Repository: confluentinc/terraform-provider-confluent
Pull request #575: CLI-3429: Add new read-only endpoint_suffix attribute to confluent_network resource & data source
Author: login: linouk23
Created: 2025-02-26T01:46:11Z | Merged: 2025-03-31T19:59:49Z

Release Notes
---------
New Features
- Added a new `endpoint_suffix` computed attribute to `confluent_network` [resource](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_network) and and corresponding [data source](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/data-sources/confluent_network).

Checklist
---------
<!-- 
Check each item in the checklist to ensure high-quality Terraform development practices are followed. PR approval won't be granted until the checklist is carefully reviewed.
For instructions, please refer to this Confluence page: https://confluentinc.atlassian.net/wiki/spaces/AEGI/pages/3938058831/
-->
- [x] I can successfully build and use a custom Terraform provider binary for Confluent.
- [x] I have verified my PR with real Confluent Cloud resources in a pre-prod or production environment, or both.
- [x] I have attached manual Terraform verification results or screenshots in the `Test & Review` section below.
- [x] I have included appropriate Terraform acceptance or unit tests for any new resource, data source, or functionality.
- [x] I confirm that this PR introduces no breaking changes or backward compatibility issues.
- [x] I have updated the corresponding documentation and include relevant examples for this PR.
- [x] I have indicated the potential customer impact if something goes wrong in the `Blast Radius` section below.
- [x] I have put checkmarks below confirming that the feature associated with this PR is enabled in:
  - [ ] Confluent Cloud prod
  - [x] Confluent Cloud stag
  - [ ] Check this box if the feature is enabled for certain organizations only

What
----
This PR adds a new computed attribute to the `confluent_network` [resource](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_network) and and corresponding [data source](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/data-sources/confluent_network).

Blast Radius
----
Confluent Cloud customers who are using `confluent_network` resource/data-source will be blocked.

References
----------
* https://confluentinc.atlassian.net/browse/CLI-3429

Test & Review
-------------
The testing steps & the staging logs are attached to the linked JIRA.

Notes
-------------
This PR also updates `confluent_network.go` to use the new SDK version `networking/v0.14.0` instead of `networking/v0.12.0`.  

Unfortunately, there were some minor struct changes between `0.14.0` and `0.12.0`. Given that `0.14.0` is the correct version, we decided to update the client code as well. Our acceptance tests cover both the connection_types and zone_info attributes (these are the attributes with updated SDK structs) as well.


Diff:
diff --git a/docs/data-sources/confluent_network.md b/docs/data-sources/confluent_network.md
index 7356b21e6..2ae049556 100644
--- a/docs/data-sources/confluent_network.md
+++ b/docs/data-sources/confluent_network.md
@@ -85,6 +85,7 @@ In addition to the preceding arguments, the following attributes are exported:
     When resolution is `CHASED_PRIVATE`, clusters in this network require both public and private DNS to resolve cluster endpoints.
     When resolution is `PRIVATE`, clusters in this network only require private DNS to resolve cluster endpoints.
 
+- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable. It can take various forms (for example, `.pr1jy6.us-east-2.aws.confluent.cloud` or `-pr1jy6.us-east-2.aws.confluent.cloud`). Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding `flink` — that is, `https://flink` + `endpoint_suffix`; namely, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
 - `resource_name` - (Required String) The Confluent Resource Name of the Network.
 - `gateway` (Optional Configuration Block) supports the following:
   - `id` - (Optional String) The ID of the Gateway, for example, `gw-abc123`.
diff --git a/docs/resources/confluent_flink_statement.md b/docs/resources/confluent_flink_statement.md
index be9b901b0..751670198 100644
--- a/docs/resources/confluent_flink_statement.md
+++ b/docs/resources/confluent_flink_statement.md
@@ -41,7 +41,10 @@ resource "confluent_flink_statement" "random_int_table" {
     "sql.current-database" = data.confluent_kafka_cluster.example.display_name
   }
   # Use data.confluent_flink_region.main.rest_endpoint for Basic, Standard, public Dedicated Kafka clusters
-  # and data.confluent_flink_region.main.private_rest_endpoint for Kafka clusters with private networking
+  # For private networking use
+  # data.confluent_flink_region.main.private_rest_endpoint
+  # or
+  # "https://flink${data.confluent_network.main.endpoint_suffix}"
   rest_endpoint = data.confluent_flink_region.main.rest_endpoint
   credentials {
     key    = confluent_api_key.env-admin-flink-api-key.id
diff --git a/docs/resources/confluent_network.md b/docs/resources/confluent_network.md
index a53ffe094..b7019c2b1 100644
--- a/docs/resources/confluent_network.md
+++ b/docs/resources/confluent_network.md
@@ -153,6 +153,7 @@ The following arguments are supported:
 In addition to the preceding arguments, the following attributes are exported:
 
