release-v1.0.38 by yashwanthjammi · Pull Request #366 · citrix/terraform-provider-citrix

yashwanthjammi · 2026-07-17T18:53:01Z

New Features:

Added support for per-policy restricted_access_users on default_access_policies and custom_access_policies in the citrix_delivery_group resource. Mutually exclusive with citrix_delivery_group.restricted_access_users. Fixes [Feature] Delivery Group Advanced Access Policy Filters #359
Added support for OID for allow and block lists on delivery groups, applications, and application groups. Fixes [Bug] Not able to specify EntraID groups in the allow_list in the citrix_delivery_group #361
Added a configurable timeout block (create, update, delete, in minutes) to all hypervisor resource pool resources (Azure, AWS, Amazon WorkSpaces Core, GCP, Nutanix, SCVMM, vSphere, XenServer, OpenShift).
Added support for access_type=Full on citrix_cloud_admin_user with type=AdministratorGroup. Fixes [Feature] Admin group full-access property #364

Bugfixes:

Fixed citrix_delivery_groups with random catalogs failing to apply due to unsupported log off action values returned by the API.
Fixed import of PVS citrix_machine_catalog where the API returns provisioning type "PVS", which caused a schema validation failure on subsequent terraform plan. [Bug] Imported Machine Catalog Resource causes Invalid Attribute Value Match on terraform plan #363
Fixed "provider produced inconsistent result after apply" error when adding default_access_policies or custom_access_policies to a citrix_delivery_group resource that was previously managed without them.

Other Improvements:

Added support for importing Entra ID admins via the citrix_cloud_admin_user resource.
Added support in the onboarding script for citrix_cloud_admin_user, citrix_cloud_resource_location, citrix_cloud_saml_identity_provider, citrix_cloud_google_identity_provider, citrix_cloud_okta_identity_provider, and citrix_policy_set_v2 and its associated policy resources. [Feature] Add citrix_cloud and citrix_policy_set_v2 resources to the onboarding helper #353
Updated the onboarding script to place the generated .tf files and .tfstate in a subfolder.
Added the ability to re-run the onboarding script to capture additional resources.
Made the onboarding script more resilient to transient errors so it no longer fails on Citrix Cloud token rate limits when importing large sites.

Copilot

Pull request overview

This release branch update expands the provider’s feature surface (delivery group policy user filters, Entra ID OID identifiers, cloud admin onboarding/import, and configurable resource-pool timeouts) and includes several reliability fixes (import/idempotency, async-job handling, and schema/state consistency).

Changes:

Added OID (OID:/azuread/<object_id>) support across allow/block user lists (delivery groups, apps, app groups) and added per-policy restricted_access_users for delivery-group access policies.
Added configurable timeout { create, update, delete } blocks to hypervisor resource pool resources and updated docs/tests accordingly.
Improved onboarding script idempotency/re-run behavior and added cloud resource onboarding/import capabilities; added CITRIX_ACCESS_TOKEN seeding to reduce auth rate-limiting.

Reviewed changes

Copilot reviewed 53 out of 55 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/onboarding-helper/terraform.tf	Bumps required provider version for onboarding output.
scripts/onboarding-helper/terraform-onboarding.ps1	Adds re-run/idempotency, output folder, cloud onboarding, retries/backoff, and endpoint refactors.
scripts/onboarding-helper/README.md	Documents re-run behavior, output folder, updated provider requirements, and warnings.
main.go	Wires CLI `-debug` into util debug mode behavior.
internal/util/common.go	Adds Azure AD OID regex + OID-aware user refresh/identity completeness checks.
internal/util/planmodifiers/mark_unknown_if_no_prior_state.go	New plan modifier to avoid inconsistent results for new nested computed attrs.
internal/util/planmodifiers/mark_unknown_if_no_prior_state_test.go	Unit tests for the new plan modifier.
internal/provider/provider.go	Allows seeding a caller-supplied access token for cloud auth reuse.
internal/examples/resources/citrix_cloud_admin_user/resource.tf	Adds Azure AD admin-user example.
internal/daas/policies/policy_set_resource_model.go	Applies new plan modifier to nested computed IDs.
internal/daas/machine_catalog/machine_catalog_resource_model.go	Fixes/extends PVS provisioning type normalization.
internal/daas/image_definition/image_version_resource.go	Improves async failure handling to avoid orphaning failed image versions.
internal/daas/hypervisor_resource_pool/hypervisor_resource_pool_common.go	Introduces shared timeout schema + plumbs timeouts into async job waits.
internal/daas/hypervisor_resource_pool/azure_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/aws_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/amazon_workspaces_core_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/gcp_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/nutanix_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/openshift_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/scvmm_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/vsphere_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/xenserver_hypervisor_resource_pool_resource.go	Uses configurable timeouts for create/update/delete.
internal/daas/hypervisor_resource_pool/*_resource_model.go	Adds `timeout` attribute to resource pool schemas.
internal/test/hypervisor_resource_pool_test.go	Extends vSphere resource-pool tests to validate timeout config.
internal/daas/delivery_group/delivery_group_utils.go	Adds per-policy user filters; improves autoscale normalization; preserves OID-only identity users.
internal/daas/delivery_group/delivery_group_resource.go	Validates mutual exclusivity of DG-level vs per-policy `restricted_access_users`.
internal/daas/delivery_group/delivery_group_resource_model.go	Adds per-policy schema + updates validators/docs strings to include OID format.
internal/daas/application/application_resource_model.go	Updates user-list validator/docs to include OID format.
internal/daas/application/application_group_resource_model.go	Updates user-list validator/docs to include OID format.
internal/citrixcloud/admin_user/admin_user_resource.go	Extends validation to support AzureAd users + tightens group provider-type validation.
internal/citrixcloud/admin_user/admin_user_resource_model.go	Makes service-name validation debug-relaxable; ensures external IDs populate on import.
docs/resources/delivery_group.md	Documents per-policy user filters and OID format.
docs/resources/application.md	Documents OID format for user lists.
docs/resources/application_group.md	Documents OID format for user lists.
docs/resources/cloud_admin_user.md	Adds Azure AD admin-user example in docs.
docs/resources/azure_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/aws_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/amazon_workspaces_core_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/gcp_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/nutanix_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/openshift_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/scvmm_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/vsphere_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
docs/resources/xenserver_hypervisor_resource_pool.md	Documents new create/update/delete timeouts.
go.mod	Bumps citrix-daas-rest-go and several indirect deps.
go.sum	Updates checksums for dependency bumps.
.gitignore	Ignores default onboarding output folder.

