Allow unconfigured computed metadata in Terraform bundle plans #125

Merged

gitchegumi merged 1 commit from kiyi/terraform-computed-kv-metadata into main

2026-10-18 00:35:54 -05:00

kiyi commented

2026-10-18 00:26:19 -05:00

Member

Terraform run 105 rejects Core record adoption because Vault 5.12 plans omitted custom_metadata as unknown. That block is Optional+Computed in the pinned provider source. The existing module supplies no metadata block.

Allow the exact computed true marker only for declared bundle KV records when their owned record resource has no custom_metadata expression in the exported configuration. Missing or malformed configuration fails closed. Concrete metadata blocks, configured expressions, all other unknown control fields, deletion/replacement, secret persistence and imports remain rejected. Plan hashing retains the metadata marker and full configuration. No caller, status name, OpenBao permission or secret is changed.

Validation: all 58 Terraform delivery/OpenBao/catalog/bootstrap tests pass. An isolated Terraform 1.16.5 test with the actual Vault 5.12 provider and synthetic data reproduced custom_metadata: true without contacting a live API or applying resources; its exported resource change passes the corrected validator. Regression tests reject configured metadata and other unknown fields and prove the marker stays bound to the plan fingerprint. Native Gitleaks 8.30.1 and git diff --check pass. Hosted acceptance requires a reviewed workflow release promoted to stable-v1, followed by the same owning plan operation.

[Terraform run 105](https://git.gitchegumi.com/Homelab/terraform-modules/actions/runs/105/jobs/1/attempt/1) rejects Core record adoption because Vault 5.12 plans omitted `custom_metadata` as unknown. That block is Optional+Computed in the [pinned provider source](https://github.com/hashicorp/terraform-provider-vault/blob/v5.12.0/vault/resource_kv_secret_v2.go). The existing module supplies no metadata block. Allow the exact computed `true` marker only for declared bundle KV records when their owned record resource has no `custom_metadata` expression in the exported configuration. Missing or malformed configuration fails closed. Concrete metadata blocks, configured expressions, all other unknown control fields, deletion/replacement, secret persistence and imports remain rejected. Plan hashing retains the metadata marker and full configuration. No caller, status name, OpenBao permission or secret is changed. Validation: all 58 Terraform delivery/OpenBao/catalog/bootstrap tests pass. An isolated Terraform 1.16.5 test with the actual Vault 5.12 provider and synthetic data reproduced `custom_metadata: true` without contacting a live API or applying resources; its exported resource change passes the corrected validator. Regression tests reject configured metadata and other unknown fields and prove the marker stays bound to the plan fingerprint. Native Gitleaks 8.30.1 and git diff --check pass. Hosted acceptance requires a reviewed workflow release promoted to stable-v1, followed by the same owning plan operation.

kiyi added 1 commit

2026-10-18 00:26:19 -05:00

Allow unconfigured computed metadata in Terraform bundle plans

Repository security / security-1 (pull_request) Successful in 2m10s

Details

Workflow acceptance / acceptance (pull_request) Successful in 2m28s

Details

Library checks / tests (pull_request) Successful in 7m2s

Details

27ef3856ae

portegumi approved these changes

2026-10-18 00:28:02 -05:00

portegumi left a comment

Reviewed the exact head's Terraform plan validator and regression cases. The exception is restricted to declared bundle KV records, the exact custom_metadata: true unknown marker, and a single managed owned resource whose exported configuration omits the metadata expression; absent/malformed configuration fails closed. Existing guards still reject concrete metadata, other unknown control fields, imports, deletions/replacements, and persisted secret data; the complete plan including this marker remains fingerprinted. Verified Vault provider v5.12.0 declares custom_metadata Optional+Computed. This change is Terraform/OpenBao bundle-plan validation, not a UDS deployment, policy/admission, or routing-resource change. Source approval only: Workflow acceptance, Repository security, and Library checks were pending when reviewed; they must pass for merge, and a released stable-v1 workflow plus the owning plan operation remains separately unverified. I did not run tests locally or perform a live plan/apply.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the exact head's Terraform plan validator and regression cases. The exception is restricted to declared bundle KV records, the exact `custom_metadata: true` unknown marker, and a single managed owned resource whose exported configuration omits the metadata expression; absent/malformed configuration fails closed. Existing guards still reject concrete metadata, other unknown control fields, imports, deletions/replacements, and persisted secret data; the complete plan including this marker remains fingerprinted. Verified Vault provider v5.12.0 declares custom_metadata Optional+Computed. This change is Terraform/OpenBao bundle-plan validation, not a UDS deployment, policy/admission, or routing-resource change. Source approval only: Workflow acceptance, Repository security, and Library checks were pending when reviewed; they must pass for merge, and a released stable-v1 workflow plus the owning plan operation remains separately unverified. I did not run tests locally or perform a live plan/apply. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.