Support SSL certificates directly, not as paths

[wosc]

For example when working with cloud databases, we usually have the SSL certificate material available directly as terraform variables (e.g. google_sql_database_instance.mydb.server_ca_cert.0.cert). Currently, we have to write those to temporary files first to configure the postgresql provider, which works (see example below), but is inconvenient and seems extraneous, even if it had better support. The lib/pq library added support for passing SSL material directly in v1.10.0. It would be great if the provider supported this mode of configuration as well.

Configuring SSL with local_sensitive_file

provider "postgresql" {
  host = ...
  database = ...
  username = ...
  password = ...
  sslmode = "verify-ca"
  clientcert {
    cert = local_sensitive_file.mydb_client_cert.filename
    key  = local_sensitive_file.mydb_client_key.filename
  }
  sslrootcert = local_sensitive_file.mydb_server_ca_cert.filename
}

resource "local_sensitive_file" "mydb_client_cert" {
  filename = "${path.root}/.terraform/tmp/${google_sql_database_instance.mydb.name}_client_cert"
  content = google_sql_ssl_cert.mydb_client.cert
}
resource "local_sensitive_file" "mydb_client_key" {
  filename = "${path.root}/.terraform/tmp/cloudsql_${google_sql_database_instance.mydb.name}_client_key"
  content = google_sql_ssl_cert.mydb_client.private_key
}
resource "local_sensitive_file" "cloudsql_main_production_pg14_server_ca_cert" {
  filename = "${path.root}/.terraform/tmp/${google_sql_database_instance.mydb.name}_server_ca_cert"
  content = google_sql_database_instance.mydb.server_ca_cert.0.cert
}

[dindurthy]

@wosc Does that workaround succeed in a CI context when terraform init might be run from scratch? Once terraform has a postgresql resource in state, I believe it will be unable to plan from a clean terraform init. In my testing, assuming I've not erred, the first apply succeeds but a subsequent plan/apply with a cleanly initialized .terraform fails for postgresql resources in state.

[wosc]

To be quite honest, I don't really know. We've actually abandoned trying to make this work for now, because it caused too many problems. I think the concrete breaking point was some breakage when using it with atlantis, but the issue you're describing does not sound unlikely to me either.

[Mart-Bogdan]

This seems to be already merged, so this issue can be closed.