tctl: fix create cmd when input starts with an empty doc

tool/tctl/common/resource_command.go

@@ -26,6 +26,7 @@ import (
 	"log/slog"
 	"math"
 	"os"
+	"reflect"
 	"slices"
 	"sort"
 	"strings"
@@ -403,6 +404,14 @@ func (rc *ResourceCommand) Create(ctx context.Context, client *authclient.Client
 			}
 			return trace.Wrap(err)
 		}
+
+		// An empty document at the beginning of the input will unmarshal without error.
+		// Keep reading - there may be a valid document later on.
+		// https://github.com/gravitational/teleport/issues/4703
+		if reflect.ValueOf(raw).IsZero() {
+			continue
+		}
+
 		count++
 
 		// locate the creator function for a given resource kind:

tool/tctl/common/resource_command_test.go

@@ -1407,6 +1407,10 @@ func TestCreateResources(t *testing.T) {
 				assert.Contains(t, s, "kind: user")
 			},
 		},
+		{
+			kind:   "empty-doc",
+			create: testCreateWithEmptyDocument,
+		},
 		{
 			kind:   types.KindDatabaseObjectImportRule,
 			create: testCreateDatabaseObjectImportRule,
@@ -1675,6 +1679,22 @@ spec:
 	require.NoError(t, err)
 }
 
+func testCreateWithEmptyDocument(t *testing.T, clt *authclient.Client) {
+	const userYAML = `
+---
+kind: user
+version: v2
+metadata:
+  name: llama2
+spec:
+  roles: ["access"]
+`
+	userYAMLPath := filepath.Join(t.TempDir(), "user.yaml")
+	require.NoError(t, os.WriteFile(userYAMLPath, []byte(userYAML), 0644))
+	_, err := runResourceCommand(t, clt, []string{"create", userYAMLPath})
+	require.NoError(t, err)
+}
+
 func testCreateUser(t *testing.T, clt *authclient.Client) {
 	// Ensure that our test user does not exist
 	_, err := runResourceCommand(t, clt, []string{"get", types.KindUser + "/llama", "--format=json"})