 - `id` - (Required String) The ID of the Network, for example, `n-abc123`.
+- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable. It can take various forms (for example, `.pr1jy6.us-east-2.aws.confluent.cloud` or `-pr1jy6.us-east-2.aws.confluent.cloud`). Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding `flink` — that is, `https://flink` + `endpoint_suffix`; namely, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
 - `resource_name` - (Required String) The Confluent Resource Name of the Network.
 - `dns_domain` - (Optional String) The root DNS domain for the network, for example, `pr123a.us-east-2.aws.confluent.cloud` if applicable. Present on Networks that support Private Link.
 - `zonal_subdomains` - (Optional Map) The DNS subdomain for each zone. Present on networks that support Private Link. Keys are zone names, for example, `use2-az1` and values are DNS domains, for example, `use2-az1.pr123a.us-east-2.aws.confluent.cloud`.
diff --git a/go.mod b/go.mod
index cc9e643f1..62c034d0a 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,7 @@ require (
 	github.com/confluentinc/ccloud-sdk-go-v2/kafkarest v0.14.0
 	github.com/confluentinc/ccloud-sdk-go-v2/ksql v0.1.0
 	github.com/confluentinc/ccloud-sdk-go-v2/mds v0.3.0
-	github.com/confluentinc/ccloud-sdk-go-v2/networking v0.12.0
+	github.com/confluentinc/ccloud-sdk-go-v2/networking v0.14.0
 	github.com/confluentinc/ccloud-sdk-go-v2/networking-access-point v0.5.0
 	github.com/confluentinc/ccloud-sdk-go-v2/networking-dnsforwarder v0.4.0
 	github.com/confluentinc/ccloud-sdk-go-v2/networking-gateway v0.2.0
diff --git a/go.sum b/go.sum
index 84cb93b91..24142b119 100644
--- a/go.sum
+++ b/go.sum
@@ -101,8 +101,8 @@ github.com/confluentinc/ccloud-sdk-go-v2/ksql v0.1.0 h1:dtLqrG3nltpe2xucO8Bj17HP
 github.com/confluentinc/ccloud-sdk-go-v2/ksql v0.1.0/go.mod h1:0LAvd4VqlaRwKU4yvDEkVCtV43yNezt56+hBe9Lmg7Q=
 github.com/confluentinc/ccloud-sdk-go-v2/mds v0.3.0 h1:DaipFGVdZjAE8eSztUrA/4b74kj6k5lZ0EJmK1RqccU=
 github.com/confluentinc/ccloud-sdk-go-v2/mds v0.3.0/go.mod h1:ufn9In8kDsyJ7Nru2ygpAaWdGw7DSDTOTtDhQVSmZjs=
-github.com/confluentinc/ccloud-sdk-go-v2/networking v0.12.0 h1:eaIjlpKyjW6WgOKqR2/v1oITgK/m/eg4PdIrmIN8fbc=
-github.com/confluentinc/ccloud-sdk-go-v2/networking v0.12.0/go.mod h1:jL9lLHYwFKzCJE5Fh62UdRqJCMJ9T/xg5QOdnQRYIUg=
+github.com/confluentinc/ccloud-sdk-go-v2/networking v0.14.0 h1:btDFGijvzpWaKLKztc7S9YenbtGTsHgjs4+fNuyYceI=
+github.com/confluentinc/ccloud-sdk-go-v2/networking v0.14.0/go.mod h1:6BDrwG6OfSnT++Yr3mXStvmy4Jb8uMtdfKK7sZO/X+M=
 github.com/confluentinc/ccloud-sdk-go-v2/networking-access-point v0.5.0 h1:q2sfstoFDF/ZUs0MapOzalwIjp4UjL6CK+cMNZmdzNM=
 github.com/confluentinc/ccloud-sdk-go-v2/networking-access-point v0.5.0/go.mod h1:HV1xGUwTsGEU3Mgvc+7Ya/0HRpUO69L2rqqxO7LeWMc=
 github.com/confluentinc/ccloud-sdk-go-v2/networking-dnsforwarder v0.4.0 h1:LT8trYIkMZ7EFM7nZZOkmH12B7AgOEvZYZjw86nazD0=
diff --git a/internal/provider/data_source_network.go b/internal/provider/data_source_network.go
index a4ec75929..747034fd7 100644
--- a/internal/provider/data_source_network.go
+++ b/internal/provider/data_source_network.go
@@ -82,6 +82,11 @@ func networkDataSource() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			paramEndpointSuffix: {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The endpoint suffix for the network, if applicable.",
+			},
 			paramZonalSubdomains: {
 				Type: schema.TypeMap,
 				Elem: &schema.Schema{
diff --git a/internal/provider/data_source_network_test.go b/internal/provider/data_source_network_test.go
index d5634b8d8..2ca86aa64 100644
--- a/internal/provider/data_source_network_test.go
+++ b/internal/provider/data_source_network_test.go
@@ -99,6 +99,7 @@ func TestAccDataSourceNetwork(t *testing.T) {
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, fmt.Sprintf("%s.#", paramDnsConfig), "1"),
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, fmt.Sprintf("%s.0.%s", paramDnsConfig, paramResolution), awsNetworkDefaultDnsResolution),
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, paramResourceName, awsNetworkResourceName),
+					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, paramEndpointSuffix, awsEndpointSuffix),
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, paramDnsDomain, awsDnsDomain),
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, paramReservedCidr, ""),
 					resource.TestCheckResourceAttr(fullNetworkDataSourceLabel, fmt.Sprintf("%s.#", paramZoneInfo), "0"),
diff --git a/internal/provider/resource_network.go b/internal/provider/resource_network.go
index 55b69ffc7..f14421ba3 100644
--- a/internal/provider/resource_network.go
+++ b/internal/provider/resource_network.go
@@ -45,6 +45,7 @@ const (
 	paramDnsConfig                               = "dns_config"
 	paramResolution                              = "resolution"
 	paramZonalSubdomains                         = "zonal_subdomains"
+	paramEndpointSuffix                          = "endpoint_suffix"
 
 	connectionTypePrivateLink    = "PRIVATELINK"
 	connectionTypeTransitGateway = "TRANSITGATEWAY"
@@ -118,6 +119,11 @@ func networkResource() *schema.Resource {
 				Computed:    true,
 				Description: "The root DNS domain for the network if applicable. Present on networks that support PrivateLink.",
 			},
+			paramEndpointSuffix: {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The endpoint suffix for the network, if applicable.",
+			},
 			paramZonalSubdomains: {
 				Type: schema.TypeMap,
 				Elem: &schema.Schema{
@@ -267,16 +273,14 @@ func networkCreate(ctx context.Context, d *schema.ResourceData, meta interface{}
 	}
 	spec.SetCloud(cloud)
 	spec.SetRegion(region)
-	spec.SetConnectionTypes(net.NetworkingV1ConnectionTypes{
-		Items: connectionTypes,
-	})
+	spec.SetConnectionTypes(connectionTypes)
 	if cidr != "" {
 		spec.SetCidr(cidr)
 	}
 	if reservedCidr != "" {
 		spec.SetReservedCidr(reservedCidr)
 	}
-	if len(zonesInfo.Items) > 0 {
+	if len(zonesInfo) > 0 {
 		spec.SetZonesInfo(zonesInfo)
 	}
 	if len(zones) > 0 {
@@ -377,7 +381,7 @@ func setNetworkAttributes(d *schema.ResourceData, network net.NetworkingV1Networ
 		return nil, err
 	}
 
