Accept fully known Terraform collection markers in identity plans #107

Merged

gitchegumi merged 1 commit from kiyi/identity-plan-known-values into main

2026-10-15 20:22:11 -05:00

kiyi commented

2026-10-15 19:58:41 -05:00

Member

Fully known Terraform collection values were rejected by the workload identity plan guard. Terraform 1.16.5 emits after_unknown markers such as bound_audiences: [false], token_policies: [false] and allowed_kubernetes_namespaces: [false]; Python treats those nonempty lists as true. The old guard therefore rejects valid plans before printing their approval summary/fingerprint. Private Terraform run 69 on main at 3f0c7d9d3708bfcd512b89576bfe47c5d760d3f7 stopped after successful plan export at this boundary; raw provider output remains withheld.

Inspect nested boolean markers recursively. False-only lists/maps now pass; true leaves and malformed markers still fail, including in restricted scope options. Exact declaration comparisons, allowed actions, ownership checks, full semantic fingerprint, saved-plan apply and confidentiality stay in place. Computed resource IDs remain allowed. Workflow/job/status names and caller inputs are unchanged.

Validation at 9f4fecf: captured the marker shape with Terraform 1.16.5 test -json -verbose using only the existing mocked Vault provider; no real local plan, credentials or live APIs. The known-collection regression fails against the old guard and passes with this change. All 35 identity, Terraform delivery, state/approval/confidentiality tests pass, including nested unknown and malformed-marker rejection. Native staged Gitleaks 8.30.1 and diff checks passed; hosted checks remain required. Terraform’s JSON change representation documents nested unknown markers.

After review/checks/merge, publish one new patch release and promote it to stable-v1, then start a fresh owning Provision OpenBao workload identities → plan on main with approval fields blank. Do not reuse run 69’s attempt or dispatch apply: it produced no approved fingerprint and made no identity changes.

Fully known Terraform collection values were rejected by the workload identity plan guard. Terraform 1.16.5 emits `after_unknown` markers such as `bound_audiences: [false]`, `token_policies: [false]` and `allowed_kubernetes_namespaces: [false]`; Python treats those nonempty lists as true. The old guard therefore rejects valid plans before printing their approval summary/fingerprint. Private Terraform run 69 on main at 3f0c7d9d3708bfcd512b89576bfe47c5d760d3f7 stopped after successful plan export at this boundary; raw provider output remains withheld. Inspect nested boolean markers recursively. False-only lists/maps now pass; true leaves and malformed markers still fail, including in restricted scope options. Exact declaration comparisons, allowed actions, ownership checks, full semantic fingerprint, saved-plan apply and confidentiality stay in place. Computed resource IDs remain allowed. Workflow/job/status names and caller inputs are unchanged. Validation at 9f4fecf: captured the marker shape with Terraform 1.16.5 `test -json -verbose` using only the existing mocked Vault provider; no real local plan, credentials or live APIs. The known-collection regression fails against the old guard and passes with this change. All 35 identity, Terraform delivery, state/approval/confidentiality tests pass, including nested unknown and malformed-marker rejection. Native staged Gitleaks 8.30.1 and diff checks passed; hosted checks remain required. [Terraform’s JSON change representation](https://developer.hashicorp.com/terraform/internals/json-format#change-representation) documents nested unknown markers. After review/checks/merge, publish one new patch release and promote it to stable-v1, then start a fresh owning **Provision OpenBao workload identities → plan** on main with approval fields blank. Do not reuse run 69’s attempt or dispatch apply: it produced no approved fingerprint and made no identity changes.

kiyi added 1 commit

2026-10-15 19:58:41 -05:00

Accept fully known Terraform collection markers in identity plans

Workflow acceptance / acceptance (pull_request) Successful in 1m45s

Details

Repository security / security-1 (pull_request) Successful in 6m11s

Details

Library checks / tests (pull_request) Successful in 9m14s

Details

9f4fecfce4

portegumi approved these changes

2026-10-15 19:59:49 -05:00

portegumi left a comment

Reviewed the exact head source, changed-file inventory, identity guard tests, and documentation. The new recursive marker check treats false-only lists/maps as known, rejects true leaves and non-boolean/non-container markers in declared bindings and restricted scope fields, and leaves computed IDs permissible. Existing declaration equality, allowed actions, and restricted-option checks remain intact; the regression covers the reported list shapes and negative cases. This does not modify UDS deployment resources, admission, or gateway/route ownership. Source review approved; this is not merge readiness. Workflow acceptance, Repository security, and Library checks were pending at review time, so their results and live OpenBao/provider compatibility remain unverified. No deployment, promotion, apply, or merge is authorized by this review.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added this to the Homelab Roadmap project

2026-10-15 20:00:34 -05:00

kiyi referenced this pull request from Homelab/Documentation

2026-10-15 20:02:03 -05:00

Record identity plan export and pending review-guard correction #50