Terraform
Description
The Terraform crawler looks recursively for every .terraform.lock.hcl file from a root directory, and updates each provider pinned in it.
Providers are read from the lock file rather than from required_providers blocks, so a module with no lock file yields nothing. Run terraform init first if that is the case.
This crawler is enabled by default, so it can be used either automatically by running updatecli diff from a directory containing the files to update, or by providing a manifest.
The automatic discovery behavior can be tuned by providing a YAML manifest with a terraform crawler in top-level directive autodiscovery as explained in the "Autodiscovery" page.
Generated manifests
Automation is done by using two resources: terraform/registry as the source and
terraform/lock as the target.
The version filter is narrowed per provider from the version currently locked, so a provider on 5.30.0 is filtered with >=5.30.0.
Platforms
A Terraform lock file records a checksum per target platform, and the target has to refresh all of them or terraform init will fail on the platforms left behind.
Use platforms to declare which ones to request. When unset, Updatecli falls back to linux_amd64, linux_arm64, darwin_amd64, and darwin_arm64.
Important | The checksums written back cover exactly the platforms requested. If your lock file needs a platform outside the fallback list, such as windows_amd64, list every platform you require explicitly. |
Manifest
Parameters
| Name | Type | Description | Required |
|---|---|---|---|
| ignore | array | “ignore” defines rules to exclude matching Terraform providers from the autodiscovery. remark:
| |
| path | string | “path” defines a “.terraform.lock.hcl” path pattern. remark:
| |
| providers | object | “providers” defines the Terraform providers to match, keyed by provider address as written in “.terraform.lock.hcl”. remark:
example: | |
| only | array | “only” defines rules to restrict the autodiscovery to matching Terraform providers. remark:
| |
| path | string | “path” defines a “.terraform.lock.hcl” path pattern. remark:
| |
| providers | object | “providers” defines the Terraform providers to match, keyed by provider address as written in “.terraform.lock.hcl”. remark:
example: | |
| platforms | array | “platforms” defines the target platforms to request provider checksums for. default: | |
| rootdir | string | “rootdir” defines the directory where the crawler starts searching for “.terraform.lock.hcl” files. default: the scm directory when “scmid” is set, otherwise the directory relative paths resolve from, by default the working directory. remark:
| |
| versionfilter | object | “versionfilter” defines the version filter used by the generated manifests. default: kind “semver” with pattern “*”, any version greater than or equal to the current one. remark:
example: | |
| kind | string | “kind” defines the versioning scheme used to select a version. default: latest remark:
example:
| |
| pattern | string | “pattern” defines the version pattern, according to “kind”. default:
remark:
example:
| |
| regex | string | “regex” defines the regular expression extracting the version from each entry. remark:
example:
| |
| replaceall | object | “replaceall” applies a regular expression replacement to each version before filtering. remark:
example: turns “curl-8_15_0” into “curl-8.15.0”. | |
| pattern | string | “pattern” defines the regular expression matching the text to replace. example:
| |
| replacement | string | “replacement” defines the text replacing each match of “pattern”. remark:
example:
| |
| strict | boolean | “strict” enforces strict semantic versioning rules when parsing versions. default: false remark:
|
Example
# updatecli.d/default.yaml
name: "Terraform autodiscovery using git scm"
scms:
default:
kind: git
spec:
url: https://github.com/updatecli-test/jenkins-infra-aws.git
branch: main
autodiscovery:
# scmid is applied to all crawlers
scmid: default
crawlers:
terraform:
# platforms to request package checksums for, defaults to:
platforms:
- linux_amd64
- linux_arm64
- darwin_amd64
- darwin_arm64
# To ignore specific path
#ignore:
# - path: <filepath relative to scm repository>
# - providers:
# # Ignoring provider updates for this provider
# registry.terraform.io/hashicorp/aws:
# # Ignore provider updates for this version
# registry.terraform.io/hashicorp/kubernetes: "1.x"
ignore:
# - path: <filepath relative to scm repository>
# - providers:
# # Ignoring provider updates for this provider
# registry.terraform.io/hashicorp/aws:
# # Ignore provider updates for this version
# registry.terraform.io/hashicorp/kubernetes: "1.x"