Skip to main content

Providers

Coming soon

In preparation. This page describes the target interface to gather your feedback; nothing is usable yet.

A Provider carries the configuration of an OpenTofu provider (ovh, aws, …): public attributes in clear text, secret attributes drawn from tenant secrets, environment variables. Workspace resources reference it by name instead of repeating the configuration.

Example​

provider-ovh.yml
apiVersion: tofu.stackngo.io/v1alpha1
kind: Provider
metadata:
  name: ovh-gra
spec:
  type: ovh
  source: ovh/ovh                     # compared to the module's required_providers
  version: "~> 1.6"                   # informational
  config:
    endpoint: ovh-eu
  configFrom:
    - attribute: application_key
      secretRef: {name: ovh-credentials, key: application_key}
    - attribute: application_secret
      secretRef: {name: ovh-credentials, key: application_secret}
    - attribute: consumer_key
      secretRef: {name: ovh-credentials, key: consumer_key}
provider-aws.yml
apiVersion: tofu.stackngo.io/v1alpha1
kind: Provider
metadata:
  name: aws-eu
spec:
  type: aws
  config: {region: eu-west-3}
  envFrom:
    - secretRef: {name: aws-credentials}   # AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

Three ways to pass a value​

FieldForHow it is passed to the run
confignon-secret attributeswritten as is in the provider block
configFromsecret attributesone sensitive variable per attribute, fed from the secret; the value appears neither in the manifest nor in the logs
envFromcredentials read by the provider from the environmentall keys of the secret become environment variables of the run

An input secret that changes reruns the Workspaces that use the Provider.

Alias​

spec.alias allows several configurations of the same type (aws-eu, aws-us); the Workspace references both and the module distinguishes them with provider = aws.us.

Checks​

  • type and source are compared to the module's required_providers; a mismatch gives the reason ProviderMismatch on the Workspace.
  • If the module already declares the provider block, the Provider configuration overrides it; otherwise it creates it.

See also​