606 Commits (073fd0d183a6fa68965bdfcedbf459e2fbc78f8d)

Author	SHA1	Message	Date
Kristin Laemmert	604e65bb62	Revert "backend/local: release lock if there is an error in Context() (#25427)" ... This reverts commit 1ba0d615e7.	6 years ago
Kristin Laemmert	1ba0d615e7	backend/local: release lock if there is an error in Context() (#25427) ... * command/console: return in case of errors before trying to unlock remote state The remote backend `Context` would exit without an active lock if there was an error, while the local backend `Context` exited *with* a lock. This caused a problem in `terraform console`, which would call unlock regardless of error status. This commit makes the local and remote backend consistently unlock the state incase of error, and updates terraform console to check for errors before trying to unlock the state. * adding tests for remote and local backends	6 years ago
Even Holthe	0f85b283b9	Azure backend: support snapshots/versioning (#24069) ... * Azure backend: support snapshots/versioning Co-authored-by: Reda Ahdjoudj <reda.ahdjoudj@gmail.com> Co-authored-by: Patrick F. Marques <patrickfmarques@gmail.com> * Azure backend: Versioning -> Snapshot Co-authored-by: Reda Ahdjoudj <reda.ahdjoudj@gmail.com> Co-authored-by: Patrick F. Marques <patrickfmarques@gmail.com>	6 years ago
James Bardin	35d232481f	prevent panic in remote backend retry ... Ensure that the *http.Response is not nil before checking the status.	6 years ago
Petros Kolyvas	4a3d0118c6	Merge pull request #25139 from xiaozhu36/master ... backend/oss: supports setting HTTPS_PROXY	6 years ago
James Bardin	7800ef63d4	Merge pull request #19525 from dramich/k8sback ... backend/kubernetes: Add Kubernetes as a backend	6 years ago
John Houston	01ebdd27f2	Rework soak test to error on unlock failure	6 years ago
John Houston	b0f7e273e8	Add errors for lock disappearing	6 years ago
Brian Flad	ba081aa10a	backend/s3: Updates for Terraform v0.13.0 (#25134) ... * deps: Update github.com/hashicorp/aws-sdk-go-base@v0.5.0 Updated via: ``` $ go get github.com/hashicorp/aws-sdk-go-base@v0.5.0 $ go mod tidy $ go mod vendor ``` * backend/s3: Updates for Terraform v0.13.0 Reference: https://github.com/hashicorp/terraform/issues/13410 Reference: https://github.com/hashicorp/terraform/issues/18774 Reference: https://github.com/hashicorp/terraform/issues/19482 Reference: https://github.com/hashicorp/terraform/issues/20062 Reference: https://github.com/hashicorp/terraform/issues/20599 Reference: https://github.com/hashicorp/terraform/issues/22103 Reference: https://github.com/hashicorp/terraform/issues/22161 Reference: https://github.com/hashicorp/terraform/issues/22601 Reference: https://github.com/hashicorp/terraform/issues/22992 Reference: https://github.com/hashicorp/terraform/issues/24252 Reference: https://github.com/hashicorp/terraform/issues/24253 Reference: https://github.com/hashicorp/terraform/issues/24480 Reference: https://github.com/hashicorp/terraform/issues/25056 Changes: ``` NOTES * backend/s3: Deprecated `lock_table`, `skip_get_ec2_platforms`, `skip_requesting_account_id` arguments have been removed * backend/s3: Credential ordering has changed from static, environment, shared credentials, EC2 metadata, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata) to static, environment, shared credentials, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata) * The `AWS_METADATA_TIMEOUT` environment variable no longer has any effect as we now depend on the default AWS Go SDK EC2 Metadata client timeout of one second with two retries ENHANCEMENTS * backend/s3: Always enable shared configuration file support (no longer require `AWS_SDK_LOAD_CONFIG` environment variable) * backend/s3: Automatically expand `~` prefix for home directories in `shared_credentials_file` argument * backend/s3: Add `assume_role_duration_seconds`, `assume_role_policy_arns`, `assume_role_tags`, and `assume_role_transitive_tag_keys` arguments BUG FIXES * backend/s3: Ensure configured profile is used * backend/s3: Ensure configured STS endpoint is used during AssumeRole API calls * backend/s3: Prefer AWS shared configuration over EC2 metadata credentials * backend/s3: Prefer ECS credentials over EC2 metadata credentials * backend/s3: Remove hardcoded AWS Provider messaging ``` Output from acceptance testing: ``` --- PASS: TestBackend (16.32s) --- PASS: TestBackendConfig (0.58s) --- PASS: TestBackendConfig_AssumeRole (0.02s) --- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s) --- PASS: TestBackendConfig_invalidKey (0.00s) --- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s) --- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s) --- PASS: TestBackendExtraPaths (13.21s) --- PASS: TestBackendLocked (28.98s) --- PASS: TestBackendPrefixInWorkspace (5.65s) --- PASS: TestBackendSSECustomerKey (17.60s) --- PASS: TestBackend_impl (0.00s) --- PASS: TestForceUnlock (17.50s) --- PASS: TestKeyEnv (50.25s) --- PASS: TestRemoteClient (4.78s) --- PASS: TestRemoteClientLocks (16.85s) --- PASS: TestRemoteClient_clientMD5 (12.08s) --- PASS: TestRemoteClient_impl (0.00s) --- PASS: TestRemoteClient_stateChecksum (17.92s) ```	6 years ago
John Houston	e5f7237582	Soak test for kubernetes backend	6 years ago
Kristin Laemmert	e6cf6cd758	backend/remote: do not panic if PrepareConfig or Configure receive null (#25135) ... * backend/remote: do not panic if PrepareConfig or Configure receive null objects If a user cancels (ctrl-c) terraform init while it is requesting missing configuration options for the remote backend, the PrepareConfig and Configure functions would receive a null cty.Value which would result in panics. This PR adds a check for null objects to the two functions in question. Fixes #23992	6 years ago
He Guimin	5b4950e2cb	backend(oss): supports setting HTTPS_PROXY	6 years ago
John Houston	23fb8f6d21	Add kubernetes backend ... Co-authored-by: Dan Ramich <danold215@gmail.com>	6 years ago
Martin Atkins	31a4b44d2e	backend/local: treat output changes as side-effects to be applied ... This is a baby-step towards an intended future where all Terraform actions which have side-effects in either remote objects or the Terraform state can go through the plan+apply workflow. This initial change is focused only on allowing plan+apply for changes to root module output values, so that these can be written into a new state snapshot (for consumption by terraform_remote_state elsewhere) without having to go outside of the primary workflow by running "terraform refresh". This is also better than "terraform refresh" because it gives an opportunity to review the proposed changes before applying them, as we're accustomed to with resource changes. The downside here is that Terraform Core was not designed to produce accurate changesets for root module outputs. Although we added a place for it in the plan model in Terraform 0.12, Terraform Core currently produces inaccurate changesets there which don't properly track the prior values. We're planning to rework Terraform Core's evaluation approach in a forthcoming release so it would itself be able to distinguish between the prior state and the planned new state to produce an accurate changeset, but this commit introduces a temporary stop-gap solution of implementing the logic up in the local backend code, where we can freeze a snapshot of the prior state before we take any other actions and then use that to produce an accurate output changeset to decide whether the plan has externally-visible side-effects and render any changes to output values. This temporary approach should be replaced by a more appropriately-placed solution in Terraform Core in a release, which should then allow further behaviors in similar vein, such as user-visible drift detection for resource instances.	6 years ago
Matthew Frahry	481b03c34a	Update azure backend storage sdk (#24669) ... * update vendored azure sdk * vendor giovanni storage sdk * Add giovanni clients * go mod vendor * Swap to new storage sdk * workable tests * update .go-version to 1.14.2 * Tests working minus SAS * Add SAS Token support * Update vendor * Passing tests * Add date randomizer * Captalize RG * Remove random bits * Update client var name Co-authored-by: kt <kt@katbyte.me>	6 years ago
CJ Horton	e1dcae17b7	add sad path tests for the TFP API version check	6 years ago
CJ Horton	68f199fc76	replace status string with go-tfe enum	6 years ago
Martin Atkins	8e1615a802	backend/remote: Handle cost estimation skipped due to targeting ... The remote server might choose to skip running cost estimation for a targeted plan, in which case we'll show a note about it in the UI and then move on, rather than returning an "invalid status" error. This new status isn't yet available in the go-tfe library as a constant, so for now we have the string directly in our switch statement. This is a pragmatic way to expedite getting the "critical path" of this feature in place without blocking on changes to ancillary codebases. A subsequent commit should switch this over to tfe.CostEstimateSkippedDueToTargeting once that's available in a go-tfe release.	6 years ago
CJ Horton	0eea4e7c62	prevent targeting for unsupported API versions	6 years ago
Mike Nomitch	650a272a1d	Change message sent to remote backend if -target used	6 years ago
Martin Atkins	16f1f3b739	backend/remote: Support -target on plan and apply ... Previously we did not allow -target to be used with the remote backend because there was no way to send the targets to Terraform Cloud/Enterprise via the API. There is now an attribute in the request for creating a plan that allows us to send target addresses, so we'll remove that restriction and copy the given target addresses into the API request.	6 years ago
Martin Atkins	db4f3f8bc5	vendor: go get github.com/hashicorp/go-tfe@v0.8.0 ... This includes a new TargetAddrs field on both Run and RunCreateOptions which we'll use to send resource addresses that were specified using -target on the CLI command line when using the remote backend. There were some unrelated upstream breaking changes compared to the last version we had vendored, so this commit also includes some changes to the backend/remote package to work with this new API, which now requires the remote backend to be aware of the remote system's opaque workspace id.	6 years ago
