command

type AliasCommand ¶

type AliasCommand struct {
	cli.Command
}

AliasCommand is a Command implementation that wraps another Command for the purpose of aliasing.

func (c *AliasCommand) Help() string

func (c *AliasCommand) Run(args []string) int

func (c *AliasCommand) Synopsis() string

type ApplyCommand ¶

type ApplyCommand struct {
	Meta

	// If true, then this apply command will become the "destroy"
	// command. It is just like apply but only processes a destroy.
	Destroy bool
}

ApplyCommand is a Command implementation that applies a OpenTofu configuration and actually builds or changes infrastructure.

func (c ApplyCommand) Execute(args *arguments.Apply, view views.Apply) int

func (c *ApplyCommand) Help() string

func (c *ApplyCommand) LoadPlanFile(path string, enc encryption.Encryption) (*planfile.WrappedPlanFile, tfdiags.Diagnostics)

func (c *ApplyCommand) OperationRequest(
	ctx context.Context,
	be backend.Enhanced,
	view views.Apply,
	applyArgs *arguments.Apply,
	planFile *planfile.WrappedPlanFile,
	enc encryption.Encryption,
) (*backend.Operation, tfdiags.Diagnostics)

func (c *ApplyCommand) PrepareBackend(ctx context.Context, planFile *planfile.WrappedPlanFile, args *arguments.State, backendView views.Backend, enc encryption.StateEncryption) (backend.Enhanced, tfdiags.Diagnostics)

func (c *ApplyCommand) Run(rawArgs []string) int

func (c *ApplyCommand) Synopsis() string

type BackendOpts ¶

type BackendOpts struct {
	// Config is a representation of the backend configuration block given in
	// the root module, or nil if no such block is present.
	Config *configs.Backend

	// ConfigOverride is an hcl.Body that, if non-nil, will be used with
	// configs.MergeBodies to override the type-specific backend configuration
	// arguments in Config.
	ConfigOverride hcl.Body

	// Init should be set to true if initialization is allowed. If this is
	// false, then any configuration that requires configuration will show
	// an error asking the user to reinitialize.
	Init bool

	// ForceLocal will force a purely local backend, including state.
	// You probably don't want to set this.
	ForceLocal bool

	// ViewOptions will set console output format for the
	// initialization operation (JSON or human-readable).
	View views.Backend
}

BackendOpts are the options used to initialize a backend.Backend.

type BackendWithRemoteTerraformVersion ¶

type BackendWithRemoteTerraformVersion interface {
	IgnoreVersionConflict()
	VerifyWorkspaceTerraformVersion(workspace string) tfdiags.Diagnostics
	IsLocalOperations() bool
}

BackendWithRemoteTerraformVersion is a shared interface between the 'remote' and 'cloud' backends for simplified type checking when calling functions common to those particular backends.

type Command ¶ added in v0.21.0

type Command struct {
	Name    string
	Aliases []string
	// Short is the text that accompanies it in the parent command's help text.
	Short string
	// Long is the full description that is printed as part of the command's help text.
	Long string
	// GroupID if set determines what group to show the command under in the parent command's help text.
	GroupID string
	// If this command should not be shown in the help text of the parent command.
	Hidden bool

	// Commands are the sub-commands of the current command.
	Commands []Command
	// Groups to split the sub Commands into
	Groups []Group

	// UsageOverride are custom overrides for special cases.
	// Ideally we can retire this eventually as we unify the help/usage text.
	UsageOverride UsageOverride

	// CommandLine defines what flags and arguments are available to this command.
	CommandLine arguments.CommandLine
	// Run is the action that will be executed if this command is selected.
	Run func(Meta) int

	// A legacy option that will be removed at some point
	// This was introduced during the migration to proper
	// diagnostic error printing during the meta-refactor
	DiagsWithNewline bool
}

Command is the metadata and action associated with a command available to the CLI. This is eventually translated into a parsable/runnable CLI in cmd/tofu.

func ApplyCommander() Command

func ConsoleCommander() Command

func DestroyCommander() Command

func FmtCommander(input io.Reader) Command

func GetCommander() Command

func GraphCommander() Command

func ImportCommander() Command

func InitCommander() Command

func LiveAffectedCommander() Command

func LiveBucketCommander() Command

func LiveCheckCommander() Command

func LiveClusterCommander() Command

func LiveCommanders() []Command

func LiveImportCommander() Command

func LiveLsCommander() Command

func LiveMvCommander() Command

func LivePlanCommander() Command

func LivePlanSetCommander() Command

func LiveSummaryCommander() Command

func LiveWaveApplyCommander() Command

func LiveWavesCommander() Command

func LoginCommander() Command

func LogoutCommander() Command

func MetadataCommander() Command

func MetadataFunctionsCommander() Command

func OutputCommander() Command

func PlanCommander() Command

func ProvidersCommander() Command

func ProvidersLockCommander() Command

func ProvidersMirrorCommander() Command

func ProvidersSchemaCommander() Command

func RefreshCommander() Command

func RootCommander(help *bool, ver *bool, chdir *string) Command

func ShowCommander() Command

func StateCommander() Command

func StateListCommander() Command

func StateMvCommander() Command

func StatePullCommander() Command

func StatePushCommander() Command

func StateReplaceProviderCommander() Command

func StateRmCommander() Command

func StateShowCommander() Command

func TaintCommander() Command

func TestCommander() Command

func UnlockCommander() Command

func UntaintCommander() Command

func ValidateCommander() Command

func VersionCommander(version string, versionPrerelease string, platform getproviders.Platform) Command

func WorkspaceCommander(legacyName bool) Command

func WorkspaceDeleteCommander(legacyName bool) Command

func WorkspaceListCommander(legacyName bool) Command

func WorkspaceNewCommander(legacyName bool) Command

func WorkspaceSelectCommander(legacyName bool) Command

func WorkspaceShowCommander() Command

type ConsoleCommand ¶

type ConsoleCommand struct {
	Meta
}

ConsoleCommand is a Command implementation that starts an interactive console that can be used to try expressions with the current config.

func (c ConsoleCommand) Execute(args *arguments.Console, view views.Console) int

func (c *ConsoleCommand) Help() string

func (c *ConsoleCommand) Run(rawArgs []string) int

func (c *ConsoleCommand) Synopsis() string

type FmtCommand ¶

type FmtCommand struct {
	Meta
	// contains filtered or unexported fields
}

FmtCommand is a Command implementation that rewrites OpenTofu config files to a canonical format and style.

func (c FmtCommand) Execute(args *arguments.Fmt, view views.Fmt) int

func (c *FmtCommand) Help() string

func (c *FmtCommand) Run(rawArgs []string) int

func (c *FmtCommand) Synopsis() string

type GetCommand ¶

type GetCommand struct {
	Meta
}

GetCommand is a Command implementation that takes a OpenTofu configuration and downloads all the modules.

func (c GetCommand) Execute(args *arguments.Get, view views.Get) int

func (c *GetCommand) Help() string

func (c *GetCommand) Run(rawArgs []string) int

func (c *GetCommand) Synopsis() string

type GraphCommand ¶

type GraphCommand struct {
	Meta
}

GraphCommand is a Command implementation that takes a OpenTofu configuration and outputs the dependency tree in graphical form.

func (c GraphCommand) Execute(args *arguments.Graph, view views.Graph) int

func (c *GraphCommand) Help() string

func (c *GraphCommand) Run(rawArgs []string) int

func (c *GraphCommand) Synopsis() string

type Group ¶ added in v0.21.0

type Group struct {
	ID     string
	Title  string
	NoSort bool
}

Group defines a command group and it's metadata In practice, this is only used for the special formatting in the root command

type ImportCommand ¶

type ImportCommand struct {
	Meta
}

ImportCommand is a cli.Command implementation that imports resources into the OpenTofu state.

func (c ImportCommand) Execute(args *arguments.Import, view views.Import) int

func (c *ImportCommand) Help() string

func (c *ImportCommand) Run(rawArgs []string) int

func (c *ImportCommand) Synopsis() string

type InitCommand ¶

type InitCommand struct {
	Meta
}

InitCommand is a Command implementation that takes a Terraform module and clones it to the working directory.

func (c *InitCommand) AutocompleteArgs() complete.Predictor

func (c *InitCommand) AutocompleteFlags() complete.Flags

func (c InitCommand) Execute(args *arguments.Init, view views.Init) int

func (c *InitCommand) Help() string

func (c *InitCommand) Run(rawArgs []string) int

func (c *InitCommand) Synopsis() string

type LiveAffectedCommand ¶ added in v0.22.0

type LiveAffectedCommand struct {
	Meta
}

LiveAffectedCommand names the estate roots a git range touches (GitHub issue #1751, part of #1749; it takes over #1106 section 4). It reads configuration at both ends of the range and plans nothing.

func (c *LiveAffectedCommand) Execute(args *arguments.LiveAffected) int

func (c *LiveAffectedCommand) Help() string

func (c *LiveAffectedCommand) Run(rawArgs []string) int

func (c *LiveAffectedCommand) Synopsis() string

type LiveBucketCommand ¶ added in v0.18.0

type LiveBucketCommand struct {
	Meta
}

LiveBucketCommand reports whether a record store bucket satisfies its contract (GitHub issues #1339 and #1341): versioning, a lifecycle that expires noncurrent versions, and public-access block.

It reports the bucket, not the configuration ¶

A plan or an apply honours allow_insecure (#1340), because whether a RUN may proceed is the operator's call. This command answers a different question - is this bucket correct - and answering it through the run's path would print green for a bucket with versioning off, which is the opposite of what someone runs it for. So a waiver never changes a verdict or the exit status here. It is named, separately, together with whether it is hiding anything.

It writes nothing: no sentinel, no record, no tag.

func (c *LiveBucketCommand) Execute(args *arguments.LiveBucket) int

func (c *LiveBucketCommand) Help() string

func (c *LiveBucketCommand) Run(rawArgs []string) int

func (c *LiveBucketCommand) Synopsis() string

type LiveCheckCommand ¶ added in v0.3.0

type LiveCheckCommand struct {
	Meta
}

LiveCheckCommand answers "will my configuration work under live resource markers" from a directory, with no cloud, no state, and no live block required in the configuration under test.

It is GitHub issue #114, and it is deliberately a thin renderer over internal/live/check rather than an analysis of its own. That package is also what tools/corpus-gen runs across a corpus for #102, so the compatibility claim this project publishes and the verdict a user gets on their own repository are computed by the same code. Two implementations would eventually disagree, and the user's would be the one that mattered.

Three things are answered, in the order someone reads them: whether it can move at all, what stops it, and what to do about each. The report then names the stages it did not check - stamping, discovery and projection all need a cloud - because a clean verdict that read as "this ships" while three stages went unexamined would be the same overstatement #101 spent a campaign removing.

func (c *LiveCheckCommand) Execute(args *arguments.LiveCheck) int

func (c *LiveCheckCommand) Help() string

func (c *LiveCheckCommand) Run(rawArgs []string) int

func (c *LiveCheckCommand) Synopsis() string

type LiveClusterCommand ¶ added in v0.19.0

type LiveClusterCommand struct {
	Meta
}

LiveClusterCommand reports whether the cluster a record_store "kubernetes" keeps its records in satisfies its contract (GitHub issue #1393): the records namespace and this identity's access to it, read isolation, encryption at rest, and the estate boundary policy.

It is `live-bucket` (#1341) for the other remote store, and it answers the same question in the same way and for the same reason.

It reports the cluster, not the configuration ¶

A plan or an apply honours allow_insecure (#1340), because whether a RUN may proceed is the operator's call. This command answers a different question - is this cluster correct - and answering it through the run's path would print green for a cluster whose Secrets are not encrypted, which is the opposite of what someone runs it for. So a waiver never changes a verdict or the exit status here. It is named, separately, together with whether it is hiding anything.

Not checked is not correct ¶

Two of the four properties cannot be read on every distribution. A finding the cluster could not answer is NOT CHECKED, it is not a pass, and it makes the verdict "NOT correct" the same way a failure does. That is the whole reason for a report a person runs on purpose: an operator who wants the answer can go and get it from outside the cluster.

It writes nothing: no sentinel, no record, no Secret. The only object it creates is a SelfSubjectAccessReview, which is a question, not a change - the API server evaluates it and stores nothing.

func (c *LiveClusterCommand) Execute(args *arguments.LiveCluster) int

func (c *LiveClusterCommand) Help() string

func (c *LiveClusterCommand) Run(rawArgs []string) int

func (c *LiveClusterCommand) Synopsis() string

type LiveImportCommand ¶ added in v0.3.0

type LiveImportCommand struct {
	Meta
}

LiveImportCommand is the bulk migration path from a state-backed estate to live resource markers (issue #61): read an existing tfstate file once, verify every root-module managed resource it names against the live system, print the ratification report, and - only on a second run given -approve - stamp this estate's markers onto everything that verified.

The pipeline is the observe/stamp split github.com/intentius/choudoufu/internal/live/liveimport's package doc describes, adapted from chant's carve: liveImportRatify is entirely read-only (it opens the state file exactly once, and calls only GetProviderSchema and ReadResource on every provider it reaches), and its report is what gets printed whether or not -approve was given. Only when it was does this command call liveimport.Ratification.Approve, which is the one thing in the whole command that writes.

func (c *LiveImportCommand) Execute(args *arguments.LiveImport) int

func (c *LiveImportCommand) Help() string

func (c *LiveImportCommand) Run(rawArgs []string) int

func (c *LiveImportCommand) Synopsis() string

type LiveLsCommand ¶ added in v0.12.0

type LiveLsCommand struct {
	Meta
}

LiveLsCommand answers "what does this account hold under estate X", read straight off the live system rather than off anything a configuration declares - live-plan's own question, and a different one. It is GitHub issue #789.

The prior art is examples/live-mv-workbench/tlmig/govern.py's read_inventory, which this command ports rather than reimplements against: two passes, because the Resource Groups Tagging API does not index IAM on a real account (an aws_iam_role created and tagged natively still comes back empty from GetResources - live/floci-capabilities.json records the same gap against floci before lex00/floci#229's fix, and the fact is real AWS's regardless of what any one emulator pin does about it), so an inventory that trusted the tagging index alone would silently under-report every estate that owns a role. The second pass - iam:ListRoles, then iam:ListRoleTags per role, kept only where the role's own tofu-estate tag names this estate - is what closes that gap, at the cost this command's own doc comment on liveLsIAMRoles states plainly rather than hides.

What this command deliberately does NOT do is reuse internal/live/discovery's sweep (Discover, sweepViaTagging): that machinery answers "what does this estate's CONFIGURATION not yet know about", which needs a loaded configuration, a running provider and a resolved identity map before it can list anything at all. This command answers a narrower, cheaper question - what carries the estate's tag, full stop - that an inheritor or an auditor with nothing but read-only IAM can ask with no configuration in hand. The lower-level primitives discovery's own tagging sweep is built from (cloudcontrol.Client.GetResources, markers's decode functions) are exactly what this command reuses; the configuration-aware parts are not.

The Kubernetes listing (GitHub issue #1081) is the one part that does need DIR, because the substrate is learned from the configuration's provider blocks and the cluster client is built from one of them, the way live-plan's own sweep builds it ([projectionProviders.kubernetesClient]). What it lists is what the sweep lists - one cluster-wide, label-selected list per kind the cluster serves, controller-made objects excluded (kubesweep.Client) - and what it calls declared is what the sweep calls declared ([discovery.DeclaredKubernetesObjects]), so the inventory and the removal plan cannot disagree about an object.

func (c *LiveLsCommand) Execute(args *arguments.LiveLs) int

func (c *LiveLsCommand) Help() string

func (c *LiveLsCommand) Run(rawArgs []string) int

func (c *LiveLsCommand) Synopsis() string

type LiveMvCommand ¶

type LiveMvCommand struct {
	Meta
}

LiveMvCommand renames a resource in a live-mode estate: it rewrites the tofu-address ownership marker on the live resource that carries the old address.

This is the whole replacement for `moved` blocks and state surgery. There is no record to edit, because there is no record - a resource's address lives in one tag value on the resource itself, and overwriting that value is the move (live/MARKERS.md, "The rename rule"). Nothing about the old address survives the write, because a single tag value cannot hold two addresses.

The order of operations is config first, marker second: rename the resource block, then run this. That is the ordering that never leaves a marker naming an address nothing declares, and it is why a destination address absent from configuration is refused rather than written (-allow-missing-config is the deliberate opt out, for the operator who wants both halves in one change).

The write is a real, minimal apply through the provider, on one instance: the resource is materialized exactly as a projection materializes it, the same object is synthesized with one tag changed, and PlanResourceChange and ApplyResourceChange run for that instance alone. No cloud CLI, no provider-specific code, and no plan over the rest of the configuration.

func (c *LiveMvCommand) Execute(args *arguments.LiveMv) int

func (c *LiveMvCommand) Help() string

func (c *LiveMvCommand) Run(rawArgs []string) int

func (c *LiveMvCommand) Synopsis() string

type LivePlanCommand ¶

type LivePlanCommand struct {
	Meta
}

LivePlanCommand plans a configuration with no authoritative state: no backend, no lock. Prior state is a projection, rebuilt by reading the live system at the start of the run and discarded when the run ends - this standalone command neither reads nor writes the #685 state cache, which belongs to plain plan/apply's LiveRun seam (live_mode.go's runner wires it); a diagnostic command that wrote the cache would overwrite the last real run's snapshot with its own.

