chore: remove coder_secret Terraform integration#25512
Merged
Merged
Conversation
Docs preview📖 View docs preview for |
zedkipp
force-pushed
the
zedkipp/remove-coder-secret-integration
branch
from
May 19, 2026 22:32
167c98f to
d7d4e0a
Compare
…rm (#24542)" This reverts commit 79735f2, with two deliberate carve-outs that are unrelated to the Terraform integration being removed: - Keep the variadic `mutators` parameter on `dbgen.UserSecret`. It is a test-utility ergonomic improvement, used by user-secret telemetry tests added in #24854, and is independent of the proto/Terraform work being reverted. - Keep the authorization check in `dbauthz.ListUserSecretsWithValues` against `rbac.ResourceUserSecret` rather than rolling it back to `rbac.ResourceSystem`. The user-secret CRUD methods, all kept, already authorize against `rbac.ResourceUserSecret.WithOwner(...)`, so checking the bare resource here keeps the boundary consistent with the rest of the user-secrets feature. Current callers (`coderd/agentapi/manifest.go` via `AsSystemRestricted`) still satisfy the check via `ResourceWildcard:read` on the system role. Co-authored-by: Coder Agents <agents@coder.com>
…1.18 The preceding revert of #24542 removed the proto fields that carried user secret values from coderd through the provisioner chain. The revert as generated by 'git revert' also rolled `CurrentMinor` back from 17 to 16, which is incorrect: v1.17 has been shipped (v2.33.x), so we must not reuse that version label for a different contract. This commit: - Restores `reserved 12;` in `provisionerd.AcquiredJob.WorkspaceBuild` and `reserved 7;` in `provisionersdk.PlanRequest` so the field numbers cannot be reused. Mirrors the pattern from #21706, which removed `stop_modules` from `CompletedJob`. - Restores the v1.17 entry in the version history comment block, documenting what shipped, and adds a v1.18 entry that documents the removal. - Bumps `CurrentMinor` to 18 and updates the affected CLI golden file accordingly. User secrets are still delivered to running workspaces via the agent manifest path (#24252/#24313), which is independent of the provisioner proto. Co-authored-by: Coder Agents <agents@coder.com>
Two minor lint failures surfaced by 'make lint' after the revert series:
- coderd/dynamicparameters/resolver_test.go: replaces two pre-existing
emdashes (in comments restored by the revert of #24785) with commas,
matching the form on origin/main. Required by 'make lint/emdash'.
- coderd/usersecrets.go: trims two trailing blank lines left over from
the conflict resolution in the revert of #24786. Required by
goimports / trailing-whitespace lint.
Co-authored-by: Coder Agents <agents@coder.com>
zedkipp
force-pushed
the
zedkipp/remove-coder-secret-integration
branch
from
May 19, 2026 23:01
d7d4e0a to
d9dd002
Compare
zedkipp
commented
May 19, 2026
| const ( | ||
| CurrentMajor = 1 | ||
| CurrentMinor = 17 | ||
| CurrentMinor = 18 |
Contributor
Author
There was a problem hiding this comment.
For reviewers: changes are almost entirely deletions/reverts with the exception of the provisioner proto changes.
dylanhuff-at-coder
approved these changes
May 21, 2026
dylanhuff-at-coder
left a comment
Contributor
There was a problem hiding this comment.
Mentioned in a DM, but of the three reverting PRs you are merging, I think we should do this one first since the code removed here depends on the others
Other two PRs for reference:
https://github.com/coder/terraform-provider-coder/pull/512
coder/preview#212
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the coder_secret Terraform integration: the data.coder_secret consumption path through provisionerdserver → provisioner.proto → provisioner/terraform, the dynamic-parameter secret-requirement validation, and the workspace-update / resolve-autostart surfaces that depended on it. This is being done due to a product/feature direction change (see https://linear.app/codercom/issue/PLAT-243). User-secret CRUD (DB, REST, CLI, UI, telemetry, audit) and the agent-manifest secret-injection path are untouched.
The provisionerd API is bumped from v1.17 to v1.18 rather than rolled back: v1.17 shipped in v2.33.x, so user_secrets field numbers are reserved and the changelog documents both versions.
Commit map
Six reverse-chronological reverts, a deliberate proto bump, and a lint fixup.
Generated with assistance from Coder Agents.