chore(objectstorage): add retry on 429 for objectstorage control plane

Signed-off-by: Mauritz Uphoff <mauritz.uphoff@stackit.cloud>

Author: h3adex

docs/data-sources/objectstorage_bucket.md

@@ -4,12 +4,15 @@ page_title: "stackit_objectstorage_bucket Data Source - stackit"
 subcategory: ""
 description: |-
   ObjectStorage bucket data source schema. Must have a region specified in the provider configuration.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_bucket (Data Source)
 
 ObjectStorage bucket data source schema. Must have a `region` specified in the provider configuration.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

docs/data-sources/objectstorage_credential.md

@@ -4,12 +4,15 @@ page_title: "stackit_objectstorage_credential Data Source - stackit"
 subcategory: ""
 description: |-
   ObjectStorage credential data source schema. Must have a region specified in the provider configuration.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_credential (Data Source)
 
 ObjectStorage credential data source schema. Must have a `region` specified in the provider configuration.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

docs/data-sources/objectstorage_credentials_group.md

@@ -4,12 +4,15 @@ page_title: "stackit_objectstorage_credentials_group Data Source - stackit"
 subcategory: ""
 description: |-
   ObjectStorage credentials group data source schema. Must have a region specified in the provider configuration.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_credentials_group (Data Source)
 
 ObjectStorage credentials group data source schema. Must have a `region` specified in the provider configuration.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

docs/resources/objectstorage_bucket.md

@@ -5,6 +5,7 @@ subcategory: ""
 description: |-
   ObjectStorage bucket resource schema. Must have a region specified in the provider configuration.
   ~> This resource cannot be destroyed if the bucket contains objects. Please ensure the bucket is empty before attempting to destroy it.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_bucket (Resource)
@@ -13,6 +14,8 @@ ObjectStorage bucket resource schema. Must have a `region` specified in the prov
 
 ~> This resource cannot be destroyed if the bucket contains objects. Please ensure the bucket is empty before attempting to destroy it.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

docs/resources/objectstorage_credential.md

@@ -4,12 +4,15 @@ page_title: "stackit_objectstorage_credential Resource - stackit"
 subcategory: ""
 description: |-
   ObjectStorage credential resource schema. Must have a region specified in the provider configuration.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_credential (Resource)
 
 ObjectStorage credential resource schema. Must have a `region` specified in the provider configuration.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

docs/resources/objectstorage_credentials_group.md

@@ -4,12 +4,15 @@ page_title: "stackit_objectstorage_credentials_group Resource - stackit"
 subcategory: ""
 description: |-
   ObjectStorage credentials group resource schema. Must have a region specified in the provider configuration.
+  -> Note: States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
 ---
 
 # stackit_objectstorage_credentials_group (Resource)
 
 ObjectStorage credentials group resource schema. Must have a `region` specified in the provider configuration.
 
