Preserve comments in acl file

[clstokes]

Is your feature request related to a problem? Please describe.
The tailscale_acl standardizes the acl input which removes all comments in the file.

Describe the solution you'd like
It would be helpful to preserve comments in the ACL file to help Tailscale admins better understand the ACL output in the Admin Console.

Example

This ACL resource:

resource "tailscale_acl" "sample_acl" {
  acl = <<EOF
{
	// Access control lists.
	"acls": [
		// default allow allow
		{"action": "accept", "src": ["*"], "dst": ["*:*"]},
	],
}
EOF
}

Becomes this in the admin console:

{
	"acls": [
		{
			"action": "accept",
			"src": [
				"*"
			],
			"dst": [
				"*:*"
			]
		}
	]
}

[porkcharsui]

Using tailscale_acl within a CI workflow is akin to the Tailscale GitOps tool.

Perhaps the ask here is having the Terraform provider use the same parsing design as the GitOps tool, which uses github.com/tailscale/hujson not encoding/json. This ensures that all HuJSON comments are preserved.

[markwellis]

perhaps a good middle ground would be to add a name attribute to acl rules? Which would also solve another problem I have:

I read the ACL policy via the api, then merge specific parts over the top to programmatically add rules. If there was a name attribute this would also allow me to programmatically remove rules via terraform too, which is not something I can't do at the moment.

[knyar]

Based on a brief internal discussion, we think a reasonable way forward would be to add a new field to the tailscale_acl resource that will accept the ACL content as a HuJSON string.

To simplify ongoing maintenance related to keeping the ACL schema in sync between Tailscale management plane and the Terraform provider, the contents of this field will not be parsed or interpreted by the provider. It will be validated against the validate ACL API endpoint, and will be written verbatim as HuJSON, with all comments and markup preserved.

We're planning to call this field raw to indicate lack of local validation. Users of the Terraform provider will be expected to either set the acl field (JSON string, validated offline and re-encoded) or the raw field (HuJSON string, passed verbatim to the API), but not both.

Please comment on this issue if you have any feedback on this.

[markwellis]

How would one work with HuJSON in terraform though?

jsondecode will either error on the comments, or remove them, which means this can't be used in a way that preserves the comments unless you only use it a string?

[alexeiser]

How would one work with HuJSON in terraform though?

jsondecode will either error on the comments, or remove them, which means this can't be used in a way that preserves the comments unless you only use it a string?

We would use a templated string - as mentioned in the earlier comment - it would still be validated on the tailscale api endpoint - but could potentially not be valid hujson.