[v18] Support summarizer resources in Terraform provider

api/client/client.go

@@ -62,6 +62,7 @@ import (
 	scopedaccess "github.com/gravitational/teleport/api/client/scopes/access"
 	"github.com/gravitational/teleport/api/client/secreport"
 	statichostuserclient "github.com/gravitational/teleport/api/client/statichostuser"
+	"github.com/gravitational/teleport/api/client/summarizer"
 	"github.com/gravitational/teleport/api/client/userloginstate"
 	usertaskapi "github.com/gravitational/teleport/api/client/usertask"
 	"github.com/gravitational/teleport/api/constants"
@@ -946,6 +947,13 @@ func (c *Client) SummarizerServiceClient() summarizerv1.SummarizerServiceClient
 	return summarizerv1.NewSummarizerServiceClient(c.conn)
 }
 
+// SummarizerClient returns a client for the session summarizer service that
+// hides away the gRPC request/response layer. Required for compatibility with
+// autogenerated Terraform provider code.
+func (c *Client) SummarizerClient() *summarizer.Client {
+	return summarizer.NewClient(summarizerv1.NewSummarizerServiceClient(c.conn))
+}
+
 // RecordingMetadataServiceClient returns an unadorned client for the session
 // recording metadata service.
 func (c *Client) RecordingMetadataServiceClient() recordingmetadatav1.RecordingMetadataServiceClient {

api/client/summarizer/summarizer.go

@@ -0,0 +1,162 @@
+// Copyright 2026 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package summarizer
+
+import (
+	"context"
+
+	"github.com/gravitational/trace"
+
+	summarizerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/summarizer/v1"
+)
+
+// Client wraps the gRPC SummarizerServiceClient to provide a higher-level
+// interface that hides the RPC request handling details.
+type Client struct {
+	grpcClient summarizerv1.SummarizerServiceClient
+}
+
+// NewClient creates a new [Client] that wraps a gRPC client.
+func NewClient(grpcClient summarizerv1.SummarizerServiceClient) *Client {
+	return &Client{
+		grpcClient: grpcClient,
+	}
+}
+
+// GetInferenceModel retrieves an existing InferenceModel by name.
+func (c *Client) GetInferenceModel(ctx context.Context, name string) (*summarizerv1.InferenceModel, error) {
+	resp, err := c.grpcClient.GetInferenceModel(ctx, &summarizerv1.GetInferenceModelRequest{
+		Name: name,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Model, nil
+}
+
+// CreateInferenceModel creates a new InferenceModel.
+func (c *Client) CreateInferenceModel(ctx context.Context, model *summarizerv1.InferenceModel) (*summarizerv1.InferenceModel, error) {
+	resp, err := c.grpcClient.CreateInferenceModel(ctx, &summarizerv1.CreateInferenceModelRequest{
+		Model: model,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Model, nil
+}
+
+// UpsertInferenceModel creates a new InferenceModel or updates an existing
+// one.
+func (c *Client) UpsertInferenceModel(ctx context.Context, model *summarizerv1.InferenceModel) (*summarizerv1.InferenceModel, error) {
+	resp, err := c.grpcClient.UpsertInferenceModel(ctx, &summarizerv1.UpsertInferenceModelRequest{
+		Model: model,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Model, nil
+}
+
+// DeleteInferenceModel deletes an existing InferenceModel by name.
+func (c *Client) DeleteInferenceModel(ctx context.Context, name string) error {
+	_, err := c.grpcClient.DeleteInferenceModel(ctx, &summarizerv1.DeleteInferenceModelRequest{
+		Name: name,
+	})
+	return trace.Wrap(err)
+}
+
+// GetInferenceSecret retrieves an existing InferenceSecret by name.
+func (c *Client) GetInferenceSecret(ctx context.Context, name string) (*summarizerv1.InferenceSecret, error) {
+	resp, err := c.grpcClient.GetInferenceSecret(ctx, &summarizerv1.GetInferenceSecretRequest{
+		Name: name,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Secret, nil
+}
+
+// CreateInferenceSecret creates a new InferenceSecret.
+func (c *Client) CreateInferenceSecret(ctx context.Context, secret *summarizerv1.InferenceSecret) (*summarizerv1.InferenceSecret, error) {
+	resp, err := c.grpcClient.CreateInferenceSecret(ctx, &summarizerv1.CreateInferenceSecretRequest{
+		Secret: secret,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Secret, nil
+}
+
+// UpsertInferenceSecret creates a new InferenceSecret or updates an existing
+// one.
+func (c *Client) UpsertInferenceSecret(ctx context.Context, secret *summarizerv1.InferenceSecret) (*summarizerv1.InferenceSecret, error) {
+	resp, err := c.grpcClient.UpsertInferenceSecret(ctx, &summarizerv1.UpsertInferenceSecretRequest{
+		Secret: secret,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Secret, nil
+}
+
+// DeleteInferenceSecret deletes an existing InferenceSecret by name.
+func (c *Client) DeleteInferenceSecret(ctx context.Context, name string) error {
+	_, err := c.grpcClient.DeleteInferenceSecret(ctx, &summarizerv1.DeleteInferenceSecretRequest{
+		Name: name,
+	})
+	return trace.Wrap(err)
+}
+
+// GetInferencePolicy retrieves an existing InferencePolicy by name.
+func (c *Client) GetInferencePolicy(ctx context.Context, name string) (*summarizerv1.InferencePolicy, error) {
+	resp, err := c.grpcClient.GetInferencePolicy(ctx, &summarizerv1.GetInferencePolicyRequest{
+		Name: name,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Policy, nil
+}
+
+// CreateInferencePolicy creates a new InferencePolicy.
+func (c *Client) CreateInferencePolicy(ctx context.Context, policy *summarizerv1.InferencePolicy) (*summarizerv1.InferencePolicy, error) {
+	resp, err := c.grpcClient.CreateInferencePolicy(ctx, &summarizerv1.CreateInferencePolicyRequest{
+		Policy: policy,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Policy, nil
+}
+
+// UpsertInferencePolicy creates a new InferencePolicy or updates an existing
+// one.
+func (c *Client) UpsertInferencePolicy(ctx context.Context, policy *summarizerv1.InferencePolicy) (*summarizerv1.InferencePolicy, error) {
+	resp, err := c.grpcClient.UpsertInferencePolicy(ctx, &summarizerv1.UpsertInferencePolicyRequest{
+		Policy: policy,
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+	return resp.Policy, nil
+}
+
+// DeleteInferencePolicy deletes an existing InferencePolicy by name.
+func (c *Client) DeleteInferencePolicy(ctx context.Context, name string) error {
+	_, err := c.grpcClient.DeleteInferencePolicy(ctx, &summarizerv1.DeleteInferencePolicyRequest{
+		Name: name,
+	})
+	return trace.Wrap(err)
+}

api/proto/teleport/summarizer/v1/summarizer.proto

@@ -93,7 +93,7 @@ message BedrockProvider {
   // Temperature controls the randomness of the model's output.
   float temperature = 3;
   // Integration is the AWS OIDC Integration name. If unset, Teleport will use
-  // AWS credentials available on the auth server machine; otherwise, it will
+  // AWS credentials available on the Auth Service machine; otherwise, it will
   // use the specified OIDC integration for assuming appropriate role.
   string integration = 4;
 }

docs/pages/reference/infrastructure-as-code/terraform-provider/resources/inference_model.mdx

@@ -0,0 +1,66 @@
+---
+title: Reference for the teleport_inference_model Terraform resource
+sidebar_label: inference_model
+description: This page describes the supported values of the teleport_inference_model resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_inference_model resource of the Teleport Terraform provider.
+
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+
+### Optional
+
+- `sub_kind` (String) SubKind is the resource sub-kind. Should be empty.
+- `version` (String) Version is the resource version. Should be set to "v1".
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
+
+### Nested Schema for `spec`
+
+Optional:
+
+- `bedrock` (Attributes) Bedrock indicates that this model uses Amazon Bedrock as the inference provider and specifies Bedrock-specific parameters. (see [below for nested schema](#nested-schema-for-specbedrock))
+- `max_session_length_bytes` (Number) MaxSessionLengthBytes is the maximum session length that can be sent to inference provider. Currently, it's determined by the size of model's context window; future versions of Teleport will allow summarizing larger sessions by splitting them.  Inference providers will reject requests that are larger than given model's context window. Since context windows are usually sized in tokens, this value is an approximation. Assuming 2 bytes per input token should be safe.  Currently, Teleport will outright reject sessions larger than this limit; future versions will split sessions in chunks, treating this size as a maximum.  If unset or set to 0, defaults to 1MB.
+- `openai` (Attributes) Openai indicates that this model uses OpenAI as the inference provider and specifies OpenAI-specific parameters. (see [below for nested schema](#nested-schema-for-specopenai))
+
+### Nested Schema for `spec.bedrock`
+
+Optional:
+
+- `bedrock_model_id` (String) BedrockModelId specifies a model ID or an inference profile as understood by the Bedrock API.
+- `integration` (String) Integration is the AWS OIDC Integration name. If unset, Teleport will use AWS credentials available on the Auth Service machine; otherwise, it will use the specified OIDC integration for assuming appropriate role.
+- `region` (String) Region is the AWS region which will be used for inference.
+
+
+### Nested Schema for `spec.openai`
+
+Optional:
+
+- `api_key_secret_ref` (String) ApiKeySecretRef is a reference to an InferenceSecret that contains the OpenAI API key.
+- `base_url` (String) BaseUrl is the OpenAI API base URL. Optional, defaults to the public OpenAI API URL. May be used to point to a custom OpenAI-compatible API, such as LiteLLM. In such case, the `api_key_secret_ref` must point to a secret that contains the API key for that custom API.
+- `openai_model_id` (String) OpenaiModelId specifies the model ID, as understood by the OpenAI API.

docs/pages/reference/infrastructure-as-code/terraform-provider/resources/inference_policy.mdx

@@ -0,0 +1,52 @@
+---
+title: Reference for the teleport_inference_policy Terraform resource
+sidebar_label: inference_policy
+description: This page describes the supported values of the teleport_inference_policy resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_inference_policy resource of the Teleport Terraform provider.
+
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes) (see [below for nested schema](#nested-schema-for-spec))
+
+### Optional
+
+- `sub_kind` (String) SubKind is the resource sub-kind. Should be empty.
+- `version` (String) Version is the resource version. Should be set to "v1".
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `kinds` (List of String) Kinds are session kinds matched by this policy, e.g., "ssh", "k8s", "db"
+- `model` (String) Model is the name of the `InferenceModel` resource to be used for summarization.
+
+Optional:
+
+- `filter` (String) Filter is an optional filter expression using Teleport Predicate Language to select sessions for summarization. If it's empty, all sessions that match the list of kinds will be summarized using this model.

docs/pages/reference/infrastructure-as-code/terraform-provider/resources/inference_secret.mdx

@@ -0,0 +1,47 @@
+---
+title: Reference for the teleport_inference_secret Terraform resource
+sidebar_label: inference_secret
+description: This page describes the supported values of the teleport_inference_secret resource of the Teleport Terraform provider.
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
+
+This page describes the supported values of the teleport_inference_secret resource of the Teleport Terraform provider.
+
+
+
+
+
+
+{/*  schema generated by tfplugindocs */}
+## Schema
+
+### Required
+
+- `metadata` (Attributes) (see [below for nested schema](#nested-schema-for-metadata))
+- `spec` (Attributes, Sensitive) Spec contains the secret value. Once set, it can only be read by Teleport itself; it will not be returned in API responses. (see [below for nested schema](#nested-schema-for-spec))
+
+### Optional
+
+- `sub_kind` (String) SubKind is the resource sub-kind. Should be empty.
+- `version` (String) Version is the resource version. Should be set to "v1".
+
+### Nested Schema for `metadata`
+
+Required:
+
+- `name` (String) name is an object name.
+
+Optional:
+
+- `description` (String) description is object description.
+- `expires` (String) expires is a global expiry time header can be set on any resource in the system.
+- `labels` (Map of String) labels is a set of labels.
+
+
+### Nested Schema for `spec`
+
+Required:
+
+- `value` (String, Sensitive) Value is the secret value, such as an API key.

docs/pages/reference/infrastructure-as-code/terraform-provider/resources/resources.mdx

@@ -28,6 +28,9 @@ The Teleport Terraform provider supports the following resources:
   - [`teleport_dynamic_windows_desktop`](./dynamic_windows_desktop.mdx)
   - [`teleport_github_connector`](./github_connector.mdx)
   - [`teleport_health_check_config`](./health_check_config.mdx)
+  - [`teleport_inference_model`](./inference_model.mdx)
+  - [`teleport_inference_policy`](./inference_policy.mdx)
+  - [`teleport_inference_secret`](./inference_secret.mdx)
   - [`teleport_installer`](./installer.mdx)
   - [`teleport_integration`](./integration.mdx)
   - [`teleport_login_rule`](./login_rule.mdx)