Documentation
¶
Overview ¶
Package tfstate backs up and restores Terraform recipe state across ephemeral Radius control planes.
Terraform recipes store their state in Kubernetes Secrets (the Terraform "kubernetes" backend), not in the Radius PostgreSQL databases. Those Secrets live in the radius-system namespace and are labelled "tfstate=true" by the backend. When the Radius control plane runs on an ephemeral cluster (for example a k3d cluster inside a CI runner), those Secrets are destroyed on teardown. Without backing them up, a second deploy of the same Terraform-backed resource in a later run plans from an empty backend and either fails or orphans cloud resources.
This package exports those Secrets to a state directory (the same directory used for the PostgreSQL dumps) and restores them into a fresh cluster before any deploy runs.
Index ¶
Constants ¶
const ( // DefaultNamespace is the Kubernetes namespace where the Radius control plane and its // Terraform state Secrets are installed. DefaultNamespace = "radius-system" // LabelSelector matches the Secrets that the Terraform Kubernetes backend creates for recipe // state. The backend labels every state Secret with "tfstate=true". // https://developer.hashicorp.com/terraform/language/settings/backends/kubernetes LabelSelector = "tfstate=true" // SubDir is the directory, relative to the state directory, where Terraform state Secrets are // written. It keeps the Terraform backups separate from the PostgreSQL dumps in the same tree. SubDir = "tfstate" )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client backs up and restores Terraform recipe state stored as Kubernetes Secrets.
func NewClient ¶
NewClient creates a Client backed by the supplied Kubernetes clientset and namespace.
func NewClientForContext ¶
NewClientForContext builds a Client from a kubeconfig context name, targeting the given namespace.
func (*Client) Backup ¶
Backup writes every Terraform state Secret in the namespace to <stateDir>/tfstate/<name>.json. Existing files in the target directory are removed first so that a Secret deleted since the previous backup does not linger and get restored.
Source Files