The pipeline is lint -> identity -> discovery -> projection -> the ordinary plan engine:

1. The configuration is loaded exactly as the plan command loads it, and no backend is prepared. There is deliberately no state manager of any kind, not even an in-memory one, because there is no operation here that reads or writes a state snapshot: the prior state is passed to tofu.Context.Plan as a value and the resulting plan is rendered and dropped. Avoiding the backend rather than stubbing it is what makes "no state was read or written" a structural property instead of a promise, and it is why this command works in a directory whose backend was never initialized.
2. The providers the configuration names are launched from the ordinary plugin library (the providercache that "choudoufu init" populated), unconfigured, far enough to read their resource identity schemas.
3. lint.CheckWith decides whether the configuration is in the live-mode subset at all, with those schemas in hand: a type absent from the v0 admission table still passes when the schemas describe it completely enough (see identity.SynthesizeTypeIdentity), and a refused type is explained in the identity layer's own words. Any remaining issue is fatal.
4. identity.Resolve classifies every instance, from the same schemas lint just used. Error diagnostics are fatal, because a partial identity map plans creates for things that already exist. The providers are configured only later, once a projection needs to make provider calls.
5. [discovery.Discover] lists the live resources of every type that has an instance waiting on marker discovery, binds the ones carrying this estate's markers, and - because it is asked for unclaimed resources too - brings back everything of those types that carries no marker at all. A count block's instances are bound as a set rather than one address at a time, so the live members past the declared count come back at the instance addresses above it and the plan below destroys them the way it destroys any shrunken count's leftovers. When the estate's managed resources span more than one provider configuration (aliased providers, typically multi-region), liveDiscover runs this step once per distinct provider configuration and [discovery.Merge] combines the results into one, so this step still reads as "discovery ran" even though it may have run several times under the hood (issue #69).
6. foreign.Classify sorts those unclaimed resources into foreign, bind candidate and other-estate, and reports the owned resources sitting at a for_each key the configuration no longer declares as rename candidates. All of it goes into one section. Nothing it finds is ever fed back into the run: an unclaimed resource has no declared address, so it never enters the prior state, and the plan engine has nothing to propose destroying. That is the protection property, and it holds by construction rather than by a filter someone has to remember to apply.
7. projection.BuildFrom materializes the prior state from the merged resolutions, admitting a live object only when it carries this estate's ownership marker or discovery already bound it by one. That check is what keeps a client-named resource - whose identity comes out of the configuration and which therefore never passes through step 5 or step 6 at all - from being adopted on the strength of a name. Whatever it could not read, and whatever it refused, is reported in its own section above the plan, which is the transparency surface for "why does this plan propose a create".
8. [stamp.Stamp] injects this estate's ownership markers into every taggable resource whose configuration does not already declare them, by rewriting the resource bodies before the plan reads them. That is what makes markers a property of the tool rather than of the author's discipline: the plan below shows the tags being added, and an apply of it writes them. A marker the configuration declares and this run disagrees with is fatal rather than overwritten. Count instances also get their tofu-slot tag here, from the assignment discovery worked out in step 5 - which is why stamping runs after discovery and not before.
9. The plan runs with refresh disabled, because the projection was built from live reads moments earlier and refreshing it would read every object a second time to learn the same thing.

func (c *LivePlanCommand) Execute(args *arguments.LivePlan) int

func (c *LivePlanCommand) Help() string

func (c *LivePlanCommand) Run(rawArgs []string) int

func (c *LivePlanCommand) Synopsis() string

type LivePlanSetCommand ¶ added in v0.22.0

type LivePlanSetCommand struct {
	Meta
}

LivePlanSetCommand plans a set of estate roots in one invocation (GitHub issue #1752, part of epic #1749). The orchestration, and why it runs each root's stages as child processes rather than in this one, is internal/live/setplan's package documentation.

It is its own command rather than a flag on live-plan because the two answer different questions with different contracts: live-plan's option set is the plan command's, every one of which applies to one root, and its -json is GitHub issue #788's bound/omissions/unowned document for that root. A set plan has one output directory instead of -out, a document of per-root stock plans instead of #788's, and an exit code that can say "some roots failed" - three places a flag on live-plan would have had to refuse or reinterpret live-plan's own options.

func (c *LivePlanSetCommand) Execute(args *arguments.LivePlanSet) (exitCode int)

func (c *LivePlanSetCommand) Help() string

func (c *LivePlanSetCommand) Run(rawArgs []string) int

func (c *LivePlanSetCommand) Synopsis() string

type LiveSummaryCommand ¶ added in v0.22.0

type LiveSummaryCommand struct {
	Meta
	// contains filtered or unexported fields
}

LiveSummaryCommand prints a grouped summary of many plans (GitHub issue #1753, part of #1749): the set plan's -json document, or one stock plan's JSON, read from a file or stdin. Units with identical changes, after the names that identify each unit are stripped, are one group, so a reviewer reads each distinct change once. The rules are github.com/intentius/choudoufu/internal/live/plansummary's package doc.

It reads a document and prints; it touches no configuration, no cloud and no record. It is output only: it approves and refuses nothing.

func (c *LiveSummaryCommand) Execute(args *arguments.LiveSummary) int

func (c *LiveSummaryCommand) Help() string

func (c *LiveSummaryCommand) Run(rawArgs []string) int

func (c *LiveSummaryCommand) Synopsis() string

type LiveWaveApplyCommand ¶ added in v0.22.0

type LiveWaveApplyCommand struct {
	Meta
}

LiveWaveApplyCommand applies one wave of an approved set (GitHub issue #1754, part of #1749). The approval itself is not stored here: the caller names the set plan document and the digest that was approved, and this command refuses with exit 3 unless every root of the wave still plans to exactly that. The rules are internal/live/waves' Apply.

func (c *LiveWaveApplyCommand) Execute(args *arguments.LiveWaveApply) (exitCode int)

func (c *LiveWaveApplyCommand) Help() string

func (c *LiveWaveApplyCommand) Run(rawArgs []string) int

func (c *LiveWaveApplyCommand) Synopsis() string

type LiveWavesCommand ¶ added in v0.22.0

type LiveWavesCommand struct {
	Meta
}

LiveWavesCommand splits a set of estate roots into ordered waves (GitHub issue #1754, part of #1749): canaries first, then every root after each root whose estate it reads. With a set plan document it also prints the set digest and each wave's. It applies nothing; the 2026-10-01 scope addition is that another tool can read one wave's roots from it and open one change per wave.

func (c *LiveWavesCommand) Execute(args *arguments.LiveWaves) int

func (c *LiveWavesCommand) Help() string

func (c *LiveWavesCommand) Run(rawArgs []string) int

func (c *LiveWavesCommand) Synopsis() string

type LoginCommand ¶

type LoginCommand struct {
	Meta
}

LoginCommand is a Command implementation that runs an interactive login flow for a remote service host. It then stashes credentials in a tfrc file in the user's home directory.

func (c LoginCommand) Execute(args *arguments.Login, view views.Login) int

func (c *LoginCommand) Help() string

func (c *LoginCommand) Run(rawArgs []string) int

func (c *LoginCommand) Synopsis() string

type LogoutCommand ¶

type LogoutCommand struct {
	Meta
}

LogoutCommand is a Command implementation which removes stored credentials for a remote service host.

func (c LogoutCommand) Execute(args *arguments.Logout, view views.Logout) int

func (c *LogoutCommand) Help() string

func (c *LogoutCommand) Run(rawArgs []string) int

func (c *LogoutCommand) Synopsis() string

type Meta ¶

type Meta struct {

	// WorkingDir is an object representing the "working directory" where we're
	// running commands. In the normal case this literally refers to the
	// working directory of the OpenTofu process, though this can take on
	// a more symbolic meaning when the user has overridden default behavior
	// to specify a different working directory or to override the special
	// data directory where we'll persist settings that must survive between
	// consecutive commands.
	//
	// We're currently gradually migrating the various bits of state that
	// must persist between consecutive commands in a session to be encapsulated
	// in here, but we're not there yet and so there are also some methods on
	// Meta which directly read and modify paths inside the data directory.
	WorkingDir *workdir.Dir

	// SystemCfg holds the configuration attributes that are global for all
	// the commands and are used by different parts of the system.
	//SystemCfg system.Config
	SystemCfg system.Config

	View *views.View

	// Services provides access to remote endpoint information for
	// 'tofu-native' services running at a specific user-facing hostname.
	Services *disco.Disco

	// PluginCacheMayBreakDependencyLockFile is a temporary CLI configuration-based
	// opt out for the behavior of only using the plugin cache dir if its
	// contents match checksums recorded in the dependency lock file.
	//
	// This is an accommodation for those who currently essentially ignore the
	// dependency lock file -- treating it only as transient working directory
	// state -- and therefore don't care if the plugin cache dir causes the
	// checksums inside to only be sufficient for the computer where OpenTofu
	// is currently running.
	//
	// We intend to remove this exception again (making the CLI configuration
	// setting a silent no-op) in future once we've improved the dependency
	// lock file mechanism so that it's usable for everyone and there are no
	// longer any compelling reasons for folks to not lock their dependencies.
	PluginCacheMayBreakDependencyLockFile bool

	// ProviderSource allows determining the available versions of a provider
	// and determines where a distribution package for a particular
	// provider version can be obtained.
	ProviderSource getproviders.Source

	// ModulePackageFetcher is the client to use when fetching module packages
	// from remote locations. This object effectively represents the policy
	// for how to fetch remote module packages, which is decided by the caller.
	//
	// Leaving this nil means that only local modules (using relative paths
	// in the source address) are supported, which is only reasonable for
	// unit testing.
	ModulePackageFetcher *getmodules.PackageFetcher

	// MakeRegistryHTTPClient is a function called each time a command needs
	// an HTTP client that will be used to make requests to a module or
	// provider registry.
	//
	// This is used by package main to deal with some operator-configurable
	// settings for retries and timeouts. If this isn't set then a new client
	// with reasonable defaults for tests will be used instead.
	MakeRegistryHTTPClient func() *retryablehttp.Client

	// BrowserLauncher is used by commands that need to open a URL in a
	// web browser.
	BrowserLauncher webbrowser.Launcher

	// A context.Context provided by the caller -- typically "package main" --
	// which might be carrying telemetry-related metadata and so should be
	// used when creating downstream traces, etc.
	//
	// This isn't guaranteed to be set, so use [Meta.CommandContext] to
	// safely create a context for the entire execution of a command, which
	// will be connected to this parent context if it's present.
	CallerContext context.Context

	// When this channel is closed, the command will be cancelled.
	ShutdownCh <-chan struct{}

	// ProviderDevOverrides are providers where we ignore the lock file, the
	// configured version constraints, and the local cache directory and just
	// always use exactly the path specified. This is intended to allow
	// provider developers to easily test local builds without worrying about
	// what version number they might eventually be released as, or what
	// checksums they have.
	ProviderDevOverrides map[addrs.Provider]getproviders.PackageLocalDir

	// UnmanagedProviders are a set of providers that exist as processes
	// predating OpenTofu, which OpenTofu should use but not worry about the
	// lifecycle of.
	//
	// This is essentially a more extreme version of ProviderDevOverrides where
	// OpenTofu doesn't even worry about how the provider server gets launched,
	// just trusting that someone else did it before running OpenTofu.
	UnmanagedProviders map[addrs.Provider]*plugin.ReattachConfig

	// Since `tofu providers lock` and `tofu providers mirror` have their own
	// logic to create the source to fetch providers through, we had to
	// plumb this configuration through the [Meta] type to reach that part too.
	// In any other cases, this configuration is built and used directly in `realMain`
	// when the providers sources are built.
	ProviderSourceLocationConfig getproviders.LocationConfig
	OCICredentialsPolicyBuilder  oci.OCICredsPolicyBuilder
	// contains filtered or unexported fields
}

Meta are the meta-options that are available on all or most commands.

func (m *Meta) Backend(ctx context.Context, opts *BackendOpts, enc encryption.StateEncryption) (backend.Enhanced, tfdiags.Diagnostics)

func (m *Meta) BackendForLocalPlan(ctx context.Context, settings plans.Backend, enc encryption.StateEncryption) (backend.Enhanced, tfdiags.Diagnostics)

func (m *Meta) CommandContext() context.Context

func (m *Meta) Encryption(ctx context.Context) (encryption.Encryption, tfdiags.Diagnostics)

func (m *Meta) EncryptionFromModule(ctx context.Context, module *configs.Module) (encryption.Encryption, tfdiags.Diagnostics)

func (m *Meta) EncryptionFromPath(ctx context.Context, path string) (encryption.Encryption, tfdiags.Diagnostics)

func (m *Meta) Input() bool

func (m *Meta) InputMode() tofu.InputMode

func (m *Meta) InterruptibleContext(base context.Context) (context.Context, context.CancelFunc)

// This example is only for when using this function very early in
// the "Run" method of a Command implementation. If you already have
// an active context, pass that in as base instead.
ctx, done := c.InterruptibleContext(c.CommandContext())
defer done()

func (m *Meta) MaybeGetSchemas(ctx context.Context, state *states.State, config *configs.Config) (*tofu.Schemas, tfdiags.Diagnostics)

func (m *Meta) NewRuntimeEnabled() bool

func (m *Meta) Operation(ctx context.Context, b backend.Backend, view views.Backend, enc encryption.Encryption) *backend.Operation

func (m *Meta) PlanFile(path string, enc encryption.PlanEncryption) (*planfile.WrappedPlanFile, error)

func (m *Meta) RunOperation(ctx context.Context, b backend.Enhanced, opReq *backend.Operation) (*backend.RunningOperation, tfdiags.Diagnostics)

func (m *Meta) SetWorkspace(name string) error

func (m *Meta) StateOutPath() string

func (m *Meta) StaticConfigInstance(ctx context.Context, root *configs.Module, modules eval.ExternalModules) (*eval.ConfigInstance, tfdiags.Diagnostics)

func (m *Meta) UIInput() tofu.UIInput

func (m *Meta) Workspace(ctx context.Context) (string, error)

func (m *Meta) WorkspaceOverridden(_ context.Context) (string, bool)

type MetadataCommand ¶

type MetadataCommand struct {
	Meta
}

MetadataCommand is a Command implementation that just shows help for the subcommands nested below it.

func (c *MetadataCommand) Help() string

func (c *MetadataCommand) Run(args []string) int

func (c *MetadataCommand) Synopsis() string

type MetadataFunctionsCommand ¶

type MetadataFunctionsCommand struct {
	Meta
}

MetadataFunctionsCommand is a Command implementation that prints out information about the available functions in OpenTofu.

func (c *MetadataFunctionsCommand) Help() string

func (c *MetadataFunctionsCommand) Run(rawArgs []string) int

func (c *MetadataFunctionsCommand) Synopsis() string

type OutputCommand ¶

type OutputCommand struct {
	Meta
}

OutputCommand is a Command implementation that reads an output from a OpenTofu state and prints it.

func (c OutputCommand) Execute(args *arguments.Output, view views.Output) int

func (c *OutputCommand) Help() string

func (c *OutputCommand) Outputs(ctx context.Context, statePath string, enc encryption.Encryption) (map[string]*states.OutputValue, tfdiags.Diagnostics)

func (c *OutputCommand) Run(rawArgs []string) int

func (c *OutputCommand) Synopsis() string

type PlanCommand ¶

type PlanCommand struct {
	Meta
}

PlanCommand is a Command implementation that compares a OpenTofu configuration to an actual infrastructure and shows the differences.

func (c PlanCommand) Execute(args *arguments.Plan, view views.Plan) int

func (c *PlanCommand) Help() string

func (c *PlanCommand) OperationRequest(
	ctx context.Context,
	be backend.Enhanced,
	view views.Plan,
	viewOptions *arguments.View,
	args *arguments.Operation,
	planOutPath string,
	generateConfigOut string,
	enc encryption.Encryption,
) (*backend.Operation, tfdiags.Diagnostics)

func (c *PlanCommand) PrepareBackend(ctx context.Context, args *arguments.State, view views.Plan, enc encryption.Encryption) (backend.Enhanced, tfdiags.Diagnostics)

func (c *PlanCommand) Run(rawArgs []string) int

func (c *PlanCommand) Synopsis() string

type ProvidersCommand ¶

type ProvidersCommand struct {
	Meta
}

ProvidersCommand is a Command implementation that prints out information about the providers used in the current configuration/state.

func (c ProvidersCommand) Execute(args *arguments.Providers, view views.Providers) int

func (c *ProvidersCommand) Help() string

func (c *ProvidersCommand) Run(rawArgs []string) int

func (c *ProvidersCommand) Synopsis() string

type ProvidersLockCommand ¶

type ProvidersLockCommand struct {
	Meta
}

ProvidersLockCommand is a Command implementation that implements the "tofu providers lock" command, which creates or updates the current configuration's dependency lock file using information from upstream registries, regardless of the provider installation configuration that is configured for normal provider installation.

func (c ProvidersLockCommand) Execute(args *arguments.ProvidersLock, view views.ProvidersLock) int

func (c *ProvidersLockCommand) Help() string

func (c *ProvidersLockCommand) Run(rawArgs []string) int

func (c *ProvidersLockCommand) Synopsis() string

type ProvidersMirrorCommand ¶

type ProvidersMirrorCommand struct {
	Meta
}

ProvidersMirrorCommand is a Command implementation that implements the "tofu providers mirror" command, which populates a directory with local copies of provider plugins needed by the current configuration so that the mirror can be used to work offline, or similar.

func (c ProvidersMirrorCommand) Execute(args *arguments.ProvidersMirror, view views.ProvidersMirror) int

func (c *ProvidersMirrorCommand) Help() string

func (c *ProvidersMirrorCommand) Run(rawArgs []string) int

func (c *ProvidersMirrorCommand) Synopsis() string

type ProvidersSchemaCommand ¶

type ProvidersSchemaCommand struct {
	Meta
}

ProvidersSchemaCommand is a Command implementation that prints out information about the providers used in the current configuration/state.

func (c ProvidersSchemaCommand) Execute(args *arguments.ProvidersSchema, view views.ProvidersSchema) int

func (c *ProvidersSchemaCommand) Help() string

func (c *ProvidersSchemaCommand) Run(rawArgs []string) int

func (c *ProvidersSchemaCommand) Synopsis() string

type PushCommand ¶

type PushCommand struct {
	Meta
}

func (c *PushCommand) Help() string

func (c *PushCommand) Run(rawArgs []string) int

func (c *PushCommand) Synopsis() string

type RefreshCommand ¶

type RefreshCommand struct {
	Meta
}

RefreshCommand is a cli.Command implementation that refreshes the state file.

func (c RefreshCommand) Execute(args *arguments.Refresh, view views.Refresh) int

func (c *RefreshCommand) Help() string

func (c *RefreshCommand) OperationRequest(ctx context.Context, be backend.Enhanced, view views.Refresh, args *arguments.Operation, enc encryption.Encryption,
) (*backend.Operation, tfdiags.Diagnostics)

func (c *RefreshCommand) PrepareBackend(ctx context.Context, args *arguments.State, view views.Refresh, enc encryption.Encryption) (backend.Enhanced, tfdiags.Diagnostics)

func (c *RefreshCommand) Run(rawArgs []string) int

func (c *RefreshCommand) Synopsis() string

type ShowCommand ¶

type ShowCommand struct {
	Meta
	// contains filtered or unexported fields
}

ShowCommand is a Command implementation that reads and outputs the contents of a OpenTofu plan or state file. write about config here

func (c ShowCommand) Execute(args *arguments.Show, view views.Show) int

func (c *ShowCommand) Help() string

func (c *ShowCommand) Run(rawArgs []string) int

func (c *ShowCommand) Synopsis() string

type StateCommand ¶

type StateCommand struct {
	StateMeta
}

StateCommand is a Command implementation that just shows help for the subcommands nested below it.

func (c *StateCommand) Help() string

func (c *StateCommand) Run(_ []string) int

func (c *StateCommand) Synopsis() string

type StateListCommand ¶

type StateListCommand struct {
	StateMeta
}

StateListCommand is a Command implementation that lists the resources within a state file.

func (c StateListCommand) Execute(args *arguments.StateList, view views.State) int

func (c *StateListCommand) Help() string

func (c *StateListCommand) Run(rawArgs []string) int

func (c *StateListCommand) Synopsis() string

type StateMeta ¶

type StateMeta struct {
	Meta
}

StateMeta is the meta struct that should be embedded in state subcommands.

func (c *StateMeta) State(ctx context.Context, enc encryption.Encryption, view views.State) (statemgr.Full, error)

type StateMvCommand ¶

type StateMvCommand struct {
	StateMeta
}

StateMvCommand is a Command implementation that shows a single resource.

func (c StateMvCommand) Execute(args *arguments.StateMv, view views.State) int

func (c *StateMvCommand) Help() string

func (c *StateMvCommand) Run(rawArgs []string) int

func (c *StateMvCommand) Synopsis() string

type StatePullCommand ¶

type StatePullCommand struct {
	StateMeta
}

StatePullCommand is a Command implementation that shows a single resource.

func (c StatePullCommand) Execute(args *arguments.StatePull, view views.State) int

func (c *StatePullCommand) Help() string

func (c *StatePullCommand) Run(rawArgs []string) int

func (c *StatePullCommand) Synopsis() string

type StatePushCommand ¶

type StatePushCommand struct {
	StateMeta
}

StatePushCommand is a Command implementation that shows a single resource.

func (c StatePushCommand) Execute(args *arguments.StatePush, view views.State) int

func (c *StatePushCommand) Help() string

func (c *StatePushCommand) Run(rawArgs []string) int

func (c *StatePushCommand) Synopsis() string

type StateReplaceProviderCommand ¶

type StateReplaceProviderCommand struct {
	StateMeta
}

StateReplaceProviderCommand is a Command implementation that allows users to change the provider associated with existing resources. This is only likely to be useful if a provider is forked or changes its fully-qualified name.

func (c StateReplaceProviderCommand) Execute(args *arguments.StateReplaceProvider, view views.State) int

func (c *StateReplaceProviderCommand) Help() string

func (c *StateReplaceProviderCommand) Run(rawArgs []string) int

func (c *StateReplaceProviderCommand) Synopsis() string

type StateRmCommand ¶

type StateRmCommand struct {
	StateMeta
}

StateRmCommand is a Command implementation that shows a single resource.

func (c StateRmCommand) Execute(args *arguments.StateRm, view views.State) int

func (c *StateRmCommand) Help() string

func (c *StateRmCommand) Run(rawArgs []string) int

func (c *StateRmCommand) Synopsis() string

type StateShowCommand ¶

type StateShowCommand struct {
	StateMeta
}

StateShowCommand is a Command implementation that shows a single resource.

func (c StateShowCommand) Execute(args *arguments.StateShow, view views.State) int

func (c *StateShowCommand) Help() string

func (c *StateShowCommand) Run(rawArgs []string) int

func (c *StateShowCommand) Synopsis() string

type TaintCommand ¶

type TaintCommand struct {
	Meta
}

TaintCommand is a cli.Command implementation that manually taints a resource, marking it for recreation.

func (c TaintCommand) Execute(args *arguments.Taint, view views.Taint) int

func (c *TaintCommand) Help() string

func (c *TaintCommand) Run(rawArgs []string) int

func (c *TaintCommand) Synopsis() string

type TestCommand ¶

type TestCommand struct {
	Meta
}

func (c TestCommand) Execute(args *arguments.Test, view views.Test) int

func (c *TestCommand) Help() string

func (c *TestCommand) Run(rawArgs []string) int

func (c *TestCommand) Synopsis() string

type TestFileRunner ¶

type TestFileRunner struct {
	Suite *TestSuiteRunner

	States map[string]*TestFileState
}

func (runner *TestFileRunner) Cleanup(ctx context.Context, file *moduletest.File)

func (runner *TestFileRunner) ExecuteTestFile(ctx context.Context, file *moduletest.File)

func (runner *TestFileRunner) ExecuteTestRun(ctx context.Context, run *moduletest.Run, file *moduletest.File, state *states.State, config *configs.Config) (*states.State, bool)

type TestFileState ¶

type TestFileState struct {
	Run   *moduletest.Run
	State *states.State
}

type TestSuiteRunner ¶

type TestSuiteRunner struct {
	Suite  *moduletest.Suite
	Config *configs.Config

	GlobalVariables map[string]backend.UnparsedVariableValue
	Opts            *tofu.ContextOpts

	View views.Test

	// Stopped and Cancelled track whether the user requested the testing
	// process to be interrupted. Stopped is a nice graceful exit, we'll still
	// tidy up any state that was created and mark the tests with relevant
	// `skipped` status updates. Cancelled is a hard stop right now exit, we
	// won't attempt to clean up any state left hanging, and tests will just
	// be left showing `pending` as the status. We will still print out the
	// destroy summary diagnostics that tell the user what state has been left
	// behind and needs manual clean up.
	Stopped   bool
	Cancelled bool

