Skip to content

Commit 644ba3b

Browse files
committed
Add Sarah article
1 parent 181a776 commit 644ba3b

File tree

4 files changed

+159
-53
lines changed

4 files changed

+159
-53
lines changed

content/terraform/v1.13.x/docs/language/stacks/component/declare-providers.mdx

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,10 @@ component "s3" {
7878
After configuring your provider, you can use the Terraform CLI to generate a provider lock file:
7979

8080
```shell
81-
$ terraform stacks providers-lock
81+
$ terraform stacks init
8282
```
8383

84-
If you update a provider version and want to apply those changes to your Stack locally, re-run the [`terraform stacks providers-lock` command](terraform/cli/commands/stacks/providers-lock) to update the provider lock file.
84+
If you update a provider version and want to apply those changes to your Stack locally, re-run the [`terraform stacks init -upgrade` command](terraform/cli/commands/stacks/init) to update the provider lock file.
8585

8686
### Dynamic provider configurations
8787

@@ -149,15 +149,13 @@ Check your provider in the [Terraform registry](https://registry.terraform.io/)
149149

150150
## Provider lock file
151151

152-
A Stack cannot run without a lock file for its providers. After defining your providers, use the Terraform CLI to generate a `.terraform.lock.hcl` lock file. The `terraform stacks providers-lock` command creates and updates your `.terraform.lock.hcl` file:
152+
A Stack cannot run without a lock file for its providers. After defining your providers, use the Terraform CLI to generate a `.terraform.lock.hcl` lock file. The `terraform stacks init` command creates and updates your `.terraform.lock.hcl` file:
153153

154154
```shell-session
155-
$ terraform stacks providers-lock
155+
$ terraform stacks init
156156
```
157157

158-
The `terraform stacks providers-lock` command uses the `required_providers` block from your configuration to download the listed providers and compute the provider lock hashes. The `terraform stacks providers-lock` command only checks the `required_providers` block, so you must list all of the providers you use in that block to ensure that the `terraform stacks` CLI can find them.
159-
160-
If you update your Stack’s providers, rerun the `terraform stacks providers-lock` command to update your Stack’s lock file locally. For more details, refer to the [`terraform stacks` commands](/terraform/cli/commands/stacks).
158+
The `terraform stacks init` command uses the `required_providers` block from your configuration to download the listed providers and compute the provider lock hashes. If you update your Stack’s providers, run `terraform stacks init -upgrade` command to update your Stack’s lock file locally. For more details, refer to the [`terraform stacks` commands](/terraform/cli/commands/stacks).
161159

162160
## Next steps
163161

content/terraform/v1.13.x/docs/language/stacks/deploy/authenticate.mdx

Lines changed: 39 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ We recommend authenticating your Stack with OIDC because using static credential
1313

1414
## Authenticate with OIDC
1515

16-
[OpenID Connect](https://openid.net/connect/) (OIDC) is an identity layer on top of the OAuth 2.0 protocol. You can use HCP Terraforms [Workload identity](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens) tokens, built on the OpenID Connect protocol, to securely connect and authenticate your Stacks with cloud providers.
16+
[OpenID Connect](https://openid.net/connect/) (OIDC) is an identity layer on top of the OAuth 2.0 protocol. You can use HCP Terraform's [Workload identity](/terraform/cloud-docs/workspaces/dynamic-provider-credentials/workload-identity-tokens) tokens, built on the OpenID Connect protocol, to securely connect and authenticate your Stacks with cloud providers.
1717

1818
-> **Hands on**: Walk through setting up OIDC for a Stack in the [Deploy a Stack with HCP Terraform](/terraform/tutorials/cloud/stacks-deploy) tutorial.
1919

@@ -24,9 +24,9 @@ Stacks have a built-in `identity_token` block that creates workload identity tok
2424
The details of Stack authentication differ based on which cloud provider you are setting up, but the basic steps remain the same:
2525

2626
1. Set up the trust configuration between your cloud provider and HCP Terraform, which usually includes creating roles and policies for your cloud provider.
27-
1. Add an `identity_token` block to your Stacks deployment file using the audience and roles you created in the previous step.
27+
1. Add an `identity_token` block to your Stack's deployment file using the audience and roles you created in the previous step.
2828

29-
Your deployments can reference the value of the `identity_token` block to pass the trust relationship role to your Stacks operations.
29+
Your deployments can reference the value of the `identity_token` block to pass the trust relationship role to your Stack's operations.
3030

