Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
a7259ff
first steps for kms key-ring resource and datasource
ruslan-18 Jul 1, 2025
6f6d063
define model, implement Metadata, Configure, Schema and Create method…
ruslan-18 Jul 11, 2025
5b59eb6
Merge branch 'main' into kms-integration
ruslan-18 Jul 11, 2025
185fed5
Merge branch 'main' into kms-integration
ruslan-18 Jul 16, 2025
6bcc14a
PR comments, fix region logic, add example, add datasource, add examp…
ruslan-18 Jul 28, 2025
d320073
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Jul 28, 2025
bcd0528
first steps for kms key-ring resource and datasource
ruslan-18 Jul 1, 2025
99e2b7f
define model, implement Metadata, Configure, Schema and Create method…
ruslan-18 Jul 11, 2025
8c654ad
PR comments, fix region logic, add example, add datasource, add examp…
ruslan-18 Jul 28, 2025
219adac
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Jul 28, 2025
1186cee
PR comments, fix region logic, add example, add datasource, add examp…
ruslan-18 Jul 28, 2025
cb23a4e
PR comments, fix region logic, add example, add datasource, add examp…
ruslan-18 Jul 28, 2025
8d0da16
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Jul 28, 2025
2732c4a
add missing resources and unit tests
ruslan-18 Aug 8, 2025
b483c13
Merge branch 'main' into kms-integration
ruslan-18 Aug 8, 2025
248748e
add missing examples and docs
ruslan-18 Aug 8, 2025
d41ad9d
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Aug 8, 2025
77a623e
fix linter findings
ruslan-18 Aug 8, 2025
7df0307
Merge branch 'main' into kms-integration
ruslan-18 Aug 8, 2025
d87d60f
update docs
ruslan-18 Aug 8, 2025
438da14
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Aug 8, 2025
889b222
update kms client config
ruslan-18 Aug 8, 2025
0ce560c
(wip) some PR comment fixes, Key Ring Acceptance Test
ruslan-18 Sep 23, 2025
cd6f006
Merge branch 'main' into kms-integration
ruslan-18 Oct 14, 2025
7c0e4b2
updated doc, datasources and acceptance tests
ruslan-18 Oct 14, 2025
170e000
Merge remote-tracking branch 'origin/kms-integration' into kms-integr…
ruslan-18 Oct 14, 2025
d4aad10
updated doc, datasources and acceptance tests
ruslan-18 Oct 14, 2025
96e695d
docs and go.sum
ruslan-18 Oct 14, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions docs/data-sources/kms_key.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_key Data Source - stackit"
subcategory: ""
description: |-
KMS Key resource schema. Must have a region specified in the provider configuration.
---

# stackit_kms_key (Data Source)

KMS Key resource schema. Must have a `region` specified in the provider configuration.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In all three data sources the examples are missing. Please add them in examples/data-sources/<data-source-name>/data-source.tf like you did it for the resources



<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
- `display_name` (String) The display name to distinguish multiple keys
- `import_only` (Boolean) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
- `key_id` (String)
- `key_ring_id` (String) The ID of the associated key ring
- `project_id` (String) STACKIT project ID to which the key ring is associated.
- `protection` (String) The underlying system that is responsible for protecting the key material. Currently only software is accepted.
- `purpose` (String) The purpose for which the key will be used

### Optional

- `access_scope` (String) The access scope of the key. Default is PUBLIC.
- `description` (String) A user chosen description to distinguish multiple keys
- `region` (String) The resource region. If not defined, the provider region is used.

### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
28 changes: 28 additions & 0 deletions docs/data-sources/kms_key_ring.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_key_ring Data Source - stackit"
subcategory: ""
description: |-
KMS Key Ring resource schema.
---

# stackit_kms_key_ring (Data Source)

KMS Key Ring resource schema.



<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `key_ring_id` (String) An auto generated unique id which identifies the key ring.
- `project_id` (String) STACKIT project ID to which the key ring is associated.

### Read-Only

- `description` (String) A user chosen description to distinguish multiple key rings.
- `display_name` (String) A user chosen description to distinguish multiple key rings.
- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
- `region` (String) The resource region. If not defined, the provider region is used.
36 changes: 36 additions & 0 deletions docs/data-sources/kms_wrapping_key.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_wrapping_key Data Source - stackit"
subcategory: ""
description: |-
KMS Key resource schema. Must have a region specified in the provider configuration.
---

# stackit_kms_wrapping_key (Data Source)

KMS Key resource schema. Must have a `region` specified in the provider configuration.



<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
- `display_name` (String) The display name to distinguish multiple keys
- `key_ring_id` (String) The ID of the associated key ring
- `project_id` (String) STACKIT project ID to which the key ring is associated.
- `protection` (String) The underlying system that is responsible for protecting the key material. Currently only software is accepted.
- `purpose` (String) The purpose for which the key will be used
- `wrapping_key_id` (String)

### Optional

- `access_scope` (String) The access scope of the key. Default is PUBLIC.
- `description` (String) A user chosen description to distinguish multiple keys
- `region` (String) The resource region. If not defined, the provider region is used.

### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
1 change: 1 addition & 0 deletions docs/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ Note: AWS specific checks must be skipped as they do not work on STACKIT. For de
- `experiments` (List of String) Enables experiments. These are unstable features without official support. More information can be found in the README. Available Experiments: iam, routing-tables, network
- `git_custom_endpoint` (String) Custom endpoint for the Git service
- `iaas_custom_endpoint` (String) Custom endpoint for the IaaS service
- `kms_custom_endpoint` (String) Custom endpoint for the KMS service
- `loadbalancer_custom_endpoint` (String) Custom endpoint for the Load Balancer service
- `logme_custom_endpoint` (String) Custom endpoint for the LogMe service
- `mariadb_custom_endpoint` (String) Custom endpoint for the MariaDB service
Expand Down
50 changes: 50 additions & 0 deletions docs/resources/kms_key.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_key Resource - stackit"
subcategory: ""
description: |-
KMS Key resource schema. Must have a region specified in the provider configuration.
---

# stackit_kms_key (Resource)

KMS Key resource schema. Must have a `region` specified in the provider configuration.

## Example Usage

```terraform
resource "stackit_kms_key" "name" {
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
import_only = false
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
- `display_name` (String) The display name to distinguish multiple keys
- `key_ring_id` (String) The ID of the associated key ring
- `project_id` (String) STACKIT project ID to which the key ring is associated.
- `protection` (String) The underlying system that is responsible for protecting the key material. Currently only software is accepted.
- `purpose` (String) The purpose for which the key will be used

### Optional

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding the api spec access_scope is missing

- `access_scope` (String) The access scope of the key. Default is PUBLIC.
- `description` (String) A user chosen description to distinguish multiple keys
- `region` (String) The resource region. If not defined, the provider region is used.

### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
- `import_only` (Boolean) Specifies if the the key should be import_only
- `key_id` (String) The ID of the key
40 changes: 40 additions & 0 deletions docs/resources/kms_key_ring.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_key_ring Resource - stackit"
subcategory: ""
description: |-
KMS Key Ring resource schema. Must have a region specified in the provider configuration.
---

# stackit_kms_key_ring (Resource)

KMS Key Ring resource schema. Must have a `region` specified in the provider configuration.

## Example Usage

```terraform
resource "stackit_kms_key_ring" "example" {
description = "example description"
display_name = "example name"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
region_id = "eu01"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `display_name` (String) A user chosen description to distinguish multiple key rings.
- `project_id` (String) STACKIT project ID to which the key ring is associated.

### Optional

- `description` (String) A user chosen description to distinguish multiple key rings.
- `region` (String) The resource region. If not defined, the provider region is used.

### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`key_ring_id`".
- `key_ring_id` (String) An auto generated unique id which identifies the key ring.
49 changes: 49 additions & 0 deletions docs/resources/kms_wrapping_key.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "stackit_kms_wrapping_key Resource - stackit"
subcategory: ""
description: |-
KMS Key resource schema. Must have a region specified in the provider configuration.
---

# stackit_kms_wrapping_key (Resource)

KMS Key resource schema. Must have a `region` specified in the provider configuration.

## Example Usage

```terraform
resource "stackit_kms_wrapping_key" "name" {
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `algorithm` (String) The encryption algorithm that the key will use to encrypt data
- `display_name` (String) The display name to distinguish multiple keys
- `key_ring_id` (String) The ID of the associated key ring
- `project_id` (String) STACKIT project ID to which the key ring is associated.
- `protection` (String) The underlying system that is responsible for protecting the key material. Currently only software is accepted.
- `purpose` (String) The purpose for which the key will be used

### Optional

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

access_scope is missing

- `access_scope` (String) The access scope of the key. Default is PUBLIC.
- `description` (String) A user chosen description to distinguish multiple keys
- `region` (String) The resource region. If not defined, the provider region is used.

### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`instance_id`".
- `import_only` (Boolean)
- `wrapping_key_id` (String) The ID of the wrapping key
10 changes: 10 additions & 0 deletions examples/resources/stackit_kms_key/resource.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
resource "stackit_kms_key" "name" {
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
import_only = false
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
Comment on lines +2 to +9
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We usually have the project_id and depending ids, like in this case key_ring_id at the top of the example. And for the basic example we only set the required fields.

Suggested change
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
import_only = false
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
algorithm = "example algorithm"
backend = "software"
description = "example description"
display_name = "example name"
purpose = "example purpose"

If you want you can also add an additional example, where the stackit_kms_key resource is used together with stackit_kms_key_ring, but this is not necessary. If you add it, please add a comment to indicate, that it's a different example

}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add an example how the resource can be imported, like we have it here

# Only use the import statement, if you want to import an existing ske cluster
import {
to = stackit_ske_cluster.import-example
id = "${var.project_id},${var.region},${var.ske_name}"
}

6 changes: 6 additions & 0 deletions examples/resources/stackit_kms_key_ring/resource.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
resource "stackit_kms_key_ring" "example" {
description = "example description"
display_name = "example name"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
region_id = "eu01"
}
Comment on lines +2 to +6
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change also the order here, so that project_id is first and remove region_id. Also add an import example

Suggested change
description = "example description"
display_name = "example name"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
region_id = "eu01"
}
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
description = "example description"
display_name = "example name"
}

9 changes: 9 additions & 0 deletions examples/resources/stackit_kms_wrapping_key/resource.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
resource "stackit_kms_wrapping_key" "name" {
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
Comment on lines +2 to +8
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change the order, so that project_id and key_ring_id are first. And add an import example

Suggested change
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
purpose = "example purpose"
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
algorithm = "example algorithm"
backend = "software"
description = "new descr"
display_name = "example name"
purpose = "example purpose"

}
3 changes: 2 additions & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ require (
github.com/stackitcloud/stackit-sdk-go/services/git v0.8.0
github.com/stackitcloud/stackit-sdk-go/services/iaas v0.31.0
github.com/stackitcloud/stackit-sdk-go/services/iaasalpha v0.1.21-alpha
github.com/stackitcloud/stackit-sdk-go/services/kms v1.0.0
github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.6.0
github.com/stackitcloud/stackit-sdk-go/services/logme v0.25.1
github.com/stackitcloud/stackit-sdk-go/services/mariadb v0.25.1
Expand Down Expand Up @@ -80,7 +81,7 @@ require (
github.com/mitchellh/go-wordwrap v1.0.0 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/oklog/run v1.1.0 // indirect
github.com/oklog/run v1.2.0 // indirect
github.com/rogpeppe/go-internal v1.13.1 // indirect
github.com/stackitcloud/stackit-sdk-go/services/authorization v0.9.0
github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
Expand Down
6 changes: 4 additions & 2 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -137,8 +137,8 @@ github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyua
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
github.com/oklog/run v1.2.0 h1:O8x3yXwah4A73hJdlrwo/2X6J62gE5qTMusH0dvz60E=
github.com/oklog/run v1.2.0/go.mod h1:mgDbKRSwPhJfesJ4PntqFUbKQRZ50NgmZTSPlFA0YFk=
github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
Expand Down Expand Up @@ -166,6 +166,8 @@ github.com/stackitcloud/stackit-sdk-go/services/iaas v0.31.0 h1:dnEjyapuv8WwRN5v
github.com/stackitcloud/stackit-sdk-go/services/iaas v0.31.0/go.mod h1:854gnLR92NvAbJAA1xZEumrtNh1DoBP1FXTMvhwYA6w=
github.com/stackitcloud/stackit-sdk-go/services/iaasalpha v0.1.21-alpha h1:m1jq6a8dbUe+suFuUNdHmM/cSehpGLUtDbK1CqLqydg=
github.com/stackitcloud/stackit-sdk-go/services/iaasalpha v0.1.21-alpha/go.mod h1:Nu1b5Phsv8plgZ51+fkxPVsU91ZJ5Ayz+cthilxdmQ8=
github.com/stackitcloud/stackit-sdk-go/services/kms v1.0.0 h1:zxoOv7Fu+FmdsvTKiKkbmLItrMKfL+QoVtz9ReEF30E=
github.com/stackitcloud/stackit-sdk-go/services/kms v1.0.0/go.mod h1:KEPVoO21pC4bjy5l0nyhjUJ0+uVwVWb+k2TYrzJ8xYw=
github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.6.0 h1:q33ZaCBVEBUsnMDxYyuJKtJvGcE5nKgvuPed3s8zXNI=
github.com/stackitcloud/stackit-sdk-go/services/loadbalancer v1.6.0/go.mod h1:20QOZ3rBC9wTGgzXzLz9M6YheX0VaxWE0/JI+s8On7k=
github.com/stackitcloud/stackit-sdk-go/services/logme v0.25.1 h1:hv5WrRU9rN6Jx4OwdOGJRyaQrfA9p1tzEoQK6/CDyoA=
Expand Down
1 change: 1 addition & 0 deletions stackit/internal/core/core.go
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ type ProviderData struct {
DnsCustomEndpoint string
GitCustomEndpoint string
IaaSCustomEndpoint string
KMSCustomEndpoint string
LoadBalancerCustomEndpoint string
LogMeCustomEndpoint string
MariaDBCustomEndpoint string
Expand Down
Loading
Loading