@firestartr/cli 1.54.0-snapshot-1 → 1.54.0-snapshot-2

package/build/index.js

@@ -356807,10 +356807,6 @@ class SyncerInitializer extends InitializerPatches {
             const provider = helperCTX(ctx).provider;
             return claim.providers[provider].sync || {};
         }
-        function policyInfo(ctx) {
-            const provider = helperCTX(ctx).provider;
-            return claim.providers[provider].policy;
-        }
         return [
             {
                 validate(cr) {
@@ -356829,38 +356825,33 @@ class SyncerInitializer extends InitializerPatches {
                         if (!PERIOD_VALIDATOR.test(cr.metadata.annotations['firestartr.dev/sync-period'])) {
                             throw `${this.identify()}: period incorrect '${cr.metadata.annotations['firestartr.dev/sync-period']}' for ${cr.kind}/${cr.metadata.name}`;
                         }
+                        return true;
                     }
                     else if (helperHasSyncSchedule(cr)) {
                         if (!catalog_common.cron.isValidCron(cr.metadata.annotations[SYNC_SCHED_ANNOTATION])) {
                             throw `${this.identify()}: sync-schedule: cron incorrect '${cr.metadata.annotations[SYNC_SCHED_ANNOTATION]}' for ${cr.kind}/${cr.metadata.name}`;
                         }
                     }
-                    return true;
+                    else {
+                        return true;
+                    }
                 },
                 apply(cr) {
-                    cr.metadata.annotations = cr.metadata.annotations || {};
-                    // Apply general policy annotation
-                    const policy = policyInfo(this);
-                    // Default to 'apply' for GitHub resources when no policy is specified
-                    const provider = helperCTX(this).provider;
-                    const defaultPolicy = provider === 'github' ? 'apply' : undefined;
-                    if (policy) {
-                        cr.metadata.annotations['firestartr.dev/policy'] = policy;
-                    }
-                    else if (defaultPolicy) {
-                        cr.metadata.annotations['firestartr.dev/policy'] = defaultPolicy;
-                    }
                     if (syncInfo(this).enabled) {
+                        cr.metadata.annotations = cr.metadata.annotations || {};
                         cr.metadata.annotations['firestartr.dev/sync-enabled'] = 'true';
                         if (syncInfo(this).period) {
+                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations['firestartr.dev/sync-period'] =
                                 syncInfo(this).period;
                         }
                         if (syncInfo(this).policy) {
+                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations['firestartr.dev/sync-policy'] =
                                 syncInfo(this).policy;
                         }
                         if (syncInfo(this).schedule) {
+                            cr.metadata.annotations = cr.metadata.annotations || {};
                             cr.metadata.annotations[SYNC_SCHED_ANNOTATION] =
                                 syncInfo(this).schedule;
                             cr.metadata.annotations[SYNC_SCHED_TIMEZONE_ANNOTATION] =
@@ -357054,6 +357045,7 @@ class FirestartrAllClaim {
 
 
 
+
 class RefValuesNormalizer extends Normalizer {
     constructor() {
         super(...arguments);
@@ -357093,6 +357085,14 @@ providerValues, resolveRef, references = new Map()) {
     for (const key in providerValues) {
         values[key] = await interpolateObject(providerValues[key], references, resolveRef);
     }
+    let secretRefCount = 0;
+    for (const key in providerValues) {
+        if (isRepoSecretRef(providerValues[key])) {
+            values[key] = await interpolateSecretClaimRef(providerValues[key], references, 
+            // closure to increase the refCount and avoid collision
+            () => secretRefCount++);
+        }
+    }
     return { values, references: Array.from(updatedReferences.values()) };
 }
 async function interpolateObject(toInterpolate, references, resolveRef) {
@@ -357162,6 +357162,40 @@ async function replaceReferencesValues(contents, references, resolveRef) {
     }
     return replacedContent;
 }
+async function interpolateSecretClaimRef(secretClaimRef, references, getSecretRefCountF) {
+    const extractedSecretClaimRef = {
+        ...extractRepoSecretRef(secretClaimRef),
+        // force the kind to ALWAYS be a Secret
+        kind: 'Secret',
+    };
+    // has already been visited
+    const alreadyPresentKey = findSecretKey(extractedSecretClaimRef, references);
+    if (alreadyPresentKey)
+        return alreadyPresentKey;
+    // new reference we have to build it
+    const secretClaimRefInternalKey = `secret-ref-${getSecretRefCountF()}`;
+    // we set the secret value
+    references.set(secretClaimRefInternalKey, {
+        name: secretClaimRefInternalKey,
+        ref: extractedSecretClaimRef,
+    });
+    return secretClaimRefInternalKey;
+}
+function findSecretKey(secretClaimRef, references) {
+    const entry = Array.from(references.entries()).find(([, value]) => {
+        // Destructure the entry to easily access the value.
+        // Check if the value is an object and matches all properties.
+        return (typeof value === 'object' &&
+            value !== null &&
+            value.ref !== null &&
+            typeof value.ref === 'object' &&
+            value.ref.kind === secretClaimRef.kind &&
+            value.ref.name === secretClaimRef.name &&
+            value.ref.key === secretClaimRef.key);
+    });
+    // If a matching entry was found, return its key (the first element of the entry array).
+    return entry ? entry[0] : undefined;
+}
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/normalizers/RevisionNormalizer.ts
 
@@ -357293,14 +357327,20 @@ const kindMap = {
     secret: 'SecretsClaim',
     domain: 'DomainClaim',
 };
+// this function is intended to search for refs of the same kind
+// it is used to search for circular references (i.e. a reference to oneself)
+// to extract all type of references use extractAllRefs
 function extractRefs(renderClaims, kind) {
     const result = {};
     for (const key in renderClaims) {
         const claim = renderClaims[key].claim;
         let refs = [];
+        // for workspaces
+        let [tfWorkspaceRefs, secretsRefs] = [[], []];
         switch (kind) {
             case 'TFWorkspaceClaim':
-                refs = getTfWorkspacesRefs(claim.providers.terraform.values);
+                [tfWorkspaceRefs, secretsRefs] = getTfWorkspacesRefs(claim.providers.terraform.values);
+                refs = [...tfWorkspaceRefs];
                 break;
             case 'GroupClaim':
                 /**
@@ -357324,11 +357364,13 @@ function extractAllRefs(claimData) {
     refs.push(...extractVirtualRefs(parsedClaim));
     switch (parsedClaim.kind) {
         case 'TFWorkspaceClaim': {
-            const tfWorkspaceRefs = getTfWorkspacesRefs(parsedClaim.providers.terraform.values);
+            const [tfWorkspaceRefs, secretRefs] = getTfWorkspacesRefs(parsedClaim.providers.terraform.values);
             tfWorkspaceRefs.forEach((ref, idx, arr) => {
                 arr[idx] = `TFWorkspaceClaim-${ref}`;
             });
+            cdk8s_renderer_src_logger.debug(`Obtained the following secret refs for ${parsedClaim.kind}/${parsedClaim.name}: ${JSON.stringify(secretRefs)}`);
             refs.push(...tfWorkspaceRefs);
+            refs.push(...secretRefs);
             break;
         }
         case 'GroupClaim': {
@@ -357373,22 +357415,28 @@ function getGroupParentRef(parent, references = []) {
     }
     return references;
 }
-function getTfWorkspacesRefs(values, references = []) {
+function getTfWorkspacesRefs(values, references = [], secretsRefs = []) {
     const regex = catalog_common.types.regex.TFWorkspaceRefRegex;
     for (const key in values) {
         switch (typeof values[key]) {
             case 'object':
-                getTfWorkspacesRefs(values[key], references);
+                getTfWorkspacesRefs(values[key], references, secretsRefs);
                 break;
             case 'string':
+                // Extract all implicit refs
                 for (const match of values[key].matchAll(regex)) {
                     const [_, claimName] = match;
                     references.push(claimName);
                 }
+                // extract a secretsclaim ref
+                if (isRepoSecretRef(values[key])) {
+                    const secretRef = extractRepoSecretRef(values[key]);
+                    secretsRefs.push(`SecretsClaim-${secretRef.name}`);
+                }
                 break;
         }
     }
-    return references;
+    return [references, secretsRefs];
 }
 function getComponentVarsAndSecretsRefs(parsedClaim) {
     const refs = {};
@@ -357581,76 +357629,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
             },
             additionalProperties: false,
         },
-        PolicyType: {
-            $id: 'firestartr.dev://common/PolicyType',
-            type: 'string',
-            description: 'Policy for resource management',
-            enum: [
-                'apply',
-                'create-only',
-                'create-update-only',
-                'full-control',
-                'observe',
-                'observe-only',
-            ],
-        },
-    },
-});
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/base/schemas/sync-config.schema.ts
-/* harmony default export */ const sync_config_schema = ({
-    $id: 'SyncConfig',
-    definitions: {
-        SyncConfig: {
-            $id: 'firestartr.dev://common/SyncConfig',
-            type: 'object',
-            description: 'Sync configuration for resources',
-            properties: {
-                enabled: {
-                    type: 'boolean',
-                    description: 'Enable periodic sync operations',
-                },
-                period: {
-                    type: 'string',
-                    pattern: '^[0-9]+[smhd]$',
-                    description: 'Sync period (e.g., 1h, 30m, 5s). Must be enabled without schedule.',
-                },
-                schedule: {
-                    type: 'string',
-                    description: 'Cron schedule for sync operations. Must be enabled without period.',
-                },
-                schedule_timezone: {
-                    type: 'string',
-                    description: 'Timezone for cron schedule (e.g., UTC, America/New_York)',
-                },
-                policy: {
-                    type: 'string',
-                    description: 'Policy for sync operations (apply or observe)',
-                },
-            },
-            additionalProperties: false,
-            required: ['enabled'],
-            oneOf: [
-                {
-                    required: ['period'],
-                },
-                {
-                    required: ['schedule'],
-                },
-                {
-                    not: {
-                        anyOf: [
-                            {
-                                required: ['period'],
-                            },
-                            {
-                                required: ['schedule'],
-                            },
-                        ],
-                    },
-                },
-            ],
-        },
     },
 });
 
@@ -358011,9 +357989,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
-                        policy: {
-                            $ref: 'firestartr.dev://common/PolicyType',
-                        },
                         privacy: {
                             type: 'string',
                             enum: ['closed', 'secret'],
@@ -358024,9 +357999,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                         org: {
                             type: 'string',
                         },
-                        sync: {
-                            $ref: 'firestartr.dev://common/SyncConfig',
-                        },
                     },
                     required: ['org', 'privacy'],
                 },
@@ -358052,9 +358024,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
-                        policy: {
-                            $ref: 'firestartr.dev://common/PolicyType',
-                        },
                         role: {
                             type: 'string',
                             enum: ['admin', 'member'],
@@ -358062,9 +358031,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                         org: {
                             type: 'string',
                         },
-                        sync: {
-                            $ref: 'firestartr.dev://common/SyncConfig',
-                        },
                     },
                     required: ['org', 'role'],
                 },
@@ -358089,9 +358055,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
-                        policy: {
-                            $ref: 'firestartr.dev://common/PolicyType',
-                        },
                         org: {
                             type: 'string',
                             description: 'The github organization name',
@@ -358100,9 +358063,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             type: 'string',
                             enum: ['private', 'public', 'internal'],
                         },
-                        sync: {
-                            $ref: 'firestartr.dev://common/SyncConfig',
-                        },
                         features: {
                             type: 'array',
                             items: {
@@ -358138,9 +358098,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                 {
                     type: 'object',
                     properties: {
-                        policy: {
-                            $ref: 'firestartr.dev://common/PolicyType',
-                        },
                         orgName: {
                             type: 'string',
                             description: 'Organization name on GitHub',
@@ -358174,9 +358131,6 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                             },
                             required: ['url', 'contentType', 'events', 'secretRef'],
                         },
-                        sync: {
-                            $ref: 'firestartr.dev://common/SyncConfig',
-                        },
                     },
                     required: ['orgName', 'webhook'],
                 },
@@ -358348,7 +358302,15 @@ const GithubSchemas = [
                     type: 'object',
                     properties: {
                         policy: {
-                            $ref: 'firestartr.dev://common/PolicyType',
+                            type: 'string',
+                            enum: [
+                                'apply',
+                                'create-only',
+                                'create-update-only',
+                                'full-control',
+                                'observe',
+                                'observe-only',
+                            ],
                         },
                         name: {
                             type: 'string',
@@ -358358,7 +358320,47 @@ const GithubSchemas = [
                             enum: ['remote', 'inline', 'Remote', 'Inline'],
                         },
                         sync: {
-                            $ref: 'firestartr.dev://common/SyncConfig',
+                            type: 'object',
+                            properties: {
+                                enabled: {
+                                    type: 'boolean',
+                                },
+                                period: {
+                                    type: 'string',
+                                    pattern: '^[0-9]+[smhd]$',
+                                },
+                                schedule: {
+                                    type: 'string',
+                                },
+                                schedule_timezone: {
+                                    type: 'string',
+                                },
+                                policy: {
+                                    type: 'string',
+                                },
+                            },
+                            additionalProperties: false,
+                            required: ['enabled'],
+                            oneOf: [
+                                {
+                                    required: ['period'],
+                                },
+                                {
+                                    required: ['schedule'],
+                                },
+                                {
+                                    not: {
+                                        anyOf: [
+                                            {
+                                                required: ['period'],
+                                            },
+                                            {
+                                                required: ['schedule'],
+                                            },
+                                        ],
+                                    },
+                                },
+                            ],
                         },
                         valuesSchema: {
                             type: 'string',
@@ -358659,12 +358661,10 @@ const SecretsSchemas = [external_secrets_schema];
 
 
 
-
 const schemas = {
     root: root_schema,
     schemas: [
         common_meta_schema,
-        sync_config_schema,
         group_schema,
         user_schema,
         component_schema,
@@ -363508,6 +363508,8 @@ var FirestartrTerraformWorkspaceSpecReferencesRefKind;
     FirestartrTerraformWorkspaceSpecReferencesRefKind["FIRESTARTR_TERRAFORM_WORKSPACE"] = "FirestartrTerraformWorkspace";
     /** ExternalSecret */
     FirestartrTerraformWorkspaceSpecReferencesRefKind["EXTERNAL_SECRET"] = "ExternalSecret";
+    /** Secret */
+    FirestartrTerraformWorkspaceSpecReferencesRefKind["SECRET"] = "Secret";
 })(FirestartrTerraformWorkspaceSpecReferencesRefKind || (FirestartrTerraformWorkspaceSpecReferencesRefKind = {}));
 /**
  * @schema FirestartrTerraformWorkspaceSpecContextBackendRefKind
@@ -364149,12 +364151,8 @@ class FeatureRepoChart extends BaseGithubChart {
         const annotations = this.getAnnotationsFromRepo(this.get('repoCr'), [
             'claim-ref',
             'revision',
-            'policy',
-            'sync-policy',
             'sync-enabled',
             'sync-period',
-            'sync-schedule',
-            'sync-schedule-timezone',
         ]);
         cr.metadata.annotations = {
             ...cr.metadata.annotations,
@@ -364229,12 +364227,8 @@ class RepoSecretsSectionChart extends BaseGithubChart {
         const annotations = this.getAnnotationsFromRepo(this.get('repoCr'), [
             'claim-ref',
             'revision',
-            'policy',
-            'sync-policy',
             'sync-enabled',
             'sync-period',
-            'sync-schedule',
-            'sync-schedule-timezone',
         ]);
         cr.metadata.annotations = {
             ...cr.metadata.annotations,
@@ -367785,12 +367779,19 @@ function updateConditionByType(conditionList, type, newCondition) {
     return conditionList;
 }
 
+;// CONCATENATED MODULE: ../operator/src/utils/operationErrorMessages.ts
+const APPLY_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform apply operation.';
+const DESTROY_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform destroy operation.';
+const PLAN_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform plan operation.';
+const SYNC_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Sync operation.';
+
 ;// CONCATENATED MODULE: ../operator/src/syncCtl.ts
 // Machinery for syncing
 
 
 
 
+
 const DEFAULT_REVISION_TIME = '1m';
 async function createWatcherForItem(itemPath, itemCR) {
     const item = itemCR ?? (await getItemByItemPath(itemPath));
@@ -367853,7 +367854,7 @@ async function getSyncStatus(itemPath, itemCR) {
             : (await getSyncSpecs(itemPath, item)).schedule
                 ? 'Scheduled'
                 : 'Period';
-        return {
+        const syncStatus = {
             itemPath,
             syncMode: mode,
             conditions: [syncCondition],
@@ -367861,6 +367862,11 @@ async function getSyncStatus(itemPath, itemCR) {
             nextTimeoutInMS: isLapsed ? -1 : nextSyncDate.getTime() - Date.now(),
             intervalLapsed: isLapsed,
         };
+        if (syncCondition) {
+            syncStatus.hasSyncFailed =
+                syncCondition.message === SYNC_DEFAULT_ERROR_MESSAGE;
+        }
+        return syncStatus;
     }
 }
 async function setSyncStatus(itemPath, reason, status, message) {
@@ -368509,6 +368515,15 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
             yield transition;
         }
         if (needsUpdateSyncConditions) {
+            if (operation === OperationType.SYNC) {
+                // let's check if the process has not failed
+                const syncStatus = await getSyncStatus(workItem.handler.itemPath());
+                if (syncStatus.hasSyncFailed) {
+                    // we do not update sync because we are not going to trigger
+                    // a RETRY operation if the sync has failed
+                    return;
+                }
+            }
             await setSyncStatus(workItem.handler.itemPath(), operation, operation === OperationType.SYNC ? 'True' : 'False', 'Sync process finished');
             void syncCtl.updateItem(informer_itemPath(pluralKind, item));
         }
@@ -369529,9 +369544,7 @@ function provisionFeatureFiles(scope, feature) {
                 ? { ignoreChanges: ['content'] }
                 : {};
             const repoConfig = {
-                branch: file.targetBranch.length === 0
-                    ? defaultBranchName
-                    : file.targetBranch,
+                branch: file.targetBranch || defaultBranchName,
                 commitMessage: `feat: ${feature.spec.type} ${feature.spec.version}`,
                 content: cdktf_lib.Fn.base64decode(file.content),
                 file: file.path,
@@ -370532,15 +370545,10 @@ class Resource {
         this.set('operation', operation);
         this.set('deps', deps);
     }
-    async run(options) {
+    async run() {
         await this.preprocess();
         await this.synth();
-        if (options?.planOnly) {
-            await this.runTerraformPlanOnly();
-        }
-        else {
-            await this.runTerraform();
-        }
+        await this.runTerraform();
         await this.postprocess();
         if (this.logStream) {
             this.logStream.end();
@@ -370565,13 +370573,6 @@ class Resource {
     log(msg) {
         this.logFn(msg);
     }
-    async runTerraformPlanOnly() {
-        await this.onTFStreaming();
-        let output = '';
-        output += await terraformInit(this.get('main_artifact'), this.logStream);
-        output += await terraformPlan(this.get('main_artifact'), this.logStream);
-        this.set('output', output);
-    }
     async runTerraform() {
         await this.onTFStreaming();
         let output = '';
@@ -370959,7 +370960,7 @@ async function runProvisioner(data, opts) {
     if ('logStreamCallbacksTF' in opts) {
         resource.setTFStreamLogs(opts['logStreamCallbacksTF']);
     }
-    await resource.run({ planOnly: opts.planOnly });
+    await resource.run();
     return resource;
 }
 function createInstanceOf(entity, op, deps) {
@@ -371241,57 +371242,6 @@ function helperCreateCheckRunName(cmd, item) {
     return `${item.kind} - ${cmd}`;
 }
 
