Skip to content

Add WriteOnly context_wo support for ephemeral resources #626

@mcanevet

Description

@mcanevet

Description

Add support for a context_wo (write-only) attribute in VM instances to handle sensitive ephemeral data that should not be persisted in Terraform state.

Use Case

When using ephemeral providers (like Vault, AWS Secrets Manager, etc.) to inject sensitive credentials into VM context, these values should not be stored in the Terraform state file. The context_wo attribute would allow passing sensitive data to VMs while ensuring it's never persisted.

Example use case:

resource "opennebula_virtual_machine" "vm" {
  name = "secure-vm"
  
  context = {
    NETWORK  = "YES"
    HOSTNAME = "vm-01"
  }
  
  context_wo = {
    # These values are passed to the VM but not stored in state
    API_KEY  = data.vault_generic_secret.api_key.data["value"]
    PASSWORD = random_password.db_password.result
  }
}

Benefits

  • Enhanced security: Sensitive values never written to state files
  • Compliance: Meets requirements for handling secrets
  • Compatibility: Works seamlessly with ephemeral/write-only providers

Implementation Requirements

  • Upgrade terraform-plugin-sdk/v2 to a version supporting WriteOnly attributes
  • Merge context_wo with context during VM operations
  • Ensure context_wo values are never read from or persisted to state

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions