unkin/terraform-authentik
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix self-referential authentik_group parents #4

Merged
benvin merged 1 commits from benvin/fix-group-parents into main 2026-07-12 22:55:47 +10:00
Conversation 0 Commits 1 Files Changed 2
+5 -3
unkinben commented 2026-07-12 22:42:33 +10:00
Owner
Copy Link
Copy Source

Why

The authentik_group resource resolved its parents by indexing authentik_group.this itself:

parents = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : []

OpenTofu rejects this as a self-referential block ("Configuration for authentik_group.this may not refer to itself"). config/groups/ has been empty since the repo was created, so tofu plan never evaluated the groups resource and the bug stayed dormant. The first managed group trips it.

Change

Pass parents through as literal group PKs. A resource can't reference itself, so resolving parents by map-key was never viable; callers that need a hierarchy pass actual group PKs.

Validation

terragrunt run --all plan succeeds (only the pre-existing Grafana redirect-uri drift shows). Prereq/unblocks the argocd-admins group in the ArgoCD-OIDC branch, which is what surfaced this.

## Why The `authentik_group` resource resolved its `parents` by indexing `authentik_group.this` itself: ```hcl parents = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : [] ``` OpenTofu rejects this as a *self-referential block* ("Configuration for authentik_group.this may not refer to itself"). `config/groups/` has been empty since the repo was created, so `tofu plan` never evaluated the groups resource and the bug stayed dormant. The first managed group trips it. ## Change Pass `parents` through as literal group PKs. A resource can't reference itself, so resolving parents by map-key was never viable; callers that need a hierarchy pass actual group PKs. ## Validation `terragrunt run --all plan` succeeds (only the pre-existing Grafana redirect-uri drift shows). Prereq/unblocks the `argocd-admins` group in the ArgoCD-OIDC branch, which is what surfaced this.
unkinben added 1 commit 2026-07-12 22:42:34 +10:00
Fix self-referential authentik_group parents
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
7636d45f21 
Adding the first managed group (argocd-admins) exposed a dormant bug: the
groups resource resolved `parents` by indexing authentik_group.this itself,
which OpenTofu rejects as a self-referential block. config/groups/ had been
empty, so `tofu plan` never hit it before.

Pass `parents` through as literal group PKs instead (the resource cannot
reference itself, so parent-by-map-key was never viable). Plan is clean:
3 to add (argocd provider, application, argocd-admins group).
benvin merged commit 58b200c512 into main 2026-07-12 22:55:47 +10:00
benvin deleted branch benvin/fix-group-parents 2026-07-12 22:55:48 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#4
Delete Branch "benvin/fix-group-parents"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?