Add optional methods attribute to the arrstack role resource #3

2026-08-30T16:54:49+10:00

unkin-agent commented

2026-08-30 16:54:49 +10:00

Why

Engine plugin v0.2.0 added a methods field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from terraform-vault.

How

Adds an optional methods set attribute to arrstack_secret_backend_role, validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan).
Always writes methods: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind.
Reads an unrestricted role back as null rather than an empty set, so a config that omits methods shows no drift; a scope cleared out of band still surfaces as a diff.
Documents the attribute in the README and both example configs.
Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator.

Dependency: engine plugin >= 0.2.0.

## Why Engine plugin v0.2.0 added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can be handed a key that cannot write. The provider had no way to express it, so those roles could not be managed from `terraform-vault`. ## How - Adds an optional `methods` set attribute to `arrstack_secret_backend_role`, validated at plan time against `GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS` (upper case only, since the engine stores them upper-cased and a lower-case value would drift on every plan). - Always writes `methods`: the engine only clears an existing scope when the key is present, so an omitted key would leave a stale scope behind. - Reads an unrestricted role back as null rather than an empty set, so a config that omits `methods` shows no drift; a scope cleared out of band still surfaces as a diff. - Documents the attribute in the README and both example configs. - Tests cover the write mapping (null and populated), the read-back cases (absent/empty/null/cleared), and the plan-time validator. Dependency: engine plugin >= 0.2.0.

unkin-agent added 1 commit 2026-08-30 16:54:49 +10:00

Add optional methods attribute to the arrstack role resource

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

0d2823293e

Engine plugin v0.2.0 added a `methods` field to roles, pinning a minted
arrproxy key to a set of HTTP methods so a read-only integration can be
handed a key that cannot write. The provider had no way to express it.

- Add an optional `methods` set attribute to arrstack_secret_backend_role,
  validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS.
- Always write `methods`, since the engine only clears a scope when the key
  is present; an unrestricted role reads back as null rather than an empty
  set so an omitted config value does not drift.
- Document the attribute in the README and examples, and cover the write
  mapping, read-back, and validation in tests.

benvin merged commit ff2dff7af2 into main

2026-08-30 17:05:47 +10:00

benvin deleted branch benvin/role-methods-attr

2026-08-30 17:05:48 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-vault-secrets-arrstack#3