0.65.0 h1:bWs9AwKrbK9h2vbHd/rNFR7tCsk/ktTJ+wRimwNS48U=
-github.com/cloudflare/cloudflare-go v0.65.0/go.mod h1:tA44hjU9FfycofKT+lWWMHb/dEq1pRbiVPGuJo1WzLQ=
+github.com/cloudflare/cloudflare-go v0.66.0 h1:B74IvVGQ4UFYJnqQSK/9GbR+Y1HwNxqqdN2Bmg0dckg=
+github.com/cloudflare/cloudflare-go v0.66.0/go.mod h1:tA44hjU9FfycofKT+lWWMHb/dEq1pRbiVPGuJo1WzLQ=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -101,8 +101,8 @@ github.com/hashicorp/terraform-plugin-go v0.15.0 h1:1BJNSUFs09DS8h/XNyJNJaeusQuW
 github.com/hashicorp/terraform-plugin-go v0.15.0/go.mod h1:tk9E3/Zx4RlF/9FdGAhwxHExqIHHldqiQGt20G6g+nQ=
 github.com/hashicorp/terraform-plugin-log v0.8.0 h1:pX2VQ/TGKu+UU1rCay0OlzosNKe4Nz1pepLXj95oyy0=
 github.com/hashicorp/terraform-plugin-log v0.8.0/go.mod h1:1myFrhVsBLeylQzYYEV17VVjtG8oYPRFdaZs7xdW2xs=
-github.com/hashicorp/terraform-plugin-mux v0.9.0 h1:a2Xh63cunDB/1GZECrV02cGA74AhQGUjY9X8W3P/L7k=
-github.com/hashicorp/terraform-plugin-mux v0.9.0/go.mod h1:8NUFbgeMigms7Tma/r2Vgi5Jv5mPv4xcJ05pJtIOhwc=
+github.com/hashicorp/terraform-plugin-mux v0.10.0 h1:VejY1BffxGy2iYOaa8DDHavY4k9jbvAE8F3lhruspKY=
+github.com/hashicorp/terraform-plugin-mux v0.10.0/go.mod h1:9sdnpmY20xIsl4ItsfODZYE+MgpSy/osXpSf+RwaZCY=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1 h1:G9WAfb8LHeCxu7Ae8nc1agZlQOSCUWsb610iAogBhCs=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1/go.mod h1:xcOSYlRVdPLmDUoqPhO9fiO/YCN/l6MGYeTzGt5jgkQ=
 github.com/hashicorp/terraform-plugin-testing v1.2.0 h1:pASRAe6BOZFO4xSGQr9WzitXit0nrQAYDk8ziuRfn9E=

internal/framework/service/rulesets/resource.go

@@ -527,12 +527,20 @@ func toRulesetResourceModel(zoneID, accountID basetypes.StringValue, in cloudfla
 						include, _ := basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include)
 						exclude, _ := basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude)
 
-						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include != nil && ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.All {
-							include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include != nil {
+							if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.All {
+								include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+							} else {
+								include, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Include.List)
+							}
 						}
 
-						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude != nil && ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.All {
-							exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+						if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude != nil {
+							if ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.All {
+								exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, []string{"*"})
+							} else {
+								exclude, _ = basetypes.NewSetValueFrom(context.Background(), types.StringType, ruleResponse.ActionParameters.CacheKey.CustomKey.Query.Exclude.List)
+							}
 						}
 
 						key.QueryString = []*ActionParameterCacheKeyCustomKeyQueryStringModel{{

internal/framework/service/rulesets/resource_test.go

@@ -2011,6 +2011,36 @@ func TestAccCloudflareRuleset_ConfigConflictingCacheByDevice(t *testing.T) {
 	})
 }
 
+func TestAccCloudflareRuleset_CacheSettingsDefinedQueryStringExcludeKeys(t *testing.T) {
+	rnd := utils.GenerateRandomResourceName()
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsExclude(rnd, zoneID),
+			},
+		},
+	})
+}
+
+func TestAccCloudflareRuleset_CacheSettingsDefinedQueryStringIncludeKeys(t *testing.T) {
+	rnd := utils.GenerateRandomResourceName()
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsInclude(rnd, zoneID),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudflareRulesetMagicTransitSingle(rnd, name, accountID string) string {
 	return fmt.Sprintf(`
   resource "cloudflare_ruleset" "%[1]s" {
@@ -3725,6 +3755,72 @@ func testAccCloudflareRulesetConfigConflictingCacheByDeviceConfigs(rnd, zoneID s
   }`, rnd, zoneID)
 }
 
