-
Notifications
You must be signed in to change notification settings - Fork 57
Open
Description
Description
Add support for a context_wo (write-only) attribute in VM instances to handle sensitive ephemeral data that should not be persisted in Terraform state.
Use Case
When using ephemeral providers (like Vault, AWS Secrets Manager, etc.) to inject sensitive credentials into VM context, these values should not be stored in the Terraform state file. The context_wo attribute would allow passing sensitive data to VMs while ensuring it's never persisted.
Example use case:
resource "opennebula_virtual_machine" "vm" {
name = "secure-vm"
context = {
NETWORK = "YES"
HOSTNAME = "vm-01"
}
context_wo = {
# These values are passed to the VM but not stored in state
API_KEY = data.vault_generic_secret.api_key.data["value"]
PASSWORD = random_password.db_password.result
}
}Benefits
- Enhanced security: Sensitive values never written to state files
- Compliance: Meets requirements for handling secrets
- Compatibility: Works seamlessly with ephemeral/write-only providers
Implementation Requirements
- Upgrade terraform-plugin-sdk/v2 to a version supporting WriteOnly attributes
- Merge
context_wowithcontextduring VM operations - Ensure
context_wovalues are never read from or persisted to state
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels