26 Commits (80d4c4841900bc4e6a555ffce21e3e2eae1fbe03)

Author	SHA1	Message	Date
Liam Cervante	6f89b66c5b	config generation: stop editing the original schema when filtering (#35484) ... * config generation: stop editing the original schema when filtering * copywrite headers	2 years ago
Liam Cervante	af4a734262	import: only filter id attribute at root level when generating configuration (#35220)	2 years ago
Martin Atkins	30e2fd6525	Handle marks a little more consistently ... In the very first implementation of "sensitive values" we were unfortunately not disciplined about separating the idea of "marked value" from the idea of "sensitive value" (where the latter is a subset of the former). The first implementation just assumed that any marking whatsoever meant "sensitive". We later improved that by adding the marks package and the marks.Sensitive value to standardize on the representation of "sensitive value" as being a value marked with _that specific mark_. However, we did not perform a thorough review of all of the mark-handling codepaths to make sure they all agreed on that definition. In particular, the state and plan models were both designed as if they supported arbitrary marks but then in practice marks other than marks.Sensitive would be handled in various inconsistent ways: dropped entirely, or interpreted as if marks.Sensitive, and possibly do so inconsistently when a value is used only in memory vs. round-tripped through a wire/file format. The goal of this commit is to resolve those oddities so that there are now two possible situations: - General mark handling: some codepaths genuinely handle marks generically, by transporting them from input value to output value in a way consistent with how cty itself deals with marks. This is the ideal case because it means we can add new marks in future and assume these codepaths will handle them correctly without any further modifications. - Sensitive-only mark preservation: the codepaths that interact with our wire protocols and file formats typically have only specialized support for sensitive values in particular, and lack support for any other marks. Those codepaths are now subject to a new rule where they must return an error if asked to deal with any other mark, so that if we introduce new marks in future we'll be forced either to define how we'll avoid those markings reaching the file/wire formats or extend the file/wire formats to support the new marks. Some new helper functions in package marks are intended to standardize how we deal with the "sensitive values only" situations, in the hope that this will make it easier to keep things consistent as the codebase evolves in future. In practice the modules runtime only ever uses marks.Sensitive as a mark today, so all of these checks are effectively covering "should never happen" cases. The only other mark Terraform uses is an implementation detail of "terraform console" and does not interact with any of the codepaths that only support sensitive values in particular.	2 years ago
Martin Atkins	1358245617	dependencies: Remove all non-legacy uses of hashicorp/go-multierror ... This functionality is now provided by the "errors" package in the standard library, so the HashiCorp-specific library is obsolete. This also removed our one direct use of github.com/pkg/errors, which we were using in a way that was totally redundant with the stdlib package errors. However, it lives on as an indirect dependency through the Consul backend's dependency on the Consul SDK, which uses that library.	2 years ago
Martin Atkins	d86eee6c1f	go.mod: Eliminate github.com/apparentlymart/go-dump ... I originally wrote this library as a stopgap measure because davecgh/go-spew produced a hard-to-read representation of cty.Value due to exposing the raw internals, whereas my "go-dump" instead just pretty-prints whatever fmt.Sprintf("%#v", ...) would return for a given value. However, in the meantime I wrote ctydebug as a more cty-specialized library for this purpose, and we switched to using go-cmp as our primary library for deep-comparing data structures, and so our few remaining uses of apparentlymart/go-dump were vestigial in tests that haven't been updated recently enough to have been updated to our new standards. This commit therefore swaps out all use of that library with combinations of go-cmp and ctydebug, matching our current standards for how to do these sorts of things in tests. This removes our dependency on "go-dump" altogether. At least one of our dependencies is still using go-dump as part of its own test suite, and so the Go toolchain still includes its declared version in our go.sum file. However, this library is no longer linked in to Terraform either in real builds or in test binaries, and so it gets dropped entirely from our go.mod file.	2 years ago
James Bardin	7ccb21d864	Block.Filter can panic with no attrs ... Make sure that we only dereference an attribute is it was set in the filter. While not extremely useful, a provider could have a nested object with no attributes.	2 years ago
James Bardin	663cc1d1b7	move invalid tests ... Schema attributes must have a type to be valid. These would have panicked anyway when used in other cases, but were passing within the limited test case. The update to hcl makes these panic earlier, so add our own panics to prevent invalid attribute schemas entirely.	3 years ago
Jared Baker	649f9831e7	internal/configs: CoerceValue error for omitted attribute requirements	3 years ago
CJ Horton	98b81d3c50	add missing copyright headers	3 years ago
hashicorp-copywrite[bot]	53c34ff49c	Update copyright file headers to BUSL-1.1	3 years ago
kmoe	be2ad69eda	plannable import: safer config generation and schema filters (#33232) ... * genconfig: fix nil nested block panic * genconfig: null NestingSingle blocks should be absent A NestingSingle block that is null in state should be completely absent from config. * configschema: make FilterOr variadic * configschema: apply filters to nested types * configschema: filter helper/schema id attribute The legacy SDK adds an Optional+Computed "id" attribute to the resource schema even if not defined in provider code. During validation, however, the presence of an extraneous "id" attribute in config will cause an error. Remove this attribute so we do not generate an "id" attribute where there is a risk that it is not in the real resource schema. * configschema: filter test * terraform: do not pre-validate generated config Config generated from a resource's import state may fail validation in the case of schema behaviours such as ExactlyOneOf and ConflictsWith. We don't want to fail the plan now, because that would give the user no way to proceed and fix the config to make it valid. We allow the plan to complete and output the generated config. * generate config alongside import process Rather than waiting until we call `plan()`, generate the configuration at the point of the import call, so we have the necessary data to return in case planning fails later. The `plan` and `state` predeclared variables in the plan() method were obfuscating the actual return of nil throughout, so those identifiers were removed for clarity. * move generateHCLStringAttributes closer to caller * store generated config in plan on error * test for config gen with error * add simple warning when generating config --------- Co-authored-by: James Bardin <j.bardin@gmail.com>	3 years ago
Liam Cervante	79f7f59155	Plannable import: Generate config for imported resources during the plan. (#33153) ... * command: keep our promises * remove some nil config checks Remove some of the safety checks that ensure plan nodes have config attached at the appropriate time. * add GeneratedConfig to plan changes objects Add a new GeneratedConfig field alongside Importing in plan changes. * add config generation package The genconfig package implements HCL config generation from provider state values. Thanks to @mildwonkey whose implementation of terraform add is the basis for this package. * generate config during plan If a resource is being imported and does not already have config, attempt to generate that config during planning. The config is generated from the state as an HCL string, and then parsed back into an hcl.Body to attach to the plan graph node. The generated config string is attached to the change emitted by the plan. * complete config generation prototype, and add tests --------- Co-authored-by: Katy Moe <katy@katy.moe>	3 years ago
hashicorp-copywrite[bot]	325d18262e	[COMPLIANCE] Add Copyright and License Headers	3 years ago
Nick Fagerlund	83428c91f1	Fix accidental mutation of shared `cty.Path`s in ValueMarks funcs ... Go's `append()` reserves the right to mutate its primary argument in-place, and expects the caller to assign its return value to the same variable that was passed as the primary argument. Due to what was almost definitely a typo (followed by copy-paste mishap), the configschema `Block.ValueMarks` and `Object.ValueMarks` functions were treating it like an immutable function that returns a new slice. In rare and hard-to-reproduce cases, this was causing bizarre malfunctions when marking sensitive schema attributes in deeply-nested block structures -- omitting the marks for some sensitive values (🚨), and marking other entire blocks as sensitive (which is supposed to be impossible). The chaotic and unreliable nature of the bugs is likely related to `append()`'s automatic slice reallocation behavior (if the append operation overflows the original array allocation, the resulting behavior can _look_ immutable), but there might be other contributing factors too. This commit fixes existing instances of the problem, and wraps the desired copy-and-append behavior in a helper function to simplify handling shared parent paths in an immutable way.	3 years ago
James Bardin	25f5a81048	validate deprecated attrs from static traversals ... We can't validate that data from deprecated nested attributes is used in the configuration, but we can at least catch the simple case where a deprecated attribute is referenced directly.	4 years ago
James Bardin	43100fbe39	handle nested types in StaticValidateTraversal ... The StaticValidateTraversal code was not taking into account nested structural types. Rather than create more special cases for checking Type vs NestedType, we move the ImpliedType method up to the Attribute to ensure both are used to generate the final type spec.	4 years ago
Alisdair McDiarmid	fbed52a353	configs: Add sensitive marks for nested attributes ... Object values returned from providers have their attributes marked as sensitive based on the provider schema. This was not fully implemented for nested attribute types, which is corrected in this commit.	4 years ago
Katy Moe	8e640ae151	fix typo	5 years ago
James Bardin	9847eaa9cf	remove usage of MinItems/MaxItems ... MinItems and MaxItems are not used on nested types in the protocol, so remove their usage in Terraform to prevent future confusion.	5 years ago
James Bardin	9029870613	handle NestedTypes in Block.CoerceValue ... The CoerceValue code was not updated to handle NestedTypes, and while none of the new codepaths make use of this method, there are still some internal uses.	5 years ago
James Bardin	af4f4540a9	configschema: do not expose optional attributes ... Objects with optional attributes are only used for the decoding of HCL, and those types should never be exposed elsewhere within terraform. Separate the external ImpliedType method from the cty.Type generated internally for the decoder spec. This unfortunately causes our ImpliedType method to return a different type than the hcldec.ImpliedType function, but the former is only used within terraform for concrete values, while the latter is used to decode HCL. Renaming the ImpliedType methods could be done to further differentiate them, but that does cause fairly large diff in the codebase that does not seem worth the effort at this time.	5 years ago
Kristin Laemmert	0729e9fdd7	configs/configschema: extend block.AttributeByPath to descend into Objects (#29222) ... * configs/configschema: extend block.AttributeByPath to descend into Objects This commit adds a recursive Object.AttributeByPath function which will step through Attributes with NestedTypes. If an Attribute without a NestedType is encountered while there is still more to the path, it will return nil.	5 years ago
James Bardin	aaf03d3251	update test error for hclv2.10.1	5 years ago
Kristin Laemmert	0d80a74539	configs/configschema: fix missing "computed" attributes from NestedObject's ImpliedType (#29172) ... * configs/configschema: fix missing "computed" attributes from NestedObject's ImpliedType listOptionalAttrsFromObject was not including "computed" attributes in the list of optional object attributes. This is now fixed. I've also added some tests and fixed some panics and otherwise bad behavior when bad input is given. One natable change is in ImpliedType, which was panicking on an invalid nesting mode. The comment expressly states that it will return a result even when the schema is inconsistent, so I removed the panic and instead return an empty object.	5 years ago
James Bardin	d9dfd451ea	update to use typed sensitive marks	5 years ago
Martin Atkins	31349a9c3a	Move configs/ to internal/configs/ ... This is part of a general effort to move all of Terraform's non-library package surface under internal in order to reinforce that these are for internal use within Terraform only. If you were previously importing packages under this prefix into an external codebase, you could pin to an earlier release tag as an interim solution until you've make a plan to achieve the same functionality some other way.	5 years ago