Documentation
¶
Index ¶
- func AnyVersionChangedIn(ctx context.Context, planRaw tftypes.Value, ...) bool
- func DatasourceSchema(opts DatasourceSchemaOptions) (result schema.SingleNestedAttribute)
- func ReadOnlyResourceSchema(opts ResourceSchemaOptions) (result schema.SingleNestedAttribute)
- func ResourceSchema(opts ResourceSchemaOptions) (result schema.SingleNestedAttribute)
- func SetToUnknownIfVersionChangedOrCreated(ctx context.Context, plan, state generic.AttributeGetter, ...) func(attributePath path.Path, diags *diag.Diagnostics) (versionChanged bool)
- func ValueFromConverter(ctx context.Context, plan, state generic.AttributeGetter, ...) (out tftypes.Value, err error)
- func ValueToConverter(ctx context.Context, config, plan, state generic.AttributeGetter, ...) (out clientTypes.Secret, err error)
- func VersionChanged(ctx context.Context, plan, state generic.AttributeGetter, ...) bool
- func WalkSecretPathsIn(raw tftypes.Value, diags *diag.Diagnostics, ...)
- func WithConverterSupport(ctx context.Context, config, plan, state generic.AttributeGetter) generic.ConverterOptions
- func WithDatasourceConverter() generic.ConverterOption
- type DatasourceSchemaOptions
- type HashOnly
- type ResourceSchemaOptions
- type Secret
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AnyVersionChangedIn ¶ added in v0.23.0
func AnyVersionChangedIn(ctx context.Context, planRaw tftypes.Value, plan, state generic.AttributeGetter, diags *diag.Diagnostics) bool
AnyVersionChangedIn walks every secret in planRaw and reports whether any of them is being rotated/ re-applied or newly added, relative to state (see VersionChanged). Read-only — intended for deciding whether an update must trigger a run.
func DatasourceSchema ¶
func DatasourceSchema(opts DatasourceSchemaOptions) (result schema.SingleNestedAttribute)
DatasourceSchema represents a secret read out from the backend (hash-only, sorry). Still the hash is useful to detect if secrets have changed externally. Use together with generic.ValueFrom and WithDatasourceConverter.
func ReadOnlyResourceSchema ¶ added in v0.23.0
func ReadOnlyResourceSchema(opts ResourceSchemaOptions) (result schema.SingleNestedAttribute)
ReadOnlyResourceSchema defines the read-only Secret representation (hash only, see HashOnly) for a computed resource attribute or data source, where the secret is surfaced for drift detection but is not managed through this attribute. Use ResourceSchema instead for a managed, write-only secret.
func ResourceSchema ¶
func ResourceSchema(opts ResourceSchemaOptions) (result schema.SingleNestedAttribute)
ResourceSchema defines the Secret representation within the Terraform state/plan. Use during Create/Update resource actions with generic.ValueTo, generic.ValueFrom conversion and WithConverterSupport as options. For the ModifyPlan resource action, use WalkSecretPathsIn with SetToUnknownIfVersionChangedOrCreated.
func SetToUnknownIfVersionChangedOrCreated ¶ added in v0.19.2
func SetToUnknownIfVersionChangedOrCreated(ctx context.Context, plan, state generic.AttributeGetter, responsePlan generic.AttributeSetter) func(attributePath path.Path, diags *diag.Diagnostics) (versionChanged bool)
SetToUnknownIfVersionChangedOrCreated constructs a visitor for WalkSecretPathsIn which sets the secret_hash of the secret at the given attribute to unknown if the secret_version changes according to the given plan and state. If the secret is newly created, sets secret_hash and secret_version to unknown to cover the case of later addition of a secret attribute if the resource exists already (resource is updated). secret_version is only set to unknown if the planned value is null (omitted in config).
func ValueFromConverter ¶
func ValueFromConverter(ctx context.Context, plan, state generic.AttributeGetter, attributePath path.Path, in clientTypes.Secret) (out tftypes.Value, err error)
ValueFromConverter is called during generic.ValueFrom when converting Terraform value from a client DTO representation. According to the given plan and state (during create and update resource phase), this converter copies over a given hash value as the initial secret_version. This way resources with secrets can be imported without explicitly specifying the correct version initially. Typically used with WithConverterSupport in conjunction with ValueToConverter, but the building_block_definition resource has some special needs as it combines secret values with arbitrary json-encoded strings.
func ValueToConverter ¶
func ValueToConverter(ctx context.Context, config, plan, state generic.AttributeGetter, attributePath path.Path) (out clientTypes.Secret, err error)
ValueToConverter is called during generic.ValueTo when converting Terraform value to a client DTO representation. According to the given plan and state (during create and update resource phase), this converter pulls the write-only attribute secret_value if the secret_version changes and provides this as a one-off value to the backend. Thus, secret rotation can be controlled with secret_version. Typically used with WithConverterSupport in conjunction with ValueFromConverter, but the building_block_definition resource has some special needs as it combines secret values with arbitrary json-encoded strings.
func VersionChanged ¶ added in v0.23.0
func VersionChanged(ctx context.Context, plan, state generic.AttributeGetter, attributePath path.Path, diags *diag.Diagnostics) bool
VersionChanged reports whether the secret at attributePath is being rotated/re-applied — i.e. its secret_version differs between state and plan, its version is unknown (known-after-apply), or the secret is newly added. It is the READ-ONLY counterpart of SetToUnknownIfVersionChangedOrCreated's boolean decision and MUST stay in sync with it: the latter mutates the plan (sets secret_hash unknown) for the same conditions, while this one only reports the decision so callers (e.g. a resource's rerun gate) can reuse it without a response plan.
func WalkSecretPathsIn ¶
func WalkSecretPathsIn(raw tftypes.Value, diags *diag.Diagnostics, visitor func(attributePath path.Path, diags *diag.Diagnostics))
WalkSecretPathsIn finds all secrets matching the Secret object representation in the given raw Terraform value (usually a req.Plan.Raw). It calls the given visitor with the attributePath where the secret is located. See SetToUnknownIfVersionChangedOrCreated for an example visitor.
func WithConverterSupport ¶
func WithConverterSupport(ctx context.Context, config, plan, state generic.AttributeGetter) generic.ConverterOptions
WithConverterSupport enables resources to use Secret representations in their ResourceSchema, while the client uses clientTypes.Secret. See ValueFromConverter and ValueToConverter for details of the bidirectional conversion.
func WithDatasourceConverter ¶
func WithDatasourceConverter() generic.ConverterOption
WithDatasourceConverter converts read in hashes from the backend to the Terraform DatasourceSchema representation. As data sources are read-only, only generic.ValueFrom conversion is supported.
Types ¶
type DatasourceSchemaOptions ¶ added in v0.19.0
type DatasourceSchemaOptions struct {
MarkdownDescription string
}
type HashOnly ¶ added in v0.23.0
type HashOnly struct {
Hash string `tfsdk:"secret_hash"`
}
HashOnly is the read-only Terraform representation of a secret: it exposes only the backend hash, never a value. Use it for data sources and for read-only resource attributes where the secret is surfaced for drift detection but is not managed through that attribute.
type ResourceSchemaOptions ¶ added in v0.19.0
type Secret ¶
type Secret struct {
Value *string `tfsdk:"secret_value"`
Version *string `tfsdk:"secret_version"`
Hash *string `tfsdk:"secret_hash"`
}
Secret is the Terraform representation of a secret that a resource manages: the caller supplies a write-only value and controls rotation via the version, while the backend-stored hash is computed and read back. Use it for resource attributes that are created/updated through Terraform.
Source Files