Refactor Terraform credential loading

[hugoShaka]

Fixes #42437

This PR refactors Terraform's credential loading to stop YOLO-ing all the credentials into the client and praying that one of them works.

Now each credential is individually tested. Terraform also lists the supported credentials and can explain why a credential is active or not.

This change will open the way for 2 other changes:

• have Terraform check if credentials are expired and warn the user
• have Terraform support MachineID joining

Other notable changes are:

• introduce a new KeyPair() function that builds a credential from DER material. This is neeed as creds built from tls.Config don't allow to report the expiry.
• use terraform-plugin-log to provide structured logging. We'll be able to tell the users to diagnose with export TF_LOG=INFO

Changelog: clearer terraform-provider error and warning messages about its credentials.

Example output

No credential source

╷
│ Error: No active credentials source found
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│  - cannot read credentials from Key, Cert, and CA path because neither cert_path, key_path, TF_TELEPORT_CERT, nor TF_TELEPORT_KEY are set
│  - cannot read credentials from Key, Cert, and CA base64 because neither cert_base64, key_base64, TF_TELEPORT_CERT_BASE64, nor TF_TELEPORT_KEY_BASE64 are set
│  - cannot read credentials from the identity file path because neither identity_file_path, nor TF_TELEPORT_IDENTITY_FILE_PATH are set
│  - cannot read credentials from the identity file (passed as a string) because neither identity_file, nor TF_TELEPORT_IDENTITY_FILE are set
│  - cannot read credentials from the identity file (passed as a base64-encoded string) because neither identity_file_base64, nor TF_TELEPORT_IDENTITY_FILE_BASE64 are set
│  - cannot read credentials from the local profile because neither profile_name, profile_dir, TF_TELEPORT_PROFILE_NAME, nor TF_TELEPORT_PROFILE_PATH are set
│ 

Expired credentials

│ Warning: Credentials from the identity file (passed as a base64-encoded string) are expired
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│ The credentials from the identity file (passed as a base64-encoded string) are expired. Expiration is "2024-07-16 12:57:13 -0400 EDT" while current time is "2024-07-16
│ 12:57:37.066592 -0400 EDT"). You might need to refresh them. The provider will not attempt to use those credentials.
╵
╷
│ Error: Impossible to build Teleport client
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│ Every credential source provided has failed. The Terraform cannot connect to the Teleport cluster '0.0.0.0:3025'.
│ 
│ We tried building a client:
│  - from the identity file (passed as a base64-encoded string)
│ 
│ You can find more information about each credential source specific errors in the Terraform warnings above this error.
╵

Failed to build credentials

╷
│ Error: Failed to build credentials from the identity file (passed as a base64-encoded string)
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│ The Terraform provider tried to build credentials from the identity file (passed as a base64-encoded string) but received the following error:
│ 
│ decoding base64 identity file
│       illegal base64 data at input byte 4
│ 
│ The provider tried to use the credential source because either identity_file_base64, or TF_TELEPORT_IDENTITY_FILE_BASE64 are set. You must either address the error or
│ disable the credential source by removing its values.
╵

Failed to connect (teleport not running)

╷
│ Warning: Failed to connect with credentials from the identity file (passed as a base64-encoded string)
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│ The client built from the credentials from the identity file (passed as a base64-encoded string) failed to connect to "0.0.0.0:3025" with the error: all connection methods
│ failed
│       
│       failed to connect to addr 0.0.0.0:3025 as a web proxy
│               context deadline exceeded: connection error: desc = "transport: Error while dialing: failed to dial: Get \"https://0.0.0.0:3025/webapi/find\": dial tcp 0.0.0.0:3025:
│ connect: connection refused", 
│       failed to connect to addr 0.0.0.0:3025 as a reverse tunnel proxy
│               context deadline exceeded: connection error: desc = "transport: Error while dialing: failed to dial: dial tcp 0.0.0.0:3025: connect: connection refused", 
│       failed to connect to addr 0.0.0.0:3025 as an auth server
│               context deadline exceeded: connection error: desc = "transport: Error while dialing: failed to dial: dial tcp 0.0.0.0:3025: connect: connection refused", 
│       failed to connect to addr 0.0.0.0:3025 with TLS Routing with ALPN connection upgrade dialer
│               context deadline exceeded: connection error: desc = "transport: Error while dialing: failed to dial: Get \"https://0.0.0.0:3025/webapi/find\": dial tcp 0.0.0.0:3025:
│ connect: connection refused", 
│       failed to connect to addr 0.0.0.0:3025 with TLS Routing dialer
│               context deadline exceeded: connection error: desc = "transport: Error while dialing: failed to dial: Get \"https://0.0.0.0:3025/webapi/find\": dial tcp 0.0.0.0:3025:
│ connect: connection refused".
╵
╷
│ Error: Impossible to build Teleport client
│ 
│   with provider["terraform.releases.teleport.dev/gravitational/teleport"],
│   on main.tf line 11, in provider "teleport":
│   11: provider "teleport" {
│ 
│ Every credential source provided has failed. The Terraform cannot connect to the Teleport cluster '0.0.0.0:3025'.
│ 
│ We tried building a client:
│  - from the identity file (passed as a base64-encoded string)
│ 
│ You can find more information about each credential source specific errors in the Terraform warnings above this error.
╵

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[hugoShaka]

@marcoandredinis I addressed all your feedback and also caught a breaking change: the provider used to fallback to the local profile when no credential is specified. This makes everything super slow but I can't just break this in v16. I implemented a backward compatible behaviour in this PR and will remove it in v17.

[github-actions]

🤖 Vercel preview here: https://docs-itxc1qiny-goteleport.vercel.app/docs/ver/preview

[public-teleport-github-review-bot]

@hugoShaka See the table below for backport results.

Branch	Result
branch/v16	Failed