[Romsnacks]

Summary

CloudStack's VPC-to-VPC site-to-site VPN requires one of the two VPN connections to be passive: it waits for the other side to start the IPsec negotiation. cloudstack_vpn_connection had no way to set this, so a VPC-to-VPC tunnel could not be built with provider resources alone. People had to call createVpnConnection passive=true outside Terraform (e.g. cmk in a local-exec).

This PR adds an optional passive argument to cloudstack_vpn_connection:

• passive (bool, optional, default false). It is passed to createVpnConnection through SetPassive, which is already in cloudstack-go v2.19.1.
• It is ForceNew, because updateVpnConnection cannot change it.
• Read sets it from the API response, so drift detection and import pick it up.
• The acceptance test now makes one of its two VPC-to-VPC connections passive and checks the attribute on both.
• Docs are updated.

resource "cloudstack_vpn_connection" "cloud_to_site" {
  vpn_gateway_id      = cloudstack_vpn_gateway.cloud.id
  customer_gateway_id = cloudstack_vpn_customer_gateway.cloud_to_site.id
  passive             = true
}

Testing

I tested this with OpenTofu against a real CloudStack zone, using two VPCs, two VPN gateways, two customer gateways, and one passive plus one active connection:

• apply created both connections. listVpnConnections returned passive: true for one and passive: false for the other.
• A second plan showed no changes.
• After state rm and import, the connection came back with passive = true and no changes planned.
• Changing passive planned a replacement.
• destroy was clean.

go build and go vet pass. I did not run the acceptance test suite (TF_ACC) in CI conditions.

How to test

• Acceptance test (needs a CloudStack with two VPCs allowed): TF_ACC=1 go test ./cloudstack -run TestAccCloudStackVPNConnection -v. _basic checks that passive is true on bar-foo and false on foo-bar.
• Manually: build two VPCs, each with a cloudstack_vpn_gateway and a cloudstack_vpn_customer_gateway pointing at the other one. Create one cloudstack_vpn_connection with passive = true and one without (depends_on the passive one). Then run cmk list vpnconnections filter=id,passive,state. Once a VM sends traffic across, the tunnel comes up as Connected.

Compatibility

Existing connections read passive = false by default, so nothing changes for them. If a connection was created passive outside Terraform, the next plan will show a replacement until passive = true is set in the config.

---

This PR was created with AI assistance (Claude Code). I reviewed the change and tested it against a live CloudStack environment.

🤖 Generated with Claude Code