Missing IMPORTED config_type support for Certificate resource - Incomplete TypeScript schema

[gcfialho]

Bug Report: OCI Certificates Management Certificate - Missing IMPORTED config_type support

---

🐛 Bug Description

The Pulumi OCI provider v3.9.0 has incomplete TypeScript schema for oci.certificatesmanagement.Certificate resource's certificateConfig property, preventing users from importing external certificates with config_type: "IMPORTED".

Issues Identified:

1. Missing TypeScript properties for IMPORTED certificates (certificatePem, privateKeyPem, certChainPem)
2. Runtime validation error rejecting IMPORTED config_type
3. Undocumented enum values for configType field (shown as generic string)
4. Feature parity gap with Terraform OCI provider v7.20.0 (which works correctly)

📦 Environment

• Pulumi Version: v3.x
• Pulumi OCI Provider: v3.9.0 (using Terraform OCI v7.20.0 upstream)
• Pulumi Terraform Bridge: v3.114.0
• Language: TypeScript/Node.js
• OS: macOS (Darwin 25.0.0)
• Node.js: v22.x

🔍 Root Cause Analysis

1. TypeScript Interface Incomplete

Inspected node_modules/@pulumi/oci/types/input.d.ts:

// Current Pulumi OCI v3.9.0 TypeScript definition
interface CertificateCertificateConfig {
    configType: pulumi.Input<string>;  // ❌ No enum values documented

    // Properties for ISSUED_BY_INTERNAL_CA
    certificateProfileType?: pulumi.Input<string>;
    csrPem?: pulumi.Input<string>;
    issuerCertificateAuthorityId?: pulumi.Input<string>;
    keyAlgorithm?: pulumi.Input<string>;
    signatureAlgorithm?: pulumi.Input<string>;
    subject?: pulumi.Input<CertificateCertificateConfigSubject>;
    subjectAlternativeNames?: pulumi.Input<...>;
    validity?: pulumi.Input<CertificateCertificateConfigValidity>;
    versionName?: pulumi.Input<string>;

    // ❌ MISSING: Properties for IMPORTED config_type
    // certificatePem?: pulumi.Input<string>;
    // privateKeyPem?: pulumi.Input<string>;
    // certChainPem?: pulumi.Input<string>;
    // privateKeyPemPassphrase?: pulumi.Input<string>;
}

Verified: Searched entire @pulumi/oci package - these properties do not exist anywhere.

2. Terraform OCI Provider Has Complete Schema

Source: https://docs.oracle.com/en-us/iaas/tools/terraform-provider-oci/7.0.0/docs/r/certificates_management_certificate.html

# Terraform OCI v7.20.0 - WORKS CORRECTLY ✅
resource "oci_certificates_management_certificate" "imported_cert" {
  compartment_id = var.compartment_id
  name           = "imported-certificate"

  certificate_config {
    config_type              = "IMPORTED"  # ✅ Valid value
    certificate_pem          = var.certificate_pem  # ✅ Property exists
    private_key_pem          = var.private_key_pem  # ✅ Property exists
    cert_chain_pem           = var.cert_chain_pem   # ✅ Property exists
    private_key_pem_passphrase = var.passphrase     # ✅ Property exists (optional)
  }
}

Valid config_type values in Terraform:

• IMPORTED ✅
• ISSUED_BY_INTERNAL_CA ✅
• MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA ✅

3. Documentation Issues

Pulumi Registry: https://www.pulumi.com/registry/packages/oci/api-docs/certificatesmanagement/certificate/

Problems:

• configType shown as generic string (no enum values listed)
• Properties certificatePem, privateKeyPem, certChainPem not documented
• No examples showing IMPORTED usage
• Users cannot discover valid config_type values

Expected: Documentation should show:

configType: "IMPORTED" | "ISSUED_BY_INTERNAL_CA" | "MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA"