3131
### Configure trust configuration
3232

@@ -127,8 +127,7 @@ output "role_arn" {
127127

128128
</CodeBlockConfig>
129129

130-
131-
After setting up your workspace in HCP Terraform, perform a plan and apply operation. HCP Terraform will create your OpenID provider, policy, and role before outputting your new role’s ARN with the `role_arn` output. Copy your new AWS ARN role because this is the value you use to configure your cloud provider with your Stack and HCP Terraform.
130+
After setting up your workspace in HCP Terraform, perform a plan and apply operation. HCP Terraform will create your OpenID provider, policy, and role before outputting your new role's ARN with the `role_arn` output. Copy your new AWS ARN role because this is the value you use to configure your cloud provider with your Stack and HCP Terraform.
132131

133132
To learn more about the workload identity trust claims and metadata, refer to the `identity_token` block reference](/terraform/language/block/stack/deploy/identity_token#token-attributes).
134133

@@ -140,63 +139,62 @@ When you define the `identity_token` block, you specify its audience. For exampl
140139

141140
```hcl
142141
identity_token "aws" {
143-
audience = ["aws.workload.identity"]
142+
audience = ["aws.workload.identity"]
144143
}
145144
```
146145

147-
Once defined, you can reference an identity token in a deployment's input variables and reference that token in a providers configuration.
146+
Once defined, you can reference an identity token in a deployment's input variables and reference that token in a provider's configuration.
148147

149148
You also need to add your trust relationship, your role ARN, to configure your token with the trust relationship to authenticate AWS resources.
150149

151150
<CodeBlockConfig filename="deployments.tfdeploy.hcl">
152151

153152
```hcl
154153
identity_token "aws" {
155-
audience = ["aws.workload.identity"]
154+
audience = ["aws.workload.identity"]
156155
}
157156
158157
deployment "development" {
159-
inputs = {
160-
role_arn = "<YOUR_ROLE_ARN>"
161-
identity_token = identity_token.aws.jwt
162-
}
158+
inputs = {
159+
role_arn = "<YOUR_ROLE_ARN>"
160+
identity_token = identity_token.aws.jwt
161+
}
163162
}
164163
```
165164

166165
</CodeBlockConfig>
167166

168-
Now, the deployments are authenticated with AWS and can pass the trust configuration to your Stack’s providers for authentication.
169-
167+
Now, the deployments are authenticated with AWS and can pass the trust configuration to your Stack's providers for authentication.
170168

171169
```hcl
172170
# variables.tfcomponent.hcl
173171
174172
variable "role_arn" {
175-
type = string
173+
type = string
176174
}
177175
178176
variable "identity_token" {
179-
type = string
180-
ephemeral = true
177+
type = string
178+
ephemeral = true
181179
}
182180
183181
# providers.tfcomponent.hcl
184182
185183
required_providers {
186-
aws = {
187-
source = "hashicorp/aws"
188-
version = "~> 5.7.0"
189-
}
184+
aws = {
185+
source = "hashicorp/aws"
186+
version = "~> 5.7.0"
187+
}
190188
}
191189
192190
provider "aws" "this" {
193-
config {
194-
region = var.region
195-
assume_role_with_web_identity {
196-
role_arn = var.aws_role
197-
web_identity_token = var.aws_token
198-
}
191+
config {
192+
region = var.region
193+
assume_role_with_web_identity {
194+
role_arn = var.aws_role
195+
web_identity_token = var.aws_token
199196
}
197+
}
200198
}
201199
```
202200

@@ -214,27 +212,27 @@ Next, add a `store` block to your deployment configuration file to access the va
214212

215213
```hcl
216214
store "varset" "tokens" {
217-
name = "Example_Varset_Name"
215+
name = "Example_Varset_Name"
218216
category = "env"
219217
}
220218
```
221219

222220
</CodeBlockConfig>
223221

224-
Once defined, your deployments can access your variable sets values. In the following example, the `test` deployment uses the `tokens` store to access the variable set named `Example_Varset_Name`:
222+
Once defined, your deployments can access your variable set's values. In the following example, the `test` deployment uses the `tokens` store to access the variable set named `Example_Varset_Name`:
225223

226224
<CodeBlockConfig filename="deployments.tfdeploy.hcl">
227225

228226
```hcl
229227
store "varset" "tokens" {
230-
name = "Example_Varset_Name"
228+
name = "Example_Varset_Name"
231229
category = "env"
232230
}
233231
234232
deployment "test" {
235233
inputs = {
236-
access_key = store.varset.tokens.AWS_ACCESS_KEY_ID
237-
secret_key = store.varset.tokens.AWS_SECRET_ACCESS_KEY
234+
access_key = store.varset.tokens.AWS_ACCESS_KEY_ID
235+
secret_key = store.varset.tokens.AWS_SECRET_ACCESS_KEY
238236
session_token = store.varset.tokens.AWS_SESSION_TOKEN
239237
}
240238
}
@@ -249,22 +247,22 @@ After defining a `store` block, deployments can reference specific values from t
249247
```hcl
250248
variable "access_key" {
251249
description = "AWS access key"
252-
type = string
253-
ephemeral = true
250+
type = string
251+
ephemeral = true
254252
}
255253
256254
variable "secret_key" {
257255
description = "AWS sensitive secret key."
258-
type = string
259-
sensitive = true
260-
ephemeral = true
256+
type = string
257+
sensitive = true
258+
ephemeral = true
261259
}
262260
263261
variable "session_token" {
264262
description = "AWS session token."
265-
type = string
266-
sensitive = true
267-
ephemeral = true
263+
type = string
264+
sensitive = true
265+
ephemeral = true
268266
}
269267
270268
required_providers {
@@ -278,15 +276,13 @@ provider "aws" "this" {
278276
config {
279277
access_key = var.access_key
280278
secret_key = var.secret_key
281-
token = var.session_token
279+
token = var.session_token
282280
}
283281
}
284282
```
285283

286284
</CodeBlockConfig>
287285

288-
289286
By default, Stacks deployments do not save the values of variable sets into their state, because variable set values usually include sensitive data, such as passwords or API keys. For variables that need to persist in your deployment state, such as license keys, you can use the `stable` keyword. To learn more, refer to [Persist store values for deployments](/terraform/language/block/stack/deploy/store#persist-store-values-for-deployments).
290287

291-
292288
For more information and examples about the `store` block, refer to the [`store` block reference](/terraform/language/block/stack/deploy/store).

content/terraform/v1.13.x/docs/language/stacks/deploy/config.mdx

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Learn how to write Stack deployment configuration files to define h
55

66
# Define deployment configuration
77

8-
In Stacks, deployments let you replicate infrastructure across multiple environments, regions, or accounts. Each deployment has in its own isolated state, ensuring that changes in one deployment do not affect others. Learn how to write a deployment configuration to define how HCP Terraform deploys your infrastructure.
8+
In Stacks, deployments let you replicate infrastructure across multiple environments, regions, or accounts. Each deployment has its own isolated state, ensuring that changes in one deployment do not affect others. Learn how to write a deployment configuration to define how HCP Terraform deploys your infrastructure.
99

1010
## Background
1111

@@ -22,7 +22,7 @@ You can also create deployment groups to define rules that let you auto-approve
2222

2323
## Write a deployment configuration file
2424

25-
Deployment configuration files live at the top level of your repository and use the `.tfdeploy.hcl` file extension. We recommend naming your deployments file `deployments.tfdeploy.hcl`.
25+
Deployment configuration files live at the top level of your repository and use the `.tfdeploy.hcl` file extension. You can organize your deployment configuration into multiple files, as in traditional Terraform configurations.
2626

2727
You can define the following blocks in deployment configuration files to support setting up your Stack's deployments:
2828

@@ -149,6 +149,8 @@ To learn more about the `identity_token` block, refer to the [`identity_token` b
149149

150150
## Automatically approve deployment runs
151151

152+
@include 'premium-deployment-groups.mdx'
153+
152154
You can create deployment groups to define rules that let you auto-approve deployment runs that match your specified criteria.
153155

154156

@@ -158,7 +160,6 @@ Deployment groups only support one deployment per group at this time.
158160

159161
</Note>
160162

161-
162163
Define a `deployment_group` block to create a new group, and specify the auto-approve rules that deployment group enforces. In the following example, the `production` deployment group enforces the `no_destroys` rule:
163164

164165
<CodeBlockConfig filename="deployments.tfdeploy.hcl">
Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
page_title: Stack configuration files for Terraform
3+
description: |-
4+
Learn about the new general release of Stacks and how to migrate from the beta to the general release.
5+
---
6+
7+
# Move from Stacks beta to general availability
8+
9+
The GA release of Stacks introduces several new features and improvements.
10+
11+
## Terraform CLI changes
12+
13+
During the Stacks beta, you could initialize your Stack using the `terraform-stacks-cli`. The separate `terraform-stacks-cli` is now deprecated. To provide a more unified experience, all Stacks commands are now in the main Terraform CLI as a new subcommand: `terraform stacks`. You can now manage all of your Terraform Stack operations from a single tool, streamlining your workflow. To learn more, refer to [the `terraform stacks` CLI commands](/terraform/cli/commands/stacks).
14+
15+
## Language changes
16+
17+
The general availability release of Stacks introduced a few backward-incompatible syntax changes to the Stacks language:
18+
19+
- Syntax change for deployment groups and auto-approval:
20+
- The `auto_approve`, `orchestrate`, and `replan` blocks for orchestration rule are now deprecated.
21+
- The `auto_approve` block is replaced by a new auto_approve_checks argument on the deployment_group block. The new `deployment_group` syntax lets you define auto-approval rules directly within your custom deployment groups, giving you more granular control. [Learn more about defining conditions for your deployment runs](/terraform/language/stacks/deploy/conditions).
22+
- Stacks no longer support the `<NAME>.tfstack.hcl` file extension.
23+
- The new extension for configuring your Stack components is `<NAME>.tfcomponent.hcl`. The file name change better reflects the mental model of a component-based configuration.
24+
25+
## Billing Changes
26+
27+
The Stacks public beta did not count toward your HCP Terraform organization's Resources Under Management (RUM). With the GA release, Stacks RUM is aggregated with your workspace RUM for billing purposes.
28+
29+
### Billing Dashboard
30+
31+
The HCP Terraform usage page has been updated to reflect the new billing metrics, including:
32+
33+
- **Billable Managed Resources** displays the sum of your total Stacks and total workspace RUM.
34+
- **Total Applies** displays the sum of your total Stacks and workspace applies.
35+
- **Applies this month** displays the Stacks and workspace applies this month.
36+
- **Billable Stack Resources** displays the sum of your total Stacks RUM.
37+
38+
For more information on billing, refer to the [HCP Terraform pricing page](https://www.hashicorp.com/en/pricing).
39+
40+
## Steps for migration
41+
42+
If you used Stacks during the public beta, you need to take a few steps to transition your existing configurations to the GA release.
43+
44+
<Note>
45+
46+
After the release of Stacks in general availability, your existing beta configurations and state history are no longer available.
47+
48+
</Note>
49+
50+
### Update your configuration files
51+
52+
Perform the following updates to your Stack configuration files to use the new `tfcomponent.hcl` file extension and the new syntax for deployment groups and auto-approval rules:
53+
54+
1. Rename all of your `<NAME>.tfstack.hcl` files to `<NAME>.tfcomponent.hcl`. For example you could run the following command to rename your file:
55+
56+
<CodeBlockConfig>
57+
58+
```shell-session
59+
$ mv my_stack.tfstack.hcl my_stack.tfcomponent.hcl
60+
```
61+
62+
</CodeBlockConfig>
63+
64+
2. Update your configuration files to use the new `deployment_group` syntax for auto-approval. For example, the following code snippet uses the deprecated `orchestrate` block:
65+
66+
<CodeBlockConfig>
67+
68+
```hcl
69+
orchestrate "auto_approve" "no_destroy" {
70+
check {
71+
condition = context.plan.changes.remove == 0
72+
reason = "Plan destroys ${context.plan.changes.remove} resources."
73+
}
74+
}
75+
```
76+
77+
</CodeBlockConfig>
78+
79+
You can rewrite your auto-approval rules using the `deployment_auto_approve` block to define your rules, then attaching those rules to deployment groups using the `auto_approve_checks` argument. The following example rewrites the `auto_approve` rule using deployment groups:
80+
81+
<CodeBlockConfig filename="deployments.tfdeploy.hcl">
82+
83+
```hcl
84+
deployment "my_deployment" {
85+
inputs = {
86+
# ...
87+
}
88+
deployment_group = deployment_group.my_custom_group
89+
}
90+
91+
deployment_group "my_custom_group" {
92+
auto_approve_checks = [
93+
deployment_auto_approve.no_destroy
94+
]
95+
}
96+
97+
deployment_auto_approve "no_destroy" {
98+
check {
99+
condition = context.plan.changes.remove == 0
100+
reason = "Plan destroys ${context.plan.changes.remove} resources."
101+
}
102+
}
103+
```
104+
105+
</CodeBlockConfig>
106+
107+
For more information about deployment groups and auto-approval rules, refer to [Defining conditions for your deployment runs](/terraform/language/stacks/deploy/conditions).
108+
109+
### Fetch your configuration
110+
111+
Trigger a new configuration fetch for each of your Stacks. The fetching process pulls your configuration from your Version Control System (VCS) and reinitializes your Stack. You can do this by using the [`terraform stacks fetch`](/terraform/cli/commands/stacks/configuration/fetch) command in the new CLI, or by triggering a deployment run in the HCP Terraform UI.

0 commit comments

Comments
 (0)