diff --git a/CHANGELOG.md b/CHANGELOG.md index 1a26197a4..5c076d520 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,20 @@ # Changelog +## [6.11.0](https://github.com/nullplatform/tofu-modules/compare/v6.10.0...v6.11.0) (2026-08-07) + + +### Features + +* **agent:** worker orchestration passthrough + chart 2.37.0 ([#478](https://github.com/nullplatform/tofu-modules/issues/478)) ([6758a95](https://github.com/nullplatform/tofu-modules/commit/6758a9566e9e0623dec4d91172e8793ed8234c68)) +* **service_definition:** allow pinning specs to a tag or commit SHA ([#470](https://github.com/nullplatform/tofu-modules/issues/470)) ([15b6d47](https://github.com/nullplatform/tofu-modules/commit/15b6d473375031b31f7c8b17049e315bef4fc879)) + + +### Bug Fixes + +* **azure/vnet:** let a subnet declare its route table ([#475](https://github.com/nullplatform/tofu-modules/issues/475)) ([d2a5faf](https://github.com/nullplatform/tofu-modules/commit/d2a5faf83e8f3297503f961e30a0a3d5b60ae015)) +* **docs:** update usage example to a current release tag ([a167934](https://github.com/nullplatform/tofu-modules/commit/a167934eaa22e97d3a704c1cb1f00ffe731d8ca3)) +* **docs:** update usage example to a current release tag ([#484](https://github.com/nullplatform/tofu-modules/issues/484)) ([ed6f5b0](https://github.com/nullplatform/tofu-modules/commit/ed6f5b06a907ef538c3cb44cb1614e9474414de9)) + ## [6.10.0](https://github.com/nullplatform/tofu-modules/compare/v6.9.0...v6.10.0) (2026-08-07) diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md index 8a83d9d39..5a545a6b5 100644 --- a/infrastructure/aws/acm/README.md +++ b/infrastructure/aws/acm/README.md @@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is ```hcl module "acm" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.11.0" domain_name = "your-domain-name" zone_id = "your-zone-id" diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md index 030b30bec..72c42dadb 100644 --- a/infrastructure/aws/aws_load_balancer_controller/README.md +++ b/infrastructure/aws/aws_load_balancer_controller/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont ```hcl module "aws_load_balancer_controller" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.11.0" cluster_name = "your-cluster-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md index 2c0f89a10..fe482cadd 100644 --- a/infrastructure/aws/backend/README.md +++ b/infrastructure/aws/backend/README.md @@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.11.0" } ``` diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md index b780eef03..dd45878af 100644 --- a/infrastructure/aws/dns/README.md +++ b/infrastructure/aws/dns/README.md @@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.11.0" domain_name = "your-domain-name" vpc_id = "your-vpc-id" diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md index 8c3880fee..16937e15c 100644 --- a/infrastructure/aws/eks/README.md +++ b/infrastructure/aws/eks/README.md @@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.11.0" aws_subnets_private_ids = "your-aws-subnets-private-ids" aws_vpc_vpc_id = "your-aws-vpc-vpc-id" @@ -80,6 +80,7 @@ resource "example_resource" "this" { | [attach\_cluster\_primary\_security\_group](#input\_attach\_cluster\_primary\_security\_group) | Attach cluster primary security group to node groups | `bool` | `true` | no | | [authentication\_mode](#input\_authentication\_mode) | Authentication mode for the EKS cluster. Valid values: CONFIG\_MAP, API, API\_AND\_CONFIG\_MAP. | `string` | `"API_AND_CONFIG_MAP"` | no | | [auto\_mode\_node\_pools](#input\_auto\_mode\_node\_pools) | Node pools for Auto Mode. Valid values are 'general-purpose' and 'system'. | `list(string)` | 
[
  "general-purpose",
  "system"
]
| no | +| [aws\_profile](#input\_aws\_profile) | Optional AWS CLI profile used by the kubernetes provider's exec plugin (`aws eks get-token`) to authenticate against the cluster. If empty, the default AWS credential chain (or the AWS\_PROFILE environment variable) is used. | `string` | `""` | no | | [aws\_subnets\_private\_ids](#input\_aws\_subnets\_private\_ids) | List of private subnet IDs for the EKS cluster and node groups | `list(string)` | n/a | yes | | [aws\_vpc\_vpc\_id](#input\_aws\_vpc\_vpc\_id) | VPC ID where the EKS cluster will be deployed | `string` | n/a | yes | | [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Number of days to retain log events in the CloudWatch log group | `number` | `90` | no | diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md index 9dd8b3688..b7bcfc6aa 100644 --- a/infrastructure/aws/iam/agent/README.md +++ b/infrastructure/aws/iam/agent/README.md @@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.11.0" agent_namespace = "your-agent-namespace" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md index 1ca39edb6..af3020330 100644 --- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md +++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md @@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t ```hcl module "aws_load_balancer_controller_iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.11.0" aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md index af83f9e53..00b0a87ca 100644 --- a/infrastructure/aws/iam/cert_manager/README.md +++ b/infrastructure/aws/iam/cert_manager/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53 ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.11.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md index 4150cef55..1d7195598 100644 --- a/infrastructure/aws/iam/ci-build-workflow-user/README.md +++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md @@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera ```hcl module "ci-build-workflow-user" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.11.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md index 15d346131..347dcc33f 100644 --- a/infrastructure/aws/iam/cloudwatch/README.md +++ b/infrastructure/aws/iam/cloudwatch/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write ```hcl module "cloudwatch" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v6.11.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md index c9d56edb7..649864fb9 100644 --- a/infrastructure/aws/iam/ecr/README.md +++ b/infrastructure/aws/iam/ecr/README.md @@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.11.0" build_workflow_group_name = "your-build-workflow-group-name" cluster_name = "your-cluster-name" diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md index ef9028b3a..bd1108043 100644 --- a/infrastructure/aws/iam/external_dns/README.md +++ b/infrastructure/aws/iam/external_dns/README.md @@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.11.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md index 8850e541e..3a556a93d 100644 --- a/infrastructure/aws/iam/s3/README.md +++ b/infrastructure/aws/iam/s3/README.md @@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v6.11.0" bucket = "your-bucket" build_workflow_group_name = "your-build-workflow-group-name" diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md index b2c325b55..57cd3976f 100644 --- a/infrastructure/aws/ingress/README.md +++ b/infrastructure/aws/ingress/README.md @@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte ```hcl module "ingress" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.11.0" certificate_arn = "your-certificate-arn" } diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md index ee208ea72..e2d2a12cd 100644 --- a/infrastructure/aws/security/README.md +++ b/infrastructure/aws/security/README.md @@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.11.0" cluster_name = "your-cluster-name" } diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md index 1dc12183a..b12401fb5 100644 --- a/infrastructure/aws/vpc/README.md +++ b/infrastructure/aws/vpc/README.md @@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.11.0" account = "your-account" organization = "your-organization" diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md index c1e7538d3..0da312531 100644 --- a/infrastructure/azure/acr/README.md +++ b/infrastructure/azure/acr/README.md @@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container ```hcl module "acr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.11.0" containerregistry_name = "your-containerregistry-name" location = "your-location" diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md index f194854ea..c47e31f5f 100644 --- a/infrastructure/azure/aks/README.md +++ b/infrastructure/azure/aks/README.md @@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) which i ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.11.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md index 248ccaf65..4b2c1f2f3 100644 --- a/infrastructure/azure/aks_route_table/README.md +++ b/infrastructure/azure/aks_route_table/README.md @@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the route table cre ```hcl module "aks_route_table" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.11.0" node_resource_group = "your-node-resource-group" subnet_id = "your-subnet-id" diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md index ac7a296a0..f067741ec 100644 --- a/infrastructure/azure/dns/README.md +++ b/infrastructure/azure/dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.11.