Pam Selle	60b3815af4	Merge pull request #24696 from hashicorp/leetrout/remote-state-force-push ... Add support for force pushing with the remote backend	6 years ago
Lee Trout	cb0e20ca2b	Add support for force pushing with the remote backend ... Both differing serials and lineage protections should be bypassed with the -force flag (in addition to resources). Compared to other backends we aren’t just shipping over the state bytes in a simple payload during the persistence phase of the push command and the force flag added to the Go TFE client needs to be specified at that time. To prevent changing every method signature of PersistState of the remote client I added an optional interface that provides a hook to flag the Client as operating in a force push context. Changing the method signature would be more explicit at the cost of not being used anywhere else currently or the optional interface pattern could be applied to the state itself so it could be upgraded to support PersistState(force bool) only when needed. Prior to this only the resources of the state were checked for changes not the lineage or the serial. To bring this in line with documented behavior noted above those attributes also have a “read” counterpart just like state has. These are now checked along with state to determine if the state as a whole is unchanged. Tests were altered to table driven test format and testing was expanded to include WriteStateForMigration and its interaction with a ClientForcePusher type.	6 years ago
Kritonas	71395a0656	Fixed minor grammatical errors	6 years ago
kayrus	bd344f9d73	Sync auth options with upstream openstack provider	6 years ago
kayrus	50084f5b17	gofmt -w -s	6 years ago
Ryan Uber	105fcb3cac	backend/remote: move reading policy check logs earlier	6 years ago
Ryan Uber	93906e1ad8	backend/remote: display cost estimate and policy check whenever available	6 years ago
Kristin Laemmert	32062b00a2	backend/local: refactor tests with modern state and default providers (#24524)	6 years ago
Martin Atkins	549aede792	Remove terraform.ResourceProvider, use providercache.Installer instead ... Back when we first introduced provider versioning in Terraform 0.10, we did the provider version resolution in terraform.NewContext because we weren't sure yet how exactly our versioning model was going to play out (whether different versions could be selected per provider configuration, for example) and because we were building around the limitations of our existing filesystem-based plugin discovery model. However, the new installer codepath is new able to do all of the selections up front during installation, so we don't need such a heavy inversion of control abstraction to get this done: the command package can select the exact provider versions and pass their factories directly to terraform.NewContext as a simple static map. The result of this commit is that CLI commands other than "init" are now able to consume the local cache directory and selections produced by the installation process in "terraform init", passing all of the selected providers down to the terraform.NewContext function for use in implementing the main operations. This commit is just enough to get the providers passing into the terraform.Context. There's still plenty more to do here, including to repair all of the tests this change has additionally broken.	6 years ago
James Bardin	33464568e8	Merge pull request #24346 from hashicorp/jbardin/module-expansion-another-part ... Continue pushing the Path calls out of the Resource and Provider types	6 years ago
James Bardin	e13eecbc5b	finish provider ModuleInstance replacement	6 years ago
James Bardin	f6221100ee	Merge pull request #24149 from mlafeldt/fix-oss-state-locking ... Fix & improve state locking of OSS backend	6 years ago
Yuri Astrakhan	6eb968531d	backend/plan: Show warnings even if no changes are needed	6 years ago
Mathias Lafeldt	1f3a2c0e02	backend/remote-state/oss: Add test revealing bug in state locking	6 years ago
Mathias Lafeldt	07139e453a	backend/remote-state/oss: extract pkName constant	6 years ago
Mathias Lafeldt	6bb22907a1	backend/remote-state/oss: Fix state locking by using LockID as PK	6 years ago
Mathias Lafeldt	b4a735779c	backend/remote-state/oss: Prepend bucket name to LockID ... To allow using the same Tablestore table with multiple OSS buckets. e.g. instead of env:/some/path/terraform.tfstate the LockID now becomes some-bucket/env:/some/path/terraform.tfstate	6 years ago
Mathias Lafeldt	3b3739b0ca	backend/remote-state/oss: Add missing lock path to lock info ... So that is shows up in lock errors, etc.	6 years ago
Mathias Lafeldt	bbd2d46ac8	backend/remote-state/oss: Format code using goimports	6 years ago