-	if err := d.Set(paramConnectionTypes, network.Spec.ConnectionTypes.Items); err != nil {
+	if err := d.Set(paramConnectionTypes, network.Spec.GetConnectionTypes()); err != nil {
 		return nil, err
 	}
 	if err := d.Set(paramCidr, network.Spec.GetCidr()); err != nil {
@@ -393,6 +397,9 @@ func setNetworkAttributes(d *schema.ResourceData, network net.NetworkingV1Networ
 	if err := d.Set(paramDnsDomain, network.Status.GetDnsDomain()); err != nil {
 		return nil, err
 	}
+	if err := d.Set(paramEndpointSuffix, network.Status.GetEndpointSuffix()); err != nil {
+		return nil, err
+	}
 	if err := d.Set(paramZonalSubdomains, network.Status.GetZonalSubdomains()); err != nil {
 		return nil, err
 	}
@@ -631,7 +638,7 @@ func computedGatewaySchema() *schema.Schema {
 	}
 }
 
-func buildZonesInfo(tfZonesInfo []interface{}) net.NetworkingV1ZonesInfo {
+func buildZonesInfo(tfZonesInfo []interface{}) []net.NetworkingV1ZoneInfo {
 	zonesInfo := make([]net.NetworkingV1ZoneInfo, len(tfZonesInfo))
 	for index, tfZoneInfo := range tfZonesInfo {
 		zoneInfo := net.NewNetworkingV1ZoneInfo()
@@ -644,14 +651,12 @@ func buildZonesInfo(tfZonesInfo []interface{}) net.NetworkingV1ZonesInfo {
 		}
 		zonesInfo[index] = *zoneInfo
 	}
-	return net.NetworkingV1ZonesInfo{
-		Items: zonesInfo,
-	}
+	return zonesInfo
 }
 
