32532 Commits (eecbfbf2cccedfb581469ee63599c4b4abc5c60f)

 

All Branches   

Search

Author	SHA1	Message	Date
Martin Atkins	eecbfbf2cc	CODEOWNERS: gcs backend is maintained by team tf-eco-hybrid-cloud ... The folks involved asked for us to use this broader GitHub team so that it's easier to maintain both this and the kubernetes backend collectively.	2 years ago
Martin Atkins	d3c0092711	CODEOWNERS: kubernetes backend is maintained by tf-eco-hybrid-cloud ... We're trying to standardize on using teams rather than individuals because that way the membership will get managed automatically by other processes rather than us having to maintain the sets directly in this file. I asked internally and the answer was that this team best represents the set of individuals who share responsibility for maintaining this backend.	2 years ago
Martin Atkins	2f1d26950e	CODEOWNERS: No direct owner for go.sum files ... These get updated only as a side-effect of changing a go.mod file, or else our PR consistency checks would detect that and fail. The Go toolchain includes in go.sum any module it needed to retrieve to decide whether or not a module was relevant (whether there's a specific-package-based indirect dependency) and so if a particular module sees a go.sum update without an associated go.mod update then that means that the change cannot possibly affect that module's behavior at runtime.	2 years ago
Martin Atkins	884b3854ee	CODEOWNERS: remove terraform-ecosystem-strategic team ... This team no longer exists, so is not a useful code owner.	2 years ago
Martin Atkins	df57e04a18	CODEOWNERS: Comment out entries that GitHub cannot use ... GitHub considers any entry that cannot result in an automatic review request to be invalid. We want to retain them for human reference, but it's nice to have the file be considered valid by GitHub so that we can more easily see if we accidentally make it invalid again in future.	2 years ago
Martin Atkins	9446a35cc9	CODEOWNERS: Remove obsolete entries ... These removed entries refer to paths that have already been deleted in earlier commits. They no longer serve any purpose.	2 years ago
Martin Atkins	ebcb4447f5	CODEOWNERS: The Consul backend is unmaintained	2 years ago
Martin Atkins	84df5562f2	moduleaddrs: Terraform now owns module source address normalization ... We've been gradually chipping away at how much we use go-getter for source packages, because it's generally been a bit of a nightmare and sharing it with other codebases means that any time someone wants to change something we end up needing to find some way to prevent it breaking Terraform's compatibility promises. Here we make one further step: Terraform owns the "detectors" idea that deals with source address normalization, and now always produces fully-qualified addresses for go-getter to chew on only for the getting and decompressing steps. Retaining go-getter for the actual getting part is helpful because we can then benefit from security fixes upstream, but Terraform owning the first layer of parsing means that we can fix in place the definition of what "module source address" syntax means, and thus we can avoid having everything in this codebase indirectly depend on go-getter just because it wants to parse module source addresses. Now only the module installer actually depends indirectly on go-getter, which finally disconnects go-getter's subtree from all of the remote state backend dependency graphs.	2 years ago
Martin Atkins	78ae6af906	legacy/terraform: Minimize the contents of this legacy package ... At one point we were relying on this for a few different things, but now it's here exclusively to support legacy/helper/schema, the legacy SDK snapshot that is still being used by a few of the remote state backends. The SDK only really needs a tiny portion of the functionality from this package, and by deleting as much of the unused stuff as possible we can reduce the indirect dependencies of this package and thus, in turn, the indirect dependencies of the remote state backends. This also selectively deletes a few parts of the legacy SDK that are focused on providers and provisioners, because we know that we have this here only to support the backends that haven't yet been weaned off it, but we'll save a more adventurous purge of _that_ package for another day.	2 years ago
Martin Atkins	621befc3a2	configtesting: Separate package for the SynthBody helper ... This "SynthBody" helper doesn't really have anything to do with package configs except that it's sometimes useful for creating fake instances of the types in there for testing. Moving it into its own package means that package backend no longer needs to depend on package configs, since it doesn't actually have any need for parsing module configurations. The old configs.SynthBody function is still available as a forwarding alias, because most of the existing callers of it are from packages that already need to import package configs for other reasons, and so this reduces the need to churn loads of existing tests.	2 years ago
