Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods #145

2026-08-30T17:34:13+10:00

unkin-agent commented

2026-08-30 17:34:13 +10:00

Why

Engine plugin v0.2.0 (catalog bumped in #144) added a methods field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can hold a key that cannot write. Provider v0.2.0 (just published to the terraform-unkin registry) exposes it as an optional set attribute, but the module had no input for it, so no role yaml could use it.

How

Bumps the vault-secrets-arrstack provider pin from 0.1.1 to 0.2.0 in environments/root.hcl and both arrstack modules.
Adds an optional methods input to modules/vault_cluster/modules/arrstack_secret_backend_role and passes it through to the resource.
Threads methods through the vault_cluster arrstack_secret_backend_role object type, so a role yaml may now carry a methods: list and it flows via the existing config.hcl merge with no discovery change.

methods defaults to null rather than []: the provider reads an unrestricted role back as null, so a null default keeps a role yaml that omits the field drift-free. An empty-set default would plan null -> [] on every existing role.

Expected plan: no resource changes. No role yaml changes here, so the plan should be a provider-version-only diff (provider upgrade, zero add/change/destroy).

Follow-up PR scopes the mediamark role to GET/HEAD.

## Why Engine plugin v0.2.0 (catalog bumped in #144) added a `methods` field to arrstack roles, pinning a minted arrproxy key to a set of HTTP methods so a read-only integration can hold a key that cannot write. Provider v0.2.0 (just published to the `terraform-unkin` registry) exposes it as an optional set attribute, but the module had no input for it, so no role yaml could use it. ## How - Bumps the `vault-secrets-arrstack` provider pin from 0.1.1 to 0.2.0 in `environments/root.hcl` and both arrstack modules. - Adds an optional `methods` input to `modules/vault_cluster/modules/arrstack_secret_backend_role` and passes it through to the resource. - Threads `methods` through the `vault_cluster` `arrstack_secret_backend_role` object type, so a role yaml may now carry a `methods:` list and it flows via the existing config.hcl merge with no discovery change. `methods` defaults to `null` rather than `[]`: the provider reads an unrestricted role back as null, so a null default keeps a role yaml that omits the field drift-free. An empty-set default would plan `null -> []` on every existing role. **Expected plan: no resource changes.** No role yaml changes here, so the plan should be a provider-version-only diff (provider upgrade, zero add/change/destroy). Follow-up PR scopes the mediamark role to GET/HEAD.

unkin-agent added 1 commit 2026-08-30 17:34:13 +10:00

Bump vault-secrets-arrstack provider to 0.2.0 and plumb methods

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

fc1c7121ee

Engine plugin v0.2.0 (catalog bumped in #144) added a methods field to
arrstack roles, pinning a minted arrproxy key to a set of HTTP methods.
Provider v0.2.0 exposes it as an optional set attribute, but the module
had no input for it, so no role yaml could use it.

- Bumps the vault-secrets-arrstack provider pin from 0.1.1 to 0.2.0 in
  root.hcl and both arrstack modules
- Adds an optional methods input to arrstack_secret_backend_role and
  passes it through to the resource
- Threads methods through the vault_cluster arrstack_secret_backend_role
  object type so a role yaml may carry a methods: list

methods defaults to null rather than [], matching the provider's null
read-back for an unrestricted role, so existing role yamls need no change
and plan stays a provider-version-only diff.

benvin merged commit 1f03bcdc67 into master

2026-08-30 18:19:05 +10:00

benvin deleted branch benvin/arrstack-provider-0.2.0

2026-08-30 18:19:05 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#145