Add admin_role and admin_role_attachment resources

Giannis Kepasrequested to merge
gitlab-community/gitlab-org/terraform-provider-gitlab:6842-read-admin-perms into main

What does this MR do?

Adds support for GitLab custom admin roles.

READ_ADMIN_* permissions were listed as valid enabled_permissions values on gitlab_member_role, but GitLab's GraphQL API always rejected them at runtime with Unknown permission: ..., since they belong to a separate admin-role mutation, not the member-role one.

Changes

  • New resource gitlab_admin_role: manages instance-wide custom admin roles (memberRoleAdminCreate/Update/Delete). No base_access_level/group_path, since admin roles aren't namespace-scoped. Self-managed only.
  • New resource gitlab_admin_role_attachment: assigns a gitlab_admin_role to a user (memberRoleToUserAssign). Note: the GitLab API has no query to look up a user's current admin role, so Read can only detect that the user or role was deleted, not that the assignment itself changed externally, documented in the resource description.
  • gitlab_member_role: removed READ_ADMIN_CICD, READ_ADMIN_GROUPS, READ_ADMIN_MONITORING, READ_ADMIN_PROJECTS, READ_ADMIN_SUBSCRIPTION, READ_ADMIN_USERS, READ_ADMIN_DASHBOARD from valid enabled_permissions (never worked, use gitlab_admin_role instead) and the associated dead SaaS-blocking code path.

How to test

resource "gitlab_admin_role" "auditor" {
  name                = "Auditor"
  enabled_permissions = ["READ_ADMIN_USERS", "READ_ADMIN_CICD"]
}

resource "gitlab_admin_role_attachment" "example" {
  user_id       = gitlab_user.example.id
  admin_role_id = gitlab_admin_role.auditor.id
}

Requires a self-managed Ultimate instance (GitLab 18.3+, custom admin roles GA).

Changelog: Feature

Closes #6842 (closed)

Merge request reports