fix(secure): deprecate dead rule resources (container/filesystem/network/process/syscall)

[ivanlysiuk-sysdig]

Summary

Five sub-type rule resources and their matching data sources — sysdig_secure_rule_container, _filesystem, _network, _process, _syscall — are broken end-to-end against current Sysdig backends. Their Create/Update calls hit POST /api/secure/rules with ruleType values (CONTAINER, FILESYSTEM, NETWORK, PROCESS, SYSCALL) that the backend stopped accepting when list-matching policy code was removed. The endpoint returns HTTP 400 "unknown ruleType: <type>".

This adds Schema.DeprecationMessage on the resource and data source definitions so users see a clear terraform plan/apply-time warning pointing them at sysdig_secure_rule_falco.

Repro

Against a fresh Sysdig stack:

$ curl -X POST .../api/secure/rules \
    -d '{"details":{"ruleType":"CONTAINER",...}}'
HTTP 400: "The field details has an unknown ruleType: CONTAINER"

Same for FILESYSTEM / NETWORK / PROCESS / SYSCALL.

The modern backend rule unmarshaller only accepts: FALCO, DRIFT, MACHINE_LEARNING, AWS_MACHINE_LEARNING, MALWARE, OKTA_MACHINE_LEARNING, FIM.

Changes

File	Change
sysdig/resource_sysdig_secure_rule_{container,filesystem,network,process,syscall}.go	Add DeprecationMessage on the returned schema.Resource.
sysdig/data_source_sysdig_secure_rule_{container,filesystem,network,process,syscall}.go	Same on the data source.

Net: +35, -25. Pure metadata change — no behavior change beyond Terraform surfacing the deprecation banner.

What users see

When sysdig_secure_rule_container (etc.) appears in a config:

Warning: Argument is deprecated
  with sysdig_secure_rule_container.foo,
  on main.tf line 12, in resource "sysdig_secure_rule_container" "foo":

sysdig_secure_rule_container is deprecated and no longer functional
against current Sysdig backends — the backend rejects ruleType CONTAINER.
Migrate to sysdig_secure_rule_falco with an equivalent Falco condition.

Why not remove

Outright removal would be a breaking change for anyone with these resources in state (terraform plan would error out before they can migrate). Deprecation now warns users; a follow-up at a major-version bump can remove them.

Why not restore backend support

The structured ruleTypes were tied to the (now-removed) list-matching code path. Re-introducing them would resurrect that surface. Out of scope.

Test plan

• go build ./... — clean
• go vet ./sysdig/... — clean
• gofmt -l sysdig/... — clean
• Confirmed the 400 reproduction against a current Sysdig backend

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR deprecates five legacy “sub-type” Secure rule resources and their matching data sources (container, filesystem, network, process, syscall) that no longer work with current Sysdig backends (backend rejects those ruleType values). Deprecation is implemented via schema.Resource.DeprecationMessage so Terraform surfaces an explicit warning and points users to sysdig_secure_rule_falco.

Changes:

• Added DeprecationMessage to sysdig_secure_rule_{container,filesystem,network,process,syscall} resources.
• Added DeprecationMessage to sysdig_secure_rule_{container,filesystem,network,process,syscall} data sources.
• Deprecation messages include migration guidance and tracking reference (SSPROD-68481).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sysdig/resource_sysdig_secure_rule_container.go	Deprecates the container rule resource with migration guidance to Falco rules.
sysdig/resource_sysdig_secure_rule_filesystem.go	Deprecates the filesystem rule resource with migration guidance to Falco rules.
sysdig/resource_sysdig_secure_rule_network.go	Deprecates the network rule resource with migration guidance to Falco rules.
sysdig/resource_sysdig_secure_rule_process.go	Deprecates the process rule resource with migration guidance to Falco rules.
sysdig/resource_sysdig_secure_rule_syscall.go	Deprecates the syscall rule resource with migration guidance to Falco rules.
sysdig/data_source_sysdig_secure_rule_container.go	Deprecates the container rule data source and points to the Falco data source.
sysdig/data_source_sysdig_secure_rule_filesystem.go	Deprecates the filesystem rule data source and points to the Falco data source.
sysdig/data_source_sysdig_secure_rule_network.go	Deprecates the network rule data source and points to the Falco data source.
sysdig/data_source_sysdig_secure_rule_process.go	Deprecates the process rule data source and points to the Falco data source.
sysdig/data_source_sysdig_secure_rule_syscall.go	Deprecates the syscall rule data source and points to the Falco data source.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.