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md index 099f8e1ad..c7123d8a4 100644 --- a/infrastructure/azure/iam/README.md +++ b/infrastructure/azure/iam/README.md @@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.11.0" location = "your-location" name = "your-name" diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md index 479466c81..08f0a7a63 100644 --- a/infrastructure/azure/private_dns/README.md +++ b/infrastructure/azure/private_dns/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple ```hcl module "private_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.11.0" domain_name = "your-domain-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md index 9a222587e..c59adcc08 100644 --- a/infrastructure/azure/resource_group/README.md +++ b/infrastructure/azure/resource_group/README.md @@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and ```hcl module "resource_group" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.11.0" location = "your-location" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md index 2acb1bd58..8416eee40 100644 --- a/infrastructure/azure/security/README.md +++ b/infrastructure/azure/security/README.md @@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.11.0" cluster_name = "your-cluster-name" resource_group_name = "your-resource-group-name" diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md index fee4f1e0c..188c9caf9 100644 --- a/infrastructure/azure/vnet/README.md +++ b/infrastructure/azure/vnet/README.md @@ -2,23 +2,25 @@ ## Description -Creates an Azure virtual network with specified address space and subnets +Creates an Azure Virtual Network with configurable subnets using the Azure Verified Module for network virtual networks ## Architecture -This module creates an Azure virtual network using the azurerm provider and configures it with the specified address space and subnets. The virtual network is created in the specified resource group and location. The module uses the avm_res_network_virtualnetwork module from the azure registry to create the virtual network and its subnets. The module also outputs the resource ID of the virtual network, its name, and a map of subnet names to their resource IDs. +The module wraps the azure/avm-res-network-virtualnetwork/azurerm AVM module, passing address_space, name, location, and tags directly into it while constructing the parent_id from the subscription_id and resource_group_name inputs. The subnets_definition map is forwarded to the AVM module's subnets argument, which internally provisions azurerm_subnet resources with optional route table associations. Outputs derive from the AVM module's resource_id and name attributes, with subnet_ids computed by interpolating subnet names against the virtual network resource ID. ## Features -- Creates Azure virtual network with specified address space -- Configures subnets within the virtual network -- Supports custom tagging of virtual network resources +- Creates an Azure Virtual Network with one or more CIDR address spaces +- Provisions multiple subnets with configurable address prefixes via a flexible map input +- Supports optional route table association per subnet to preserve existing routing configurations +- Outputs a computed map of subnet names to their full Azure resource IDs +- Applies resource tags to all virtual network resources ## Basic Usage ```hcl module "vnet" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.11.0" address_space = "your-address-space" location = "your-location" @@ -59,7 +61,7 @@ resource "example_resource" "this" { | [address\_space](#input\_address\_space) | The address space (CIDR blocks) for the virtual network (e.g., ["10.0.0.0/16"]) | `set(string)` | n/a | yes | | [location](#input\_location) | The Azure region where the virtual network will be created (e.g., eastus, westus2) | `string` | n/a | yes | | [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group where the virtual network will be created | `string` | n/a | yes | -| [subnets\_definition](#input\_subnets\_definition) | A map of subnets to create within the virtual network. Each subnet requires a name and address\_prefixes. | 
map(object({
    name             = string
    address_prefixes = list(string)
  }))
| n/a | yes | +| [subnets\_definition](#input\_subnets\_definition) | A map of subnets to create within the virtual network. Each subnet requires
a name and address\_prefixes, and may set route\_table to associate an
existing route table. | 
map(object({
    name             = string
    address_prefixes = list(string)

    # The AVM submodule accepts this and always renders the field, so leaving it
    # out is an explicit `routeTable: null` -- i.e. a detach -- not an omission.
    # On an AKS kubenet subnet that means every plan proposes to strip the route
    # table AKS attached, which is why `aks_route_table` has to keep putting it
    # back. Declaring it here lets the subnet own what it actually has.
    route_table = optional(object({
      id = string
    }))
  }))
| n/a | yes | | [subscription\_id](#input\_subscription\_id) | The ID of the Azure subscription | `string` | n/a | yes | | [tags](#input\_tags) | A mapping of tags to assign to the virtual network resources | `map(string)` | `{}` | no | | [vnet\_name](#input\_vnet\_name) | The name of the virtual network | `string` | n/a | yes | @@ -76,12 +78,14 @@ resource "example_resource" "this" { diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md index 80ef3e3f8..82a7966af 100644 --- a/infrastructure/commons/cert_manager/README.md +++ b/infrastructure/commons/cert_manager/README.md @@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" cloud_provider = "your-cloud-provider" @@ -35,7 +35,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" cloud_provider = "gcp" @@ -50,7 +50,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -68,7 +68,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" cloud_provider = "cloudflare" @@ -83,7 +83,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" aws_identity_mode = "your-aws-identity-mode" # Required when cloud_provider = "aws" @@ -99,7 +99,7 @@ module "cert_manager" { ```hcl module "cert_manager" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.11.0" account_slug = "your-account-slug" cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace" # Required when cloud_provider = "oci" diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md index 7ad6606cb..6d6df796a 100644 --- a/infrastructure/commons/external_dns/README.md +++ b/infrastructure/commons/external_dns/README.md @@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" dns_provider_name = "your-dns-provider-name" domain_filters = "your-domain-filters" @@ -33,7 +33,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" cloudflare_token = "your-cloudflare-token" # Required when dns_provider_name = "cloudflare" dns_provider_name = "cloudflare" @@ -45,7 +45,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when dns_provider_name = "aws" aws_identity_mode = "your-aws-identity-mode" # Required when dns_provider_name = "aws" @@ -61,7 +61,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" dns_provider_name = "oci" domain_filters = "your-domain-filters" @@ -77,7 +77,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure" @@ -94,7 +94,7 @@ module "external_dns" { ```hcl module "external_dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.11.0" azure_client_id = "your-azure-client-id" # Required when dns_provider_name = "azure-private-dns" azure_federated_credential_id = "your-azure-federated-credential-id" # Required when dns_provider_name = "azure-private-dns" diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md index 7759d6970..14a08206c 100644 --- a/infrastructure/commons/istio/README.md +++ b/infrastructure/commons/istio/README.md @@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas ```hcl module "istio" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.11.0" } ``` diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md index 0c2a30d51..339a8a6ef 100644 --- a/infrastructure/commons/prometheus/README.md +++ b/infrastructure/commons/prometheus/README.md @@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from ```hcl module "prometheus" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.11.0" } ``` diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md index 3664aabfc..4805a5ea1 100644 --- a/infrastructure/gcp/artifact-registry/README.md +++ b/infrastructure/gcp/artifact-registry/README.md @@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec ```hcl module "artifact-registry" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.11.0" location = "your-location" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md index 04306b9dd..fcfc6cc82 100644 --- a/infrastructure/gcp/cloud-dns/README.md +++ b/infrastructure/gcp/cloud-dns/README.md @@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC ```hcl module "cloud-dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.11.0" domain_name = "your-domain-name" project_id = "your-project-id" diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md index 2767245c2..1d46920e1 100644 --- a/infrastructure/gcp/cloud-nat/README.md +++ b/infrastructure/gcp/cloud-nat/README.md @@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n ```hcl module "cloud-nat" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.11.0" nat_name = "your-nat-name" network_id = "your-network-id" diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md index aeff1e530..445325d51 100644 --- a/infrastructure/gcp/gke/README.md +++ b/infrastructure/gcp/gke/README.md @@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.11.0" cluster_name = "your-cluster-name" ip_range_pods = "your-ip-range-pods" diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md index d3e5eda3e..08528ee31 100644 --- a/infrastructure/gcp/iam/README.md +++ b/infrastructure/gcp/iam/README.md @@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe ```hcl module "iam" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.11.0" project_id = "your-project-id" } diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md index 644859c42..04c78e3db 100644 --- a/infrastructure/gcp/security/README.md +++ b/infrastructure/gcp/security/README.md @@ -19,7 +19,7 @@ This module uses Terraform to create GCP firewall rules for public and private I ```hcl module "security" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.11.0" cluster_name = "your-cluster-name" gcp_project_id = "your-gcp-project-id" diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md index 0a35c763c..5c5f155b6 100644 --- a/infrastructure/gcp/vpc/README.md +++ b/infrastructure/gcp/vpc/README.md @@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.11.0" network_name = "your-network-name" project_id = "your-project-id" diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md index 4e7705ae8..395d9fbbd 100644 --- a/infrastructure/oci/backend/README.md +++ b/infrastructure/oci/backend/README.md @@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit ```hcl module "backend" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.11.0" compartment_id = "your-compartment-id" namespace = "your-namespace" diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md index 481514447..25843cd74 100644 --- a/infrastructure/oci/dns/README.md +++ b/infrastructure/oci/dns/README.md @@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_ ```hcl module "dns" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.11.0" compartment_id = "your-compartment-id" } diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md index 95d6b86a0..0159d6f33 100644 --- a/infrastructure/oci/dynamic_groups/README.md +++ b/infrastructure/oci/dynamic_groups/README.md @@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting ```hcl module "dynamic_groups" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.11.0" cluster_id = "your-cluster-id" compartment_id = "your-compartment-id" diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md index b8ffb5b46..7152fae9d 100644 --- a/infrastructure/oci/oke/README.md +++ b/infrastructure/oci/oke/README.md @@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.11.0" api_endpoint_subnet_id = "your-api-endpoint-subnet-id" cluster_name = "your-cluster-name" diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md index 829eda28d..6f06ba959 100644 --- a/infrastructure/oci/vcn/README.md +++ b/infrastructure/oci/vcn/README.md @@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets ```hcl module "vcn" { - source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.11.0" } ``` diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md index ab7ea065b..4749acee0 100644 --- a/nullplatform/account/README.md +++ b/nullplatform/account/README.md @@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each` ```hcl module "account" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.11.0" nullplatform_accounts = "your-nullplatform-accounts" } diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md index a59f7e883..07b6bec42 100644 --- a/nullplatform/agent/README.md +++ b/nullplatform/agent/README.md @@ -2,27 +2,27 @@ ## Description -Deploys the Nullplatform agent to a Kubernetes cluster via a Helm release with multi-cloud provider support +Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart with cloud-provider-specific configuration for AWS, GCP, Azure, and OCI ## Architecture -The module renders a Helm values file using a templatefile() call that merges default configuration, cloud-specific environment variables, and extra envs into a single locals map. A helm_release resource named 'agent' deploys the 'nullplatform-agent' chart from the official Nullplatform Helm repository into the specified Kubernetes namespace, consuming the rendered values. A terraform_data resource tracks the api_key as a replace trigger, forcing pod recreation when the API key changes. Cross-provider variable validation is enforced via terraform_data preconditions that gate cloud-specific required inputs like aws_iam_role_arn and azure_* credentials before the Helm release proceeds. +The module uses a helm_release resource to deploy the nullplatform-agent chart from the official nullplatform Helm repository into a configurable Kubernetes namespace. A templatefile renders a YAML values file (nullplatform_agent_values.tmpl.yaml) that merges default agent configuration with cloud-provider-specific environment variables and CLI arguments resolved in locals.tf. A terraform_data resource tracks the api_key input to trigger Helm release replacement when the key rotates, while a second terraform_data resource enforces cross-variable preconditions ensuring cloud-specific variables are present. An optional worker block is encoded as a second Helm values layer and appended to the release when provided. ## Features -- Deploys nullplatform-agent Helm chart with atomic install and automatic cleanup on failure -- Configures multi-cloud provider support for AWS, GCP, Azure, and OCI with provider-specific environment variable injection -- Creates Kubernetes namespace automatically if it does not already exist -- Injects NRN-parsed organization, account, and namespace tags into the agent configuration -- Merges scope repository, extra Git repositories, and deduplicates the final agent repo list -- Forces pod recreation via terraform_data trigger when the API key is rotated -- Supports custom init scripts, image pull secrets, and additional environment variables for agent customization +- Deploys nullplatform-agent Helm chart with atomic, self-healing release settings including cleanup_on_fail and recreate_pods +- Configures cloud-provider-specific environment variables and CLI arguments for AWS, GCP, Azure, and OCI targets +- Injects AWS IAM role ARN annotation into the Kubernetes ServiceAccount for IRSA-based workload identity on AWS +- Passes Azure service principal credentials (client ID, secret, tenant, subscription) as agent environment variables for Azure deployments +- Merges agent repository scope list and extra Git repositories into a deduplicated comma-separated AGENT_REPOS argument +- Supports optional worker-orchestration configuration via a structured any-typed variable rendered as a second Helm values layer +- Triggers full Helm release replacement via terraform_data lifecycle when the API key value changes ## Basic Usage ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.0" api_key = "your-api-key" cloud_provider = "your-cloud-provider" @@ -33,11 +33,11 @@ module "agent" { } ``` -### Usage with AWS Cloud Provider +### Usage with AWS Deployment ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.0" api_key = "your-api-key" aws_iam_role_arn = "your-aws-iam-role-arn" # Required when cloud_provider = "aws" @@ -49,11 +49,11 @@ module "agent" { } ``` -### Usage with GCP Cloud Provider +### Usage with GCP Deployment ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.0" api_key = "your-api-key" cloud_provider = "gcp" @@ -64,11 +64,11 @@ module "agent" { } ``` -### Usage with Azure Cloud Provider +### Usage with Azure Deployment ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.0" api_key = "your-api-key" azure_client_id = "your-azure-client-id" # Required when cloud_provider = "azure" @@ -87,11 +87,11 @@ module "agent" { } ``` -### Usage with OCI Cloud Provider +### Usage with OCI Deployment ```hcl module "agent" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.11.0" api_key = "your-api-key" cloud_provider = "oci" @@ -160,7 +160,7 @@ resource "example_resource" "this" { | [initial\_ingress\_path](#input\_initial\_ingress\_path) | Defines the initial ingress path used when deploying the application for the first time. | `string` | `""` | no | | [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no | | [nrn](#input\_nrn) | Nullplatform Resource Name - unique identifier for nullplatform resources | `string` | n/a | yes | -| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.29.2"` | no | +| [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | Version of the nullplatform agent Helm chart to deploy | `string` | `"2.37.0"` | no | | [private\_domain](#input\_private\_domain) | Private domain name used for internal agent routing | `string` | `""` | no | | [private\_gateway\_name](#input\_private\_gateway\_name) | Private gateway name for Azure networking | `string` | `null` | no | | [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no | @@ -170,21 +170,22 @@ resource "example_resource" "this" { | [service\_template](#input\_service\_template) | Specifies the name or reference of the scope service template to be used for deployment. | `string` | `""` | no | | [tags\_selectors](#input\_tags\_selectors) | Map of tags used to select and filter channels and agents | `map(string)` | n/a | yes | | [use\_account\_slug](#input\_use\_account\_slug) | Flag to determine whether to use account slug in resource naming | `string` | `""` | no | +| [worker](#input\_worker) | Worker-orchestration config, merged into the agent chart's `worker` block:
backend, security, allowedRegistries (deny-by-default registry guardrail),
patches (standard k8s patching of workers — the preferred way to shape them),
idleTTL (reap idle workers), and the legacy defaults/rules/pins. See the
nullplatform-agent chart values (>= 2.37.0) for the full shape. null = chart
defaults.

