Commit Graph

245 Commits

Author SHA1 Message Date
aleksandarss
730a60826c backend/tests: use workspace argument in testLocksInWorkspace (#3405)
Signed-off-by: aleksandarss <aleksandar-sasa.calic@hotmail.com>
2025-10-24 16:11:01 -04:00
Larry Bordowitz
8b99bac328 go.mod: upgrade tencent libraries (#3412)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-10-22 16:51:52 +01:00
Diogenes Fernandes
13f2a9fcec refactor: use TF_AZURE_TEST_CLIENT_* variables instead of default ones
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-10-22 11:44:39 -03:00
Diogenes Fernandes
8b4fcce514 test: allowing environment variables on azure acceptance tests
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-10-22 11:44:39 -03:00
Diogenes Fernandes
6a2bb41f9a test: avoid panics
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-10-22 11:44:39 -03:00
Martin Atkins
3426be27ef go.mod: go get k8s.io/client-go@v0.34.1
This also updates the other three k8s.io/* modules that we use, as
prerequisites for the upgrade.

The indirect dependency landscape for these modules has changed quite a lot
since the versions we were previously using, and so we have some new
indirect dependencies here. I quickly reviewed each of them and confirmed
that they seem to be under suitable licenses.

The k8s.io/utils/pointer package has been deprecated in favor of
k8s.io/utils/ptr, so this also updates our two callers of that to avoid
calling into deprecated functions.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-10-21 06:54:13 -07:00
Andrei Ciobanu
943c54079a go.mod: go get cloud.google.com/go/storage@v1.57.0 (#3385)
Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>
2025-10-17 18:16:53 +03:00
Martin Atkins
cc5d324098 go.mod: go get go.uber.org/mock@v0.6.0
This is just a routine upgrade. We use this dependency only in our tests,
so this upgrade does not risk changing OpenTofu's behavior. There do not
seem to be any concerning changes upstream.

There are some systematic changes to the shape of the generated mock code,
with the results also included in this commit.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-10-13 08:18:06 -07:00
Martin Atkins
e74bf2d0a1 go.mod: Use the new "tool" directive
Previously the Go toolchain had no explicit support for "tools" and so we
used the typical Go community workaround of adding "tools.go" files (two,
for some reason) that existed only to trick the Go toolchain into
considering the tools as dependencies we could track in go.mod.

Go 1.24 introduced explicit support for tracking tools as part of go.mod,
and the ability to run those using "go tool" instead of "go run", and so
this commit switches us over to using that strategy for everything we were
previously managing in tools.go.

There are some intentional exceptions here:

- The protobuf-compile script can't use "go tool" or "go run" because the
  tools in question are run only indirectly through protoc. However, we
  do still use the "tool" directive in go.mod to tell the Go toolchain that
  we depend on those tools, so that it'll track which versions we are
  currently using as part of go.mod.
- Our golangci-lint Makefile target uses "go run" to run a specific
  version of golangci-lint. We _intentionally_ don't consider that tool
  to be a direct dependency of OpenTofu because it has a lot of indirect
  dependencies that would pollute our go.mod file. Therefore that continues
  to use "go run" after this commit.
- Both of our tools.go files previously referred to
  github.com/nishanths/exhaustive , but nothing actually appears to be
  using that tool in the current OpenTofu tree, so it's no longer a
  dependency after this commit.

All of the dependencies we have _only_ for tools are now classified as
"indirect" in the go.mod file. This is the default behavior of the Go
toolchain and appears to be motivated by making it clearer that these
modules do not contribute anything to the runtime behavior of OpenTofu.
This also corrected a historical oddity in our go.mod where for some reason
the "indirect" dependencies had been split across two different "require"
directives; they are now all grouped together in a single directive.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-10-10 07:06:56 -03:00
Larry Bordowitz
bcbfebce3d Implement the Azure Key Provider
This uses the same auth package as the newly-rewritten Azure State
Backend, so many of the properties and environment variables are the
same. I have put this through both the compliance test as well as built
the binary and run some end-to-end tests, and found that it
appropriately uses the Azure key as expected.

Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-09-29 06:19:02 -04:00
Larry Bordowitz
0090e8a18c Add new configuration to AzureRM Backend (#3251)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-09-15 19:22:17 +01:00
Larry Bordowitz
63e8845ad9 Refactor the azurerm backend (#3034)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-09-03 11:06:11 -04:00
Diógenes Fernandes
35a3100cfe Fix http test server errors on TestBackendConfig_Authentication by removing usage of os.Clearenv (#3221)
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-09-02 16:15:30 -03:00
Diógenes Fernandes
b969c73ee8 fix: filepath.Separator was used to parse URLs (#3220)
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-09-02 07:35:17 -03:00
Andrei Ciobanu
48c55a4bfe Add logging for dynamodb client in s3 backend (#3103)
Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>
2025-08-20 11:28:02 +03:00
Aaron George
e802c63f58 Add tag options for S3 state backend objects (#3038)
Signed-off-by: Aaron George <aarongeorge1994+github@gmail.com>
Co-authored-by: Andrei Ciobanu <andreic9203@gmail.com>
2025-08-07 10:39:19 +03:00
Christian Mesh
2aa3af37a2 Reduce calls to ListKey in azure backend (#3083)
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
2025-07-31 08:39:07 -04:00
Christian Mesh
f311f013fc Fix azure backend tests (#3084)
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
2025-07-31 07:43:28 -04:00
Martin Atkins
868dc2f01b hcl2shim: Split out legacy subset
Due to some past confusion about the purpose of this package, it has grown
to include a confusing mix of currently-viable code and legacy support
code from the move to HCL 2. This has in turn caused confusion about which
parts of this package _should_ be used for new code.

To help clarify that distinction we'll move the legacy support code into
a package under the "legacy" directory, which is also where most of its
callers live.

There are unfortunately still some callers to these outside of the legacy
tree, but the vast majority are either old tests written before HCL 2
adoption or helper code used only by those tests. The one dubious exception
is the use in ResourceInstanceObjectSrc.Decode, which makes a best effort
to shim flatmap as a concession to the fact that not all state-loading
codepaths are able to run the provider state upgrade function that would
normally be responsible for the flatmap-to-JSON conversion, which is
explained in a new comment inline.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-07-10 08:13:25 -07:00
Martin Atkins
67a5cd0911 statemgr+remote: context.Context parameters
This extends statemgr.Persistent, statemgr.Locker and remote.Client to
all expect context.Context parameters, and then updates all of the existing
implementations of those interfaces to support them.

All of the calls to statemgr.Persistent and statemgr.Locker methods outside
of tests are consistently context.TODO() for now, because the caller
landscape of these interfaces has some complications:

1. statemgr.Locker is also used by the clistate package for its state
   implementation that was derived from statemgr.Filesystem's predecessor,
   even though what clistate manages is not actually "state" in the sense
   of package statemgr. The callers of that are not yet ready to provide
   real contexts.

   In a future commit we'll either need to plumb context through to all of
   the clistate callers, or continue the effort to separate statemgr from
   clistate by introducing a clistate-specific "locker" API for it
   to use instead.

2. We call statemgr.Persistent and statemgr.Locker methods in situations
   where the active context might have already been cancelled, and so we'll
   need to make sure to ignore cancellation when calling those.

   This is mainly limited to PersistState and Unlock, since both need to
   be able to complete after a cancellation, but there are various
   codepaths that perform a Lock, Refresh, Persist, Unlock sequence and so
   it isn't yet clear where is the best place to enforce the invariant that
   Persist and Unlock must not be called with a cancelable context. We'll
   deal with that more in subsequent commits.

Within the various state manager and remote client implementations the
contexts _are_ wired together as best as possible with how these subsystems
are already laid out, and so once we deal with the problems above and make
callers provide suitable contexts they should be able to reach all of the
leaf API clients that might want to generate OpenTelemetry traces.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-07-10 08:11:39 -07:00
Andrei Ciobanu
a183f8ac6d Adjust one of the tests to ensure that the customer managed sse is configured correctly for the request to get the lock file (#2978)
Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>
2025-06-30 11:26:47 -04:00
Andrei Ciobanu
482042e3f1 Unify encryption calls s3 backend (#2976)
Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>
2025-06-30 17:19:43 +03:00
Andrei Ciobanu
0e8d32e556 Add encryption headers for the s3 native locking file (#2975)
Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>
2025-06-30 16:51:12 +03:00
Martin Atkins
0afbaae42d backend/s3: Use APNInfo instead of UserAgent (#2955)
Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-06-25 09:15:40 -04:00
Larry Bordowitz
ed6699f8c9 refactor: add err checks (#2896)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-06-17 20:18:53 +04:00
Larry Bordowitz
9b6a8fae60 refactor: implement all simple static checks (#2895)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-06-10 15:48:43 -04:00
Larry Bordowitz
839392d52c refactor: remove unused func in s3 backend (#2879)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-06-10 10:28:17 -04:00
Larry Bordowitz
afa7787859 refactor: fix deprecated Google Cloud KMS lib (#2897)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-06-10 10:24:16 -04:00
Larry Bordowitz
837f905c7f refactor: remove unnecessary var in k8s backend (#2894)
Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>
2025-06-10 10:22:40 -04:00
James Humphries
dd8acbb113 Added otel tracing to show command (#2734)
Signed-off-by: James Humphries <james@james-humphries.co.uk>
2025-05-22 15:10:23 +01:00
Christian Mesh
ae542df787 Tune .golangci.yml and fix small lint
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
2025-05-09 14:14:53 -04:00
Martin Atkins
d1de75543c backend/azure: Use the context.Context passed from caller
Now that the backend.Backend interface includes a context.Context parameter
on all of the methods that are expected to make external API requests we
can connect the incoming contexts with the previous use of contexts for
timeout handling, so that these functions can also (in future) make use
of incoming trace span metadata for describing the requests being made.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 14:14:34 -07:00
Martin Atkins
b3ab138799 backend: Backend.DeleteWorkspace takes context.Context
This adds a new context.Context argument to the Backend.DeleteWorkspace
method, updates all of the implementations to match, and then updates all
of the callers to pass in a context.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 14:14:34 -07:00
Martin Atkins
601e84ee71 backend: Backend.StateMgr takes context.Context
This adds a new context.Context argument to the Backend.StateMgr method,
updates all of the implementations to match, and then updates all of the
callers to pass in a context.

A small number of callers don't yet have context plumbed to them so those
use context.TODO() as a placeholder for now, so we can more easily find
and fix them in later commits once we have contexts more thoroughly
plumbed.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 14:14:34 -07:00
Martin Atkins
b9573139ab backend: Backend.Workspaces takes context.Context
This adds a new context.Context argument to the Backend.Workspaces method,
updates all of the implementations to match, and then updates all of the
callers to pass in a context.

A small number of callers don't yet have context plumbed to them so those
use context.TODO() as a placeholder for now, so we can more easily find
and fix them in later commits once we have contexts more thoroughly
plumbed.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 14:14:34 -07:00
Martin Atkins
2922059ff3 backend: Backend.Configure takes context.Context
This adds a new context.Context argument to the Backend.Configure method,
updates all of the implementations to match, and then updates all of the
callers to pass in a context.

A small number of callers don't yet have context plumbed to them so those
use context.TODO() as a placeholder for now, so we can more easily find
and fix them in later commits once we have contexts more thoroughly
plumbed.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 14:14:34 -07:00
Martin Atkins
45e3a7bcf4 various: Remove context.TODO() usage from all tests
When context.Context was new, APIs using it arrived sporadically and so
the Go team introduced context.TODO() as an explicit way to say "I need a
context but I don't yet have a useful one to provide".

It took quite a while for there to be an established pattern for contexts
in tests, but now there is finally testing.T.Context which returns a
context that gets cancelled once the test is complete, and so that's a good
parent context to use for all contexts belonging to a test case.

This commit therefore mechanically replaces every use of context.TODO in
our test cases throughout the codebase with a call to t.Context instead.
There were a small number of tests that were using a mixture of
context.TODO and context.Background as placeholders and so those are also
updated to use t.Context consistently. There are probably still some
remaining uses of context.Background in our tests, but we'll save those
for another day.

As of this commit there are still various uses of context.TODO left in
_non-test_ code, but we need to take more care in how we update those so
those are intentionally excluded here.

Signed-off-by: Martin Atkins <mart@degeneration.co.uk>
2025-05-07 10:33:03 -07:00
Diógenes Fernandes
6120086315 Adding pagination to azure backend workspaces (#2720)
Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>
2025-05-07 09:46:27 -03:00
Oleksandr Levchenkov
82d71e50e8 add deprecation warnings support for terraform_remote_state (#2679)
Signed-off-by: ollevche <ollevche@gmail.com>
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
Co-authored-by: Christian Mesh <christianmesh1@gmail.com>
2025-04-25 12:26:28 +03:00
xingjiu
f0e3ad83c8 backend/oss: Support NO_PROXY environment variable
This backend previously had its own local implementation of dealing with the typical proxy-configuration environment variables, which did not support NO_PROXY.

We'll now use the proxy-from-environment implementation from the Go x/net/http library, which matches how we deal with proxy-from-environment in some other locations and, in particular, handles the NO_PROXY environment variable in the way that it's typically interpreted by other software.

Signed-off-by: zeshan <xingjiu06@gmail.com>
2025-04-17 09:39:04 -07:00
Taliesin Sisson
690a38dd69 Make table name and index name a config value for PG backend (#2465)
Signed-off-by: Taliesin Sisson <taliesins@yahoo.com>
2025-04-09 17:21:25 -04:00
Andrei Ciobanu
44d07cea4b Lock object writing is configured the same with the state object writing (#2606)
Signed-off-by: yottta <andrei.ciobanu@opentofu.org>
2025-03-18 12:34:27 +02:00
Andrei Ciobanu
1b103f3ac4 Bump aws sdk - mx-central-1 included and new default checksum behaviour changed for 3rd party s3 providers (#2596)
Signed-off-by: yottta <andrei.ciobanu@opentofu.org>
2025-03-18 10:36:57 +02:00
Christian Mesh
b2bf39802a Implement the first part of RFC 20250303-linter-policy (#2577)
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
2025-03-10 13:16:27 -04:00
Andrei Ciobanu
eba25e2fed Add the initial implementation for s3 locking (#2521)
Signed-off-by: yottta <andrei.ciobanu@opentofu.org>
2025-02-25 14:17:30 +02:00
Andrei Ciobanu
a3276028ad Upgrade aws sdk to a version that will give us access to s3 conditional writes arguments (#2528)
Signed-off-by: yottta <andrei.ciobanu@opentofu.org>
2025-02-18 15:58:17 +02:00
Oleksandr Levchenkov
2a4d81042b make pg backend acquire schema-based global locks (#2411)
Signed-off-by: ollevche <ollevche@gmail.com>
2025-01-31 14:21:36 +02:00
Haider Bari
6614782e6d Improved error messages for lock-related problems in the s3 backend (#2410)
Signed-off-by: Bari, Haider <haider.bari@fmr.com>
Co-authored-by: Bari, Haider <haider.bari@fmr.com>
2025-01-29 11:20:28 -05:00
Christian Mesh
87cd9227dc Fix S3 acceptance test panic, introduced in 1.7 encryption (#2420)
Signed-off-by: Christian Mesh <christianmesh1@gmail.com>
2025-01-24 09:59:43 -05:00
Haider Bari
be72380cdb "force-unlock" support for the HTTP backend (#2381)
Signed-off-by: Bari, Haider <haider.bari@fmr.com>
Co-authored-by: Bari, Haider <haider.bari@fmr.com>
2025-01-22 19:05:57 -05:00