mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Zach
79735f2d45
This change passes user secrets from coderd to the Terraform process at workspace build time so the `data.coder_secret` data source in terraform-provider-coder can resolve values at plan time. Secrets traverse two proto hops: `provisionerdserver` fetches them via`ListUserSecretsWithValues`, attaches them to `AcquiredJob.WorkspaceBuild.user_secrets` on `provisionerd.proto`; `runner.go` forwards into `PlanRequest.user_secrets` on `provisioner.proto`; the Terraform provisioner encodes each as `CODER_SECRET_ENV_<name>` or `CODER_SECRET_FILE_<hex(path)>` before invoking `terraform plan`. Only plan requests carry secrets; apply runs with `nil` because values are baked into plan state. Fetch is gated on a workspace transitioning to start. stop and delete transitions never carry secrets, so revoking or deleting a stored secret cannot make a workspace unstoppable. DB errors on the fetch fail the job outright rather than silently continuing with an empty secret set. Note that user secrets will be stored in the workspace_builds table in provisioner_state with other Terraform state (including other sensitive data).
99 lines
4.1 KiB
Go
99 lines
4.1 KiB
Go
package proto
|
|
|
|
import "github.com/coder/coder/v2/apiversion"
|
|
|
|
// Version history:
|
|
//
|
|
// API v1.2:
|
|
// - Add support for `open_in` parameters in the workspace apps.
|
|
//
|
|
// API v1.3:
|
|
// - Add new field named `resources_monitoring` in the Agent with resources monitoring.
|
|
//
|
|
// API v1.4:
|
|
// - Add new field named `devcontainers` in the Agent.
|
|
//
|
|
// API v1.5:
|
|
// - Add new field named `prebuilt_workspace_build_stage` enum in the Metadata message.
|
|
// - Add new field named `running_agent_auth_tokens` to provisioner job metadata
|
|
// - Add new field named `resource_replacements` in PlanComplete & CompletedJob.WorkspaceBuild.
|
|
// - Add new field named `api_key_scope` to WorkspaceAgent to support running without user data access.
|
|
// - Add `plan` field to `CompletedJob.TemplateImport`.
|
|
//
|
|
// API v1.6:
|
|
// - Add `module_files` field to `CompletedJob.TemplateImport`.
|
|
// - Add previous parameter values to 'WorkspaceBuild' jobs. Provisioner passes
|
|
// the previous values for the `terraform apply` to enforce monotonicity
|
|
// in the terraform provider.
|
|
// - Add new field named `expiration_policy` to `Prebuild`, with a field named
|
|
// `ttl` to define TTL-based expiration for unclaimed prebuilds.
|
|
// - Add `group` field to `App`
|
|
// - Add `form_type` field to parameters
|
|
//
|
|
// API v1.7:
|
|
// - Added DataUpload and ChunkPiece messages to support uploading large files
|
|
// back to Coderd. Used for uploading module files in support of dynamic
|
|
// parameters.
|
|
// - Add new field named `scheduling` to `Prebuild`, with fields for timezone
|
|
// and schedule rules to define cron-based scaling of prebuilt workspace
|
|
// instances based on time patterns.
|
|
// - Added new field named `id` to `App`, which transports the ID generated by the coder_app provider to be persisted.
|
|
// - Added new field named `default` to `Preset`.
|
|
// - Added various fields in support of AI Tasks:
|
|
// -> `ai_tasks` in `CompleteJob.WorkspaceBuild`
|
|
// -> `has_ai_tasks` in `CompleteJob.TemplateImport`
|
|
// -> `has_ai_tasks` and `ai_tasks` in `PlanComplete`
|
|
// -> new message types `AITaskSidebarApp` and `AITask`
|
|
//
|
|
// API v1.8:
|
|
// - Add new fields `description` and `icon` to `Preset`.
|
|
//
|
|
// API v1.9:
|
|
// - Added new field named 'has_external_agent' in 'CompleteJob.TemplateImport'
|
|
//
|
|
// API v1.10:
|
|
// - Added new field `tooltip` in `App`
|
|
//
|
|
// API v1.11:
|
|
// - Added new fields `task_id` and `task_prompt` to `Manifest`.
|
|
// - Added new field `app_id` to `AITask`
|
|
//
|
|
// API v1.12:
|
|
// - Added new field `template_version_id` to `provisioner.Metadata`
|
|
// - Added new field `exp_reuse_terraform_workspace` to `provisioner.Job.WorkspaceBuild`
|
|
// - Added fields `template_version_id`, `template_id`, and `exp_reuse_terraform_workspace` to `provisioner.Config`
|
|
//
|
|
// API v1.13:
|
|
// - Removed experimental fields `exp_reuse_terraform_workspace`. Caching moved into Coderd
|
|
//
|
|
// API v1.14:
|
|
// - Added new field `template_version_modules_file` to Metadata
|
|
// - Added `FailedFile` type for file upload failures.
|
|
// - Add `DownloadFile` capability for provisioner daemons to fetch files from coderd.
|
|
// - Moved type `UploadFileRequest` -> `provisioner.FileUpload`
|
|
//
|
|
// API v1.15:
|
|
// - Removed `stop_modules` from CompleteJob. Was a duplicate of start_modules
|
|
// - Add `id`, `subagent_id`, `apps`, `scripts` and `envs` to `provisioner.Devcontainer`
|
|
//
|
|
// API v1.16:
|
|
// - Added `merge_strategy` field to `provisioner.Env` message
|
|
//
|
|
// API v1.17:
|
|
// - Added `user_secrets` field to `AcquiredJob.WorkspaceBuild`, carrying user
|
|
// secret values from coderd to provisioner daemons.
|
|
// - Added `UserSecretValue` message and `user_secrets` field to `PlanRequest`,
|
|
// carrying user secret values from provisioner daemons to provisioners
|
|
// during plan.
|
|
const (
|
|
CurrentMajor = 1
|
|
CurrentMinor = 17
|
|
)
|
|
|
|
// CurrentVersion is the current provisionerd API version.
|
|
// Breaking changes to the provisionerd API **MUST** increment
|
|
// CurrentMajor above.
|
|
// Non-breaking changes to the provisionerd API **MUST** increment
|
|
// CurrentMinor above.
|
|
var CurrentVersion = apiversion.New(CurrentMajor, CurrentMinor)
|