	// StoppedCtx and CancelledCtx allow in progress OpenTofu operations to
	// respond to external calls from the test command.
	StoppedCtx   context.Context
	CancelledCtx context.Context

	// Verbose tells the runner to print out plan files during each test run.
	Verbose bool
	// contains filtered or unexported fields
}

func (runner *TestSuiteRunner) Start(ctx context.Context)

type UIInput ¶

type UIInput struct {
	// Colorize will color the output.
	Colorize *colorstring.Colorize

	// Reader and Writer for IO. If these aren't set, they will default to
	// Stdin and Stdout respectively.
	Reader io.Reader
	Writer io.Writer
	// contains filtered or unexported fields
}

UIInput is an implementation of tofu.UIInput that asks the CLI for input stdin.

func (i *UIInput) Input(ctx context.Context, opts *tofu.InputOpts) (string, error)

type UnlockCommand ¶

type UnlockCommand struct {
	Meta
}

UnlockCommand is a cli.Command implementation that manually unlocks the state.

func (c UnlockCommand) Execute(args *arguments.Unlock, view views.Unlock) int

func (c *UnlockCommand) Help() string

func (c *UnlockCommand) Run(rawArgs []string) int

func (c *UnlockCommand) Synopsis() string

type UntaintCommand ¶

type UntaintCommand struct {
	Meta
}

UntaintCommand is a cli.Command implementation that manually untaints a resource, marking it as primary and ready for service.

func (c UntaintCommand) Execute(args *arguments.Taint, view views.Taint) int

func (c *UntaintCommand) Help() string

func (c *UntaintCommand) Run(rawArgs []string) int

func (c *UntaintCommand) Synopsis() string

type UsageOverride ¶ added in v0.21.0

type UsageOverride struct {
	// Weird formatting for the root command
	Usage string
	// Weird formatting for the root command
	SingleSpace bool
}

type ValidateCommand ¶

type ValidateCommand struct {
	Meta
}

ValidateCommand is a Command implementation that validates the tofu files

func (c ValidateCommand) Execute(args *arguments.Validate, view views.Validate) int

func (c *ValidateCommand) Help() string

func (c *ValidateCommand) Run(rawArgs []string) int

func (c *ValidateCommand) Synopsis() string

type VersionCommand ¶

type VersionCommand struct {
	Meta

	Version           string
	VersionPrerelease string
	Platform          getproviders.Platform
}

VersionCommand is a Command implementation prints the version.

func (c VersionCommand) Execute(view views.Version) int

func (c *VersionCommand) Help() string

func (c *VersionCommand) Run(rawArgs []string) int

func (c *VersionCommand) Synopsis() string

type WorkspaceCommand ¶

type WorkspaceCommand struct {
	Meta
	LegacyName bool
}

WorkspaceCommand is a Command Implementation that manipulates workspaces, which allow multiple distinct states and variables from a single config.

func (c *WorkspaceCommand) Help() string

func (c *WorkspaceCommand) Run(rawArgs []string) int

func (c *WorkspaceCommand) Synopsis() string

type WorkspaceDeleteCommand ¶

type WorkspaceDeleteCommand struct {
	Meta
	LegacyName bool
}

func (c *WorkspaceDeleteCommand) AutocompleteArgs() complete.Predictor

func (c *WorkspaceDeleteCommand) AutocompleteFlags() complete.Flags

func (c WorkspaceDeleteCommand) Execute(args *arguments.WorkspaceDelete, view views.Workspace) int

func (c *WorkspaceDeleteCommand) Help() string

func (c *WorkspaceDeleteCommand) Run(rawArgs []string) int

func (c *WorkspaceDeleteCommand) Synopsis() string

type WorkspaceListCommand ¶

type WorkspaceListCommand struct {
	Meta
	LegacyName bool
}

func (c *WorkspaceListCommand) AutocompleteArgs() complete.Predictor

func (c *WorkspaceListCommand) AutocompleteFlags() complete.Flags

func (c WorkspaceListCommand) Execute(args *arguments.WorkspaceList, view views.Workspace) int

func (c *WorkspaceListCommand) Help() string

func (c *WorkspaceListCommand) Run(rawArgs []string) int

func (c *WorkspaceListCommand) Synopsis() string

type WorkspaceNewCommand ¶

type WorkspaceNewCommand struct {
	Meta
	LegacyName bool
}

func (c *WorkspaceNewCommand) AutocompleteArgs() complete.Predictor

func (c *WorkspaceNewCommand) AutocompleteFlags() complete.Flags

func (c WorkspaceNewCommand) Execute(args *arguments.WorkspaceNew, view views.Workspace) int

func (c *WorkspaceNewCommand) Help() string

func (c *WorkspaceNewCommand) Run(rawArgs []string) int

func (c *WorkspaceNewCommand) Synopsis() string

type WorkspaceSelectCommand ¶

type WorkspaceSelectCommand struct {
	Meta
	LegacyName bool
}

func (c *WorkspaceSelectCommand) AutocompleteArgs() complete.Predictor

func (c *WorkspaceSelectCommand) AutocompleteFlags() complete.Flags

func (c WorkspaceSelectCommand) Execute(args *arguments.WorkspaceSelect, view views.Workspace) int

func (c *WorkspaceSelectCommand) Help() string

func (c *WorkspaceSelectCommand) Run(rawArgs []string) int

func (c *WorkspaceSelectCommand) Synopsis() string

type WorkspaceShowCommand ¶

type WorkspaceShowCommand struct {
	Meta
}

func (c *WorkspaceShowCommand) AutocompleteArgs() complete.Predictor

func (c *WorkspaceShowCommand) AutocompleteFlags() complete.Flags

func (c WorkspaceShowCommand) Execute(args *arguments.WorkspaceShow, view views.Workspace) int

func (c *WorkspaceShowCommand) Help() string

func (c *WorkspaceShowCommand) Run(rawArgs []string) int

func (c *WorkspaceShowCommand) Synopsis() string