-func buildTfZonesInfo(zonesInfo net.NetworkingV1ZonesInfo) *[]map[string]interface{} {
-	tfZonesInfo := make([]map[string]interface{}, len(zonesInfo.Items))
-	for i, zoneInfo := range zonesInfo.Items {
+func buildTfZonesInfo(zonesInfo []net.NetworkingV1ZoneInfo) *[]map[string]interface{} {
+	tfZonesInfo := make([]map[string]interface{}, len(zonesInfo))
+	for i, zoneInfo := range zonesInfo {
 		tfZonesInfo[i] = *buildTfZoneInfo(zoneInfo)
 	}
 	return &tfZonesInfo
diff --git a/internal/provider/resource_network_aws_test.go b/internal/provider/resource_network_aws_test.go
index 115e7c620..8548a2abd 100644
--- a/internal/provider/resource_network_aws_test.go
+++ b/internal/provider/resource_network_aws_test.go
@@ -39,6 +39,7 @@ const (
 	awsNetworkDefaultDnsResolution        = "CHASED_PRIVATE"
 	awsNetworkId                          = "n-pr1jy6"
 	awsDnsDomain                          = "pr1jy6.us-east-2.aws.confluent.cloud"
+	awsEndpointSuffix                     = ".pr1jy6.us-east-2.aws.confluent.cloud"
 	awsNetworkVpc                         = "vpc-03e78ba4db7bb1789"
 	awsNetworkAccount                     = "012345678901"
 	awsNetworkPrivateLinkEndpointService  = "com.amazonaws.vpce.us-east-2.vpce-svc-0089db43e25590123"
@@ -160,6 +161,7 @@ func TestAccAwsNetwork(t *testing.T) {
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.#", paramDnsConfig), "1"),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.0.%s", paramDnsConfig, paramResolution), awsNetworkDefaultDnsResolution),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramResourceName, awsNetworkResourceName),
+					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramEndpointSuffix, awsEndpointSuffix),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramDnsDomain, awsDnsDomain),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramReservedCidr, ""),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.#", paramZoneInfo), "0"),
@@ -191,6 +193,7 @@ func TestAccAwsNetwork(t *testing.T) {
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.#", paramDnsConfig), "1"),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.0.%s", paramDnsConfig, paramResolution), awsNetworkDefaultDnsResolution),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramResourceName, awsNetworkResourceName),
+					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramEndpointSuffix, awsEndpointSuffix),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramDnsDomain, awsDnsDomain),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, paramReservedCidr, ""),
 					resource.TestCheckResourceAttr(fullAwsNetworkResourceLabel, fmt.Sprintf("%s.#", paramZoneInfo), "0"),
diff --git a/internal/testdata/network/aws/create_network.json b/internal/testdata/network/aws/create_network.json
index 8693aee7a..8bee80aeb 100644
--- a/internal/testdata/network/aws/create_network.json
+++ b/internal/testdata/network/aws/create_network.json
@@ -37,6 +37,7 @@
       "vpc": ""
     },
     "dns_domain": "",
+    "endpoint_suffix": ".",
     "phase": "PROVISIONING",
     "zonal_subdomains": {}
   }
diff --git a/internal/testdata/network/aws/read_created_network.json b/internal/testdata/network/aws/read_created_network.json
index a8ba02e96..f7d577734 100644
--- a/internal/testdata/network/aws/read_created_network.json
+++ b/internal/testdata/network/aws/read_created_network.json
@@ -40,6 +40,7 @@
       "vpc": "vpc-03e78ba4db7bb1789"
     },
     "dns_domain": "pr1jy6.us-east-2.aws.confluent.cloud",
+    "endpoint_suffix": ".pr1jy6.us-east-2.aws.confluent.cloud",
     "phase": "READY",
     "zonal_subdomains": {
       "use2-az1": "use2-az1.pr1jy6.us-east-2.aws.confluent.cloud",
diff --git a/internal/testdata/network/aws/read_provisioning_network.json b/internal/testdata/network/aws/read_provisioning_network.json
index 49010364a..899e4a1a1 100644
--- a/internal/testdata/network/aws/read_provisioning_network.json
+++ b/internal/testdata/network/aws/read_provisioning_network.json
@@ -40,6 +40,7 @@
       "vpc": ""
     },
     "dns_domain": "",
+    "endpoint_suffix": ".",
     "phase": "PROVISIONING",
     "zonal_subdomains": {}
   }


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: 

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

<details>
<summary>Comments suppressed due to low confidence (2)</summary>

**docs/data-sources/confluent_network.md:88**
* The phrase 'fpr example' appears to be a typo. Consider replacing 'fpr example' with 'for example'.
```
- `endpoint_suffix` - (Optional String) The endpoint suffix for the network if applicable, for example, ".n-abc123.us-east-1.aws.glb.confluent.cloud". It is the concatenation of the subdomain separator (fpr example, '.' or '-') and the dns domain. For a Flink endpoint written as: "flink.$networkid.$region.$cloud.confluent.cloud" the endpoint_suffix would be ".$networkid.$region.$cloud.confluent.cloud". The full endpoint can be obtained by concatenating "flink" + endpoint_suffix.
```
**docs/resources/confluent_network.md:156**
* The text 'fpr example' seems to be a typo; it should be corrected to 'for example'.
```
- `endpoint_suffix` - (Optional String) The endpoint suffix for the network if applicable, for example, ".n-abc123.us-east-1.aws.glb.confluent.cloud". It is the concatenation of the subdomain separator (fpr example, '.' or '-') and the dns domain. For a Flink endpoint written as: "flink.$networkid.$region.$cloud.confluent.cloud" the endpoint_suffix would be ".$networkid.$region.$cloud.confluent.cloud". The full endpoint can be obtained by concatenating "flink" + endpoint_suffix.
```
</details>


state: COMMENTED
author_association: NONE
submitted_at: 2025-02-26T01:46:37Z
user: login: channingdong
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-27T07:02:34Z
user: login: danielayaz
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-28T21:32:22Z
user: login: linouk23
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T22:42:33Z
user: login: linouk23
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T22:42:40Z
user: login: linouk23
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T22:43:44Z
user: login: channingdong
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T22:50:01Z
user: login: tmalikconfluent
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T22:58:13Z
user: login: linouk23
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T23:23:25Z
user: login: linouk23
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T23:23:36Z
user: login: sgagniere
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-28T23:56:37Z
user: login: channingdong
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-31T18:18:46Z
user: login: danielayaz
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-31T19:46:43Z

Review comments:
diff_hunk: @@ -85,6 +85,7 @@ In addition to the preceding arguments, the following attributes are exported:
     When resolution is `CHASED_PRIVATE`, clusters in this network require both public and private DNS to resolve cluster endpoints.
     When resolution is `PRIVATE`, clusters in this network only require private DNS to resolve cluster endpoints.
 
+- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable, for example, `.pr1jy6.us-east-2.aws.confluent.cloud`. Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding "flink" - 'https://flink' + 'endpoint_suffix', for example, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
path: docs/data-sources/confluent_network.md
user: login: channingdong
body: In my experiment, the endpoint suffix can sometimes be:

`.pr1jy6.us-east-2.aws.confluent.cloud
`
Sometimes be:

`-pr1jy6.us-east-2.aws.confluent.cloud
`

Not sure if it's worthwhile to mention it to customers?
created_at: 2025-03-27T06:57:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -85,6 +85,7 @@ In addition to the preceding arguments, the following attributes are exported:
     When resolution is `CHASED_PRIVATE`, clusters in this network require both public and private DNS to resolve cluster endpoints.
     When resolution is `PRIVATE`, clusters in this network only require private DNS to resolve cluster endpoints.
 
+- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable, for example, `.pr1jy6.us-east-2.aws.confluent.cloud`. Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding "flink" - 'https://flink' + 'endpoint_suffix', for example, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
path: docs/data-sources/confluent_network.md
user: login: channingdong
body: Also, the description here seems to be a nested "for example"?

```suggestion
- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable, for example, `.pr1jy6.us-east-2.aws.confluent.cloud`. Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding "flink" - 'https://flink' + 'endpoint_suffix', namely, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
```
created_at: 2025-03-27T06:58:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -118,6 +119,10 @@ func networkResource() *schema.Resource {
 				Computed:    true,
 				Description: "The root DNS domain for the network if applicable. Present on networks that support PrivateLink.",
 			},
+			paramEndpointSuffix: {
path: internal/provider/resource_network.go
user: login: channingdong
body: nit: adding a description here? It works very much like the short description for CLI, and we can refer to the doc as the long description.
created_at: 2025-03-27T06:59:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -39,6 +39,7 @@ const (
 	awsNetworkDefaultDnsResolution        = "CHASED_PRIVATE"
 	awsNetworkId                          = "n-pr1jy6"
 	awsDnsDomain                          = "pr1jy6.us-east-2.aws.confluent.cloud"
+	awsEndpointSuffix                     = ".pr1jy6.us-east-2.aws.confluent.cloud"
path: internal/provider/resource_network_aws_test.go
user: login: channingdong
body: Shall we cover the change for the data source test as well?
created_at: 2025-03-27T07:02:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,16 +272,14 @@ func networkCreate(ctx context.Context, d *schema.ResourceData, meta interface{}
 	}
 	spec.SetCloud(cloud)
 	spec.SetRegion(region)
-	spec.SetConnectionTypes(net.NetworkingV1ConnectionTypes{
path: internal/provider/resource_network.go
user: login: danielayaz
body: Did the model for this change?
created_at: 2025-03-28T21:32:22Z
author_association: MEMBER
diff_hunk: @@ -85,6 +85,7 @@ In addition to the preceding arguments, the following attributes are exported:
     When resolution is `CHASED_PRIVATE`, clusters in this network require both public and private DNS to resolve cluster endpoints.
     When resolution is `PRIVATE`, clusters in this network only require private DNS to resolve cluster endpoints.
 