+-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.
+
 ## Example Usage
 
 ```terraform

stackit/internal/services/objectstorage/bucket/datasource.go

@@ -60,7 +60,8 @@ func (r *bucketDataSource) Configure(ctx context.Context, req datasource.Configu
 // Schema defines the schema for the data source.
 func (r *bucketDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
 	descriptions := map[string]string{
-		"main":                     "ObjectStorage bucket data source schema. Must have a `region` specified in the provider configuration.",
+		"main": "ObjectStorage bucket data source schema. Must have a `region` specified in the provider configuration.\n\n" +
+			"-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.",
 		"id":                       "Terraform's internal data source identifier. It is structured as \"`project_id`,`region`,`name`\".",
 		"name":                     "The bucket name. It must be DNS conform.",
 		"project_id":               "STACKIT Project ID to which the bucket is associated.",
@@ -130,7 +131,11 @@ func (r *bucketDataSource) Read(ctx context.Context, req datasource.ReadRequest,
 	ctx = tflog.SetField(ctx, "name", bucketName)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	bucketResp, err := r.client.DefaultAPI.GetBucket(ctx, projectId, region, bucketName).Execute()
+	bucketResp, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.GetBucket(ctx, projectId, region, bucketName).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		utils.LogError(
 			ctx,

stackit/internal/services/objectstorage/bucket/resource.go

@@ -120,7 +120,8 @@ func (r *bucketResource) Configure(ctx context.Context, req resource.ConfigureRe
 func (r *bucketResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	descriptions := map[string]string{
 		"main": "ObjectStorage bucket resource schema. Must have a `region` specified in the provider configuration.\n\n" +
-			"~> This resource cannot be destroyed if the bucket contains objects. Please ensure the bucket is empty before attempting to destroy it.",
+			"~> This resource cannot be destroyed if the bucket contains objects. Please ensure the bucket is empty before attempting to destroy it.\n\n" +
+			"-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.",
 		"id":                       "Terraform's internal resource identifier. It is structured as \"`project_id`,`region`,`name`\".",
 		"name":                     "The bucket name. It must be DNS conform.",
 		"project_id":               "STACKIT Project ID to which the bucket is associated.",
@@ -218,7 +219,11 @@ func (r *bucketResource) Create(ctx context.Context, req resource.CreateRequest,
 	}
 
 	// Create new bucket
-	_, err = r.client.DefaultAPI.CreateBucket(ctx, projectId, region, bucketName).ObjectLockEnabled(model.ObjectLock.ValueBool()).Execute()
+	_, err = utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.CreateBucket(ctx, projectId, region, bucketName).ObjectLockEnabled(model.ObjectLock.ValueBool()).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error creating bucket", fmt.Sprintf("Calling API: %v", err))
 		return
@@ -275,7 +280,11 @@ func (r *bucketResource) Read(ctx context.Context, req resource.ReadRequest, res
 	ctx = tflog.SetField(ctx, "name", bucketName)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	bucketResp, err := r.client.DefaultAPI.GetBucket(ctx, projectId, region, bucketName).Execute()
+	bucketResp, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.GetBucket(ctx, projectId, region, bucketName).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		var oapiErr *oapierror.GenericOpenAPIError
 		if errors.As(err, &oapiErr) && oapiErr.StatusCode == http.StatusNotFound {
@@ -330,7 +339,11 @@ func (r *bucketResource) Delete(ctx context.Context, req resource.DeleteRequest,
 	ctx = tflog.SetField(ctx, "region", region)
 
 	// Delete existing bucket
-	_, err := r.client.DefaultAPI.DeleteBucket(ctx, projectId, region, bucketName).Execute()
+	_, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.DeleteBucket(ctx, projectId, region, bucketName).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		var oapiErr *oapierror.GenericOpenAPIError
 		if errors.As(err, &oapiErr) {

stackit/internal/services/objectstorage/credential/datasource.go

@@ -70,7 +70,8 @@ func (r *credentialDataSource) Configure(ctx context.Context, req datasource.Con
 // Schema defines the schema for the datasource.
 func (r *credentialDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
 	descriptions := map[string]string{ //nolint:gosec // description for credential id
-		"main":                 "ObjectStorage credential data source schema. Must have a `region` specified in the provider configuration.",
+		"main": "ObjectStorage credential data source schema. Must have a `region` specified in the provider configuration.\n\n" +
+			"-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.",
 		"id":                   "Terraform's internal resource identifier. It is structured as \"`project_id`,`region`,`credentials_group_id`,`credential_id`\".",
 		"credential_id":        "The credential ID.",
 		"credentials_group_id": "The credential group ID.",
@@ -133,7 +134,11 @@ func (r *credentialDataSource) Read(ctx context.Context, req datasource.ReadRequ
 	ctx = tflog.SetField(ctx, "credential_id", credentialId)
 	ctx = tflog.SetField(ctx, "region", region)
 
-	credentialsGroupResp, err := r.client.DefaultAPI.ListAccessKeys(ctx, projectId, region).CredentialsGroup(credentialsGroupId).Execute()
+	credentialsGroupResp, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.ListAccessKeys(ctx, projectId, region).CredentialsGroup(credentialsGroupId).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		utils.LogError(
 			ctx,

stackit/internal/services/objectstorage/credential/resource.go

@@ -160,7 +160,8 @@ func (r *credentialResource) Configure(ctx context.Context, req resource.Configu
 // Schema defines the schema for the resource.
 func (r *credentialResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	descriptions := map[string]string{ //nolint:gosec // description for credential id
-		"main":                 "ObjectStorage credential resource schema. Must have a `region` specified in the provider configuration.",
+		"main": "ObjectStorage credential resource schema. Must have a `region` specified in the provider configuration.\n\n" +
+			"-> **Note:** States with many Object Storage resources may take several minutes to plan or apply due to Control Plane rate limiting. Requests are automatically retried.",
 		"id":                   "Terraform's internal resource identifier. It is structured as \"`project_id`,`region`,`credentials_group_id`,`credential_id`\".",
 		"credential_id":        "The credential ID.",
 		"credentials_group_id": "The credential group ID.",
@@ -294,7 +295,11 @@ func (r *credentialResource) Create(ctx context.Context, req resource.CreateRequ
 		return
 	}
 	// Create new credential
-	credentialResp, err := r.client.DefaultAPI.CreateAccessKey(ctx, projectId, region).CredentialsGroup(credentialsGroupId).CreateAccessKeyPayload(*payload).Execute()
+	credentialResp, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.CreateAccessKey(ctx, projectId, region).CredentialsGroup(credentialsGroupId).CreateAccessKeyPayload(*payload).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		core.LogAndAddError(ctx, &resp.Diagnostics, "Error creating credential", fmt.Sprintf("Calling API: %v", err))
 		return
@@ -454,7 +459,11 @@ func (r *credentialResource) Delete(ctx context.Context, req resource.DeleteRequ
 	ctx = tflog.SetField(ctx, "region", region)
 
 	// Delete existing credential
-	_, err := r.client.DefaultAPI.DeleteAccessKey(ctx, projectId, region, credentialId).CredentialsGroup(credentialsGroupId).Execute()
+	_, err := utils.RetryRequest(
+		ctx,
+		r.client.DefaultAPI.DeleteAccessKey(ctx, projectId, region, credentialId).CredentialsGroup(credentialsGroupId).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		var oapiErr *oapierror.GenericOpenAPIError
 		if errors.As(err, &oapiErr) && oapiErr.StatusCode == http.StatusNotFound {
@@ -560,7 +569,11 @@ func readCredentials(ctx context.Context, model *Model, region string, client *o
 	credentialsGroupId := model.CredentialsGroupId.ValueString()
 	credentialId := model.CredentialId.ValueString()
 
-	credentialsGroupResp, err := client.DefaultAPI.ListAccessKeys(ctx, projectId, region).CredentialsGroup(credentialsGroupId).Execute()
+	credentialsGroupResp, err := utils.RetryRequest(
+		ctx,
+		client.DefaultAPI.ListAccessKeys(ctx, projectId, region).CredentialsGroup(credentialsGroupId).Execute,
+		objectstorageUtils.RateLimitRetryConfig,
+	)
 	if err != nil {
 		var oapiErr *oapierror.GenericOpenAPIError
 		if errors.As(err, &oapiErr) && oapiErr.StatusCode == http.StatusNotFound {