🔬 Steps to Reproduce

1. Attempt to Use IMPORTED (TypeScript Error)

import * as oci from "@pulumi/oci";

const certificate = new oci.certificatesmanagement.Certificate("test-cert", {
  compartmentId: "ocid1.compartment.oc1...",
  name: "test-imported-certificate",
  certificateConfig: {
    configType: "IMPORTED",
    certificatePem: "-----BEGIN CERTIFICATE-----\n...",     // ❌ TS2322: Property does not exist
    privateKeyPem: "-----BEGIN PRIVATE KEY-----\n...",     // ❌ TS2322: Property does not exist
    certChainPem: "-----BEGIN CERTIFICATE-----\n...",      // ❌ TS2322: Property does not exist
  },
});

TypeScript Error:

error TS2322: Type '{ configType: string; certificatePem: string; privateKeyPem: string; }'
is not assignable to type 'Input<CertificateCertificateConfig>'.
  Object literal may only specify known properties, and 'certificatePem' does not exist
  in type 'Input<CertificateCertificateConfig>'.

2. Workaround with as any (Runtime Validation Error)

certificateConfig: {
  configType: "IMPORTED",
  certificatePem: testCertPem,
  privateKeyPem: testKeyPem,
  certChainPem: testChainPem,
} as any  // Bypass TypeScript validation

Runtime Error Observed:

error: oci:CertificatesManagement/certificate:Certificate resource 'test-cert' has a problem:
expected certificate_config.0.config_type to be one of
  ["ISSUED_BY_INTERNAL_CA" "MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA"],
got IMPORTED.
Examine values at 'test-cert.certificateConfig.configType'.

Note: This runtime error was encountered when attempting to use a custom ManagedCertificate component wrapper around the OCI resource. The provider explicitly rejects IMPORTED at runtime, not just at TypeScript compile time.

📊 Comparison: Terraform vs Pulumi

Feature	Terraform OCI v7.20.0	Pulumi OCI v3.9.0	Status
config_type: "IMPORTED"	✅ Supported	❌ Rejected	MISSING
certificate_pem property	✅ Exists	❌ Missing	MISSING
private_key_pem property	✅ Exists	❌ Missing	MISSING
cert_chain_pem property	✅ Exists	❌ Missing	MISSING
private_key_pem_passphrase	✅ Exists	❌ Missing	MISSING
Enum values in docs	✅ Documented	❌ Generic string	UNDOCUMENTED
Import external certs	✅ Works	❌ Impossible	BLOCKED

💡 Real-World Use Case: mTLS with External Certificates

Architecture Requirement:

Cloudflare Origin CA (15-year cert)
    ↓
OCI Certificates Service (IMPORTED)  ← ❌ BLOCKED BY THIS BUG
    ↓
Load Balancer Listener (certificateIds + trustedCertificateAuthorityIds)
    ↓
mTLS enabled ✅

Why IMPORTED is Critical:

OCI Load Balancer has two certificate storage options:

1. Load Balancer Certificate (uses certificateName alias)

   • ❌ Cannot use with mTLS (trustedCertificateAuthorityIds)
   • OCI API Error: TrustedCertificateAuthorityIds cannot be specified in conjunction with certificateAlias

2. OCI Certificates Service (uses certificateIds OCID)

   • ✅ Supports mTLS
   • ✅ Allows trustedCertificateAuthorityIds
   • ❌ Requires IMPORTED config_type for external certificates

Conclusion: Without IMPORTED support, mTLS with external certificates is impossible in Pulumi OCI.

🔍 Possible Root Cause: tfbridge Conditional Schema Fields

Related Issues in pulumi-terraform-bridge:

1. #2618 - "Optional properties with ConflictsWith and defaults expected to be null"
2. Update GitHub Actions workflows. #493 - "Computed nested properties should not be included on input interfaces"
3. Expose ConflictsWith, ExactlyOneOf, AtLeastOneOf & RequiredWith attribute values in the schema hashicorp/terraform#28657 - "Expose ConflictsWith, ExactlyOneOf, AtLeastOneOf in schema"

Working Hypothesis:

The Terraform OCI provider likely uses conditional schema fields (such as ConflictsWith or ExactlyOneOf constraints) to define mutually exclusive property sets for each config_type:

• IMPORTED → requires: certificate_pem, private_key_pem, cert_chain_pem
• ISSUED_BY_INTERNAL_CA → requires: issuer_certificate_authority_id, subject, etc.

