terraform

Commit Graph

Author	SHA1	Message	Date
Radek Simko	a91c8bc30f	WIP	2 weeks ago
Radek Simko	41cb7e8bb9	command/state_migrate: Wire up configuration parsing	2 weeks ago
Sarah French	cf0aae24f4	fix: Stop our anti-`init -upgrade` check panicking when an overridden provider is in use. (#38635 ) Prior to this commit we wanted to validate the provider upgrade process using data that was only populated during backend initialisation (as that was the only place using that data previously). Now we enable the provider supply mode data to be available before backends are initialised. After making that available, we can update the check after getProvidersFromConfig that protects against the provider version being changed outside of a deliberate state migration process. If the state store provider is overridden then the upgrade process doesn't impact that provider anyway, so the check can be skipped. Also, this protects against errors if there was ever a built in provider supplying a state store implementation.	2 weeks ago
Sarah French	dcfb4828cc	PSS: Allow users of Terraform in automation to trust the state storage provider when initialising a state store for the first time (#38461 ) Terraform cannot prompt users to establish trust in a newly downloaded provider used for state storage if input is disabled. This commit's changes enable people using Terraform in automation (defined as `-input=false` being set) to establish trust for a provider in the same situation. We expect users to follow this workflow: 1. Practitioner initialises a Terraform project with minimal config describing how they'd like to use PSS in other production configurations. This is done manually, so they get an interactive prompt for approval and create a lock file describing the downloaded provider. 2. Practitioner copies that .terraform.lock.hcl artefact to a location that can be used in their automation environment. 3. Projects being initialised with PSS for the first time (no prior state) in automation are initialised using the command terraform init -state-provider-lock=<path-to-reused-lock-file>. The `-state-provider-lock-file` flag is expected to be a path to a .terraform.lock.hcl file. If the flag is missing it defaults to a path for the project's own lock file. The lock file is expected to describe the provider used for state storage (can be among other locks present in the file) and the version must match the requirements of the config used. Use of the lock file supplied via the flag is at the same point that a user would otherwise interactively approve a provider. If the lock file is insufficient to establish trust it'll be similar to a user declining a prompt to trust a provider.	2 weeks ago
Sarah French	234ef96aec	init: Make both provider override methods (dev_overrides and reattaching providers) behave same in the context of provider download (#38634 ) This PR makes a few related changes: 1. Construct provider cache Installers so they have knowledge about dev_override providers Prior to this change, providercache.Installer variables were made in the command package with knowledge about reattached/unmanaged providers, but not with knowledge about dev_override providers. Now both sets of overridden providers are present in the installer and can affect installation logic. 2. Make the provider installation logic skip any dev_override providers from being installed from the Registry (or other configured sources) This means that if a provider is first added to a config while someone uses a dev_override an init command will not add that provider to the lock file. If the overridden provider is already in the lock file then the lock will be unchanged. An edge case, that already exists for unmanaged providers, is that if a dev_override is in play while an init -upgrade command is used, only the providers that aren't overridden or unmanaged will be upgraded This change is coupled to another change in the PR described below. 3. Fix the provider download process (in context of init) so that dev_overrides are not removed from the provider requirements. This reverts a change in https://github.com/hashicorp/terraform/pull/37884. The original motivation of that PR was to address a situation where the provider supplied by dev_overrides isn't published to the Registry yet. The config may need to include an entry in required_providers for that provider, which means that init would always fail due to the provider being unavailable in the Registry for download. The prior commit (bfc08b5d96) changed installer logic to skip dev_override providers, which cancels out this commit's changes; dev_override providers will remain in the provider requirements passed to installation logic, but that logic will now ignore them. As a consequence of no longer removing these provider requirements we will retain any pre-existing locks for the provider through the init process. 4. The `providers locks` command will now warn users about any dev_overrides in effect, as these will stop provider locks from being downloaded.	2 weeks ago
Sarah French	81053e9d70	fix: Block commands from using an invalid workspace name. (#38594 ) We're blocking commands from using an invalid workspace name, as this mitigates some risks if the invalid name attempts to cause path traversal. A workspace is selected if its name is in the .terraform/environment file, and something other than Terraform could change the contents of that file. To fix this, we expect users to use Terraform to update that file via Terraform using the `workspace select` command. This will allow the user to select or create a valid workspace instead, while also removing the bad data from the file without expecting the user to know about that file (it's an implementation detail, not a public API!).	2 weeks ago
