Skip to content

feat(jobs): support secret manager references in serverless jobs defi… #3030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 15, 2025

Conversation

Gnoale
Copy link
Contributor

@Gnoale Gnoale commented Apr 7, 2025

Following this issue, this PR implements the secret reference ressources

Example

resource "scaleway_secret" "test" {
  name = "job-secret"
  path = "/one"
}

resource "scaleway_secret_version" "test" {
  secret_id = scaleway_secret.test.id
  data      = "your_secret"
}
locals {
  parts       = split("/", scaleway_secret.test.id)
  secret_uuid = local.parts[1]
}

resource "scaleway_job_definition" "test" {
  name         = "test-jobs-job-definition-secret"
  cpu_limit    = 120
  memory_limit = 256
  image_uri    = "docker.io/alpine:latest"

  secret_reference {
    secret_id      = data.scaleway_secret.test.secret_id
    secret_version = "latest"
    file           = "/home/dev/another_env"
  }
  secret_reference {
    secret_id      = local.secret_uuid
    secret_version = "latest"
    environment    = "SOME_ENV"
  }
}

Example of terraform plan with a secret_reference parameter update

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # scaleway_job_definition.test will be updated in-place
  ~ resource "scaleway_job_definition" "test" {
        id           = "fr-par/f5522fe5-74fd-437a-bf7e-88eb5d553cb4"
        name         = "test-jobs-job-definition-secret"
        # (9 unchanged attributes hidden)

      - secret_reference {
          - file                = "/home/dev/new_env" -> null
          - secret_id           = "1294b4a8-7296-4e33-8cf6-4ddfc087cb51" -> null
          - secret_reference_id = "db2a7a93-4dde-4708-88eb-1c3213c662f5" -> null
          - secret_version      = "latest" -> null
            # (1 unchanged attribute hidden)
        }
      - secret_reference {
          - environment         = "SOME_ENV" -> null
          - secret_id           = "1294b4a8-7296-4e33-8cf6-4ddfc087cb51" -> null
          - secret_reference_id = "2ab3e378-7253-4709-b89c-29189a0ccd99" -> null
          - secret_version      = "latest" -> null
            # (1 unchanged attribute hidden)
        }
      + secret_reference {
          + file                = "/home/dev/another_env"
          + secret_id           = "1294b4a8-7296-4e33-8cf6-4ddfc087cb51"
          + secret_reference_id = (known after apply)
          + secret_version      = "latest"
            # (1 unchanged attribute hidden)
        }
      + secret_reference {
          + environment         = "SOME_ENV"
          + secret_id           = "1294b4a8-7296-4e33-8cf6-4ddfc087cb51"
          + secret_reference_id = "2ab3e378-7253-4709-b89c-29189a0ccd99"
          + secret_version      = "latest"
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Note the update part is implemented by hashing the value that could be edited by the user,
the new values not found in the old ones will be created,
the old values not found in the new ones will be deleted

@Gnoale Gnoale force-pushed the jobs-secret branch 2 times, most recently from ac490ab to 9b26c35 Compare April 8, 2025 09:20
@Gnoale Gnoale added function Serverless function issues, bugs and feature requests secret Managed Secret Manager issues, bugs and feature requests labels Apr 8, 2025
@Gnoale Gnoale force-pushed the jobs-secret branch 3 times, most recently from e6b8d0f to 312b8cb Compare April 10, 2025 15:56
@Gnoale Gnoale marked this pull request as ready for review April 10, 2025 21:03
@Gnoale Gnoale requested a review from a team as a code owner April 10, 2025 21:03
@Gnoale Gnoale force-pushed the jobs-secret branch 3 times, most recently from 2763160 to 1a97020 Compare April 11, 2025 14:28
@Gnoale Gnoale added this pull request to the merge queue Apr 15, 2025
Merged via the queue into master with commit 4e9a3d5 Apr 15, 2025
48 checks passed
@Gnoale Gnoale deleted the jobs-secret branch April 15, 2025 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
function Serverless function issues, bugs and feature requests secret Managed Secret Manager issues, bugs and feature requests
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants