Resource tailscale_oauth_client - Importing existing OAuth clients into terraform state

[quatauta]

Since v0.20.0, the provider supports managing Tailscale OAuth clients via Terraform, which is awesome.

However, it seems like importing existing OAuth clients into Terraform state isn't supported yet. In our Tailnet (we’re on the Premium plan), we already have 42 OAuth clients that were created before v0.20.0. It would be extremely helpful if we could bring those existing clients under Terraform management without having to recreate them manually.

Describe the solution you'd like

Support for importing existing Tailscale OAuth clients using terraform import and/or import blocks, so they can be managed as tailscale_oauth_client resources.

Being able to do this would make our setup more consistent, safer, and easier to manage going forward.

(Thank you for the great work on the Tailscale Terraform provider! It's been a huge help in automating and managing our Tailscale setup.)

[quatauta]

https://github.com/tailscale/terraform-provider-tailscale/blob/main/tailscale/resource_oauth_client.go#L24 mentions in a comment it would serve no purpose to support importing, because the key of an Oauth client is not returned by the API.

For us, it would provide great value to import existing Oauth clients into the terraform state. It would allow us keep track of the Oauth clients in our terraform .tf files (with comments for additional context). It would also allow us to more easily re-create or re-new OAuth clients in case of a compromised third-party services (using the Oauth client key) and manual-but-unintended deletion of a OAuth client.

[mcoulombe]

Hey @quatauta, we originally did not want to support imports for that resource because, without the sensitive key material, there's a risk that people reference the tailscale_oauth_client.key attribute from an imported client and end up breaking their authorization config.

We discussed it with the team and, since there are precedents for that scenario with other resource with sensitive material such as keys or webhooks, we'll add import support to tailscale_oauth_client for consistency.

We'll add more prominent disclaimers in the documentation of sensitive fields that are unset after an import to hopefully avoid any bad surprises.

[quatauta]

Thank you so much @mcoulombe! ❤

[mcoulombe]

@quatauta done!

It'll be available from version v0.21.0+ in a short moment. I started the release process; the new version with oauth client import support will be available soon.

As discussed and called out in the docs, the sensitive key material is unset after an import. So you must either refrain from referencing the field in other TF resources, or edit the statefile's 'key' field if you still have the original value on hand.