Plan-time validation of selector grammar and cross-resource invariants #10

New Issue

2026-07-26T17:14:15+10:00

benvin commented

2026-07-26 17:14:15 +10:00

Problem. DESIGN.md says bare selectors are "rejected at plan time", but
terraform plan never contacts tomswallapi — rejection currently happens
server-side at apply, after half the plan may have been created. Firewall
changes are exactly where you want failures before anything mutates.

Proposal.

Implement ValidateConfig/attribute validators in the provider using the
same selector parser as the server (trivial once #7's shared module exists):
bare +ipset, unknown grammar, malformed CIDRs all fail at plan.
For invariants needing server state (subnet uniqueness across zones,
binding references), add a POST /validate endpoint the provider can call
during plan, degrading gracefully when unreachable.

**Problem.** DESIGN.md says bare selectors are "rejected at plan time", but `terraform plan` never contacts tomswallapi — rejection currently happens server-side at apply, after half the plan may have been created. Firewall changes are exactly where you want failures before anything mutates. **Proposal.** - Implement `ValidateConfig`/attribute validators in the provider using the same selector parser as the server (trivial once #7's shared module exists): bare `+ipset`, unknown grammar, malformed CIDRs all fail at plan. - For invariants needing server state (subnet uniqueness across zones, binding references), add a `POST /validate` endpoint the provider can call during plan, degrading gracefully when unreachable.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-tomswallapi#10