mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-11 22:49:54 +00:00
MWI: Generate MWI Terraform Provider docs (#56564)
* Add build/release steps to Mkaefile * Rename from `teleport-mwi` to `teleportmwi` * Generate MWI Terraform Provider docs * Keep hacking on docs generation * Rename provider path * Fix more paths * Generate docs * Fix up index page generation * Add examples * Rough out index page for provider * Update the index page with an example configuration * Add note on ephemeral vs data sources * Fix templates for ephemeral resources * Update cspell * Change replace to fixed version * Address Hugo's feedback * Update examples with warning
This commit is contained in:
Noah Stride
@@ -971,6 +971,7 @@
|
||||
"teleportgithubconnector",
|
||||
"teleporthostname",
|
||||
"teleportinfra",
|
||||
"teleportmwi",
|
||||
"teleportopensshserverv",
|
||||
"teleportproxy",
|
||||
"teleportrolesv",
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
title: "MWI Terraform data-sources index"
|
||||
description: "Index of all the data-sources supported by the Teleport MWI Terraform Provider"
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{/*Auto-generated file. Do not edit.*/}
|
||||
{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
|
||||
|
||||
{/*
|
||||
This file will be renamed data-sources.mdx during build time.
|
||||
The template name is reserved by tfplugindocs so we suffix with -index.
|
||||
*/}
|
||||
|
||||
<Admonition type="info">
|
||||
This is reference page is for the Teleport MWI Terraform provider, which
|
||||
generates short-lived credentials using Teleport Machine & Workload Identity.
|
||||
These short-lived credentials can be used to grant other Terraform providers
|
||||
access to resources through Teleport.
|
||||
|
||||
If you are looking to manage the configuration of Teleport itself, use the
|
||||
[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
|
||||
instead.
|
||||
</Admonition>
|
||||
|
||||
The Teleport MWI Terraform provider supports the following data-sources:
|
||||
|
||||
- [`teleportmwi_kubernetes`](./kubernetes.mdx)
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
title: Reference for the teleportmwi_kubernetes Terraform data-source
|
||||
sidebar_label: kubernetes
|
||||
description: This page describes the supported values of the teleportmwi_kubernetes data-source of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{/*Auto-generated file. Do not edit.*/}
|
||||
{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
|
||||
|
||||
The Kubernetes data source provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```hcl
|
||||
// Warning: The teleportmwi_kubernetes data source will not function correctly
|
||||
// when the Teleport cluster is fronted by a L7 load balancer that terminates
|
||||
// TLS.
|
||||
data "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-k8s-cluster"
|
||||
}
|
||||
credential_ttl = "1h"
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = data.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = data.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = data.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = data.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = data.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
```
|
||||
|
||||
{/* schema generated by tfplugindocs */}
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `selector` (Attributes) Selects the Kubernetes cluster to connect to. (see [below for nested schema](#nested-schema-for-selector))
|
||||
|
||||
### Optional
|
||||
|
||||
- `credential_ttl` (String) How long the issued credentials should be valid for. Defaults to 30 minutes.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `output` (Attributes) (see [below for nested schema](#nested-schema-for-output))
|
||||
|
||||
### Nested Schema for `selector`
|
||||
|
||||
Required:
|
||||
|
||||
- `name` (String) The name of the Kubernetes cluster to connect to.
|
||||
|
||||
|
||||
### Nested Schema for `output`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `client_certificate` (String) Compatible with the `client_certificate` argument of the `kubernetes` provider.
|
||||
- `client_key` (String, Sensitive) Compatible with the `client_key` argument of the `kubernetes` provider.
|
||||
- `cluster_ca_certificate` (String) Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.
|
||||
- `host` (String) Compatible with the `host` argument of the `kubernetes` provider.
|
||||
- `tls_server_name` (String) Compatible with the `tls_server_name` argument of the `kubernetes` provider.
|
||||
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
---
|
||||
title: "MWI Terraform ephemeral resources index"
|
||||
description: "Index of all the resources supported by the Teleport MWI Terraform Provider"
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{/*Auto-generated file. Do not edit.*/}
|
||||
{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
|
||||
|
||||
{/*
|
||||
This file will be renamed ephemeral-resources.mdx during build time.
|
||||
The template name is reserved by tfplugindocs so we suffix with -index.
|
||||
*/}
|
||||
|
||||
<Admonition type="info">
|
||||
This is reference page is for the Teleport MWI Terraform provider, which
|
||||
generates short-lived credentials using Teleport Machine & Workload Identity.
|
||||
These short-lived credentials can be used to grant other Terraform providers
|
||||
access to resources through Teleport.
|
||||
|
||||
If you are looking to manage the configuration of Teleport itself, use the
|
||||
[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
|
||||
instead.
|
||||
</Admonition>
|
||||
|
||||
The Teleport MWI Terraform provider supports the following ephemeral resources:
|
||||
|
||||
- [`teleportmwi_kubernetes`](./kubernetes.mdx)
|
||||
@@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Reference for the teleportmwi_kubernetes Terraform ephemeral resource
|
||||
sidebar_label: kubernetes
|
||||
description: This page describes the supported values of the teleportmwi_kubernetes ephemeral resource of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{/*Auto-generated file. Do not edit.*/}
|
||||
{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
|
||||
|
||||
This page describes the supported values of the teleportmwi_kubernetes ephemeral resource of the Teleport MWI Terraform provider.
|
||||
|
||||
|
||||
The Kubernetes Ephemeral Resource provides credentials to allow other providers to access Kubernetes cluster through Teleport Machine & Workload Identity.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```hcl
|
||||
// Warning: The teleportmwi_kubernetes ephemeral resource will not function
|
||||
// correctly when the Teleport cluster is fronted by a L7 load balancer that
|
||||
// terminates TLS.
|
||||
ephemeral "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-k8s-cluster"
|
||||
}
|
||||
credential_ttl = "1h"
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
```
|
||||
|
||||
{/* schema generated by tfplugindocs */}
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `selector` (Attributes) Selects the Kubernetes cluster to connect to. (see [below for nested schema](#nested-schema-for-selector))
|
||||
|
||||
### Optional
|
||||
|
||||
- `credential_ttl` (String) How long the issued credentials should be valid for. Defaults to 30 minutes.
|
||||
|
||||
### Read-Only
|
||||
|
||||
- `output` (Attributes) (see [below for nested schema](#nested-schema-for-output))
|
||||
|
||||
### Nested Schema for `selector`
|
||||
|
||||
Required:
|
||||
|
||||
- `name` (String) The name of the Kubernetes cluster to connect to.
|
||||
|
||||
|
||||
### Nested Schema for `output`
|
||||
|
||||
Read-Only:
|
||||
|
||||
- `client_certificate` (String) Compatible with the `client_certificate` argument of the `kubernetes` provider.
|
||||
- `client_key` (String, Sensitive) Compatible with the `client_key` argument of the `kubernetes` provider.
|
||||
- `cluster_ca_certificate` (String) Compatible with the `cluster_ca_certificate` argument of the `kubernetes` provider.
|
||||
- `host` (String) Compatible with the `host` argument of the `kubernetes` provider.
|
||||
- `tls_server_name` (String) Compatible with the `tls_server_name` argument of the `kubernetes` provider.
|
||||
@@ -0,0 +1,114 @@
|
||||
---
|
||||
title: "Teleport MWI Terraform Provider"
|
||||
description: Reference documentation of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{/*Auto-generated file. Do not edit.*/}
|
||||
{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}
|
||||
|
||||
The Teleport MWI Terraform provider generates short-lived credentials using
|
||||
[Teleport Machine & Workload Identity (MWI)](../../machine-workload-identity/machine-workload-identity.mdx)
|
||||
that can be used to grant other Terraform providers access to resources.
|
||||
|
||||
To manage the configuration of Teleport itself, use the [Teleport Terraform
|
||||
Provider instead](../terraform-provider/terraform-provider.mdx).
|
||||
|
||||
{/* Note: the awkward `resource-index` file names are here because `data-sources`
|
||||
is reserved by the generator for the catch-all resource template */}
|
||||
|
||||
- [list of supported ephemeral resources](./ephemeral-resources/ephemeral-resources.mdx)
|
||||
- [list of supported data-sources](./data-sources/data-sources.mdx)
|
||||
|
||||
## Example usage
|
||||
|
||||
In this example, we will use the Teleport MWI Terraform provider to grant the
|
||||
Kubernetes provider access to a Kubernetes cluster through Teleport.
|
||||
|
||||
Our Kubernetes cluster is enrolled in Teleport under the name `my-cluster`, and
|
||||
we've setup a Bot and Join Token to allow our Terraform provider to authenticate
|
||||
to Teleport.
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
teleportmwi = {
|
||||
source = "terraform.releases.teleport.dev/gravitational/teleportmwi"
|
||||
version = "~> (=teleport.major_version=).0"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "teleportmwi" {
|
||||
join_method = "gitlab"
|
||||
join_token = "my-join-token"
|
||||
proxy_server = "example.teleport.sh:443"
|
||||
}
|
||||
|
||||
ephemeral "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-cluster"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "ns" {
|
||||
metadata {
|
||||
name = "example-namespace"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Ephemeral resources vs data sources
|
||||
|
||||
The MWI Terraform provider exposes functionality using two different kinds of
|
||||
entity in the Terraform ecosystem: **ephemeral resources** and **data sources**.
|
||||
|
||||
Ephemeral resources are supported by Terraform 1.10 and later, and should be
|
||||
the preferred way to use the MWI Terraform provider. They have the following
|
||||
benefits over data sources:
|
||||
|
||||
- The short-lived credentials generated by the MWI Terraform provider will not
|
||||
be persisted within the Terraform state.
|
||||
- Fresh short-lived credentials will be generated in the apply phase, allowing
|
||||
you to grant read-only privileges to plan runs and read-write privileges to
|
||||
apply runs.
|
||||
|
||||
When using a version of Terraform that does not support ephemeral resources,
|
||||
you can use the data source variants instead. When using the data sources,
|
||||
keep the following in mind:
|
||||
|
||||
- The short-lived secrets generated by the MWI Terraform provider will be
|
||||
persisted within the Terraform state. The secrets will be generated in the
|
||||
plan phase and reused in the apply phase. We therefore highly recommend that
|
||||
you encrypt your Terraform state file.
|
||||
- You will need to configure a `credential_ttl` that will ensure that credentials
|
||||
generated during the plan phase will still be valid during the apply phase.
|
||||
|
||||
{/* schema generated by tfplugindocs */}
|
||||
## Schema
|
||||
|
||||
### Required
|
||||
|
||||
- `join_method` (String) The join method to use to authenticate to the Teleport cluster.
|
||||
- `join_token` (String) The name of the join token to use to authenticate to the Teleport cluster.
|
||||
- `proxy_server` (String) The address of the Teleport Proxy service. This should exclude the scheme but should include the port.
|
||||
|
||||
### Optional
|
||||
|
||||
- `insecure` (Boolean) When enabled, the certificates of the Proxy will not be verified. This is not recommended for production use.
|
||||
|
||||
@@ -2,6 +2,8 @@ VERSION ?= $(shell go run ../hack/get-version/get-version.go)
|
||||
|
||||
OS ?= $(shell go env GOOS)
|
||||
ARCH ?= $(shell go env GOARCH)
|
||||
TERRAFORM_ARCH=$(OS)_$(ARCH)
|
||||
|
||||
RELEASE = terraform-provider-teleportmwi-v$(VERSION)-$(OS)-$(ARCH)-bin
|
||||
|
||||
BUILDDIR ?= build
|
||||
@@ -65,3 +67,14 @@ testacc:
|
||||
.PHONY: lint
|
||||
lint:
|
||||
golangci-lint run -c ../../.golangci.yml
|
||||
|
||||
.PHONY: docs
|
||||
docs: install
|
||||
./gen/docs.sh $(VERSION)
|
||||
|
||||
PROVIDER_PATH = ~/.terraform.d/plugins/terraform.releases.teleport.dev/gravitational/teleportmwi/$(VERSION)/$(TERRAFORM_ARCH)/
|
||||
|
||||
.PHONY: install
|
||||
install: build
|
||||
mkdir -p $(PROVIDER_PATH)
|
||||
mv $(BUILDDIR)/terraform-provider-teleportmwi $(PROVIDER_PATH)
|
||||
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
// Warning: The teleportmwi_kubernetes data source will not function correctly
|
||||
// when the Teleport cluster is fronted by a L7 load balancer that terminates
|
||||
// TLS.
|
||||
data "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-k8s-cluster"
|
||||
}
|
||||
credential_ttl = "1h"
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = data.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = data.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = data.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = data.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = data.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
// Warning: The teleportmwi_kubernetes ephemeral resource will not function
|
||||
// correctly when the Teleport cluster is fronted by a L7 load balancer that
|
||||
// terminates TLS.
|
||||
ephemeral "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-k8s-cluster"
|
||||
}
|
||||
credential_ttl = "1h"
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/bin/bash
|
||||
|
||||
# If someone runs a debug GitHub Actions task
|
||||
if [ -n "$RUNNER_DEBUG" ]; then
|
||||
set -x
|
||||
fi
|
||||
set -euo pipefail
|
||||
|
||||
info() {
|
||||
printf "\e[1;32m%s\e[0m\n" "$1"
|
||||
}
|
||||
error() {
|
||||
printf "\e[1;31m%s\e[0m\n" "$1"
|
||||
exit 1
|
||||
}
|
||||
|
||||
VERSION="$1"
|
||||
|
||||
if [ -z "$VERSION" ]; then
|
||||
error "Version parameter is required"
|
||||
fi
|
||||
|
||||
TFDIR="$(pwd)"
|
||||
DOCSDIR="$(pwd)/../../docs/pages/reference/terraform-provider-mwi"
|
||||
TMPDIR="$(mktemp -d)"
|
||||
|
||||
info "Generating provider's schema"
|
||||
|
||||
pushd "$TMPDIR"
|
||||
cat > main.tf << EOF
|
||||
terraform {
|
||||
required_providers {
|
||||
teleportmwi = {
|
||||
source = "terraform.releases.teleport.dev/gravitational/teleportmwi"
|
||||
version = "= $VERSION"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
terraform init
|
||||
terraform providers schema -json > schema.json
|
||||
|
||||
info "Rendering markdown files"
|
||||
|
||||
popd
|
||||
go tool github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs generate \
|
||||
--providers-schema "$TMPDIR/schema.json" \
|
||||
--provider-name "terraform.releases.teleport.dev/gravitational/teleportmwi" \
|
||||
--rendered-provider-name "teleportmwi" \
|
||||
--rendered-website-dir="$TMPDIR/docs" \
|
||||
--website-source-dir="$TFDIR/templates" \
|
||||
--provider-dir "$TFDIR" \
|
||||
--examples-dir="$TFDIR/examples" \
|
||||
--website-temp-dir="$TMPDIR/temp" \
|
||||
--hidden-attributes="id,kind,metadata.namespace,metadata.revision"
|
||||
|
||||
info "Converting .md files to .mdx"
|
||||
|
||||
cd "$TMPDIR/docs"
|
||||
find . -iname '*.md' -type f -exec sh -c 'i="$1"; mv "$i" "${i%.md}.mdx"' shell {} \;
|
||||
# renaming the resources and data-sources indexes because the names were reserved by the generator
|
||||
mv "$TMPDIR/docs/ephemeral-resources-index.mdx" "$TMPDIR/docs/ephemeral-resources/ephemeral-resources.mdx"
|
||||
mv "$TMPDIR/docs/data-sources-index.mdx" "$TMPDIR/docs/data-sources/data-sources.mdx"
|
||||
|
||||
info "Copying generated documentation into the teleport docs directory"
|
||||
|
||||
# Removing the apex terraform.mdx
|
||||
rm -rf "$DOCSDIR" "$DOCSDIR/terraform-provider.mdx"
|
||||
cp -r "$TMPDIR/docs" "$DOCSDIR"
|
||||
# unpacking the index to the apex terraform.mdx
|
||||
mv "$DOCSDIR/index.mdx" "$DOCSDIR/terraform-provider-mwi.mdx"