Example:
worker = {
allowedRegistries = ["public.ecr.aws/your-org/*"]
patches = [{ target = { package = "my-pkg" }, merge = { spec = { serviceAccountName = "np-agent-sa" } } }]
idleTTL = "30m"
} | `any` | `null` | no | diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md index 0d2b94007..4750bdf84 100644 --- a/nullplatform/api_key/README.md +++ b/nullplatform/api_key/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.0" type = "your-type" } @@ -31,7 +31,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.0" nrn = "your-nrn" # Required when type = "agent" type = "agent" @@ -42,7 +42,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.0" nrn = "your-nrn" # Required when type = "scope_notification" specification_slug = "your-specification-slug" # Required when type = "scope_notification" @@ -54,7 +54,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.0" nrn = "your-nrn" # Required when type = "service_notification" specification_slug = "your-specification-slug" # Required when type = "service_notification" @@ -66,7 +66,7 @@ module "api_key" { ```hcl module "api_key" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.11.0" custom_grants = "your-custom-grants" # Required when type = "custom" custom_name = "your-custom-name" # Required when type = "custom" diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md index fbd30da02..ada398b86 100644 --- a/nullplatform/asset/docker_server/README.md +++ b/nullplatform/asset/docker_server/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc ```hcl module "docker_server" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.11.0" login_server = "your-login-server" nrn = "your-nrn" diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md index 4beabf1dd..d7c852406 100644 --- a/nullplatform/asset/ecr/README.md +++ b/nullplatform/asset/ecr/README.md @@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi ```hcl module "ecr" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.11.0" application_role_arn = "your-application-role-arn" build_workflow_access_key_id = "your-build-workflow-access-key-id" diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md index ea6533999..8212da723 100644 --- a/nullplatform/asset/s3/README.md +++ b/nullplatform/asset/s3/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con ```hcl module "s3" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.11.0" bucket_name = "your-bucket-name" nrn = "your-nrn" diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md index 5d12c5199..cb6f013db 100644 --- a/nullplatform/base/README.md +++ b/nullplatform/base/README.md @@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "your-k8s-provider" np_api_key = "your-np-api-key" @@ -33,7 +33,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "eks" np_api_key = "your-np-api-key" @@ -44,7 +44,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "gke" np_api_key = "your-np-api-key" @@ -55,7 +55,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "aks" np_api_key = "your-np-api-key" @@ -66,7 +66,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "oke" np_api_key = "your-np-api-key" @@ -77,7 +77,7 @@ module "base" { ```hcl module "base" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.11.0" k8s_provider = "aro" np_api_key = "your-np-api-key" diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md index 4b5b4a05e..66c3842bc 100644 --- a/nullplatform/cloud/aws/cloud/README.md +++ b/nullplatform/cloud/aws/cloud/README.md @@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.11.0" domain_name = "your-domain-name" hosted_private_zone_id = "your-hosted-private-zone-id" diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md index 77a74c520..a8160f7ff 100644 --- a/nullplatform/cloud/aws/vpc/README.md +++ b/nullplatform/cloud/aws/vpc/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne ```hcl module "vpc" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.11.0" nrn = "your-nrn" vpc_id = "your-vpc-id" diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md index ddaee4a05..30d6a2a67 100644 --- a/nullplatform/cloud/azure/cloud/README.md +++ b/nullplatform/cloud/azure/cloud/README.md @@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.11.0" azure_resource_group_name = "your-azure-resource-group-name" nrn = "your-nrn" diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md index cde0ea84a..34e70bf4a 100644 --- a/nullplatform/cloud/gcp/cloud/README.md +++ b/nullplatform/cloud/gcp/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.11.0" domain_name = "your-domain-name" location = "your-location" diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md index 369dfe7b5..592783b73 100644 --- a/nullplatform/cloud/oci/cloud/README.md +++ b/nullplatform/cloud/oci/cloud/README.md @@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c ```hcl module "cloud" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.11.0" account_id = "your-account-id" account_name = "your-account-name" diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md index e4a86e952..2e0064a63 100644 --- a/nullplatform/code_repository/README.md +++ b/nullplatform/code_repository/README.md @@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.0" git_provider = "your-git-provider" nrn = "your-nrn" @@ -33,7 +33,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.0" git_provider = "github" github_installation_id = "your-github-installation-id" # Required when git_provider = "github" @@ -46,7 +46,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.0" git_provider = "gitlab" gitlab_access_token = "your-gitlab-access-token" # Required when git_provider = "gitlab" @@ -62,7 +62,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.0" azure_access_token = "your-azure-access-token" # Required when git_provider = "azure" azure_agent_pool = "your-azure-agent-pool" # Required when git_provider = "azure" @@ -76,7 +76,7 @@ module "code_repository" { ```hcl module "code_repository" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.11.0" bitbucket_collaborators = "your-bitbucket-collaborators" # Required when git_provider = "bitbucket" bitbucket_installation_url = "your-bitbucket-installation-url" # Required when git_provider = "bitbucket" diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md index 04505f124..c0c8d4f57 100644 --- a/nullplatform/container_orchestration/aks/README.md +++ b/nullplatform/container_orchestration/aks/README.md @@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew ```hcl module "aks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.11.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md index b7b4e72d5..07fa9168c 100644 --- a/nullplatform/container_orchestration/eks/README.md +++ b/nullplatform/container_orchestration/eks/README.md @@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource with type 'eks-configuration' th ```hcl module "eks" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.11.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md index 2490171f4..39ceee04b 100644 --- a/nullplatform/container_orchestration/gke/README.md +++ b/nullplatform/container_orchestration/gke/README.md @@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu ```hcl module "gke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.11.0" cluster_name = "your-cluster-name" location = "your-location" diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md index 90d249649..c48bd0071 100644 --- a/nullplatform/container_orchestration/oke/README.md +++ b/nullplatform/container_orchestration/oke/README.md @@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores ```hcl module "oke" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.11.0" cluster_name = "your-cluster-name" nrn = "your-nrn" diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md index d8bde4b04..ca5aac8ed 100644 --- a/nullplatform/dimension/README.md +++ b/nullplatform/dimension/README.md @@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or ```hcl module "dimension" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.11.0" name = "your-name" nrn = "your-nrn" diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md index 1fc2febb9..c1f7e635a 100644 --- a/nullplatform/dimension_value/README.md +++ b/nullplatform/dimension_value/README.md @@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres ```hcl module "dimension_value" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.11.0" dimension_id = "your-dimension-id" name = "your-name" diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md index df5766c4a..67352afa0 100644 --- a/nullplatform/identity-access-control/README.md +++ b/nullplatform/identity-access-control/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity ```hcl module "identity-access-control" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.11.0" attributes = "your-attributes" nrn = "your-nrn" diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md index 8d8bf10ef..73f19902b 100644 --- a/nullplatform/metrics/README.md +++ b/nullplatform/metrics/README.md @@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome ```hcl module "metrics" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.11.0" nrn = "your-nrn" } diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md index 03ed79b13..8fb7765f8 100644 --- a/nullplatform/packaged_service/README.md +++ b/nullplatform/packaged_service/README.md @@ -17,7 +17,7 @@ spec updates / republish correctly. ```hcl module "packaged_service" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v1.0.0" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v6.11.0" nrn = "organization=…:account=…:namespace=…" @@ -114,3 +114,44 @@ git/local source. See `examples/postgres` for a full sample PostgreSQL service + link packaged in one apply. + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.5 | +| [nullplatform](#requirement\_nullplatform) | >= 0.0.99 | + +## Providers + +| Name | Version | +|------|---------| +| [nullplatform](#provider\_nullplatform) | >= 0.0.99 | + +## Resources + +| Name | Type | +|------|------| +| [nullplatform_artifact.this](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/artifact) | resource | +| [nullplatform_package.this](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/package) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [components](#input\_components) | The package's bill of materials, as one flat list that mirrors
nullplatform\_package.components. Each entry:

type = "service\_specification" \| "link\_specification" \| "artifact" \| "action\_specification"
resource = the whole TF resource to pin (for artifact: an inline object, see below)
parent\_resource = (optional) the resource this hangs off — e.g. a link's service

Pass whole resources, not ids — the module reads each one's id + snapshot
itself. Exactly one service\_specification is required (the BOM root). For
every service\_specification / link\_specification, its default
action\_specifications are pinned automatically as children — don't list them.