Martin Atkins	5d87e32eb9	moduleaddrs: Split module source address parsing from package addrs ... Our package addrs ends up getting imported from just about ever other package in Terraform, because it contains the types we use to talk about various different kinds of objects. Therefore we typically try to keep its transitive dependency graph relatively small, because anything it depends on becomes an indirect dependency of nearly everything else. A while back we moved the module source address models into package addrs, which also brought with them the code for parsing strings to produce those addresses. Unfortunately, remote module source addresses are defined using the external dependency go-getter, which is pretty heavy itself and also brings with it numerous other external dependencies such as the AWS SDK, the Google Cloud Platform SDK, etc. Since only relatively few packages actually need to _parse_ source addresses -- with most either not caring about them at all or only consuming addresses that were already parsed by someone else -- we'll move the parser functions into their own package, while keeping the resulting address types in package addrs. This does still retain the package addrs dependency on external module github.com/hashicorp/terraform-registry-address, which is not ideal but that one at least has a relatively shallow dependency subgraph, so there's not so much urgency to tidy that one.	2 years ago
Martin Atkins	ca2be46b0e	workflows/checks: Run tests for all modules in this repository ... A few of the packages in this repository are separated into their own Go modules to reflect boundaries of code ownership and/or boundaries with significantly different external Go module dependencies. However, that means that the "./..." pattern in a Go command run at the root doesn't include those packages. The tests in the remote backends are mostly disabled in our unit test context because they require credentials for external network services, but nonetheless it's still useful to visit them and check if their packages can even compile. Therefore we'll now visit each of the modules and run tests for all packages in each one. This restores the coverage we had before the module split, with the only slight difference being that the remote backend tests now run only after all of the main Terraform tests, rather than being interleaved with Terraform's own packages as before. Since we're only visiting them to see if they compile anyway, this doesn't seem like a big deal.	2 years ago
Martin Atkins	58b48f4bab	provider/terraform: Use new convention for function names ... When we added these functions we hadn't yet settled on a single convention for how provider-contributed functions ought to be named, and so these followed the convention previously used for Terraform's own built-in functions. We've now decided to use the new provider namespace as an opportunity to partially fix the historical design error of naming functions as all lowercase without any separation between words. This makes the provider functions inconsistent with the built-in functions, but should at least hopefully encourage the provider functions to be consistent with one another, so that the rule for which to use is relatively easy to remember. This also switches the word order because the provider functions convention prefers the verb to come first: encode_tfvars instead of tfvarsencode.	2 years ago
Jamie Finnigan	d4a43d36c1	move from Go 1.22.0 to 1.22.1	2 years ago
Martin Atkins	171db752c3	go.mod: go get github.com/xanzy/ssh-agent@v0.3.3 ... This improves how the library interacts with needed DLLs on Windows.	2 years ago
Martin Atkins	097102ee67	go.mod: go get github.com/pkg/browser@5ac0b6a4141c ... We use this library as a helper to open a web browser in "terraform login". The only significant update for Terraform's purposes is that on Windows it now launches a browser by directly calling the ShellExecuteW function, instead of running the "start.exe" program that indirectly calls that same function.	2 years ago
Martin Atkins	40c55417af	go.mod: go get github.com/packer-community/winrmcp@latest ... This update is just changing the readme to say that this dependency is unmaintained. We should probably migrate away from it eventually, but for now we'll just select the latest commit.	2 years ago
Martin Atkins	81c7f70dcc	go.mod: go get github.com/nishanths/exhaustive@v0.12.0 ... We use this only as part of our static analysis PR check, and so it should not have any runtime impact.	2 years ago
Martin Atkins	56006416ba	go.mod: go get golang.org/x/tools@v0.19.0 ... We use this just for development-time tools like "stringer", so this upgrade should not have any runtime impact.	2 years ago
Martin Atkins	c541757f4a	go.mod: go get golang.org/x/mod@v0.16.0 ... Aside from development tool dependencies we use this only for the directory hashing logic used to compute go module hashes, which we also use for Terraform provider hashes. There are no changes to the dirhash package in this update, so this should have no runtime impact.	2 years ago
Martin Atkins	b059985227	go.mod: go get golang.org/x/sync@v0.6.0 ... This update only changes a documentation comment, so cannot affect runtime behavior.	2 years ago
Martin Atkins	caa7a757bc	go.mod: go get golang.org/x/oauth2@v0.18.0 ... This only upgrades a Google-specific subpackage, and so the only potential impact is to the GCS backend.	2 years ago
Martin Atkins	9c7ece8ad4	go.mod: go get golang.org/x/net@v0.22.0 ... This update is largely focused on QUIC implementation changes, which do not directly affect Terraform. There is one fix for the HTTP2 implementation to terminate the stream if a sender recieves an out-of-bounds window update, which makes the implementation better match the specification. This seems unlikely to cause any practical problems for Terraform.	2 years ago
Martin Atkins	fad9c2a4cd	go.mod: go get golang.org/x/crypto@v0.21.0 ... This update is mostly internal changes that don't affect external behavior. The only update potentially significant to Terraform is the new exclusion of a particular root certificate that is used only for some specific names under the .tr CCTLD, but the certificate database doesn't specify that constraint in a way that the library can understand, so it's excluded to avoid making the trust for that certificate broader than intended.	2 years ago
Martin Atkins	a1d2169c85	go.mod: go get golang.org/x/term@v0.18.0 ... This update contains no real changes. It just updates transitive dependencies to newer versions that we've already selected anyway.	2 years ago
Martin Atkins	b3f6a6230d	go.mod: go get golang.org/x/sys@v0.18.0 ... This small update does not directly affect any Terraform functionality.	2 years ago
Martin Atkins	48df3121af	go.mod: go get github.com/mattn/go-shellwords@v1.0.12 ... We use this library only for interpreting the "TF_CLI_ARG_..." environment variables as additional command line arguments, so the potential impact of this is very limited. The upstream changes here expand on the supported dynamic behavior around backtick command execution and nested environment variable expansion. We don't use either of those features, but just to make sure I changed the code to force them off (since otherwise another package in the program could change the package's global configuration) and added test cases that will fail if they end up turned on.	2 years ago
Martin Atkins	61a5c1f57b	go.mod: go get github.com/hashicorp/terraform-registry-address@v0.2.3 ... This is really just a bunch of changes to the upstream go.mod for updates to its own dependencies, but Terraform already has new enough versions of those dependencies for other reasons and so this changes nothing.	2 years ago
Martin Atkins	5446b43c7b	go.mod: go get github.com/hashicorp/jsonapi@v1.3.1 ... This includes just some changes that a future version of hashicorp/go-tfe will need. We aren't yet ready to upgrade go-tfe itself because the cloud integration's mocks need to be updated to match the changed models.	2 years ago
Martin Atkins	8603ee0ab5	go.mod: go get github.com/hashicorp/go-slug@v0.14.0 ... This has just some changes to the "sourcebundle" building API, which doesn't affect Terraform CLI or Terraform Core because they currently only consume source bundles, not build them.	2 years ago
Martin Atkins	19ac954215	go.mod: go get github.com/hashicorp/go-plugin@v1.6.0 ... This contains the following changes that are relevant to Terraform's usage: - The auto-mtls certificates are slightly larger and now include issuer, root CAs, and server name entries. - TLS configuration now requires TLS 1.2 - The plugin connection being broken during shutdown is now reported in logs as a "DEBUG", not "ERROR".	2 years ago
Martin Atkins	914618b061	gcs: Adopt the "ReadPathOrContents" helper function ... Package backend previously had a ReadPathOrContents helper that takes a string that could represent either a filename or some literal content, and then reads the given file if it's a filename or just returns the literal content otherwise. We originally used variations of this helper to shim a number of different situations that had originally accepted filenames but later changed to accept literal content, but over time we've eliminated all of those and so the only remaining caller is the gcs backend which uses it to accept GCP credentials either as literal content or as a file containing the credentials. Therefore here we move that helper function to be just an unexported part of the gcs backend package. This is part of an ongoing effort to minimize what each remote state backend depends on (either directly or indirectly) so that we can make gradual progress towards these remote state backends being self-contained enough to move into other codebases. In the short term though, it just puts this helper function closer to its caller so it's easier to maintain them both together if needed.	2 years ago