Kristin Laemmert	47a16b0937	addrs: embed Provider in AbsProviderConfig instead of Type ... a large refactor to addrs.AbsProviderConfig, embedding the addrs.Provider instead of a Type string. I've added and updated tests, added some Legacy functions to support older state formats and shims, and added a normalization step when reading v4 (current) state files (not the added tests under states/statefile/roundtrip which work with both current and legacy-style AbsProviderConfig strings). The remaining 'fixme' and 'todo' comments are mostly going to be addressed in a subsequent PR and involve looking up a given local provider config's FQN. This is fine for now as we are only working with default assumption.	6 years ago
Li Kexian	76e5b446ba	backend/cos: Add TencentCloud backend cos with lock (#22540) ... * add TencentCloud COS backend for remote state * add vendor of dependence * fixed error not handle and remove default value for prefix argument * get appid from TF_COS_APPID environment variables	6 years ago
Alisdair McDiarmid	f15e58adf8	Improve remote backend missing token error ... Prompt the user to run terraform login to generate and store a token for the configured remote backend.	6 years ago
Kristin Laemmert	80ab551867	terraform: use addrs.Provider as map keys for provider schemas (#24002) ... This is a stepping-stone PR for the provider source project. In this PR "legcay-stype" FQNs are created from the provider name string. Future work involves encoding the FQN directly in the AbsProviderConfig and removing the calls to addrs.NewLegacyProvider().	6 years ago
Martin Atkins	8b511524d6	Initial steps towards AbsProviderConfig/LocalProviderConfig separation (#23978) ... * Introduce "Local" terminology for non-absolute provider config addresses In a future change AbsProviderConfig and LocalProviderConfig are going to become two entirely distinct types, rather than Abs embedding Local as written here. This naming change is in preparation for that subsequent work, which will also include introducing a new "ProviderConfig" type that is an interface that AbsProviderConfig and LocalProviderConfig both implement. This is intended to be largely just a naming change to get started, so we can deal with all of the messy renaming. However, this did also require a slight change in modeling where the Resource.DefaultProviderConfig method has become Resource.DefaultProvider returning a Provider address directly, because this method doesn't have enough information to construct a true and accurate LocalProviderConfig -- it would need to refer to the configuration to know what this module is calling the provider it has selected. In order to leave a trail to follow for subsequent work, all of the changes here are intended to ensure that remaining work will become obvious via compile-time errors when all of the following changes happen: - The concept of "legacy" provider addresses is removed from the addrs package, including removing addrs.NewLegacyProvider and addrs.Provider.LegacyString. - addrs.AbsProviderConfig stops having addrs.LocalProviderConfig embedded in it and has an addrs.Provider and a string alias directly instead. - The provider-schema-handling parts of Terraform core are updated to work with addrs.Provider to identify providers, rather than legacy strings. In particular, there are still several codepaths here making legacy provider address assumptions (in order to limit the scope of this change) but I've made sure each one is doing something that relies on at least one of the above changes not having been made yet. * addrs: ProviderConfig interface In a (very) few special situations in the main "terraform" package we need to make runtime decisions about whether a provider config is absolute or local. We currently do that by exploiting the fact that AbsProviderConfig has LocalProviderConfig nested inside of it and so in the local case we can just ignore the wrapping AbsProviderConfig and use the embedded value. In a future change we'll be moving away from that embedding and making these two types distinct in order to represent that mapping between them requires consulting a lookup table in the configuration, and so here we introduce a new interface type ProviderConfig that can represent either AbsProviderConfig or LocalProviderConfig decided dynamically at runtime. This also includes the Config.ResolveAbsProviderAddr method that will eventually be responsible for that local-to-absolute translation, so that callers with access to the configuration can normalize to an addrs.AbsProviderConfig given a non-nil addrs.ProviderConfig. That's currently unused because existing callers are still relying on the simplistic structural transform, but we'll switch them over in a later commit. * rename LocalType to LocalName Co-authored-by: Kristin Laemmert <mildwonkey@users.noreply.github.com>	6 years ago
Kristin Laemmert	6541775ce4	addrs: roll back change to Type field in ProviderConfig (#23937)	6 years ago
Daniel Dreier	05c9407986	Merge pull request #23293 from kmfk/hide-values-undeclared-var-warning ... Avoid leaking sensitive values in undeclared variable warnings	6 years ago
Pam Selle	37d16b2f79	Deletions from backend local	6 years ago
Pam Selle	bb3d513c4f	Some deletions from static analysis	6 years ago