+func testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsExclude(rnd, zoneID string) string {
+	return fmt.Sprintf(`
+	resource "cloudflare_ruleset" "cache_settings_example" {
+		zone_id     = "%[2]s"
+    name        = "%[1]s"
+		description = "set cache settings for the request"
+		kind        = "zone"
+		phase       = "http_request_cache_settings"
+		rules {
+		  action      = "set_cache_settings"
+		  description = "example"
+		  enabled     = true
+		  expression  = "(http.host eq \"example.com\" and starts_with(http.request.uri.path, \"/example\"))"
+		  action_parameters {
+			cache = true
+			edge_ttl {
+			  mode    = "override_origin"
+			  default = 7200
+			}
+			cache_key {
+			  ignore_query_strings_order = true
+			  custom_key {
+				query_string {
+				  exclude = ["example"]
+				}
+			  }
+			}
+		  }
+		}
+	  }
+	`, rnd, zoneID)
+}
+
+func testAccCloudflareRulesetCacheSettingsExplicitCustomKeyCacheKeysQueryStringsInclude(rnd, zoneID string) string {
+	return fmt.Sprintf(`
+	resource "cloudflare_ruleset" "cache_settings_example" {
+		zone_id     = "%[2]s"
+    name        = "%[1]s"
+		description = "set cache settings for the request"
+		kind        = "zone"
+		phase       = "http_request_cache_settings"
+		rules {
+		  action      = "set_cache_settings"
+		  description = "example"
+		  enabled     = true
+		  expression  = "(http.host eq \"example.com\" and starts_with(http.request.uri.path, \"/example\"))"
+		  action_parameters {
+			cache = true
+			edge_ttl {
+			  mode    = "override_origin"
+			  default = 7200
+			}
+			cache_key {
+			  ignore_query_strings_order = true
+			  custom_key {
+				query_string {
+				  include = ["another_example"]
+				}
+			  }
+			}
+		  }
+		}
+	  }
+	`, rnd, zoneID)
+}
+
 func testAccCheckCloudflareRulesetDestroy(s *terraform.State) error {
 	return nil
 }

internal/sdkv2provider/schema_cloudflare_logpush_job.go

@@ -58,7 +58,7 @@ func resourceCloudflareLogpushJobSchema() map[string]*schema.Schema {
 				"workers_trace_events",
 			}, false),
 			Description: fmt.Sprintf(
-				"Uniquely identifies a resource (such as an s3 bucket) where data will be pushed. Additional configuration parameters supported by the destination may be included. See [Logpush destination documentation](https://developers.cloudflare.com/logs/reference/logpush-api-configuration#destination). %s",
+				"The kind of the dataset to use with the logpush job. %s",
 				renderAvailableDocumentationValuesStringSlice([]string{
 					"access_requests",
 					"firewall_events",

tools/cmd/sync-github-issue-to-jira/main.go

@@ -16,6 +16,10 @@ import (
 	"golang.org/x/oauth2"
 )
 
+var (
+	syncedLabel = "workflow/synced"
+)
+
 type serviceOwner struct {
 	manager  string
 	teamName string
@@ -138,6 +142,11 @@ func main() {
 		log.Fatalf("error retrieving issue %s/%s#%d: %s", githubRepositoryOwner, githubRepositoryName, issueNumber, err)
 	}
 
+	if !hasLabel(issue, syncedLabel) {
+		log.Printf("issue is already marked as synced (%s), skipping", syncedLabel)
+		os.Exit(0)
+	}
+
 	if !hasLabel(issue, acceptedLabel) {
 		log.Printf("issue is not marked as ready for syncing using %s, skipping", acceptedLabel)
 		os.Exit(0)
@@ -154,7 +163,7 @@ func main() {
 	newIssue := InternalIssue{Fields: IssueFields{
 		Project:     IssueKey{Key: "CUSTESC"},
 		Summary:     *issue.Title,
-		Description: jirafyBodyMarkdown(*issue.Body),
+		Description: jirafyBodyMarkdown(issue),
 		Teams:       []IssueValue{{Value: serviceOwner.teamName}},
 		EngOwner:    IssueName{Name: serviceOwner.manager},
 		SLA:         IssueValue{Value: "Pro / Free"},
@@ -199,6 +208,10 @@ func main() {
 	}
 
 	fmt.Println(fmt.Sprintf("successfully created internal JIRA issue: %s", createdIssue.Key))
+	_, _, err = client.Issues.AddLabelsToIssue(ctx, githubRepositoryOwner, githubRepositoryName, issueNumber, []string{syncedLabel})
+	if err != nil {
+		log.Printf("error adding synced label for issue %s/%s#%d: %s", githubRepositoryOwner, githubRepositoryName, issueNumber, err)
+	}
 
 	os.Exit(0)
 }
@@ -225,11 +238,14 @@ func getOwnershipLabel(issue *github.Issue) string {
 
 // jirafyBodyMarkdown takes GitHub markdown and makes it palatable for JIRA
 // with reasonable formatting.
-func jirafyBodyMarkdown(s string) string {
-	s = strings.ReplaceAll(s, "- [X] ", "✅ ")
-	s = strings.ReplaceAll(s, "###", "h3.")
-	s = strings.ReplaceAll(s, "```hcl", "{code}")
-	s = strings.ReplaceAll(s, "```", "{code}")
+func jirafyBodyMarkdown(issue *github.Issue) string {
+	output := "GitHub issue: " + *issue.HTMLURL + "\n\n---\n\n"
+
+	output += *issue.Body
+	output = strings.ReplaceAll(output, "- [X] ", "✅ ")
+	output = strings.ReplaceAll(output, "###", "h3.")
+	output = strings.ReplaceAll(output, "```hcl", "{code}")
+	output = strings.ReplaceAll(output, "```", "{code}")
 
-	return s
+	return output
 }