|
||||
|
||||
info "TF documentation successfully generated"
|
||||
@@ -64,6 +64,7 @@ require (
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
|
||||
github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
|
||||
github.com/MakeNowJust/heredoc v1.0.0 // indirect
|
||||
github.com/Masterminds/goutils v1.1.1 // indirect
|
||||
github.com/Masterminds/semver v1.5.0 // indirect
|
||||
@@ -136,6 +137,7 @@ require (
|
||||
github.com/aws/smithy-go/tracing/smithyoteltracing v1.0.5 // indirect
|
||||
github.com/beevik/etree v1.5.1 // indirect
|
||||
github.com/beorn7/perks v1.0.1 // indirect
|
||||
github.com/bgentry/speakeasy v0.2.0 // indirect
|
||||
github.com/blang/semver v3.5.1+incompatible // indirect
|
||||
github.com/blang/semver/v4 v4.0.0 // indirect
|
||||
github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
|
||||
@@ -266,6 +268,7 @@ require (
|
||||
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
|
||||
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
|
||||
github.com/hashicorp/cli v1.1.7 // indirect
|
||||
github.com/hashicorp/errwrap v1.1.0 // indirect
|
||||
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
|
||||
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
||||
@@ -282,6 +285,7 @@ require (
|
||||
github.com/hashicorp/logutils v1.0.0 // indirect
|
||||
github.com/hashicorp/terraform-exec v0.23.0 // indirect
|
||||
github.com/hashicorp/terraform-json v0.25.0 // indirect
|
||||
github.com/hashicorp/terraform-plugin-docs v0.0.0-00010101000000-000000000000 // indirect
|
||||
github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
|
||||
github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 // indirect
|
||||
github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
|
||||
@@ -386,6 +390,7 @@ require (
|
||||
github.com/pkg/sftp v1.13.9 // indirect
|
||||
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
||||
github.com/posener/complete v1.2.3 // indirect
|
||||
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
|
||||
github.com/pquerna/otp v1.5.0 // indirect
|
||||
github.com/prometheus/client_golang v1.22.0 // indirect
|
||||
@@ -454,6 +459,8 @@ require (
|
||||
github.com/xlab/treeprint v1.2.0 // indirect
|
||||
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
|
||||
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
|
||||
github.com/yuin/goldmark v1.7.7 // indirect
|
||||
github.com/yuin/goldmark-meta v1.1.0 // indirect
|
||||
github.com/yusufpapurcu/wmi v1.2.4 // indirect
|
||||
github.com/zclconf/go-cty v1.16.3 // indirect
|
||||
github.com/zeebo/errs v1.4.0 // indirect
|
||||
@@ -461,6 +468,7 @@ require (
|
||||
github.com/zitadel/oidc/v3 v3.39.1 // indirect
|
||||
github.com/zitadel/schema v1.3.1 // indirect
|
||||
gitlab.com/gitlab-org/api/client-go v0.131.0 // indirect
|
||||
go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
|
||||
go.etcd.io/etcd/api/v3 v3.6.1 // indirect
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.6.1 // indirect
|
||||
go.etcd.io/etcd/client/v3 v3.6.1 // indirect
|
||||
@@ -553,3 +561,9 @@ replace (
|
||||
github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
|
||||
github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
|
||||
)
|
||||
|
||||
// Doc generation tooling.
|
||||
// (using our fork of github.com/hashicorp/terraform-plugin-docs)
|
||||
tool github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
|
||||
|
||||
replace github.com/hashicorp/terraform-plugin-docs => github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8
|
||||
|
||||
@@ -136,6 +136,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapp
|
||||
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0/go.mod h1:otE2jQekW/PqXk1Awf5lmfokJx4uwuqcj1ab5SpGeW0=
|
||||
github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
|
||||
github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
|
||||
github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
|
||||
github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
|
||||
github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
|
||||
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
|
||||
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
|
||||
@@ -307,6 +309,8 @@ github.com/beevik/etree v1.5.1/go.mod h1:gPNJNaBGVZ9AwsidazFZyygnd+0pAU38N4D+Wem
|
||||
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
|
||||
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
|
||||
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
|
||||
github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
|
||||
github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
|
||||
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
|
||||
github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
|
||||
github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
|
||||
@@ -719,6 +723,8 @@ github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldD
|
||||
github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
|
||||
github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
|
||||
github.com/gravitational/selinux v1.13.0-teleport/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
|
||||
github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8 h1:FSfiARn271p3g3R0U2So5mUC6EiwaQ9KEtczU++LhQo=
|
||||
github.com/gravitational/terraform-plugin-docs v0.19.5-0.20250708171626-e77ce9bd4dd8/go.mod h1:A/+4SVMdAkQYtIBtaxV0H7AU862TxVZk/hhKaMDQB6Y=
|
||||
github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
|
||||
github.com/gravitational/trace v1.5.1/go.mod h1:sJKfJHIQ7IkG8kvYpFPEr6mj3WDEdZ0YAc7xAD8w7lw=
|
||||
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
|
||||
@@ -733,6 +739,8 @@ github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8
|
||||
github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
|
||||
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
|
||||
github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
|
||||
github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
|
||||
github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
|
||||
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
|
||||
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
|
||||
@@ -745,6 +753,7 @@ github.com/hashicorp/go-cty v1.5.0 h1:EkQ/v+dDNUqnuVpmS5fPqyY71NXVgT5gf32+57xY8g
|
||||
github.com/hashicorp/go-cty v1.5.0/go.mod h1:lFUCG5kd8exDobgSfyj4ONE/dc822kiYMguVKdHGMLM=
|
||||
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
|
||||
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
|
||||
github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
|
||||
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
|
||||
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
|
||||
github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
|
||||
@@ -1106,6 +1115,8 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
|
||||
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
|
||||
github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
|
||||
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
|
||||
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
|
||||
github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
|
||||
@@ -1319,6 +1330,10 @@ github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfS
|
||||
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
|
||||
github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
|
||||
github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
|
||||
github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
|
||||
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
|
||||
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
|
||||
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
|
||||
@@ -1342,6 +1357,8 @@ github.com/zitadel/schema v1.3.1 h1:QT3kwiRIRXXLVAs6gCK/u044WmUVh6IlbLXUsn6yRQU=
|
||||
github.com/zitadel/schema v1.3.1/go.mod h1:071u7D2LQacy1HAN+YnMd/mx1qVE2isb0Mjeqg46xnU=
|
||||
gitlab.com/gitlab-org/api/client-go v0.131.0 h1:a431AKWkrSO5dgY5o5okFjxpANhkGpzxnZrjAHRyqp8=
|
||||
gitlab.com/gitlab-org/api/client-go v0.131.0/go.mod h1:U83AmpPrAir8NH31T/BstwZcJzS/nGZptOXtGjPZrbI=
|
||||
go.abhg.dev/goldmark/frontmatter v0.2.0 h1:P8kPG0YkL12+aYk2yU3xHv4tcXzeVnN+gU0tJ5JnxRw=
|
||||
go.abhg.dev/goldmark/frontmatter v0.2.0/go.mod h1:XqrEkZuM57djk7zrlRUB02x8I5J0px76YjkOzhB4YlU=
|
||||
go.etcd.io/etcd/api/v3 v3.6.1 h1:yJ9WlDih9HT457QPuHt/TH/XtsdN2tubyxyQHSHPsEo=
|
||||
go.etcd.io/etcd/api/v3 v3.6.1/go.mod h1:lnfuqoGsXMlZdTJlact3IB56o3bWp1DIlXPIGKRArto=
|
||||
go.etcd.io/etcd/client/pkg/v3 v3.6.1 h1:CxDVv8ggphmamrXM4Of8aCC8QHzDM4tGcVr9p2BSoGk=
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
title: "MWI Terraform data-sources index"
|
||||
description: "Index of all the data-sources supported by the Teleport MWI Terraform Provider"
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{{ "{/*Auto-generated file. Do not edit.*/}" }}
|
||||
{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
|
||||
|
||||
{/*
|
||||
This file will be renamed data-sources.mdx during build time.
|
||||
The template name is reserved by tfplugindocs so we suffix with -index.
|
||||
*/}
|
||||
|
||||
<Admonition type="info">
|
||||
This is reference page is for the Teleport MWI Terraform provider, which
|
||||
generates short-lived credentials using Teleport Machine & Workload Identity.
|
||||
These short-lived credentials can be used to grant other Terraform providers
|
||||
access to resources through Teleport.
|
||||
|
||||
If you are looking to manage the configuration of Teleport itself, use the
|
||||
[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
|
||||
instead.
|
||||
</Admonition>
|
||||
|
||||
The Teleport MWI Terraform provider supports the following data-sources:
|
||||
{{ range $key, $value := .DataSourceFiles }}
|
||||
- [`{{$key}}`](./{{$value}}.mdx)
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
title: Reference for the {{.Name}} Terraform data-source
|
||||
sidebar_label: {{ slice .Name (len "teleportmwi_") }}
|
||||
description: This page describes the supported values of the {{.Name}} data-source of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{{ "{/*Auto-generated file. Do not edit.*/}" }}
|
||||
{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
|
||||
|
||||
{{ .Description | trimspace }}
|
||||
|
||||
{{ if .HasExample -}}
|
||||
## Example Usage
|
||||
|
||||
{{tffile .ExampleFile }}
|
||||
{{- end }}
|
||||
|
||||
{{ .SchemaMarkdown | trimspace }}
|
||||
{{- if .HasImport }}
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
{{codefile "shell" .ImportFile }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
title: "MWI Terraform ephemeral resources index"
|
||||
description: "Index of all the resources supported by the Teleport MWI Terraform Provider"
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{{ "{/*Auto-generated file. Do not edit.*/}" }}
|
||||
{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
|
||||
|
||||
{/*
|
||||
This file will be renamed ephemeral-resources.mdx during build time.
|
||||
The template name is reserved by tfplugindocs so we suffix with -index.
|
||||
*/}
|
||||
|
||||
<Admonition type="info">
|
||||
This is reference page is for the Teleport MWI Terraform provider, which
|
||||
generates short-lived credentials using Teleport Machine & Workload Identity.
|
||||
These short-lived credentials can be used to grant other Terraform providers
|
||||
access to resources through Teleport.
|
||||
|
||||
If you are looking to manage the configuration of Teleport itself, use the
|
||||
[Teleport Terraform Provider](../../terraform-provider/terraform-provider.mdx)
|
||||
instead.
|
||||
</Admonition>
|
||||
|
||||
The Teleport MWI Terraform provider supports the following ephemeral resources:
|
||||
{{ range $key, $value := .EphemeralResourceFiles }}
|
||||
- [`{{$key}}`](./{{$value}}.mdx)
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
title: Reference for the {{.Name}} Terraform ephemeral resource
|
||||
sidebar_label: {{ slice .Name (len "teleportmwi_") }}
|
||||
description: This page describes the supported values of the {{.Name}} ephemeral resource of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{{ "{/*Auto-generated file. Do not edit.*/}" }}
|
||||
{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
|
||||
|
||||
This page describes the supported values of the {{.Name}} ephemeral resource of the Teleport MWI Terraform provider.
|
||||
{{ includefileifexists (printf "./examples/resources/%s/introduction.md" .Name)}}
|
||||
|
||||
{{ .Description | trimspace }}
|
||||
|
||||
{{ if .HasExample -}}
|
||||
## Example Usage
|
||||
|
||||
{{tffile .ExampleFile }}
|
||||
{{- end }}
|
||||
|
||||
{{ .SchemaMarkdown | trimspace }}
|
||||
{{- if .HasImport }}
|
||||
|
||||
## Import
|
||||
|
||||
Import is supported using the following syntax:
|
||||
|
||||
{{codefile "shell" .ImportFile }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,103 @@
|
||||
---
|
||||
title: "Teleport MWI Terraform Provider"
|
||||
description: Reference documentation of the Teleport MWI Terraform provider.
