Add support for synthetics global parameters (#1155)

* Add support for synthetics global parameters

This adds support for creating synthetics global parameters, which are
used to store secrets used for synthetics monitors.

This implementation is based on what we already do for synthetics
private locations. This is mostly just a simple wrapper around API
calls, except we currently requery the resource after creating it or
updating it. This is because Kibana (at least in 9.0.0) has some
unexpected responses for /api/synthetics/params:

1. The POST request to create a parameter does not include the `value`
   field in the response.
2. The PUT request to update a parameter returns the new values for all
   fields, except for `value`, which contains the old secret.
3. None of the responses include the `share_across_spaces` value, which
   can only be inferred by checking of `namespaces` is `["*"]`.

We also use the undocumented `DELETE /api/synthetics/params` API that
the Kibana UI uses due to many quirks with the deletion APIs in various
versions of Kibana. I tested every single version of Kibana since the
parameter APIs were introduced (8.12.0) and this one is the only one
that works on all versions.

* `DELETE /api/synthetics/params/<id>` (from documentation)
    - Works on >=8.17.0.
    - HTTP 404 on 8.12.x through 8.16.x.
* `DELETE /api/synthetics/params/_bulk_delete` (from documentation)
    - HTTP 400 on 9.0.x with error message about URL parameters and body
      provided at the same time (`_bulk_delete` interpreted as parameter
      ID?).
    - HTTP 403 on 8.18.x with error message about missing `uptime-read` and
      `uptime-write` permissions despite having the `superuser` role.
    - HTTP 403 with no details on 8.17.x.
    - HTTP 404 on 8.12.x through 8.16.x.
* `POST /api/synthetics/params/_bulk_delete` (from comment in documentation
  example)
    - Works on >=8.17.0.
    - HTTP 404 on 8.12.x through 8.16.x.
* `DELETE /api/synthetics/params` (what the Kibana UI does)
    - Works on >=8.12.0.

Finally, this updates the Github Actions workflow to run the tests using
HTTP basic auth instead of API keys. On all versions of Kibana, the
params endpoint fails to return the current value when using API keys,
even if permissions are not restricted for the key. Explicitly granting
the key all permissions to Kibana does not work either.

Fixes: #1152

Signed-off-by: Andrew Gunnerson <andrew.gunnerson@elastic.co>

* synthetics/parameter: Remove duplicate code when rereading in create/update

Signed-off-by: Andrew Gunnerson <andrew.gunnerson@elastic.co>

* synthetics/parameter: Switch to using OAPI client

Co-Authored-By: Toby Brain <toby.brain@elastic.co>
Signed-off-by: Andrew Gunnerson <andrew.gunnerson@elastic.co>

* Changelog

---------

Signed-off-by: Andrew Gunnerson <andrew.gunnerson@elastic.co>
Co-authored-by: Toby Brain <toby.brain@elastic.co>

Author: agunnerson-elastic

.github/workflows/test.yml

@@ -179,4 +179,5 @@ jobs:
           ELASTICSEARCH_USERNAME: "elastic"
           ELASTICSEARCH_PASSWORD: ${{ env.ELASTIC_PASSWORD }}
           KIBANA_ENDPOINT: "http://localhost:5601"
-          KIBANA_API_KEY: ${{ steps.get-api-key.outputs.apikey }}
+          KIBANA_USERNAME: "elastic"
+          KIBANA_PASSWORD: ${{ env.ELASTIC_PASSWORD }}

CHANGELOG.md

@@ -4,6 +4,7 @@
 - Migrate `elasticstack_elasticsearch_system_user` resource to Terraform plugin framework ([#1154](https://github.com/elastic/terraform-provider-elasticstack/pull/1154))
 - Add custom `endpoint` configuration support for snapshot repository setup ([#1158](https://github.com/elastic/terraform-provider-elasticstack/pull/1158))
 - Add `description` to `elasticstack_kibana_security_role` ([#1172](https://github.com/elastic/terraform-provider-elasticstack/issues/1172))
+- Add `elasticstack_kibana_synthetics_parameter` resource ([#1155](https://github.com/elastic/terraform-provider-elasticstack/pull/1155))
 
 ## [0.11.15] - 2025-04-23
 
@@ -425,7 +426,8 @@
 - Initial set of docs
 - CI integration
 
-[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.14...HEAD
+[Unreleased]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.15...HEAD
+[0.11.15]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.14...v0.11.15
 [0.11.14]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.13...v0.11.14
 [0.11.13]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.12...v0.11.13
 [0.11.12]: https://github.com/elastic/terraform-provider-elasticstack/compare/v0.11.11...v0.11.12

docs/resources/kibana_synthetics_parameter.md

@@ -0,0 +1,54 @@
+---
+subcategory: "Kibana"
+layout: ""
+page_title: "Elasticstack: elasticstack_kibana_synthetics_parameter Resource"
+description: |-
+  Creates or updates a Kibana synthetics parameter.
+---
+
+# Resource: elasticstack_kibana_synthetics_parameter
+
+Creates or updates a Kibana synthetics parameter.
+See [Working with secrets and sensitive values](https://www.elastic.co/docs/solutions/observability/synthetics/work-with-params-secrets)
+and [API docs](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-synthetics)
+
+## Example Usage
+
+```terraform
+provider "elasticstack" {
+  kibana {}
+}
+
+resource "elasticstack_kibana_synthetics_parameter" "example" {
+  key         = "example_key"
+  value       = "example_value"
+  description = "Example description"
+  tags        = ["tag-a", "tag-b"]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key` (String) The key of the parameter.
+- `value` (String, Sensitive) The value associated with the parameter.
+
+### Optional
+
+- `description` (String) A description of the parameter.
+- `share_across_spaces` (Boolean) Whether the parameter should be shared across spaces.
+- `tags` (List of String) An array of tags to categorize the parameter.
+
+### Read-Only
+
+- `id` (String) Generated id for the parameter.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import elasticstack_kibana_synthetics_parameter.my_param <space id>/<param_id>
+```

examples/resources/elasticstack_kibana_synthetics_parameter/import.sh

@@ -0,0 +1 @@
+terraform import elasticstack_kibana_synthetics_parameter.my_param <space id>/<param_id>

examples/resources/elasticstack_kibana_synthetics_parameter/resource.tf

@@ -0,0 +1,10 @@
+provider "elasticstack" {
+  kibana {}
+}
+
+resource "elasticstack_kibana_synthetics_parameter" "example" {
+  key         = "example_key"
+  value       = "example_value"
+  description = "Example description"
+  tags        = ["tag-a", "tag-b"]
+}