Samsondeen	3b4c2f2427	Fix flaky ordering test (#38650 )	2 weeks ago
Sarah French	95db2b28ee	Refactor E2E tests to use new reattached provider test helper (#38643 ) * test: Update reattachedProviderForTest to return the provider server used, so tests can choose to make assertions against it. Refactor relevant E2E tests to use new reattachedProviderForTest helper function.	2 weeks ago
Sarah French	8410263caa	test: Add tests defining how provider installation behaviour is affected by providers that are either reattached or dev_overrides (#38633 ) * test: Add test coverage to provider installer logic defining how providers being unmanaged/reattached or dev_overrides impacts the provider installation process These tests show that the two methods of overriding a provider behave differently. This is due to how reattached/unmanaged providers are skipped during the provider installation process whereas development overrides are removed from the provider requirements passed into the installation logic. This results in Terraform treating dev_override providers similarly to a provider that's been completely removed from a configuration. I believe this is a bug and will fix in a future commit, but these tests help to highlight the current problem.	2 weeks ago
Daniel Banck	a22d91b65b	terraform: Handle missing source in nodeInstallModule	2 weeks ago
Daniel Banck	d8aedeaf4a	command: Test init with invalid configuration	2 weeks ago
Daniel Banck	23ba5d5364	Check if module version evaluates to something != null Instead of assuming a registry module when a version attribute is set, Terraform now checks if the expression evaluates to a valid constraints and only then treats the source as a registry module.	2 weeks ago
Daniel Banck	e9e554957f	Add init test cases where version = null	2 weeks ago
Daniel Banck	040d053eea	Fix Context Init Test to check version constraints	2 weeks ago
Sarah French	ecb1350623	chore: Bump golang.org/x/net to v0.55.0 https://pkg.go.dev/vuln/GO-2026-5026	2 weeks ago
Sarah French	9762e96734	chore: Bump golang.org/x/crypto to v0.52.0 https://pkg.go.dev/vuln/GO-2026-5018?q	2 weeks ago
Sarah French	a2ad11c4f1	fix: Make sure the backend state file is valid if a user introduces PSS to a pre-existing project via `init -reconfigure`. The -reconfigure flag makes Terraform ignore the backend state file when deciding what scenario is happening, which leads to Terraform acting like it's initialising a working dir for the first time. However downstream code then needs to be prepared for both of these scenarios: - The work dir has never been initialised before and the backend state file doesn't exist yet - The work dir has been used before but Terraform is being forced to treat it as new. This change helps with the second point - we need to remove any old descriptions of a Backend to avoid a situation where the backend state file describes both a backend and state_store.	3 weeks ago
Adam Snyder	c78b2c2f22	fix: Fix panic on deposed object with precondition and nop change	3 weeks ago
Kristin Laemmert	4d8ecf9d23	chore: add a test for import duplication I woke up in a cold sweat about not testing the assertion that imports in parent modules take precedence when there are duplicates. I'm genuinely revlieved this Just Worked	3 weeks ago
Samsondeen	42fe4265f2	Add policy client and protocol plumbing (#38514 )	3 weeks ago
Daniel Banck	5d289cc1a2	Improve `--from-module` test coverage Clean up and old todo and add a test for the simplified error message.	3 weeks ago
Sarah French	eb374193aa	fix: Remove unused returned diagnostics (#38617 ) Follow up to https://github.com/hashicorp/terraform/pull/38573, addressing feedback asking to remove the unused diagnostics. As discussed in that PR, the only way to use these returned diags would be to use a combination of named returns and defer functions editing those return values in order to capture those diagnostics. This is brittle and has questionable pay-off, so instead we remove these diags.	3 weeks ago
Sarah French	deed538ea8	chore: Remove unneeded `init` test (#38622 ) Follow up to https://github.com/hashicorp/terraform/pull/38391 That PR added tests showing that upgrading the provider used for PSS is blocked in init. There are no other upgrade-related user stories related to PSS in init, as upgrading the state storage provider will only be possible through a new `state migrate` command in future. Therefore these TODOs etc should be removed.	3 weeks ago
Sarah French	d75460af6d	fix: Prevent provider binary being placed outside of .terraform/providers cache unexpectedly due to use of symlinks. (#38611 )	3 weeks ago
Sarah French	634db2dcc8	PSS: Add parsing of `.tfmigrate.hcl` files to define state migration operations (#38526 ) * feat: Parsing a configuration directory can include .tfmigrate.hcl files. These files include `state_store_provider` blocks and `from` blocks that contains either a single `backend` or `state_store` block. Validation will enforce that despite multiple .tfmigrate.hcl files being parsed you can only have one state_store_provider or from block, and nested backend/state_store blocks are mutually exclusive. Use of state_store_provider is only valid when state_store is in use, and the single provider described in both blocks must be in agreement. Also, a directory's .tfmigrate.hcl files cannot be empty once combined.	3 weeks ago
Sarah French	008c92d91f	fix: Append lost warnings in MaybeGetSchemas (#38605 )	4 weeks ago
Sarah French	d174972029	test: Show warning when a `-filter` flag has an invalid value (#38603 ) * test: Show warning when a test file filter is not valid * Add change file	4 weeks ago