Martin Atkins	a2a982206c	Update CHANGELOG.md	2 years ago
Martin Atkins	dbde17b535	terraform console: Multi-line entry support ... The console command, when running in interactive mode, will now detect if the input seems to be an incomplete (but valid enough so far) expression, and if so will produce another prompt to accept another line of expression input. This is primarily to make it easier to paste in multi-line expressions taken from elsewhere, but it could also be used for manual input. The support for multi-line _editing_ is limited by the fact that the readline dependency we use doesn't support multiline input and so we're currently doing this in spite of that library. Hopefully we'll be able to improve on that in future either by contributing multi-line editing support upstream or by switching to a different readline dependency. The delimiter-counting heuristic employed here is similar to the one used by HCL itself to decide whether a newline should end the definition of an attribute, but this implementation is simpler because it doesn't need to produce error messages or perform any recovery. Instead, it just bails out if it encounters something strange so that the console session can return a parse error. Because some invalid input may cause a user to become "stuck" in a multi- line sequence, we consider a blank line as intent to immediately try to evaluate what was entered, and also interpret SIGINT (e.g. Ctrl+C) as cancellation of multi-line input, assuming that at least one line was already entered, extending the previous precedent that SIGINT cancels when at least one character was already entered at the prompt.	2 years ago
Martin Atkins	f058de612c	statemgr: Incorporate IntermediateStateConditionalPersister ... This interface was originally in the local backend's package because that backend is the only one that _truly_ runs Terraform operations and thus needs to negotiate how to store the intermediate state snapshots that result from them. However, putting the interface and its supporting types/functions there means that anything that wants to implement this interface needs to import the local backend package, and thus indirectly depends on the entire modules runtime, etc. We already had package stagemgr as a home for the shared stuff used by most state storage managers, and so we'll just move these symbols over there and then we can shed some internal dependencies on package local. This also severs the last dependency link between the remote state backends and the modules runtime, allowing us to shed a bunch of indirect dependencies from those remote state backends.	2 years ago
Liam Cervante	c6ff573180	Include provider functions in scope used to evaluate test assertions (#34825)	2 years ago
Daniel Schmidt	b3b5144834	Update Changelog	2 years ago
Daniel Schmidt	7171cea95b	Merge pull request #34762 from hashicorp/Tf-10521 ... stacks: emit component address in find stack configuration component response	2 years ago
Daniel Schmidt	8bab2a588d	stacks: use component config address relative to stack	2 years ago
Daniel Schmidt	1fd99fe6e4	stacks: adjust tests to include component addr	2 years ago
Daniel Schmidt	0cea00e919	stacks: emit component address in find stack configuration component response	2 years ago
Martin Atkins	cf3bbb890f	State managers use schemarepo.Schemas instead of terraform.Schemas ... schemarepo.Schemas used to be terraform.Schemas, but its presence in the terraform package was the only reason for a state manager to need to import package terraform, so we've moved it out into its own package in the parent commit. This means that none of the state-related packages need to import package terraform any longer, and so once we've untangled some other dependencies this will curtail the number of packages in this codebase that the remote state backends transitively depend on, as part of an ongoing effort to eventually separate them from this codebase entirely.	2 years ago
Martin Atkins	034bf4487f	schemarepo: Schema repositories get their own package ... It's a cross-cutting concern to need the dynamic value schemas of the various plugins used with a Terraform configuration, but previously we had the type for that in "package terraform", forcing lots of packages to depend on the modules runtime even though they have no direct interest in evaluating Terraform modules. We'll now split it out into its own package "schemarepo". There are currently forwarding aliases left behind in "package terraform" so that we don't need to update all of the callers at once. We'll update the callers whose dependency changes will have the most significant benefits in future commits. The new package is further split into a separate "laodschemas" part that deals with the plugin interactions, because most packages that use a schema repository expect that it was already constructed by someone else, and so don't need or want to depend indirectly on all of the plugin execution machinery.	2 years ago