An artifact's `resource` is an inline object doing exactly ONE of:
register { type = "oci\_image", meta = {…} } # new revision
look up { type = "oci\_image", meta = {…}, lookup = true } # resolve by identity
pin { resource\_id = "…", resource\_revision\_id = "…" } # existing ids
`type` defaults to "oci\_image"; `name` (optional) labels it in the BOM/outputs. | `any` | n/a | yes | +| [nrn](#input\_nrn) | Owner NRN — the org/account/namespace the package and its artifacts live in. | `string` | n/a | yes | +| [release](#input\_release) | How this revision is published. `version` lives here (nested) because a
top-level `version` is Terraform's reserved registry-module argument and
errors on a git/local source. slug/name/visible\_to default to the service
spec's when unset. | 
object({
    version    = string                 # semver of the revision to publish; bump for a new revision
    default    = optional(bool, true)   # promote this revision to the package default
    slug       = optional(string)       # package slug — defaults to the service spec's slug
    name       = optional(string)       # display name — defaults to the service spec's name
    visible_to = optional(list(string)) # visibility    — defaults to the service spec's visible_to
  })
| n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [artifacts](#output\_artifacts) | Artifacts registered by this module: name => { resource\_id, resource\_revision\_id }. | +| [default\_revision\_id](#output\_default\_revision\_id) | Revision that services bind to by default. | +| [default\_version](#output\_default\_version) | The package's default version after apply. | +| [package\_id](#output\_package\_id) | ID of the published package. | +| [package\_slug](#output\_package\_slug) | Slug of the published package. | +| [published\_revision\_id](#output\_published\_revision\_id) | Revision UUID published for package\_version. | + \ No newline at end of file diff --git a/nullplatform/packaged_service/examples/postgres/README.md b/nullplatform/packaged_service/examples/postgres/README.md new file mode 100644 index 000000000..8bfb3ab06 --- /dev/null +++ b/nullplatform/packaged_service/examples/postgres/README.md @@ -0,0 +1,37 @@ + + + +## Providers + +| Name | Version | +|------|---------| +| [nullplatform](#provider\_nullplatform) | n/a | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [packaged\_service](#module\_packaged\_service) | ../../ | n/a | + +## Resources + +| Name | Type | +|------|------| +| [nullplatform_link_specification.postgres_link](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/link_specification) | resource | +| [nullplatform_service_specification.postgres_service](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/service_specification) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [np\_api\_key](#input\_np\_api\_key) | n/a | `string` | n/a | yes | +| [nrn](#input\_nrn) | Owner NRN — organization=…:account=…:namespace=… the package lives in. | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [package\_default\_version](#output\_package\_default\_version) | n/a | +| [package\_id](#output\_package\_id) | n/a | +| [package\_slug](#output\_package\_slug) | n/a | + \ No newline at end of file diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md index e0e7b6433..decd3ad84 100644 --- a/nullplatform/parameter_storage_configuration/README.md +++ b/nullplatform/parameter_storage_configuration/README.md @@ -20,7 +20,7 @@ The module delegates entirely to a remote `scope_configuration` module sourced f ```hcl module "parameter_storage_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v6.11.0" attributes = "your-attributes" np_api_key = "your-np-api-key" @@ -69,21 +69,27 @@ module "parameter_storage_configuration" { |------|---------| | [nullplatform](#requirement\_nullplatform) | ~> 0.0.86 | -## Modules +## Providers -| Name | Source | Version | -|------|--------|---------| -| [config](#module\_config) | git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration | v6.1.0 | +| Name | Version | +|------|---------| +| [nullplatform](#provider\_nullplatform) | 0.0.96 | + +## Resources + +| Name | Type | +|------|------| +| [nullplatform_provider_config.parameter_store_configuration](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_config) | resource | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [attributes](#input\_attributes) | Provider-specific configuration matching the provider specification schema (e.g. sensibility.applies\_to, setup.kms\_key\_id). | `any` | n/a | yes | +| [applies\_to](#input\_applies\_to) | aws-secrets-manager only. Resource types this parameter storage configuration applies to. | `list(string)` | 
[
  "secret"
]
| no | | [dimensions](#input\_dimensions) | Dimension values for this instance (e.g. { environment = "production" }). | `map(string)` | `{}` | no | -| [np\_api\_key](#input\_np\_api\_key) | nullplatform API key. Forwarded to the wrapped scope\_configuration module; the provider is configured at the root. | `string` | n/a | yes | +| [kms\_key\_id](#input\_kms\_key\_id) | aws-secrets-manager only. Customer-managed KMS key ARN or alias. If empty, the default aws/secretsmanager managed key is used. | `string` | `""` | no | | [nrn](#input\_nrn) | NRN where this parameter-storage instance (provider config) is anchored. | `string` | n/a | yes | -| [provider\_specification\_slug](#input\_provider\_specification\_slug) | Slug of the parameter-storage provider specification to associate with. Typically the `slug` output of the parameter\_storage\_definition module. | `string` | n/a | yes | +| [type](#input\_type) | Provider specification slug this configuration targets. Determines which default attribute shape is applied — see README for the supported types and their payloads. | `string` | n/a | yes | ## Outputs diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md index 543af1343..1ade0bc18 100644 --- a/nullplatform/parameter_storage_definition/README.md +++ b/nullplatform/parameter_storage_definition/README.md @@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable ```hcl module "parameter_storage_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v6.11.0" np_api_key = "your-np-api-key" nrn = "your-nrn" diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md index bd9454465..de4ceab03 100644 --- a/nullplatform/parameter_storage_definition_agent_association/README.md +++ b/nullplatform/parameter_storage_definition_agent_association/README.md @@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null ```hcl module "parameter_storage_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v6.11.0" api_key = "your-api-key" nrn = "your-nrn" diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md index 6dcd24195..dbea0ac72 100644 --- a/nullplatform/scope_configuration/README.md +++ b/nullplatform/scope_configuration/README.md @@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N ```hcl module "scope_configuration" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.11.0" attributes = "your-attributes" np_api_key = "your-np-api-key" @@ -61,11 +61,25 @@ resource "example_resource" "this" { | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [attributes](#input\_attributes) | Configuration attributes matching the provider specification schema. | `any` | n/a | yes | +| [aws\_distribution](#input\_aws\_distribution) | CDN distribution for serving static files. | `string` | `"cloudfront"` | no | +| [aws\_hosted\_public\_zone\_id](#input\_aws\_hosted\_public\_zone\_id) | Public hosted zone ID for DNS records (e.g., Z1234567890ABC). | `string` | `null` | no | +| [aws\_network](#input\_aws\_network) | DNS provider for managing records. | `string` | `"route53"` | no | +| [aws\_region](#input\_aws\_region) | AWS region where resources will be deployed. | `string` | `null` | no | +| [aws\_security](#input\_aws\_security) | Optional WAF attachment for the CloudFront distribution. Choose 'none' to skip, or 'waf' to attach an existing AWS WAF WebACL. | `string` | `"none"` | no | +| [aws\_state\_bucket](#input\_aws\_state\_bucket) | S3 bucket name for storing OpenTofu state (also used for S3-native state locking). | `string` | `null` | no | +| [aws\_web\_acl\_name](#input\_aws\_web\_acl\_name) | Name of an existing AWS WAF WebACL with scope=CLOUDFRONT. Only used when aws\_security = "waf". | `string` | `""` | no | +| [cloud\_provider](#input\_cloud\_provider) | static-files only. Cloud provider for this static-files scope configuration. | `string` | `null` | no | | [dimensions](#input\_dimensions) | Dimension values for this configuration. | `map(string)` | `{}` | no | -| [np\_api\_key](#input\_np\_api\_key) | Nullplatform API key for authentication. | `string` | n/a | yes | +| [lambda\_available\_layers](#input\_lambda\_available\_layers) | aws-lambda-configuration only. Lambda layer ARNs made available for developers to select when creating scopes. | `list(string)` | `[]` | no | +| [lambda\_certificate\_arn](#input\_lambda\_certificate\_arn) | aws-lambda-configuration only. ARN of the certificate to use for the function. Required when lambda\_enable\_endpoint is true (the default). | `string` | `null` | no | +| [lambda\_enable\_endpoint](#input\_lambda\_enable\_endpoint) | aws-lambda-configuration only. Whether to create an endpoint domain. If true, lambda\_certificate\_arn is required. | `bool` | `true` | no | +| [lambda\_provisioned\_concurrency\_type](#input\_lambda\_provisioned\_concurrency\_type) | aws-lambda-configuration only. 'unprovisioned' (default AWS behavior) or 'provisioned' (set a specific limit via lambda\_provisioned\_concurrency\_value). | `string` | `"unprovisioned"` | no | +| [lambda\_provisioned\_concurrency\_value](#input\_lambda\_provisioned\_concurrency\_value) | aws-lambda-configuration only. Provisioned concurrency for this function. Required when lambda\_provisioned\_concurrency\_type is 'provisioned'. | `number` | `null` | no | +| [lambda\_reserved\_concurrency\_type](#input\_lambda\_reserved\_concurrency\_type) | aws-lambda-configuration only. 'unreserved' (default AWS behavior) or 'reserved' (set a specific limit via lambda\_reserved\_concurrency\_value). | `string` | `"unreserved"` | no | +| [lambda\_reserved\_concurrency\_value](#input\_lambda\_reserved\_concurrency\_value) | aws-lambda-configuration only. Number of concurrent executions to reserve (1-1000). Required when lambda\_reserved\_concurrency\_type is 'reserved'. | `number` | `null` | no | +| [lambda\_role\_arn](#input\_lambda\_role\_arn) | aws-lambda-configuration only. ARN of the IAM role to use for the function. | `string` | `""` | no | | [nrn](#input\_nrn) | Nullplatform Resource Name (NRN) — unique identifier for the target resource. | `string` | n/a | yes | -| [provider\_specification\_slug](#input\_provider\_specification\_slug) | Slug of the provider specification (scope configuration type) to associate with. | `string` | n/a | yes | +| [type](#input\_type) | Provider specification slug this scope configuration targets. Determines which set of variables below applies — see README for each type's payload. | `string` | n/a | yes | ## Outputs diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md index 3ff52d390..4b9ba60be 100644 --- a/nullplatform/scope_definition/README.md +++ b/nullplatform/scope_definition/README.md @@ -2,27 +2,27 @@ ## Description -Provisions a Nullplatform service specification, scope type, and action specifications by fetching and rendering gomplate templates from a remote repository, then patching the NRN with external provider configuration +Provisions a nullplatform scope definition by fetching and rendering gomplate templates from a remote repository to create service specifications, scope types, action specifications, and optionally scope configurations and versioned packages ## Architecture -The module fetches JSON templates via data.http resources from a configurable GitHub raw URL, processes them through data.external using gomplate and jq shell commands, and feeds the rendered outputs into nullplatform_service_specification, nullplatform_scope_type, and nullplatform_action_specification resources. A null_resource.nrn_patch uses a local-exec provisioner to invoke the np CLI with the NP_API_KEY environment variable to patch metrics and logging provider configuration on the NRN. Optionally, a nullplatform_provider_specification is created from a scope-configuration template when create_scope_configuration is true, with visibility controlled by concatenating var.nrn and var.extra_visible_to_nrns. +The module fetches JSON templates via `data.http` from configurable GitHub raw URLs and processes them through `data.external` using gomplate and jq shell programs to produce rendered JSON. The rendered outputs are consumed by `nullplatform_service_specification`, `nullplatform_scope_type`, `nullplatform_action_specification`, and optionally `nullplatform_provider_specification` resources, with local IDs and slugs threaded as environment variables between template-processing steps. A `null_resource.nrn_patch` provisioner runs the `np` CLI with `NP_API_KEY` to patch external metrics and logging provider references onto the NRN after all nullplatform resources are created. When `var.package` is set, additional `nullplatform_package` and `nullplatform_artifact` resources are created and wired to the service specification outputs. ## Features -- Fetches and renders service specification, scope type, and action templates from remote GitHub repositories using gomplate -- Creates nullplatform_service_specification with attributes, selectors, and cross-account visibility via extra_visible_to_nrns -- Creates nullplatform_scope_type linked to the service specification with provider type derived from rendered template -- Creates nullplatform_action_specification resources for each action defined in the service spec or explicitly provided via action_spec_names -- Patches the NRN with external metrics and logging provider slugs using the np CLI via null_resource local-exec -- Optionally creates nullplatform_provider_specification from scope-configuration template with override support for name collision avoidance -- Enforces precondition ensuring at least one action specification is resolved to prevent silent destruction of registered scope actions +- Fetches and renders gomplate service specification, scope type, and action specification templates from configurable remote GitHub repositories +- Creates nullplatform_service_specification with dynamically parsed attributes, selectors, and visibility from rendered templates +- Creates nullplatform_scope_type linked to the service specification with provider type resolved from the scope type template +- Creates one nullplatform_action_specification per action name, sourcing name, type, parameters, results, retryable, icon, and annotations from rendered action templates +- Patches the NRN with external metrics and logging provider configuration using the np CLI via a null_resource local-exec provisioner +- Optionally creates a nullplatform_provider_specification from a scope-configuration template when create_scope_configuration is true +- Optionally registers a versioned nullplatform_package with artifact bill of materials supporting new registration, identity-based lookup, or explicit resource ID pinning ## Basic Usage ```hcl module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.11.0" np_api_key = "your-np-api-key" nrn = "your-nrn" @@ -45,7 +45,7 @@ resource "example_resource" "this" { |------|---------| | [external](#requirement\_external) | ~> 2.3.5 | | [null](#requirement\_null) | ~> 3.2.4 | -| [nullplatform](#requirement\_nullplatform) | ~> 0.0.86 | +| [nullplatform](#requirement\_nullplatform) | >= 0.0.99 | ## Providers @@ -62,6 +62,8 @@ resource "example_resource" "this" { |------|------| | [null_resource.nrn_patch](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [nullplatform_action_specification.from_templates](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/action_specification) | resource | +| [nullplatform_artifact.package](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/artifact) | resource | +| [nullplatform_package.this](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/package) | resource | | [nullplatform_provider_specification.from_scope_configuration](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/provider_specification) | resource | | [nullplatform_scope_type.from_template](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/scope_type) | resource | | [nullplatform_service_specification.from_template](https://registry.terraform.io/providers/nullplatform/nullplatform/latest/docs/resources/service_specification) | resource | @@ -77,6 +79,7 @@ resource "example_resource" "this" { | [extra\_visible\_to\_nrns](#input\_extra\_visible\_to\_nrns) | Additional NRNs to add to `visible_to` of the `nullplatform_service_specification`
and `nullplatform_provider_specification` created by this module. The base
visible\_to (the spec template's value for the service\_spec, and `[var.nrn]`
for the provider\_spec) is preserved; this list is appended.

Use case: share a scope\_definition with sibling accounts in the same
organization without duplicating it per account. Example:

extra\_visible\_to\_nrns = ["organization=1636958496"]

makes the spec consumable by every account under that organization.
Default = [] (no extra visibility, backwards compatible). | `list(string)` | `[]` | no | | [np\_api\_key](#input\_np\_api\_key) | Nullplatform API key used for executing local commands (e.g., 'np nrn patch') | `string` | n/a | yes | | [nrn](#input\_nrn) | Unique NRN identifier of the environment or resource in nullplatform | `string` | n/a | yes | +| [package](#input\_package) | Register this scope definition as a versioned PACKAGE. When set, the module
publishes a package revision whose bill of materials pins the service
specification, every action specification, and the artifacts you list —
so scopes bind to an immutable revision and later template changes never
mutate what already runs.

artifacts: each entry does ONE of:
• register a new artifact revision — set `meta` (JSON-able object, e.g.
