docs/resources/pages_domain.md

+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "gitlab_pages_domain Resource - terraform-provider-gitlab"
+subcategory: ""
+description: |-
+  The gitlab_pages_domain resource allows connecting custom domains and TLS certificates in GitLab Pages.
+  Upstream API: GitLab REST API docs https://docs.gitlab.com/ee/api/pages_domains.html
+---
+
+# gitlab_pages_domain (Resource)
+
+The `gitlab_pages_domain` resource allows connecting custom domains and TLS certificates in GitLab Pages.
+
+**Upstream API**: [GitLab REST API docs](https://docs.gitlab.com/ee/api/pages_domains.html)
+
+## Example Usage
+
+```terraform
+# Example using auto_ssl_enabled, which uses lets encrypt to generate a certificate
+resource "gitlab_pages_domain" "this" {
+  project = 123
+  domain  = "example.com"
+
+  auto_ssl_enabled = true
+}
+
+# Example using a manually generated certificate and key
+resource "gitlab_pages_domain" "this" {
+  project = 123
+  domain  = "example.com"
+
+  key         = file("${path.module}/key.pem")
+  certificate = file("${path.module}/cert.pem")
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `domain` (String) The custom domain indicated by the user.
+- `project` (String) The ID or [URL-encoded path of the project](https://docs.gitlab.com/ee/api/index.html#namespaced-path-encoding) owned by the authenticated user.
+
+### Optional
+
+- `auto_ssl_enabled` (Boolean) Enables [automatic generation](https://docs.gitlab.com/ee/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.html) of SSL certificates issued by Let’s Encrypt for custom domains. When this is set to "true", certificate can't be provided.
+- `certificate` (String) The certificate in PEM format with intermediates following in most specific to least specific order.
+- `expired` (Boolean) Whether the certificate is expired.
+- `key` (String) The certificate key in PEM format.
+
+### Read-Only
+
+- `id` (String) The ID of this Terraform resource. In the format of `<project>:<domain>`.
+- `url` (String) The URL for the given domain.
+- `verification_code` (String, Sensitive) The verification code for the domain.
+- `verified` (Boolean) The certificate data.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# GitLab pages domain can be imported using an id made up of `projectId:domain` _without_ the http protocol, e.g.
+terraform import gitlab_pages_domain.this 123:example.com
+```

examples/resources/gitlab_pages_domain/import.sh

+# GitLab pages domain can be imported using an id made up of `projectId:domain` _without_ the http protocol, e.g.
+terraform import gitlab_pages_domain.this 123:example.com

examples/resources/gitlab_pages_domain/resource.tf

+# Example using auto_ssl_enabled, which uses lets encrypt to generate a certificate
+resource "gitlab_pages_domain" "this" {
+  project = 123
+  domain  = "example.com"
+
+  auto_ssl_enabled = true
+}
+
+# Example using a manually generated certificate and key
+resource "gitlab_pages_domain" "this" {
+  project = 123
+  domain  = "example.com"
+
+  key         = file("${path.module}/key.pem")
+  certificate = file("${path.module}/cert.pem")
+}
\ No newline at end of file

go.mod

@@ -6,21 +6,19 @@ require (
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
 	github.com/hashicorp/go-retryablehttp v0.7.2
 	github.com/hashicorp/terraform-plugin-framework v1.1.1
-	github.com/hashicorp/terraform-plugin-framework-validators v0.9.0
+	github.com/hashicorp/terraform-plugin-framework-validators v0.10.0
 	github.com/hashicorp/terraform-plugin-go v0.14.3
-	github.com/hashicorp/terraform-plugin-log v0.7.0
-	github.com/hashicorp/terraform-plugin-mux v0.8.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1
+	github.com/hashicorp/terraform-plugin-log v0.8.0
+	github.com/hashicorp/terraform-plugin-mux v0.9.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.25.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/onsi/gomega v1.26.0
-	github.com/xanzy/go-gitlab v0.79.1
+	github.com/onsi/gomega v1.27.0
+	github.com/xanzy/go-gitlab v0.80.2
 )
 
 require (
 	github.com/agext/levenshtein v1.2.2 // indirect
-	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/color v1.13.0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
@@ -28,16 +26,16 @@ require (
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.2.1 // indirect
+	github.com/hashicorp/go-hclog v1.4.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.8 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.4.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.15.0 // indirect
+	github.com/hashicorp/hc-install v0.5.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.16.1 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.17.3 // indirect
-	github.com/hashicorp/terraform-json v0.14.0 // indirect
+	github.com/hashicorp/terraform-json v0.15.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
 	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
@@ -53,11 +51,12 @@ require (
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
 	github.com/vmihailenco/tagparser v0.1.2 // indirect
 	github.com/zclconf/go-cty v1.12.1 // indirect
-	golang.org/x/crypto v0.0.0-20220517005047-85d78b3ac167 // indirect
-	golang.org/x/net v0.5.0 // indirect
+	golang.org/x/crypto v0.6.0 // indirect
+	golang.org/x/mod v0.7.0 // indirect
+	golang.org/x/net v0.6.0 // indirect
 	golang.org/x/oauth2 v0.3.0 // indirect
-	golang.org/x/sys v0.4.0 // indirect
-	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/sys v0.5.0 // indirect
+	golang.org/x/text v0.7.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90 // indirect

internal/provider/resource_gitlab_pages_domain.go

+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/helpers/validatordiag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/xanzy/go-gitlab"
+	"gitlab.com/gitlab-org/terraform-provider-gitlab/internal/provider/api"
+	"gitlab.com/gitlab-org/terraform-provider-gitlab/internal/provider/utils"
+)
+
+// Ensure the implementation satisfies the expected interfaces.
+var (
+	_ resource.Resource                = &gitlabPagesDomainResource{}
+	_ resource.ResourceWithConfigure   = &gitlabPagesDomainResource{}
+	_ resource.ResourceWithImportState = &gitlabPagesDomainResource{}
+)
+
+func init() {
+	registerResource(NewGitLabPagesDomainResource)
+}
+
+func NewGitLabPagesDomainResource() resource.Resource {
+	return &gitlabPagesDomainResource{}
+}
+
+type gitlabPagesDomainResource struct {
+	client *gitlab.Client
+}
+
+type gitLabPagesDomainResourceModel struct {
+	ID                 types.String `tfsdk:"id"`
+	Domain             types.String `tfsdk:"domain"`
+	Project            types.String `tfsdk:"project"`
+	AutoSslEnabled     types.Bool   `tfsdk:"auto_ssl_enabled"`
+	Key                types.String `tfsdk:"key"`
+	URL                types.String `tfsdk:"url"`
+	Verified           types.Bool   `tfsdk:"verified"`
+	VerificationString types.String `tfsdk:"verification_code"`
+	Certificate        types.String `tfsdk:"certificate"`
+	Expired            types.Bool   `tfsdk:"expired"`
+}
+
+// Metadata returns the resource name
+func (d *gitlabPagesDomainResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_pages_domain"
+}
+
+// Schema defines the schema for the resource
+func (d *gitlabPagesDomainResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: `The ` + "`gitlab_pages_domain`" + ` resource allows connecting custom domains and TLS certificates in GitLab Pages.
+
+**Upstream API**: [GitLab REST API docs](https://docs.gitlab.com/ee/api/pages_domains.html)`,
+
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Computed:            true,
+				MarkdownDescription: "The ID of this Terraform resource. In the format of `<project>:<domain>`.",
+				PlanModifiers:       []planmodifier.String{stringplanmodifier.UseStateForUnknown()},
+			},
+			"domain": schema.StringAttribute{
+				MarkdownDescription: "The custom domain indicated by the user.",
+				Required:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"project": schema.StringAttribute{
+				MarkdownDescription: "The ID or [URL-encoded path of the project](https://docs.gitlab.com/ee/api/index.html#namespaced-path-encoding) owned by the authenticated user.",
+				Required:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"auto_ssl_enabled": schema.BoolAttribute{
+				MarkdownDescription: `Enables [automatic generation](https://docs.gitlab.com/ee/user/project/pages/custom_domains_ssl_tls_certification/lets_encrypt_integration.html) of SSL certificates issued by Let’s Encrypt for custom domains. When this is set to "true", certificate can't be provided.`,
+				Optional:            true,
+				Computed:            true,
+				Validators: []validator.Bool{
+					autoSslEnabledValidator{},
+				},
+			},
+			"key": schema.StringAttribute{
+				MarkdownDescription: "The certificate key in PEM format.",
+				Optional:            true,
+			},
+			"url": schema.StringAttribute{
+				MarkdownDescription: "The URL for the given domain.",
+				Computed:            true,
+			},
+			"verified": schema.BoolAttribute{
+				MarkdownDescription: "The certificate data.",
+				Computed:            true,
+			},
+			"verification_code": schema.StringAttribute{
+				MarkdownDescription: "The verification code for the domain.",
+				Computed:            true,
+				Sensitive:           true,
+			},
+			"certificate": schema.StringAttribute{
+				MarkdownDescription: "The certificate in PEM format with intermediates following in most specific to least specific order.",
+				Optional:            true,
+				Computed:            true,
+			},
+			"expired": schema.BoolAttribute{
+				MarkdownDescription: "Whether the certificate is expired.",
+				Optional:            true,
+				Computed:            true,
+			},
+		},
+	}
+}
+
+// Configure adds the client implementation to the resource
+func (d *gitlabPagesDomainResource) Configure(_ context.Context, req resource.ConfigureRequest, _ *resource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	d.client = req.ProviderData.(*gitlab.Client)
+}
+
+func (d *gitlabPagesDomainResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	// Get plan information into our struct
+	var data gitLabPagesDomainResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Local variables for easier reference
+	projectID := data.Project.ValueString()
+
+	// Create our resource
+	options := &gitlab.CreatePagesDomainOptions{
+		Domain: gitlab.String(data.Domain.ValueString()),
+	}
+	if !data.AutoSslEnabled.IsNull() && !data.AutoSslEnabled.IsUnknown() {
+		options.AutoSslEnabled = gitlab.Bool(data.AutoSslEnabled.ValueBool())
+	}
+	if !data.Certificate.IsNull() && !data.Certificate.IsUnknown() {
+		options.Certificate = gitlab.String(data.Certificate.ValueString())
+	}
+	if !data.Key.IsNull() && !data.Key.IsUnknown() {
+		options.Key = gitlab.String(data.Key.ValueString())
+	}
+
+	pagesDomain, _, err := d.client.PagesDomains.CreatePagesDomain(projectID, options)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Error creating pages domain for project %s", data.Project),
+			err.Error(),
+		)
+		return
+	}
+
+	data.pagesDomainToStateModel(pagesDomain, projectID)
+
+	// Create the ID attribute (used for imports, among other things)
+	data.ID = types.StringValue(utils.BuildTwoPartID(&projectID, gitlab.String(data.Domain.ValueString())))
+
+	tflog.Debug(ctx, "created pages domain", map[string]interface{}{
+		"url": data.URL, "project": data.Project,
+	})
+
+	// Set our plan object into state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Read refreshes the Terraform state with the latest data.
+func (d *gitlabPagesDomainResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var data gitLabPagesDomainResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	projectID, domain, err := utils.ParseTwoPartID(data.ID.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Invalid resource ID format",
+			fmt.Sprintf("The resource ID '%s' has an invalid format. It should be '<project>:<domain>'. Error: %s", data.ID, err.Error()),
+		)
+		return
+	}
+
+	pagesDomain, _, err := d.client.PagesDomains.GetPagesDomain(projectID, domain)
+	if err != nil {
+		if api.Is404(err) {
+			tflog.Debug(ctx, "pages domain doesn't exist, removing from state", map[string]interface{}{
+				"url": data.URL, "project": data.Project,
+			})
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("GitLab API error occured", fmt.Sprintf("Unable to read pages domain details: %s", err.Error()))
+		return
+	}
+
+	data.pagesDomainToStateModel(pagesDomain, projectID)
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Updates updates the resource in-place.
+func (d *gitlabPagesDomainResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+
+	// Get data information into our struct
+	var data gitLabPagesDomainResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Update our resource
+	options := &gitlab.UpdatePagesDomainOptions{}
+	if !data.AutoSslEnabled.IsNull() && !data.AutoSslEnabled.IsUnknown() {
+		options.AutoSslEnabled = gitlab.Bool(data.AutoSslEnabled.ValueBool())
+	}
+	if !data.Certificate.IsNull() && !data.Certificate.IsUnknown() {
+		options.Certificate = gitlab.String(data.Certificate.ValueString())
+	}
+	if !data.Key.IsNull() && !data.Key.IsUnknown() {
+		options.Key = gitlab.String(data.Key.ValueString())
+	}
+
+	projectID := data.Project.ValueString()
+	pagesDomain, _, err := d.client.PagesDomains.UpdatePagesDomain(projectID, data.Domain.ValueString(), options)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Error creating pages domain for project %s", data.Project),
+			err.Error(),
+		)
+		return
+	}
+
+	data.pagesDomainToStateModel(pagesDomain, projectID)
+
+	// Create the ID attribute (used for imports, among other things)
+	data.ID = types.StringValue(utils.BuildTwoPartID(gitlab.String(data.Project.ValueString()), gitlab.String(data.Domain.ValueString())))
+
+	tflog.Debug(ctx, "updated pages domain", map[string]interface{}{
+		"url": data.URL, "project": data.Project,
+	})
+
+	// Set our plan object into state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Deletes removes the resource.
+func (d *gitlabPagesDomainResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var data gitLabPagesDomainResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	projectID, domain, err := utils.ParseTwoPartID(data.ID.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Invalid resource ID format",
+			fmt.Sprintf("The resource ID '%s' has an invalid format. It should be '<project>:<domain>'. Error: %s", data.ID, err.Error()),
+		)
+		return
+	}
+
+	if _, err := d.client.PagesDomains.DeletePagesDomain(projectID, domain); err != nil {
+		resp.Diagnostics.AddError(
+			"GitLab API Error occurred",
+			fmt.Sprintf("Unable to delete pages domain: %s", err.Error()),
+		)
+	}
+}
+
+func (r *gitlabPagesDomainResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
+
+func (r *gitLabPagesDomainResourceModel) pagesDomainToStateModel(pages *gitlab.PagesDomain, projectID string) {
+	// attributes from api response
+	r.Domain = types.StringValue(pages.Domain)
+	r.Project = types.StringValue(projectID)
+	r.AutoSslEnabled = types.BoolValue(pages.AutoSslEnabled)
+	r.URL = types.StringValue(pages.URL)
+	r.VerificationString = types.StringValue(pages.VerificationCode)
+	r.Verified = types.BoolValue(pages.Verified)
+	r.Expired = types.BoolValue(pages.Certificate.Expired)
+	r.Certificate = types.StringValue(pages.Certificate.Certificate)
+
+	// r.Key will always come from state, there is no API that exposes it.
+}
+
+// Create a validator that validates that "auto_ssl_enabled" only conflicts with certificate when
+// set to "true"
+type autoSslEnabledValidator struct{}
+
+func (v autoSslEnabledValidator) Description(ctx context.Context) string {
+	return `"certificate" can't be included when "auto_ssl_enabled" is set to true`
+}
+
+func (v autoSslEnabledValidator) MarkdownDescription(ctx context.Context) string {
+	return `"certificate" can't be included when "auto_ssl_enabled" is set to true`
+}
+
+func (v autoSslEnabledValidator) ValidateBool(ctx context.Context, req validator.BoolRequest, resp *validator.BoolResponse) {
+	// If nothing is configured for auto_ssl_enabled, skip validation because it can't conflict.
+	if req.ConfigValue.IsUnknown() || req.ConfigValue.IsNull() {
+		return
+	}
+
+	// This could be combined in the above "if" statement, but this makes it easier to read.
+	// We want to skip validation if "auto_ssl_enabled" is false, because then it shouldn't conflict.
+	if !req.ConfigValue.ValueBool() {
+		return
+	}
+
+	// We know "auto_ssl_enabled" is set to "true" at this point, so check if certificate is present, and add a diagnostic
+	// if it's present.
+	var data gitLabPagesDomainResourceModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if !data.Certificate.IsNull() {
+		resp.Diagnostics.Append(validatordiag.InvalidAttributeCombinationDiagnostic(
+			req.Path,
+			`"certificate" can't be included when "auto_ssl_enabled" is set to true`,
+		))
+	}
+
+}

internal/provider/resource_gitlab_pages_domain_test.go

+//go:build acceptance
+// +build acceptance
+
+package provider
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"gitlab.com/gitlab-org/terraform-provider-gitlab/internal/provider/api"
+	"gitlab.com/gitlab-org/terraform-provider-gitlab/internal/provider/testutil"
+)
+
+func TestAcc_GitlabPagesDomain_basic(t *testing.T) {
+
+	// Set up project environment.
+	project := testutil.CreateProject(t)
+	domain := fmt.Sprintf("%d.example.com", project.ID)
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		CheckDestroy:             testAcc_GitlabPagesDomain_CheckDestroy(project.ID, domain),
+		Steps: []resource.TestStep{
+			// Create a basic pages domain.
+			{
+				Config: fmt.Sprintf(`
+				resource "gitlab_pages_domain" "this" {
+					project     = %d
+					domain      = "%s"
+
+					auto_ssl_enabled = true
+				}`, project.ID, domain),
+
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "project"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "domain"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "auto_ssl_enabled"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "verified"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "url"),
+				),
+			},
+			// Verify upstream attributes with an import.
+			{
+				ResourceName:      "gitlab_pages_domain.this",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Add optional attributes
+			{
+				Config: fmt.Sprintf(`
+				resource "gitlab_pages_domain" "this" {
+					project     = %d
+					domain      = "%s"
+
+					auto_ssl_enabled = false
+					key              = file("${path.module}/testdata/key.pem")
+					certificate      = file("${path.module}/testdata/cert.pem")
+				}`, project.ID, domain),
+
+				// Check computed attributes.
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "expired"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "certificate"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "key"),
+				),
+			},
+			// Verify upstream attributes with an import.
+			{
+				ResourceName:            "gitlab_pages_domain.this",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"key"},
+			},
+			// Replace with a new domain
+			{
+				Config: fmt.Sprintf(`
+				resource "gitlab_pages_domain" "this" {
+					project     = %d
+					domain      = "replaced-%s"
+
+					auto_ssl_enabled = false
+					key              = file("${path.module}/testdata/key.pem")
+					certificate      = file("${path.module}/testdata/cert.pem")
+				}`, project.ID, domain),
+
+				// Check computed attributes.
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "project"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "domain"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "auto_ssl_enabled"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "verified"),
+					resource.TestCheckResourceAttrSet("gitlab_pages_domain.this", "url"),
+				),
+			},
+			// Verify upstream attributes with an import.
+			{
+				ResourceName:            "gitlab_pages_domain.this",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"key"},
+			},
+		},
+	})
+}
+
+func TestAcc_GitlabPagesDomain_conflictingError(t *testing.T) {
+
+	// Set up project environment.
+	project := testutil.CreateProject(t)
+	domain := fmt.Sprintf("%d.example.com", project.ID)
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		CheckDestroy:             testAcc_GitlabPagesDomain_CheckDestroy(project.ID, domain),
+		Steps: []resource.TestStep{
+			// Create a basic pages domain.
+			{
+				Config: fmt.Sprintf(`
+				resource "gitlab_pages_domain" "this" {
+					project     = %d
+					domain      = "%s"
+
+					// This will fail on purpose
+					auto_ssl_enabled = true
+					certificate      = file("${path.module}/testdata/cert.pem")
+				}`, project.ID, domain),
+
+				ExpectError: regexp.MustCompile(`"certificate" can't be included when "auto_ssl_enabled" is set to true`),
+			},
+		},
+	})
+}
+
+func testAcc_GitlabPagesDomain_CheckDestroy(projectID int, domain string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		_, _, err := testutil.TestGitlabClient.PagesDomains.GetPagesDomain(projectID, domain)
+		if err == nil {
+			return errors.New("Pages Domain still exists")
+		}
+		if !api.Is404(err) {
+			return fmt.Errorf("Error calling API to get the Pages Domain: %w", err)
+		}
+		return nil
+	}
+}

internal/provider/sdk/resource_gitlab_branch_protection.go

@@ -265,11 +265,11 @@ func resourceGitlabBranchProtectionUpdate(ctx context.Context, d *schema.Resourc
 
 	log.Printf("[DEBUG] update gitlab branch protection for project %s, branch %s", project, branch)
 
