638 Commits (6440c839474f052d8997bb5cec19c2743e5108e6)

Author	SHA1	Message	Date
Kristin Laemmert	3933cbd491	remove LegacyProvider (#26433)	5 years ago
Kristin Laemmert	d76cfc8c0c	Merge pull request #26440 from hashicorp/mildwonkey/remove-older-state-vs ... refactor tests to use modern states.State in favor of terraform.State where possible	5 years ago
Pam Selle	3a99405b8b	Merge pull request #26420 from remilapeyre/postgres-default-backend ... Always have the default workspace in the pg backend	5 years ago
Kristin Laemmert	479655ad47	refactor tests to use modern states.State in favor of terraform.State where possible	5 years ago
James Bardin	ab6d6f99ae	fix races in remote backend mock	5 years ago
Rémi Lapeyre	9acfe30ca6	Always have the default workspace in the pg backend ... Closes https://github.com/hashicorp/terraform/issues/23121	5 years ago
James Bardin	37569f5cc3	insert PlanRefresh into the context	6 years ago
James Bardin	bc82347a04	fix tests ... Update tests to match the new behavior. Some were incorrect, some no longer make sense, and some just weren't setup to handle th plan api calls.	6 years ago
James Bardin	312317abd0	wrong instance key in test state ... This was never picked up by the tests until now	6 years ago
James Bardin	8658424059	skip plan with no refresh test ... We still need to determine if `-refresh=false` is even useful with the new planning strategy.	6 years ago
James Bardin	f52d836e0a	fix local backend tests to match new behavior ... Leaving plan with -refresh=false tests failing for now.	6 years ago
James Bardin	be757bd416	Refresh instances during plan ... This change refreshes the instance state during plan, so a complete Refresh no longer needs to happen before Plan.	6 years ago
Alisdair McDiarmid	e183163739	Merge pull request #25856 from remilapeyre/consul-split-state ... Split the state in chunks when they outgrow the limit of Consul KV store	6 years ago
Alisdair McDiarmid	92abaadc02	Merge pull request #25842 from remilapeyre/consul-path-slash ... Sanitize lock path for the Consul backend when it ends with a /	6 years ago
Alisdair McDiarmid	09d8355f43	command: Add experimental concise diff renderer ... When rendering a diff between current state and projected state, we only show resources and outputs which have changes. However, we show a full structural diff for these values, which includes all attributes and blocks for a changed resource or output. The result can be a very long diff, which makes it difficult to verify what the changed fields are. This commit adds an experimental concise diff renderer, which suppresses most unchanged fields, only displaying the most relevant changes and some identifying context. This means: - Always show all identifying attributes, initially defined as `id`, `name`, and `tags`, even if unchanged; - Only show changed, added, or removed primitive values: `string`, `number`, or `bool`; - Only show added or removed elements in unordered collections and structural types: `map`, `set`, and `object`; - Show added or removed elements with any surrounding unchanged elements for sequence types: `list` and `tuple`; - Only show added or removed nested blocks, or blocks with changed attributes. If any attributes, collection elements, or blocks are hidden, a count is kept and displayed at the end of the parent scope. This ensures that it is clear that the diff is only displaying a subset of the resource. The experiment is currently enabled by default, but can be disabled by setting the TF_X_CONCISE_DIFF environment variable to 0.	6 years ago
Kirill Zaborsky	fbd3f191bd	Minor typo	6 years ago
Matt Kasa	c2e35ae3b5	backend/http: add support for configuration by environment variable (#25439)	6 years ago
Kristin Laemmert	196c183dda	terraform: remove state from `validate` graph walk (#26063) ... This pull reverts a recent change to backend/local which created two context, one with and one without state. Instead I have removed the state entirely from the validate graph (by explicitly passing a states.NewState() to the validate graph builder). This changed caused a test failure, which (ty so much for the help) @jbardin discovered was inaccurate all along: the test's call to `Validate()` was actually what was removing the output from state. The new expected test output matches terraform's actual behavior on the command line: if you use -target to destroy a resource, an output that references only that resource is *not* removed from state even though that test would lead you to believe it did. This includes two tests to cover the expected behavior: TestPlan_varsUnset has been updated so it will panic if it gets more than one request to input a variable TestPlan_providerArgumentUnset covers #26035 Fixes #26035, #26027	6 years ago