Sarah French	f6553bae93	fix: Stop discarding diagnostics in internal test providers (#38602 )	4 weeks ago
Sarah French	be22624430	chore: Modernise some code in provisioners packages, add some code comments (#38588 )	4 weeks ago
Kristin Laemmert	abbb650bae	refactor: remove readDiff (#38590 ) readDiff is no longer necessary now that we don't need a schema to read the change - all calls to readDiff were replaced with a single-line call to ctx.Changes, using the same inputs that readDiff used.	4 weeks ago
Kristin Laemmert	34935295e3	feat(import): support import blocks inside child modules (#38352 ) This PR adds support for import blocks inside child modules. Duplicate blocks will overwrite prior imports (I copied this behavior from the refactoring code, but we could instead return an error if multiple import blocks target the same abs config resource).	4 weeks ago
Sebastien Tardif	3c94ef65b3	Fix resource leaks in provisioners and commands (#38585 ) * Fix resource leaks in provisioners and commands Close file handles, HTTP response bodies, and pipe ends that were previously leaked on certain code paths: - workspace_new.go: Close state file opened via os.Open - file/resource_provisioner.go: Close temp file handle before returning the file path to caller - login.go: Move defer resp.Body.Close() before ioutil.ReadAll so the body is closed even when ReadAll fails - local-exec/resource_provisioner.go: Close the read end of os.Pipe after the copy goroutine completes --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>	4 weeks ago
Sarah French	820f37b35f	test: Proof of path traversals not being accepted workspaces (#38589 )	4 weeks ago
Sarah French	c56ec2943d	refactor: Move validation of `init`'s `-upgrade` and `-lockfile=readonly` flags to the arguments package. (#38561 ) The `-upgrade` and `-lockfile=readonly` flags are mutually exclusive, and this is now enforced by the arguments package. This refactor has also fixed a historical bug where that validation error was output twice. The getProvidersFromConfig code now depends on the flag validation happening in the calling code. However there is another check in downstream code, in `saveDependencyLockFile` when we overwrite the dependency lock file's contents. There, an error occurs if a diff in the locks is detected during `readonly` mode. This protects against incorrect use of `getProvidersFromConfig` with unvalidated inputs, if that happens in future.	4 weeks ago
Sarah French	2e5a89ab6f	Update command help text for `state migrate` command (#38571 ) Added details about the default behaviour for the lock-file CLI flags, and made it clearer that the upgrade flag only enables upgrading the provider used for state storage.	4 weeks ago
Sarah French	adcf9a9cb3	PSS: Make sure to close supplementary instances of a store that are intended to be used temporarily. (#38573 ) * feat : Add Close method to Pluggable struct, use method to close supplementary provider processes that are launched during init.	4 weeks ago
James Bardin	c29cb25f86	remove old resource phase addressing At one point there was an attempt to connect the destroy nodes in the apply graph by using special addressing and manipulating the references for resources. This doesn't work for a few reasons, but in particular, destroy nodes are entirely built from their state, they do not reference anything, and they cannot be referenced.	4 weeks ago
Daniel Banck	7ac3e2ec19	Return SafeInitActionNotRelevant on empty config	1 month ago
Daniel Banck	94a640a1a5	Add test case for variable value without config	1 month ago
Daniel Banck	74084a7705	Return early during provider installation if there is no config	1 month ago
Sarah French	7a960db553	PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time (#38395 ) * refactor: Replace use of prepareInstallerEvents method. This will allow finer control of callbacks when implementing security related features * feat: Users are prompted to approve a provider used for PSS on first use, and only if downloaded via HTTP. Prompts include signer details and key ID data. * test: Users see "Authentication: unauthenticated" in prompt if network mirror doesn't include hashes They'll see authentication data in all other prompt scenarios. There's no auth when using an fs mirror, but when those are in use we trust the providers already and no prompts are raised. * refactor: Simplify how we prepare installation event callbacks by defining reused callbacks * refactor: Remove unused parameters from `getProvidersFromState`	1 month ago
Michael Yocca	a941456484	patch remote-state/cos go.sum	1 month ago
Michael Yocca	ee165f07f1	fix: go.mod syncdeps	1 month ago
Michael Yocca	ffa0a98da1	test: add test case for flag determining	1 month ago
Michael Yocca	5dd7e55d9b	feat: pass generate-config-out to go-tfe client request	1 month ago
Michael Yocca	fb6f6f1c40	fix: update tfe client mocks	1 month ago
Daniel Schmidt	2cd5cacacd	run make syncdeps	1 month ago
Daniel Schmidt	6e8052393c	update go version	1 month ago
Austin Valle	527402d3fe	stackmigrate: Fix recursive provider config resolution for resource instances in deeply nested modules (#38528 ) * stackmigrate: fix recursive provider config resolution for resource instances in deeply nested modules * added additional test for implict provider configs in deeply nested modules * add changelog * move changelog to 1.15	1 month ago
Radek Simko	badc70c93d	command/output: Ignore warnings in JSON mode (#38530 ) * command/output: Ignore warnings in JSON mode * add changelog entry	1 month ago

1 2 3 4 5 ...

4411 Commits (a91c8bc30f0fcdbdef3076fa543a23f7f6024355)