-	options := &gitlab.RequireCodeOwnerApprovalsOptions{
+	options := &gitlab.UpdateProtectedBranchOptions{
 		CodeOwnerApprovalRequired: &codeOwnerApprovalRequired,
 	}
 	featureNotAvailableError := diag.Errorf("feature unavailable: `code_owner_approval_required`, Premium or Ultimate license required.")
-	if _, err := client.ProtectedBranches.RequireCodeOwnerApprovals(project, branch, options, gitlab.WithContext(ctx)); err != nil {
+	if _, _, err := client.ProtectedBranches.UpdateProtectedBranch(project, branch, options, gitlab.WithContext(ctx)); err != nil {
 		// The user might be running a version of GitLab that does not support this feature.
 		// We enhance the generic 404 error with a more informative message.
 		if api.Is404(err) {

internal/provider/sdk/resource_gitlab_project_approval_rule.go

@@ -327,7 +327,7 @@ func expandProtectedBranchIDs(ids interface{}) *[]int {
 }
 
 func getAnyApproverRuleId(ctx context.Context, client *gitlab.Client, project string) (int, error) {
-	rules, _, err := client.Projects.GetProjectApprovalRules(project)
+	rules, _, err := client.Projects.GetProjectApprovalRules(project, &gitlab.GetProjectApprovalRulesListsOptions{})
 	if err != nil {
 		if api.Is404(err) {
 			tflog.Debug(ctx, `Project approval rules not found, skipping update for "any_approver" and creating instead.`, map[string]interface{}{

internal/provider/sdk/resource_gitlab_project_approval_rule_test.go

@@ -374,7 +374,7 @@ func testAccCheckGitlabProjectApprovalRuleExists(n string, projectApprovalRule *
 			return err
 		}
 
-		rules, _, err := testutil.TestGitlabClient.Projects.GetProjectApprovalRules(projectID)
+		rules, _, err := testutil.TestGitlabClient.Projects.GetProjectApprovalRules(projectID, &gitlab.GetProjectApprovalRulesListsOptions{})
 		if err != nil {
 			return err
 		}
@@ -393,7 +393,7 @@ func testAccCheckGitlabProjectApprovalRuleExists(n string, projectApprovalRule *
 func testAccCheckGitlabProjectApprovalRuleDestroy(pid interface{}) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		return InterceptGomegaFailure(func() {
-			rules, _, err := testutil.TestGitlabClient.Projects.GetProjectApprovalRules(pid)
+			rules, _, err := testutil.TestGitlabClient.Projects.GetProjectApprovalRules(pid, &gitlab.GetProjectApprovalRulesListsOptions{})
 			Expect(err).To(BeNil())
 			Expect(rules).To(BeEmpty())
 		})

internal/provider/testdata/cert.pem

+-----BEGIN CERTIFICATE-----
+MIIDazCCAlOgAwIBAgIUE+OkjU7uf8X5Y7EtAIIlUSTKNAAwDQYJKoZIhvcNAQEL
+BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzAyMDMyMDQxMzBaFw0zMzAx
+MzEyMDQxMzBaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQC60oT4rR3LwWXPRw4G+rkG2F0sHVWvC57Y/u03T/v5
+z9bFhy2aOq/218afDS0PQgjOJKQGnc3dce7eVyhn89vszu2rC+OjdbY1trgvRQZc
+xVvoWUsm16v4mc0VBew+dDeO2fpPSPk9uM/aRuW4PQVEs2+TkmxvRv3nemCPiYpM
+pKGQTyk1eur/WjW4if20wtwRr/F4hU2hXPlDWo3pnQbe9zhhsTlbwvyTo0cbreDw
+9hSk2Z28qD8CBGNIv4SB6nytiUrt4M3xwNtETbLK4w7I87R+NC8ZjVH5FZUgi6Ph
+yYAyDnQh45J+CKj4hrgPgsrWOgd4iwYblBNyDifT80wXAgMBAAGjUzBRMB0GA1Ud
+DgQWBBSzQyCBrJqmSrS7HAggie1nQZJPxDAfBgNVHSMEGDAWgBSzQyCBrJqmSrS7
+HAggie1nQZJPxDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCJ
+5YwM4mjHr149BrUXRJQwgUA4tltR8JJFJZ0Cdw3j7BrQn+55BAHDX8kQnCPULVQa
+icsWDomT94x6DjKTdlsj0ajoBr9QdbphDRMl443qo3iHs7eowCiV94q1v75LDR1g
++zd0BukLi06uInFwTp1SjrSSVyXRMGDRJ48vx07CLksfLtaxnTRhE6EDlBg4g4xc
+0Dp/+xc8M180mDO8rZ//fcMfGk1SABpOzLd+6Mnz0aNOfPS2A5cVIbe6tZ5LSITt
+SFHEP14ZEYEAMbY6Iw8Y8VPyYQv0n7P5v9LDRryNXpuU3WN/pXLw/wcqXjk7cUeq
+P0AUqYaqAJnwf+P+b9wl
+-----END CERTIFICATE-----

internal/provider/testdata/key.pem

+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC60oT4rR3LwWXP
+Rw4G+rkG2F0sHVWvC57Y/u03T/v5z9bFhy2aOq/218afDS0PQgjOJKQGnc3dce7e
+Vyhn89vszu2rC+OjdbY1trgvRQZcxVvoWUsm16v4mc0VBew+dDeO2fpPSPk9uM/a
+RuW4PQVEs2+TkmxvRv3nemCPiYpMpKGQTyk1eur/WjW4if20wtwRr/F4hU2hXPlD
+Wo3pnQbe9zhhsTlbwvyTo0cbreDw9hSk2Z28qD8CBGNIv4SB6nytiUrt4M3xwNtE
+TbLK4w7I87R+NC8ZjVH5FZUgi6PhyYAyDnQh45J+CKj4hrgPgsrWOgd4iwYblBNy
+DifT80wXAgMBAAECggEAK5SgYEJCCR38WfYBV691Khue4IOXUVYsoAIX5CdMaGIL
+f9ig0rGOCs8bDk9Mi5qj4zK48LIvK9FAH63FRzqjuwIqfxQu7hqvfqg5Hw3DBjEj
+13e9CDqXa061gIn5KjiCHVjMA2LKgZNzKUAQpoHVkMkq5gnqMasl37G0hMdY87et
+PgZaEoOJR0CSvo/W+i/wxW8YVea8r3u3kWaamCcKzASJq9M80y9KHhNSHdVfUBLB
+yr+pWDjdBgckqc9fEkCQ40Lndw3aoUCyrEQIq1idfhNsFcN0dE+TzNUvsPtRM9NO
+3UNVeZyjXb9mcV1caKX+x3S81SDU0FMXkJaL10/kAQKBgQDzHqr9TpYz2VqW8C7o
+QxUZl4KuSS6jNiL8qKHGDchbM5HPiE3Y5QCNb8RWqzRwfl5YN03jDd4bTi39fd+Q
+c1PciYfMJAs0Z52i3htHzZe7oMfx5NO/jtPIJRH9AxLIYyLc/MFROjEk0kUWlSlL
+sefUALmGSl1PweaYXud74SzbQQKBgQDEuFAKzIsIJfeu31qW0RPJ45tIMRh236HS
+lrvLfxolqDE0D/ZSSll0JAw3BIKYrcTZig4jk475hfP1P8FlOiHCPJdaLydsAfop
+lJG3OUmRvR7dGoXoYP7LZTYn4uFx0Eqx7zPn4Rj1mgjkwvMYZ78CZbgpIvcGCbRQ
+jCZUX5+JVwKBgQDLsJoZ+Emnzycy5rCmL+3xrxrx4qaMX8MYZECFqu5+WsqDUfPH
+ELZRyZ557p7U0UtCJbO/09KOlgW6KEeywq00TJXV1yz8DwPnfKbmlb3WmXJrnAg8
+qfGN8mEL1hNaiJShCbL91v9tli4EKZybqsZMvP6zIILlW9NTPdA73gCzAQKBgGa5
+ECLzeE5C9Tk9rKJAfyLXVYi3Cl1YnbnHuDylHFQ5pafYBfomlNuOz0oTctajNr2Z
+15RAQ1KM3j1ck3J2jpZM6YPQR7eguK7pw8V3hrExnmI6rV4Q+DvhmAvv72VtLPQJ
+QoN9CXmGe8po+mPuGNH5p9bjSTa/7oZ5CLLaVAZ1AoGAf24uTkgtxhDFTnOQjtis
+wghggnjZYLMeFDzSlg+88DGSfUlj1lOuvahKWLMvS5J3ug8+rCfW5+VxqWVAksqs
+HU7sbE9EZVrHnRkkccl7Bl0SUn3IAn9Mn3LmArD8PNvDmheVy2N19poKP4xbGbJC
+xnu6UqlgxsI7XtUZutvUmig=
+-----END PRIVATE KEY-----