{ registry = "ghcr.io", repository = "acme/img", digest = "sha256:…" });
• look up one registered elsewhere BY IDENTITY (no ids needed) — set
`lookup = true` + `meta` with the identity fields (e.g. registry +
repository; add digest/reference to pin a specific revision, otherwise
the latest revision is used);
• pin explicit ids — set `resource_id` + `resource_revision_id`.

Null (the default) keeps the classic module behavior — no package. | 
object({
    slug       = optional(string)            # default: the service specification slug
    name       = optional(string)            # default: var.service_spec_name
    version    = string                      # semver of the revision this configuration publishes
    default    = optional(bool, true)        # promote each published revision to the package default
    tags       = optional(map(string), {})   # release tags: name => version (requires an API with the package release-tag routes)
    visible_to = optional(list(string))      # default: [var.nrn]
    artifacts = optional(list(object({
      name                 = string
      type                 = optional(string, "oci_image") # oci_image | oras_artifact | git_repository | blob
      meta                 = optional(any)                 # register (lookup=false) or find (lookup=true)
      lookup               = optional(bool, false)         # true: resolve an EXISTING artifact by meta identity
      resource_id          = optional(string)              # …or pin explicit ids
      resource_revision_id = optional(string)
    })), [])
  })
| `null` | no | | [repo\_path](#input\_repo\_path) | Base path to the repository used as context for gomplate template rendering | `string` | `"/root/.np/nullplatform/scopes"` | no | | [repository\_action\_templates](#input\_repository\_action\_templates) | repository of action template | `string` | `"https://raw.githubusercontent.com/nullplatform/scopes/refs/heads"` | no | | [repository\_action\_templates\_branch](#input\_repository\_action\_templates\_branch) | branch reference of action template | `string` | `"main"` | no | @@ -94,6 +97,10 @@ resource "example_resource" "this" { | Name | Description | |------|-------------| | [actions\_created](#output\_actions\_created) | Map of all action specifications created from templates. | +| [package\_artifacts](#output\_package\_artifacts) | Artifacts registered by this module: name => { resource\_id, resource\_revision\_id }. | +| [package\_default\_version](#output\_package\_default\_version) | The package's default version after apply, or null. | +| [package\_id](#output\_package\_id) | ID of the package registered from this scope definition, or null when packaging is disabled. | +| [package\_published\_revision\_id](#output\_package\_published\_revision\_id) | Revision UUID published for the configured package version, or null. | | [provider\_specification\_id](#output\_provider\_specification\_id) | The ID of the created provider specification, or null if scope configuration was not fetched | | [provider\_specification\_slug](#output\_provider\_specification\_slug) | The slug of the created provider specification, or null if scope configuration was not fetched | | [scope\_configuration](#output\_scope\_configuration) | Parsed scope configuration from scope-configuration.json.tpl, or null if not fetched | @@ -105,16 +112,16 @@ resource "example_resource" "this" { - -## Package (optional) - -Set `var.package` to also register this scope definition as a **versioned -package**: one revision whose bill of materials pins the service -specification, every action specification (both snapshotted automatically at -their latest revision), and your artifacts. Scopes then bind to an immutable -revision — publishing later versions never mutates what already runs. - -```hcl -module "scope_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=" - # … the classic inputs … - - package = { - version = "1.0.0" - artifacts = [ - # find an artifact registered elsewhere (CI, `np package publish`) — no ids: - { name = "worker-image", lookup = true, - meta = { registry = "ghcr.io", repository = "acme/my-scope" } }, - # or register one right here: - { name = "helm-chart", type = "oci_image", - meta = { registry = "ghcr.io", repository = "acme/chart", digest = "sha256:…" } }, - ] - } -} -``` - -Iterate by bumping `package.version` (usually together with new artifact -metas) — each apply publishes a new revision and, with `default = true` (the -default), promotes it. See `examples/package/` for a complete, applied-and- -verified configuration. Requires a provider build with the package/artifact -resources (release pending — use `dev_overrides` meanwhile). diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md index f5c74a0a4..cf7c148c7 100644 --- a/nullplatform/scope_definition_agent_association/README.md +++ b/nullplatform/scope_definition_agent_association/README.md @@ -2,27 +2,27 @@ ## Description -Creates and configures a nullplatform notification channel by fetching and processing a JSON template from a remote repository using gomplate and registering it via the nullplatform provider +Creates and configures a nullplatform notification channel from a remote template, supporting both legacy git-clone exec and worker-orchestrator package-exec modes with optional filter merging and override support ## Architecture -The module fetches a notification channel template via the `data.http` data source from a configurable raw GitHub URL, then processes it using a `data.external` shell script that invokes gomplate with NRN, API key, and service context variables injected as environment variables. The rendered JSON is decoded in locals to extract type, source, filters, and configuration, which are passed into a `nullplatform_notification_channel` resource along with a dynamic `agent` block that conditionally injects override flags and environment variables into command data. A `terraform_data` resource tracks the API key and triggers replacement of the notification channel when it changes. +The module fetches a notification channel JSON template via the `data.http` data source from a configurable GitHub raw URL, then processes it using `data.external` with gomplate templating to inject NRN, API key, and scope identifiers. The processed template drives a `nullplatform_notification_channel` resource that dynamically configures an agent block with either a legacy command type or a worker-orchestrator package-exec command based on the `worker_orchestrator` flag. A `terraform_data` resource tracks the API key to trigger replacement of the notification channel when credentials change, and a lifecycle precondition enforces that `package_slug` is provided when worker-orchestrator mode is enabled. ## Features -- Fetches notification channel templates dynamically from a configurable remote GitHub repository branch -- Processes templates with gomplate to inject NRN, API key, scope specification ID, and slug at render time -- Creates a nullplatform_notification_channel resource with dynamic agent configuration including command data and tag-based selectors -- Merges base template filters with optional extra MongoDB-style filter expressions using $and composition -- Injects NP_ACTION_CONTEXT environment variable and optional overrides CLI flag into agent command data when override mode is enabled -- Triggers automatic replacement of the notification channel resource when the API key changes via terraform_data lifecycle dependency -- Supports configurable repository URL, branch reference, and service path for flexible template sourcing +- Fetches and renders notification channel templates remotely using gomplate with scope-specific variable injection +- Creates nullplatform_notification_channel resources supporting both legacy git-clone exec and worker-orchestrator package-exec command types +- Configures dynamic agent selector blocks using tag-based agent filtering via tags_selectors map +- Merges base template filters with user-supplied extra_filters using MongoDB-style $and logical composition +- Supports custom override paths for scope configurations via CLI flag injection into agent commands +- Triggers automatic notification channel replacement when the API key changes via terraform_data lifecycle tracking +- Allows custom worker entrypoint override with fallback to the standard /app/packages//entrypoint path ## Basic Usage ```hcl module "scope_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.11.0" api_key = "your-api-key" nrn = "your-nrn" @@ -46,7 +46,7 @@ resource "example_resource" "this" { | Name | Version | |------|---------| -| [nullplatform](#requirement\_nullplatform) | ~> 0.0.86 | +| [nullplatform](#requirement\_nullplatform) | >= 0.0.99 | ## Providers @@ -71,12 +71,14 @@ resource "example_resource" "this" { | [api\_key](#input\_api\_key) | API key for authenticating with the nullplatform API | `string` | n/a | yes | | [description](#input\_description) | Description shown for the notification channel. | `string` | `""` | no | | [enabled\_override](#input\_enabled\_override) | Enable custom overrides for scope configurations via command line | `bool` | `false` | no | +| [entrypoint](#input\_entrypoint) | Override the worker's baked entrypoint path. Defaults to /app/packages//entrypoint. | `string` | `""` | no | | [extra\_filters](#input\_extra\_filters) | Additional filter expression to merge with the base template filters using $and.
Accepts any valid MongoDB-style filter expression, including logical operators
($and, $or, $nor, $not) and comparison operators ($eq, $ne, $in, $nin, $gt,
$gte, $lt, $lte, $regex). If null, only the base template filters are applied.

Examples:
Simple equality: { "dimensions.environment" = "production" }
Comparison: { "action" = { "$in" = ["deployment:create", "deployment:update"] } }
Logical OR: { "$or" = [{ "details.namespace.slug" = "prod" }, { "details.namespace.slug" = "staging" }] }
Negation: { "$not" = { "entity\_data.status" = "failed" } }
Combined: { "$and" = [{ "action" = { "$regex" = "^deployment" } }, { "$or" = [...] }] } | `any` | `null` | no | | [github\_ref](#input\_github\_ref) | Git reference to use (branch name, tag, or commit SHA) | `string` | `"beta"` | no | | [github\_repo\_url](#input\_github\_repo\_url) | GitHub repository URL containing scope and action templates | `string` | `"https://github.com/nullplatform/scopes"` | no | | [nrn](#input\_nrn) | Nullplatform Resource Name (NRN) — unique identifier for the target resource | `string` | n/a | yes | | [override\_repo\_path](#input\_override\_repo\_path) | Local filesystem path where the scope repository will be cloned | `string` | `null` | no | | [overrides\_service\_path](#input\_overrides\_service\_path) | Local filesystem path to the directory containing override configurations | `string` | `null` | no | +| [package\_slug](#input\_package\_slug) | Package/scope slug — the package-exec NP\_PLUGIN and default entrypoint path. Required when worker\_orchestrator = true. | `string` | `""` | no | | [repo\_path](#input\_repo\_path) | Local filesystem path where the scope repository will be cloned | `string` | `"/root/.np/nullplatform/scopes"` | no | | [repository\_notification\_channel](#input\_repository\_notification\_channel) | repository of notification channel template | `string` | `"https://raw.githubusercontent.com/nullplatform/scopes/refs/heads"` | no | | [repository\_notification\_channel\_branch](#input\_repository\_notification\_channel\_branch) | branch reference of notification channel template | `string` | `"main"` | no | @@ -84,6 +86,7 @@ resource "example_resource" "this" { | [scope\_specification\_slug](#input\_scope\_specification\_slug) | Slug of the scope (service) specification, used as a filter in the notification channel | `string` | n/a | yes | | [service\_path](#input\_service\_path) | Path to the service directory within the repository structure | `string` | `"k8s"` | no | | [tags\_selectors](#input\_tags\_selectors) | Map of tags used to select and filter channels and agents | `map(string)` | n/a | yes | +| [worker\_orchestrator](#input\_worker\_orchestrator) | Emit a worker-orchestrator (package-exec) channel instead of the legacy
git-clone exec channel. When true, the channel routes package-exec commands
to an agent that spawns the package's worker image and runs its baked
entrypoint — matching what `np package publish` registers. Requires
package\_slug; set tags\_selectors to select the agent (e.g. {package = slug}). | `bool` | `false` | no | ## Outputs @@ -95,16 +98,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md index 2cd25fdf8..96b154af6 100644 --- a/nullplatform/service_definition/README.md +++ b/nullplatform/service_definition/README.md @@ -2,27 +2,27 @@ ## Description -Provisions a Nullplatform service specification with its associated action and link specifications by fetching JSON templates from GitHub, GitLab, Bitbucket, or a local filesystem +Provisions nullplatform service, action, and link specifications by fetching JSON template files from a remote Git repository (GitHub, GitLab, or Bitbucket) or a local filesystem path ## Architecture -The module uses data.http resources to fetch service-spec, action, and link JSON templates from a remote git provider (GitHub, GitLab, or Bitbucket) or reads them from local files when git_provider is set to 'local'. Parsed template data flows into a nullplatform_service_specification resource, which is created first and provides its ID to nullplatform_action_specification and nullplatform_link_specification resources via depends_on. Authentication headers are constructed per-provider in locals (Bearer for GitHub, PRIVATE-TOKEN for GitLab, Basic or Bearer for Bitbucket) and passed to each data.http request. +The module uses `data.http` resources to fetch `service-spec.json.tpl`, action templates, and link templates from GitHub, GitLab, or Bitbucket raw/API endpoints constructed in `locals.tf`, or reads them directly from the local filesystem when `git_provider = "local"`. Parsed JSON templates are fed into `nullplatform_service_specification.from_template`, which is created first, and then `nullplatform_action_specification.from_templates` and `nullplatform_link_specification.from_templates` are created as `for_each` resources that depend on it. Authentication headers are computed per-provider in locals and injected into all HTTP data source requests, supporting Bearer tokens, GitLab PRIVATE-TOKEN headers, and Bitbucket HTTP Basic auth. ## Features -- Creates a nullplatform_service_specification resource from a JSON template with configurable name, type, attributes, selectors, and dimensions -- Fetches service, action, and link spec templates from GitHub, GitLab, Bitbucket, or local filesystem based on git_provider -- Creates nullplatform_action_specification resources for each entry in available_actions list using fetched templates -- Creates nullplatform_link_specification resources for each entry in available_links list using fetched templates -- Configures provider-specific authentication headers including Bearer tokens, GitLab PRIVATE-TOKEN, and Bitbucket HTTP Basic auth -- Supports visibility scoping via NRN list combining the required nrn with optional extra_visibile_to_nrns -- Outputs service specification ID and slug for use by downstream modules +- Creates a nullplatform_service_specification resource from a JSON template with configurable name, visibility, type, selectors, and dimensions +- Creates nullplatform_action_specification resources for each action template fetched from the repository or local filesystem +- Creates nullplatform_link_specification resources for each link template with support for scopes, dimensions, and external configuration +- Fetches spec templates from GitHub, GitLab, or Bitbucket using provider-specific URL construction and authentication headers +- Supports local filesystem spec loading for offline or monorepo workflows via the local_specs_path variable +- Constructs GitHub raw URLs with configurable ref types (branch heads, tags, or raw commit SHAs) for immutable pinning +- Supports optional visibility sharing across multiple NRNs via the extra_visibile_to_nrns variable ## Basic Usage ```hcl module "service_definition" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.11.0" nrn = "your-nrn" service_name = "your-service-name" @@ -78,6 +78,7 @@ resource "example_resource" "this" { | [repository\_branch](#input\_repository\_branch) | Branch of the service spec repository to use. Must be a short branch name (e.g. "main"), not a full ref. | `string` | `"main"` | no | | [repository\_name](#input\_repository\_name) | Repository name containing the service spec templates. | `string` | `"service"` | no | | [repository\_org](#input\_repository\_org) | GitHub organization or GitLab group owning the service spec repository. | `string` | `"nullplatform"` | no | +| [repository\_ref\_type](#input\_repository\_ref\_type) | Git ref namespace for `repository_branch` on GitHub: "heads" for a branch, "tags" for a tag, or "" to treat it as a raw commit SHA. Defaults to "heads", preserving previous behaviour. | `string` | `"heads"` | no | | [repository\_token](#input\_repository\_token) | Access token for private repositories. GitHub: personal access token or fine-grained token. GitLab: Personal Access Token (PAT) with read\_api scope. | `string` | `null` | no | | [service\_name](#input\_service\_name) | Name of the scope type to be created | `string` | n/a | yes | | [service\_path](#input\_service\_path) | Path within the repository for the specific service (e.g., databases/postgres/k8s) | `string` | n/a | yes | @@ -93,16 +94,16 @@ resource "example_resource" "this" { diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md index 3add08c86..aa7f74a8d 100644 --- a/nullplatform/service_definition_agent_association/README.md +++ b/nullplatform/service_definition_agent_association/README.md @@ -22,7 +22,7 @@ The module creates a terraform_data resource to track API key changes as a lifec ```hcl module "service_definition_agent_association" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.11.0" api_key = "your-api-key" repository_service_spec_repo = "your-repository-service-spec-repo" diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md index 7b58e63bd..315102d7d 100644 --- a/nullplatform/users/README.md +++ b/nullplatform/users/README.md @@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res ```hcl module "users" { - source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.8.1" + source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.11.0" nullplatform_users = "your-nullplatform-users" }