+- `endpoint_suffix` - (Optional String) The endpoint suffix for the network, if applicable, for example, `.pr1jy6.us-east-2.aws.confluent.cloud`. Full service endpoints can be constructed by appending the service identifier to the beginning of the endpoint suffix. For example, the Flink REST endpoint can be constructed by adding "flink" - 'https://flink' + 'endpoint_suffix', for example, `https://flink.pr1jy6.us-east-2.aws.confluent.cloud`.
path: docs/data-sources/confluent_network.md
user: login: linouk23
body: That's a great point! I updated the PR 🫡 
created_at: 2025-03-28T22:42:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -39,6 +39,7 @@ const (
 	awsNetworkDefaultDnsResolution        = "CHASED_PRIVATE"
 	awsNetworkId                          = "n-pr1jy6"
 	awsDnsDomain                          = "pr1jy6.us-east-2.aws.confluent.cloud"
+	awsEndpointSuffix                     = ".pr1jy6.us-east-2.aws.confluent.cloud"
path: internal/provider/resource_network_aws_test.go
user: login: linouk23
body: That's a great point! I updated the PR 🫡 
created_at: 2025-03-28T22:42:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -267,16 +272,14 @@ func networkCreate(ctx context.Context, d *schema.ResourceData, meta interface{}
 	}
 	spec.SetCloud(cloud)
 	spec.SetRegion(region)
-	spec.SetConnectionTypes(net.NetworkingV1ConnectionTypes{
path: internal/provider/resource_network.go
user: login: linouk23
body: SDK model did change (the previous SDK was generated without a necessary flag), but TF schema stays the same, correct.
created_at: 2025-03-28T22:43:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -82,6 +82,11 @@ func networkDataSource() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			paramEndpointSuffix: {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The endpoint suffix for the network, if applicable.",
path: internal/provider/data_source_network.go
user: login: tmalikconfluent
body: should this be optional? asking as it says "if applicable"
created_at: 2025-03-28T22:58:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -82,6 +82,11 @@ func networkDataSource() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			paramEndpointSuffix: {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The endpoint suffix for the network, if applicable.",
path: internal/provider/data_source_network.go
user: login: linouk23
body: That's a great question! "if applicable" means this field can also be "".
created_at: 2025-03-28T23:23:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -118,6 +119,10 @@ func networkResource() *schema.Resource {
 				Computed:    true,
 				Description: "The root DNS domain for the network if applicable. Present on networks that support PrivateLink.",
 			},
+			paramEndpointSuffix: {
path: internal/provider/resource_network.go
user: login: linouk23
body: That's a great point! I updated the PR 🫡
created_at: 2025-03-28T23:23:36Z
author_association: CONTRIBUTOR

PR comments:
user: login: channingdong
created_at: 2025-03-27T07:04:46Z
body: And also, I suppose we should update the examples to include our original intention of below?

rest_endpoint = "https://flink/.${data.confluent_network.example.dns_domain_suffix}"
author_association: CONTRIBUTOR
user: login: danielayaz
created_at: 2025-03-28T21:35:24Z
body: Looks great so far! Will re-review when testing is added.
author_association: MEMBER
user: login: channingdong
created_at: 2025-03-28T23:25:02Z
body: Seems like a test failing (not flakiness).
author_association: CONTRIBUTOR