Skip to content

Conversation

@estellesoulard
Copy link
Contributor

@estellesoulard estellesoulard commented Dec 15, 2025

Context

I was implementing key manager's Encrypt call as an Ephemeral Resource. This kind of resource seems like the most appropriate implementation choice (Ephemeral Resources are not persisted in state, and seems perfect for the use case of returning an encrypted payload).
To test this Ephemeral Resource, I needed a matching resource argument that I could transfer my Ephemeral Resource's value into. This is necessary because Ephemeral Resources cannot be outputted nor used liberally in any other resource, therefore in the acceptance tests I had no way to check that the Ephemeral Resource properly worked.
However, an Ephemeral Resource's attribute value can be transferred into a WriteOnly argument, that I could later retrieve in the target resource's datasource. This is exactly what I did here 😄

PR content: TLDR

This PR adds a data_wo argument to secret_version Resource that can be used alternatively to the classic data argument.
Since this data_wo is a WriteOnly it is not stored in the state, and drifts cannot be detected. It is fundamentally incompatible with ForceNew. I bypassed this issue by adding a data_wo_version with ForceNew, enabling a simili-ForceNew for data_wo: updating data_wo requires to update data_wo_version, which will then be properly caught by Terraform and trigger a recreation.

A word of caution

This PR is the first in a long line of WriteOnly attribute additions. (cf #3423). It may be treated as a blueprint for the following ones: please raise any concern during your review 🫡

@estellesoulard estellesoulard requested review from a team and remyleone as code owners December 15, 2025 16:59
@github-actions github-actions bot added the secret Managed Secret Manager issues, bugs and feature requests label Dec 15, 2025
@codecov-commenter
Copy link

codecov-commenter commented Dec 15, 2025

Codecov Report

❌ Patch coverage is 0% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 1.70%. Comparing base (6900a12) to head (61ef696).
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
internal/services/secret/version.go 0.00% 14 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff            @@
##           master   #3538      +/-   ##
=========================================
- Coverage    1.71%   1.70%   -0.01%     
=========================================
  Files         434     434              
  Lines       47517   47527      +10     
=========================================
- Hits          813     811       -2     
- Misses      46616   46627      +11     
- Partials       88      89       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@estellesoulard estellesoulard marked this pull request as draft December 16, 2025 10:23
@estellesoulard estellesoulard marked this pull request as ready for review December 16, 2025 11:46
remyleone
remyleone previously approved these changes Dec 18, 2025
@remyleone remyleone added this pull request to the merge queue Dec 18, 2025
@estellesoulard estellesoulard removed this pull request from the merge queue due to a manual request Dec 18, 2025
@estellesoulard estellesoulard marked this pull request as draft December 18, 2025 13:15
@estellesoulard estellesoulard force-pushed the feat/add-secret-data-wo branch from 8333b0a to b39ef02 Compare December 18, 2025 13:50
@estellesoulard estellesoulard marked this pull request as ready for review December 18, 2025 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

secret Managed Secret Manager issues, bugs and feature requests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants