Scaffold terraform-provider-vault-secrets-arrstack #1

2026-08-19T22:01:03+10:00

unkin-agent commented

2026-08-19 22:01:03 +10:00

Why

terraform-vault #127 declares the arrstack Vault secrets engine (backend
config + per-app roles) and references a provider published to
artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack
(local name arrstack, version 0.1.0). This repo scaffolds that provider so
#127 can plan/apply.

Changes

Add a terraform-plugin-framework provider (internal/provider, main.go)
registered under local name arrstack; it authenticates to Vault/OpenBao via
address + token (falling back to VAULT_ADDR / VAULT_TOKEN) and writes
to the engine's API paths.
Add resource arrstack_secret_backend: mounts the engine (path, plugin)
and writes <mount>/config (base_url, admin_token, ca_cert,
request_timeout_seconds, description).
Add resource arrstack_secret_backend_role: manages <mount>/roles/<name>
(backend, name, apps, ttl, max_ttl).
Add the Vault client wrapper, value conversions, and unit tests covering
schema/CRUD mapping (config data, role data, engine-response decoding, import
ID splitting).
Add Makefile (build/install/test/package + patch|minor|major tag bumps),
.pre-commit-config.yaml, Woodpecker pipelines (pre-commit/build/lint+test on
PR, tag-triggered release PUTting the zip to the artifactapi terraform-unkin
registry), examples, and README.

Schema

The resource schema mirrors terraform-vault #127 exactly
(modules/vault_cluster/modules/arrstack_secret_backend{,_role}):

arrstack_secret_backend: path, plugin (default
vault-plugin-secrets-arrstack), description, base_url, admin_token
(sensitive), ca_cert (optional, sensitive), request_timeout_seconds
(default 30).
arrstack_secret_backend_role: backend, name, apps (list of string),
ttl, max_ttl.

go build, go vet, gofmt -l, and go test -race are clean.

## Why `terraform-vault` #127 declares the arrstack Vault secrets engine (backend config + per-app roles) and references a provider published to `artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack` (local name `arrstack`, version `0.1.0`). This repo scaffolds that provider so #127 can plan/apply. ## Changes - Add a terraform-plugin-framework provider (`internal/provider`, `main.go`) registered under local name `arrstack`; it authenticates to Vault/OpenBao via `address` + `token` (falling back to `VAULT_ADDR` / `VAULT_TOKEN`) and writes to the engine's API paths. - Add resource `arrstack_secret_backend`: mounts the engine (`path`, `plugin`) and writes `<mount>/config` (`base_url`, `admin_token`, `ca_cert`, `request_timeout_seconds`, `description`). - Add resource `arrstack_secret_backend_role`: manages `<mount>/roles/<name>` (`backend`, `name`, `apps`, `ttl`, `max_ttl`). - Add the Vault client wrapper, value conversions, and unit tests covering schema/CRUD mapping (config data, role data, engine-response decoding, import ID splitting). - Add Makefile (build/install/test/package + `patch|minor|major` tag bumps), `.pre-commit-config.yaml`, Woodpecker pipelines (pre-commit/build/lint+test on PR, tag-triggered release PUTting the zip to the artifactapi terraform-unkin registry), examples, and README. ## Schema The resource schema mirrors `terraform-vault` #127 exactly (`modules/vault_cluster/modules/arrstack_secret_backend{,_role}`): - `arrstack_secret_backend`: `path`, `plugin` (default `vault-plugin-secrets-arrstack`), `description`, `base_url`, `admin_token` (sensitive), `ca_cert` (optional, sensitive), `request_timeout_seconds` (default 30). - `arrstack_secret_backend_role`: `backend`, `name`, `apps` (list of string), `ttl`, `max_ttl`. `go build`, `go vet`, `gofmt -l`, and `go test -race` are clean.

unkin-agent added 1 commit 2026-08-19 22:01:03 +10:00

Scaffold terraform-provider-vault-secrets-arrstack

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

78ba0011f9

Configure the arrstack Vault secrets engine (backend config + roles) from
terraform-vault, matching the schema declared in terraform-vault #127.

- Add terraform-plugin-framework provider (local name arrstack) authenticating
  to Vault/OpenBao via address + token (VAULT_ADDR/VAULT_TOKEN fallback).
- Add arrstack_secret_backend resource: mounts the engine and writes <mount>/config.
- Add arrstack_secret_backend_role resource: manages <mount>/roles/<name>.
- Add Vault client, conversions, unit tests, Makefile, woodpecker CI + tag
  release to artifactapi terraform-unkin, examples, and README.

benvin merged commit 8535e579ae into main

2026-08-19 23:18:07 +10:00

benvin deleted branch benvin/scaffold-provider

2026-08-19 23:18:07 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-vault-secrets-arrstack#1