+	// Only read per-policy user filters if the user had them set in state; otherwise the DG-level
+	// restricted_access_users covers this policy and we don't want to surface duplicated values here.
+	if !dgAccessPolicy.RestrictedAccessUsers.IsNull() {
+		if !accessPolicy.GetIncludedUserFilterEnabled() {
+			if attributes, err := util.ResourceAttributeMapFromObject(RestrictedAccessUsers{}); err == nil {
+				dgAccessPolicy.RestrictedAccessUsers = types.ObjectNull(attributes)
+			} else {
+				diagnostics.AddWarning("Error when creating null RestrictedAccessUsers", err.Error())
+			}
+			return dgAccessPolicy
+		}
+		users := util.ObjectValueToTypedObject[RestrictedAccessUsers](ctx, diagnostics, dgAccessPolicy.RestrictedAccessUsers)
+		users.AllowList = util.RefreshUsersList(ctx, diagnostics, users.AllowList, accessPolicy.GetIncludedUsers())
+		users.BlockList = util.RefreshUsersList(ctx, diagnostics, users.BlockList, accessPolicy.GetExcludedUsers())
+		dgAccessPolicy.RestrictedAccessUsers = util.TypedObjectToObjectValue(ctx, diagnostics, users)
+	}


+					upnMap[strings.ToLower(userPrincipalName)] = -1
+				}
+				_, exists = sidMap[strings.ToLower(userSid)]
+				if exists {
+					sidMap[strings.ToLower(userSid)] = -1
+				}


yashwanthjammi temporarily deployed to Go Test - Cloud - EU July 17, 2026 18:53 — with GitHub Actions Inactive

yashwanthjammi had a problem deploying to Go Test - OnPrem July 17, 2026 18:53 — with GitHub Actions Failure

yashwanthjammi requested review from AlanCitrix, aneeshk-citrix, Copilot, sourav-citrix and zhuolun-citrix July 17, 2026 18:53

Copilot started reviewing on behalf of yashwanthjammi July 17, 2026 18:53 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

yashwanthjammi had a problem deploying to Go Test - Cloud - EU July 17, 2026 18:58 — with GitHub Actions Failure

aneeshk-citrix previously approved these changes Jul 17, 2026

View reviewed changes

AlanCitrix previously approved these changes Jul 17, 2026

View reviewed changes

This was linked to issues Jul 17, 2026

[Feature] Add citrix_cloud and citrix_policy_set_v2 resources to the onboarding helper #353

Closed

[Bug] Imported Machine Catalog Resource causes Invalid Attribute Value Match on terraform plan #363

Closed

release-v1.0.38

1e32b0c

yashwanthjammi dismissed stale reviews from AlanCitrix and aneeshk-citrix via 1e32b0c July 20, 2026 14:45

yashwanthjammi force-pushed the release-v1.0.38 branch from 5aa2bb8 to 1e32b0c Compare July 20, 2026 14:45

yashwanthjammi temporarily deployed to Go Test - Cloud - EU July 20, 2026 14:45 — with GitHub Actions Inactive

yashwanthjammi had a problem deploying to Go Test - OnPrem July 20, 2026 14:45 — with GitHub Actions Failure

yashwanthjammi deployed to Go Test - Cloud - EU July 20, 2026 14:49 — with GitHub Actions Active

AlanCitrix approved these changes Jul 20, 2026

View reviewed changes

aneeshk-citrix approved these changes Jul 20, 2026

View reviewed changes

yashwanthjammi removed request for sourav-citrix and zhuolun-citrix July 20, 2026 17:51

yashwanthjammi merged commit d4c7549 into main Jul 20, 2026
6 of 7 checks passed

yashwanthjammi deleted the release-v1.0.38 branch July 20, 2026 18:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

release-v1.0.38 - #366

release-v1.0.38#366
yashwanthjammi merged 1 commit into
mainfrom
release-v1.0.38

yashwanthjammi commented Jul 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

yashwanthjammi commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

yashwanthjammi commented Jul 17, 2026 •

edited

Loading