James Bardin	0c5430f88d	Merge pull request #25585 from chushenmeshile/master ... fix ossbackend only returned 100 workspaces	6 years ago
James Bardin	bd5ff98ca7	Merge pull request #25830 from hashicorp/kt/secret-metadata-host ... backend/azurerm: support loading environments from a metadata host	6 years ago
James Bardin	d46e9a4198	Merge pull request #25770 from hashicorp/f/azure-backend-spcert ... backend/azurerm: support for authenticating using a Client Certificate	6 years ago
Angie Pinilla	582fb73a7c	deps: Update aws-sdk-go-based to 0.6.0	6 years ago
Rémi Lapeyre	e680211bc0	Split the state in chunks when they outgrow the limit of Consul KV store ... The Consul KV store limits the size of the values in the KV store to 524288 bytes. Once the state reaches this limit Consul will refuse to save it. It is currently possible to try to bypass this limitation by enable Gzip but the issue will manifest itself later. This is particularly inconvenient as it is possible for the state to reach this limit without changing the Terraform configuration as datasources or computed attributes can suddenly return more data than they used to. Several users already had issues with this. To fix the problem once and for all we now split the payload in chunks of 524288 bytes when they are to large and store them separatly in the KV store. A small JSON payload that references all the chunks so we can retrieve them later and concatenate them to reconstruct the payload. While this has the caveat of requiring multiple calls to Consul that cannot be done as a single transaction as those have the same size limit, we use unique paths for the chunks and CAS when setting the last payload so possible issues during calls to Put() should not result in unreadable states. Closes https://github.com/hashicorp/terraform/issues/19182	6 years ago
Rémi Lapeyre	032d339915	Sanitize lock path for the Consul backend when it ends with a / ... When the path ends with / (e.g. `path = "tfstate/"), the lock path used will contain two consecutive slashes (e.g. `tfstate//.lock`) which Consul does not accept. This change the lock path so it is sanitized to `tfstate/.lock`. If the user has two different Terraform project, one with `path = "tfstate"` and the other with `path = "tfstate/"`, the paths for the locks will be the same which will be confusing as locking one project will lock both. I wish it were possible to forbid ending slashes altogether but doing so would require all users currently having an ending slash in the path to manually move their Terraform state and would be a poor user experience. Closes https://github.com/hashicorp/terraform/issues/15747	6 years ago
kt	23b4c2db42	azurerm backend: support loading metadata from a given host	6 years ago
James Bardin	1c09df1a66	Merge pull request #25779 from hashicorp/jbardin/remove-state-attrs ... Remove resource state attributes that are no longer in the schema	6 years ago
Kristin Laemmert	6621501ae3	state: remove deprecated state package (#25490) ... Most of the state package has been deprecated by the states package. This PR replaces all the references to the old state package that can be done simply - the low-hanging fruit. * states: move state.Locker to statemgr The state.Locker interface was a wrapper around a statemgr.Full, so moving this was relatively straightforward. * command: remove unnecessary use of state package for writing local terraform state files * move state.LocalState into terraform package state.LocalState is responsible for managing terraform.States, so it made sense (to me) to move it into the terraform package. * slight change of heart: move state.LocalState into clistate instead of terraform	6 years ago
Kristin Laemmert	86e9ba3d65	* backend/local: push responsibility for unlocking state into individual operations ... * unlock the state if Context() has an error, exactly as backend/remote does today * terraform console and terraform import will exit before unlocking state in case of error in Context() * responsibility for unlocking state in the local backend is pushed down the stack, out of backend.go and into each individual state operation * add tests confirming that state is not locked after apply and plan * backend/local: add checks that the state is unlocked after operations This adds tests to plan, apply and refresh which validate that the state is unlocked after all operations, regardless of exit status. I've also added specific tests that force Context() to fail during each operation to verify that locking behavior specifically.	6 years ago
James Bardin	3cf84bb3f9	don't add state to the validate context ... The validate command should work with the configuration, but when validate was run at the start of a plan or apply command the state was inserted in preparation for the next walk. This could lead to errors when the resource schemas had changes and the state could not be upgraded or decoded.	6 years ago
tombuildsstuff	d215453495	backend/azurerm: adding a missing docs string. fixes #25765	6 years ago
tombuildsstuff	0d34e5d97c	backend/azurerm: support for authenticating using a Client Certificate ... fixes #24179 supersedes #19606 dependent on #25769	6 years ago
zjd	25de713214	fix ossbackend only returned 100 workspaces	6 years ago
Kristin Laemmert	604e65bb62	Revert "backend/local: release lock if there is an error in Context() (#25427)" ... This reverts commit 1ba0d615e7.	6 years ago
Kristin Laemmert	1ba0d615e7	backend/local: release lock if there is an error in Context() (#25427) ... * command/console: return in case of errors before trying to unlock remote state The remote backend `Context` would exit without an active lock if there was an error, while the local backend `Context` exited *with* a lock. This caused a problem in `terraform console`, which would call unlock regardless of error status. This commit makes the local and remote backend consistently unlock the state incase of error, and updates terraform console to check for errors before trying to unlock the state. * adding tests for remote and local backends	6 years ago
Even Holthe	0f85b283b9	Azure backend: support snapshots/versioning (#24069) ... * Azure backend: support snapshots/versioning Co-authored-by: Reda Ahdjoudj <reda.ahdjoudj@gmail.com> Co-authored-by: Patrick F. Marques <patrickfmarques@gmail.com> * Azure backend: Versioning -> Snapshot Co-authored-by: Reda Ahdjoudj <reda.ahdjoudj@gmail.com> Co-authored-by: Patrick F. Marques <patrickfmarques@gmail.com>	6 years ago
James Bardin	35d232481f	prevent panic in remote backend retry ... Ensure that the *http.Response is not nil before checking the status.	6 years ago
Petros Kolyvas	4a3d0118c6	Merge pull request #25139 from xiaozhu36/master ... backend/oss: supports setting HTTPS_PROXY	6 years ago
James Bardin	7800ef63d4	Merge pull request #19525 from dramich/k8sback ... backend/kubernetes: Add Kubernetes as a backend	6 years ago
John Houston	01ebdd27f2	Rework soak test to error on unlock failure	6 years ago
John Houston	b0f7e273e8	Add errors for lock disappearing	6 years ago
Brian Flad	ba081aa10a	backend/s3: Updates for Terraform v0.13.0 (#25134) ... * deps: Update github.com/hashicorp/aws-sdk-go-base@v0.5.0 Updated via: ``` $ go get github.com/hashicorp/aws-sdk-go-base@v0.5.0 $ go mod tidy $ go mod vendor ``` * backend/s3: Updates for Terraform v0.13.0 Reference: https://github.com/hashicorp/terraform/issues/13410 Reference: https://github.com/hashicorp/terraform/issues/18774 Reference: https://github.com/hashicorp/terraform/issues/19482 Reference: https://github.com/hashicorp/terraform/issues/20062 Reference: https://github.com/hashicorp/terraform/issues/20599 Reference: https://github.com/hashicorp/terraform/issues/22103 Reference: https://github.com/hashicorp/terraform/issues/22161 Reference: https://github.com/hashicorp/terraform/issues/22601 Reference: https://github.com/hashicorp/terraform/issues/22992 Reference: https://github.com/hashicorp/terraform/issues/24252 Reference: https://github.com/hashicorp/terraform/issues/24253 Reference: https://github.com/hashicorp/terraform/issues/24480 Reference: https://github.com/hashicorp/terraform/issues/25056 Changes: ``` NOTES * backend/s3: Deprecated `lock_table`, `skip_get_ec2_platforms`, `skip_requesting_account_id` arguments have been removed * backend/s3: Credential ordering has changed from static, environment, shared credentials, EC2 metadata, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata) to static, environment, shared credentials, default AWS Go SDK (shared configuration, web identity, ECS, EC2 Metadata) * The `AWS_METADATA_TIMEOUT` environment variable no longer has any effect as we now depend on the default AWS Go SDK EC2 Metadata client timeout of one second with two retries ENHANCEMENTS * backend/s3: Always enable shared configuration file support (no longer require `AWS_SDK_LOAD_CONFIG` environment variable) * backend/s3: Automatically expand `~` prefix for home directories in `shared_credentials_file` argument * backend/s3: Add `assume_role_duration_seconds`, `assume_role_policy_arns`, `assume_role_tags`, and `assume_role_transitive_tag_keys` arguments BUG FIXES * backend/s3: Ensure configured profile is used * backend/s3: Ensure configured STS endpoint is used during AssumeRole API calls * backend/s3: Prefer AWS shared configuration over EC2 metadata credentials * backend/s3: Prefer ECS credentials over EC2 metadata credentials * backend/s3: Remove hardcoded AWS Provider messaging ``` Output from acceptance testing: ``` --- PASS: TestBackend (16.32s) --- PASS: TestBackendConfig (0.58s) --- PASS: TestBackendConfig_AssumeRole (0.02s) --- PASS: TestBackendConfig_conflictingEncryptionSchema (0.00s) --- PASS: TestBackendConfig_invalidKey (0.00s) --- PASS: TestBackendConfig_invalidSSECustomerKeyEncoding (0.00s) --- PASS: TestBackendConfig_invalidSSECustomerKeyLength (0.00s) --- PASS: TestBackendExtraPaths (13.21s) --- PASS: TestBackendLocked (28.98s) --- PASS: TestBackendPrefixInWorkspace (5.65s) --- PASS: TestBackendSSECustomerKey (17.60s) --- PASS: TestBackend_impl (0.00s) --- PASS: TestForceUnlock (17.50s) --- PASS: TestKeyEnv (50.25s) --- PASS: TestRemoteClient (4.78s) --- PASS: TestRemoteClientLocks (16.85s) --- PASS: TestRemoteClient_clientMD5 (12.08s) --- PASS: TestRemoteClient_impl (0.00s) --- PASS: TestRemoteClient_stateChecksum (17.92s) ```	6 years ago
John Houston	e5f7237582	Soak test for kubernetes backend	6 years ago
Kristin Laemmert	e6cf6cd758	backend/remote: do not panic if PrepareConfig or Configure receive null (#25135) ... * backend/remote: do not panic if PrepareConfig or Configure receive null objects If a user cancels (ctrl-c) terraform init while it is requesting missing configuration options for the remote backend, the PrepareConfig and Configure functions would receive a null cty.Value which would result in panics. This PR adds a check for null objects to the two functions in question. Fixes #23992	6 years ago
He Guimin	5b4950e2cb	backend(oss): supports setting HTTPS_PROXY	6 years ago
John Houston	23fb8f6d21	Add kubernetes backend ... Co-authored-by: Dan Ramich <danold215@gmail.com>	6 years ago
Martin Atkins	31a4b44d2e	backend/local: treat output changes as side-effects to be applied ... This is a baby-step towards an intended future where all Terraform actions which have side-effects in either remote objects or the Terraform state can go through the plan+apply workflow. This initial change is focused only on allowing plan+apply for changes to root module output values, so that these can be written into a new state snapshot (for consumption by terraform_remote_state elsewhere) without having to go outside of the primary workflow by running "terraform refresh". This is also better than "terraform refresh" because it gives an opportunity to review the proposed changes before applying them, as we're accustomed to with resource changes. The downside here is that Terraform Core was not designed to produce accurate changesets for root module outputs. Although we added a place for it in the plan model in Terraform 0.12, Terraform Core currently produces inaccurate changesets there which don't properly track the prior values. We're planning to rework Terraform Core's evaluation approach in a forthcoming release so it would itself be able to distinguish between the prior state and the planned new state to produce an accurate changeset, but this commit introduces a temporary stop-gap solution of implementing the logic up in the local backend code, where we can freeze a snapshot of the prior state before we take any other actions and then use that to produce an accurate output changeset to decide whether the plan has externally-visible side-effects and render any changes to output values. This temporary approach should be replaced by a more appropriately-placed solution in Terraform Core in a release, which should then allow further behaviors in similar vein, such as user-visible drift detection for resource instances.	6 years ago
Matthew Frahry	481b03c34a	Update azure backend storage sdk (#24669) ... * update vendored azure sdk * vendor giovanni storage sdk * Add giovanni clients * go mod vendor * Swap to new storage sdk * workable tests * update .go-version to 1.14.2 * Tests working minus SAS * Add SAS Token support * Update vendor * Passing tests * Add date randomizer * Captalize RG * Remove random bits * Update client var name Co-authored-by: kt <kt@katbyte.me>	6 years ago
CJ Horton	e1dcae17b7	add sad path tests for the TFP API version check	6 years ago
CJ Horton	68f199fc76	replace status string with go-tfe enum	6 years ago
Martin Atkins	8e1615a802	backend/remote: Handle cost estimation skipped due to targeting ... The remote server might choose to skip running cost estimation for a targeted plan, in which case we'll show a note about it in the UI and then move on, rather than returning an "invalid status" error. This new status isn't yet available in the go-tfe library as a constant, so for now we have the string directly in our switch statement. This is a pragmatic way to expedite getting the "critical path" of this feature in place without blocking on changes to ancillary codebases. A subsequent commit should switch this over to tfe.CostEstimateSkippedDueToTargeting once that's available in a go-tfe release.	6 years ago