Martin Atkins	88cb4aeea3	backendrun: Separate the types/etc for backends that support operations ... We previously had all of the types and helpers for all kinds of backends together in package backend. That kept things relatively simple, but it also meant that the majority of backends that only deal with remote state storage ended up still indirectly depending on the entire Terraform modules runtime, configuration loader, etc, etc, which brings into scope a bunch of external dependencies that the remote state backends don't really need. Since backends that support operations are a rare exception, we'll move the types and helpers for those into a separate package "backendrun", and then the main package backend can have a much more modest set of types and, more importantly, a modest set of dependencies on other packages in this codebase. This is part of an ongoing effort to reduce the exposure of Terraform Core and CLI code to the remote backends and vice-versa, so that in the long run we can more often treat them as separate for dependency maintenance purposes.	2 years ago
Martin Atkins	545980d664	langrefs: Separate package for expression reference analysis ... Finding references in an expression is a static analysis operation, but we previously had it grouped in with "package lang" that primarily deals with dynamic evaluation of expressions. We need to do static analysis in far more locations than we do full expression evaluation, the static-analysis-only callers don't need anything else from package lang, and the reference-analysis functions are self-contained little wrappers around the address parsing logic in package addrs anyway. Splitting these into a separate package therefore minimizes which packages depend indirectly on package lang, and thus which packages depend indirectly on the implementations of the built-in functions. Some of the built-in functions rely on dependencies we don't use anywhere else, so cutting these out shrinks how many packages indirectly depend on those external dependencies. In particular, they are no longer in the indirect import chain for the "legacy" module.	2 years ago
Martin Atkins	77a4980074	go.mod: github.com/ProtonMail/go-crypto v1.0.0 ... We were previously using an untagged commit that slightly predated the v1.0.0 release. The changes between that commit and this tag are small and don't affect our use of this library for verifying signatures.	2 years ago
Martin Atkins	5f2eab6944	providerreqs: Provider requirement/version types in their own package ... As we previously found with "package addrs", any package that contains types used as identifiers or addresses tends to get imported from all over, which means that if we mix real logic with those types in the same package then a lot more packages end up depending indirectly on our external dependencies. In this case, the getproviders package depends on various things we need only during provider installation, such as the library we use for GPG signature verification. Lots of different packages in Terraform need to talk about provider requirements, but only the CLI layer actually needs to do provider installation, and so this commit splits the types we use to talk about requirements into a new package "providerreqs", which package getproviders then depends on. To keep the size of this diff relatively small to start I've left forwarding aliases in package getproviders, which means that not all of the callers needed to be updated all at once. This commit does update all of the packages that the remote state backends depend on though, because that then allows us to reduce the set of indirect dependencies for each of those backends. The nested module go.mod files show that this has disconnected the indirect dependencies on github.com/ProtonMail/go-crypto and on github.com/cloudflare/circl , both of which Terraform CLI uses only for provider installation.	2 years ago
James Bardin	89b01e9f72	update CHANGELOG.md	2 years ago
James Bardin	58dac51718	Merge pull request #34814 from hashicorp/jbardin/disconnect-ssh-faster ... disconnect remote-exec immediately	2 years ago
James Bardin	154f9ada90	disconnect remote-exec immediately ... The remote-exec provisioner was not disconnecting immediately after provisioning. The remote exec context was tired to the lifetime of the provisioner, but the provisioner node used to not live long after the remote execution had completed so it was not noticed. Some more recent refactoring extends the lifetime of the node, and causes the provisioner connections to hang around longer when they're not needed. Ensure we disconnect immediately after the remote execution is complete.	2 years ago