Possible explanation: If pulumi-terraform-bridge doesn't fully handle these conditional field relationships during schema generation, it may only emit properties for one variant (ISSUED_BY_INTERNAL_CA), inadvertently omitting IMPORTED-specific properties.

This would explain why:

• ✅ TypeScript interface is missing IMPORTED properties
• ✅ Runtime validation rejects IMPORTED value
• ✅ Terraform (upstream) works correctly

✅ Proposed Solution

1. Fix TypeScript Schema Generation

Update CertificateCertificateConfig interface to include ALL properties from Terraform provider:

interface CertificateCertificateConfig {
    configType: pulumi.Input<"IMPORTED" | "ISSUED_BY_INTERNAL_CA" | "MANAGED_EXTERNALLY_ISSUED_BY_INTERNAL_CA">;

    // Properties for IMPORTED
    certificatePem?: pulumi.Input<string>;
    privateKeyPem?: pulumi.Input<string>;
    certChainPem?: pulumi.Input<string>;
    privateKeyPemPassphrase?: pulumi.Input<string>;

    // Properties for ISSUED_BY_INTERNAL_CA
    certificateProfileType?: pulumi.Input<string>;
    csrPem?: pulumi.Input<string>;
    issuerCertificateAuthorityId?: pulumi.Input<string>;
    // ... rest of existing properties
}

2. Fix Runtime Validation

Ensure provider accepts IMPORTED config_type at runtime (currently hardcoded to reject it).

3. Update Documentation

• Show configType as enum with all valid values
• Document IMPORTED-specific properties
• Add example for importing external certificates

4. Investigate tfbridge Conditional Fields

Check if pulumi-terraform-bridge properly handles:

• ConflictsWith relationships
• ExactlyOneOf constraints
• Conditional schema properties

🔧 Current Workaround (Not Ideal)

Hybrid Terraform + Pulumi:

# 1. Use Terraform to import certificate
cd terraform-cert-import
terraform apply

# 2. Get OCID and pass to Pulumi
CERT_OCID=$(terraform output -raw certificate_id)
pulumi config set certificateOcid "$CERT_OCID"

# 3. Reference in Pulumi
pulumi up

Problems:

• ❌ Requires maintaining two IaC tools
• ❌ Manual certificate rotation
• ❌ Complex deployment workflow
• ❌ Defeats purpose of using Pulumi

📊 Impact

This bug affects:

• ✅ Cloudflare Origin CA integration with OCI
• ✅ Let's Encrypt certificate imports
• ✅ Any external CA certificate imports (commercial CAs, corporate CAs, etc.)
• ✅ mTLS configurations on OCI Load Balancers
• ✅ Users migrating from Terraform to Pulumi (feature regression)

📎 Additional Context

Versions Confirmed:

• Pulumi OCI v3.9.0 uses Terraform OCI v7.20.0 (per recent releases)
• Terraform OCI has supported IMPORTED since at least v7.0.0
• Gap exists for 20+ upstream versions

Testing Availability:

I'm available to:

• ✅ Test any fixes
• ✅ Provide complete reproduction code
• ✅ Validate against real-world mTLS architecture
• ✅ Confirm Cloudflare Origin CA integration works

Related Documentation:

• OCI Certificates Service - Importing Certificates
• Terraform OCI Provider - Certificate Resource
• Pulumi OCI - Certificate Resource

🙏 Thank You

This is a critical blocker for implementing production-grade mTLS with external certificates on OCI via Pulumi.

The bug has existed across multiple provider versions without being reported, suggesting many users may be:

• Unaware IMPORTED should work (undocumented enum values)
• Working around it with hybrid Terraform
• Blocked from migrating to Pulumi

Any help resolving this would be greatly appreciated! 🚀

---

Labels: bug, schema, certificates, provider/oci, tfbridge
Priority: High (blocks mTLS implementation, feature parity gap with Terraform)

[guineveresaenger]

hi @GuilhermeCF10 - thank you so much for filing this detailed issue. It really helps to have context and hear your thoughts.

We'll be looking into this as soon as we can. Thank you for your patience.