|
||||
labels:
|
||||
- reference
|
||||
- mwi
|
||||
---
|
||||
|
||||
{{ "{/*Auto-generated file. Do not edit.*/}" }}
|
||||
{{ "{/*To regenerate, navigate to integrations/terraform and run `make docs`.*/}" }}
|
||||
|
||||
The Teleport MWI Terraform provider generates short-lived credentials using
|
||||
[Teleport Machine & Workload Identity (MWI)](../../machine-workload-identity/machine-workload-identity.mdx)
|
||||
that can be used to grant other Terraform providers access to resources.
|
||||
|
||||
To manage the configuration of Teleport itself, use the [Teleport Terraform
|
||||
Provider instead](../terraform-provider/terraform-provider.mdx).
|
||||
|
||||
{/* Note: the awkward `resource-index` file names are here because `data-sources`
|
||||
is reserved by the generator for the catch-all resource template */}
|
||||
|
||||
- [list of supported ephemeral resources](./ephemeral-resources/ephemeral-resources.mdx)
|
||||
- [list of supported data-sources](./data-sources/data-sources.mdx)
|
||||
|
||||
## Example usage
|
||||
|
||||
In this example, we will use the Teleport MWI Terraform provider to grant the
|
||||
Kubernetes provider access to a Kubernetes cluster through Teleport.
|
||||
|
||||
Our Kubernetes cluster is enrolled in Teleport under the name `my-cluster`, and
|
||||
we've setup a Bot and Join Token to allow our Terraform provider to authenticate
|
||||
to Teleport.
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
teleportmwi = {
|
||||
source = "terraform.releases.teleport.dev/gravitational/teleportmwi"
|
||||
version = "~> (=teleport.major_version=).0"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "teleportmwi" {
|
||||
join_method = "gitlab"
|
||||
join_token = "my-join-token"
|
||||
proxy_server = "example.teleport.sh:443"
|
||||
}
|
||||
|
||||
ephemeral "teleportmwi_kubernetes" "my_cluster" {
|
||||
selector = {
|
||||
name = "my-cluster"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs
|
||||
provider "kubernetes" {
|
||||
host = ephemeral.teleportmwi_kubernetes.my_cluster.output.host
|
||||
tls_server_name = ephemeral.teleportmwi_kubernetes.my_cluster.output.tls_server_name
|
||||
client_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_certificate
|
||||
client_key = ephemeral.teleportmwi_kubernetes.my_cluster.output.client_key
|
||||
cluster_ca_certificate = ephemeral.teleportmwi_kubernetes.my_cluster.output.cluster_ca_certificate
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "ns" {
|
||||
metadata {
|
||||
name = "example-namespace"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Ephemeral resources vs data sources
|
||||
|
||||
The MWI Terraform provider exposes functionality using two different kinds of
|
||||
entity in the Terraform ecosystem: **ephemeral resources** and **data sources**.
|
||||
|
||||
Ephemeral resources are supported by Terraform 1.10 and later, and should be
|
||||
the preferred way to use the MWI Terraform provider. They have the following
|
||||
benefits over data sources:
|
||||
|
||||
- The short-lived credentials generated by the MWI Terraform provider will not
|
||||
be persisted within the Terraform state.
|
||||
- Fresh short-lived credentials will be generated in the apply phase, allowing
|
||||
you to grant read-only privileges to plan runs and read-write privileges to
|
||||
apply runs.
|
||||
|
||||
When using a version of Terraform that does not support ephemeral resources,
|
||||
you can use the data source variants instead. When using the data sources,
|
||||
keep the following in mind:
|
||||
|
||||
- The short-lived secrets generated by the MWI Terraform provider will be
|
||||
persisted within the Terraform state. The secrets will be generated in the
|
||||
plan phase and reused in the apply phase. We therefore highly recommend that
|
||||
you encrypt your Terraform state file.
|
||||
- You will need to configure a `credential_ttl` that will ensure that credentials
|
||||
generated during the plan phase will still be valid during the apply phase.
|
||||
|
||||
{{ .SchemaMarkdown | trimspace }}
|
||||
|
||||
Reference in New Issue
Block a user