-;// CONCATENATED MODULE: ../operator/src/utils/index.ts
-const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function replaceConfigSecrets(config, secrets) {
-    for (const key in config) {
-        if (typeof config[key] === 'object' && config[key] !== null) {
-            // If the property is an object, call this function recursively
-            replaceConfigSecrets(config[key], secrets);
-        }
-        else if (typeof config[key] === 'string') {
-            // If the property is a string and its value is equal to secrets.something,
-            // replace the value with the value of the 'something' key in the secrets object
-            config[key] = config[key].replace(secretRegex, (_, group1) => {
-                if (!secrets[group1]) {
-                    throw new Error(`Secret ${group1} not found in secrets`);
-                }
-                return secrets[group1];
-            });
-        }
-    }
-    return config;
-}
-function replaceInlineSecrets(inline, secrets) {
-    if (typeof inline !== 'string' || !inline)
-        return inline;
-    let result = inline;
-    result = result.replace(secretRegex, (_, group1) => {
-        if (!secrets[group1]) {
-            throw new Error(`Secret ${group1} not found in secrets`);
-        }
-        return secrets[group1];
-    });
-    return result;
-}
-/**
- * Retrieves a policy annotation value from a custom resource
- * @param item - The CR to get the policy from
- * @param annotation - The annotation key to retrieve
- * @returns The policy value, or undefined if not set
- */
-function getPolicy(item, annotation) {
-    const policy = item.metadata.annotations && item.metadata.annotations[annotation];
-    if (policy)
-        return policy;
-    return undefined;
-}
-
-;// CONCATENATED MODULE: ../operator/src/utils/operationErrorMessages.ts
-const APPLY_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform apply operation.';
-const DESTROY_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform destroy operation.';
-const PLAN_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraform plan operation.';
-
 ;// CONCATENATED MODULE: ../operator/cdktf.ts
 
 
@@ -371302,17 +371252,9 @@ const PLAN_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Terraf
 
 
 
-const cdktf_LAST_STATE_PR_ANNOTATION = 'firestartr.dev/last-state-pr';
-
 function processOperation(item, op, handler) {
     operator_src_logger.info(`Processing operation ${op} on ${item.kind}/${item.metadata?.name}`);
     try {
-        const policy = getPolicy(item, 'firestartr.dev/policy');
-        // If general policy is observe/observe-only, route to observe mode instead of apply
-        if (!policy || policy === 'observe' || policy === 'observe-only') {
-            operator_src_logger.info(`Policy is '${policy || 'not set (default)'}', routing to observe mode`);
-            return cdktf_observe(item, op, handler);
-        }
         switch (op) {
             case OperationType.UPDATED:
                 return updated(item, op, handler);
@@ -371337,11 +371279,6 @@ function processOperation(item, op, handler) {
         throw e;
     }
 }
-async function* cdktf_observe(item, op, handler) {
-    for await (const transition of doPlan(item, op, handler)) {
-        yield transition;
-    }
-}
 async function* created(item, op, handler) {
     for await (const transition of doApply(item, op, handler)) {
         yield transition;
@@ -371377,18 +371314,8 @@ async function* sync(item, op, handler) {
         status: 'False',
         message: 'Synth CDKTF',
     };
-    const syncPolicy = getPolicy(item, 'firestartr.dev/sync-policy');
-    if (syncPolicy === 'apply') {
-        operator_src_logger.info(`SYNC OPERATION: applying item ${item.metadata.name} with sync-policy=${syncPolicy}`);
-        for await (const transition of doApply(item, op, handler)) {
-            yield transition;
-        }
-    }
-    else {
-        operator_src_logger.info(`SYNC OPERATION: planning item ${item.metadata.name} with sync-policy=${syncPolicy || 'default (observe)'}`);
-        for await (const transition of doPlan(item, op, handler)) {
-            yield transition;
-        }
+    for await (const transition of doApply(item, op, handler)) {
+        yield transition;
     }
     yield {
         item,
@@ -371428,14 +371355,15 @@ async function* markedToDeletion(item, op, handler) {
             message: 'Destroying process started',
         };
         const deps = await handler.resolveReferences();
-        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
+        const annotation = 'firestartr.dev/last-state-pr';
+        const statePr = item?.metadata?.annotations?.[annotation];
         const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
         if (!hasStatePr) {
             operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
-                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
+                `has no "${annotation}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
         }
         else {
-            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
+            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${annotation}" = ${statePr}`);
         }
         const destroyOutput = await provisioner.runProvisioner({
             mainCr: item,
@@ -371470,7 +371398,7 @@ async function* markedToDeletion(item, op, handler) {
         };
         await handler.finalize(handler.pluralKind, item.metadata.namespace, item, 'firestartr.dev/finalizer');
         await handler.writeTerraformOutputInTfResult(item, output);
-        if (item.metadata.annotations[cdktf_LAST_STATE_PR_ANNOTATION] || false) {
+        if (item.metadata.annotations['firestartr.dev/last-state-pr'] || false) {
             await addDestroyCommitStatus(item, 'success', 'Destroy operation completed', `Terraform Destroy ${item.metadata.name}`);
         }
         void handler.success();
@@ -371557,14 +371485,15 @@ async function* doApply(item, op, handler) {
         }
         const deps = await handler.resolveReferences();
         operator_src_logger.info(`Item ${item.metadata.name} has the following dependencies: ${deps}`);
-        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
+        const annotation = 'firestartr.dev/last-state-pr';
+        const statePr = item?.metadata?.annotations?.[annotation];
         const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
         if (!hasStatePr) {
             operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
-                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
+                `has no "${annotation}" annotation; skipping GitHub Check Runs (synth, terraform apply).`);
         }
         else {
-            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
+            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${annotation}" = ${statePr}`);
         }
         const applyOutput = await provisioner.runProvisioner({
             mainCr: item,
@@ -371665,220 +371594,6 @@ async function* doApply(item, op, handler) {
         }
     }
 }
-async function* doPlan(item, op, handler) {
-    let checkRunCtl;
-    try {
-        cleanTerraformState();
-        yield {
-            item,
-            reason: op,
-            type: 'PLANNING',
-            status: 'True',
-            message: 'Planning process started',
-        };
-        const deps = await handler.resolveReferences();
-        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
-        const hasStatePr = typeof statePr === 'string' && statePr.trim().length > 0;
-        if (!hasStatePr) {
-            operator_src_logger.warn(`CR ${item?.kind ?? 'UnknownKind'}/${item?.metadata?.name ?? 'unknown'} ` +
-                `has no "${cdktf_LAST_STATE_PR_ANNOTATION}" annotation; skipping GitHub Check Runs for plan.`);
-        }
-        else {
-            operator_src_logger.debug(`CR ${item.kind}/${item.metadata.name} uses "${cdktf_LAST_STATE_PR_ANNOTATION}" = ${statePr}`);
-            await addPlanStatusCheck(statePr, 'CDKTF plan in progress...');
-        }
-        // Run provisioner in plan-only mode
-        const planResult = await provisioner.runProvisioner({ mainCr: item, deps }, {
-            planOnly: true,
-            delete: 'deletionTimestamp' in item.metadata,
-            ...(hasStatePr
-                ? {
-                    logStreamCallbacksCDKTF: {
-                        prepare: async () => {
-                            checkRunCtl = await GHCheckRun('synth', item);
-                            return checkRunCtl;
-                        },
-                    },
-                    logStreamCallbacksTF: {
-                        prepare: async () => {
-                            checkRunCtl = await GHCheckRun('plan', item);
-                            return checkRunCtl;
-                        },
-                    },
-                }
-                : {}),
-        });
-        const planOutput = planResult?.output || '';
-        // Parse terraform plan output to detect changes
-        // Handles multiple Terraform output formats and versions
-        const hasChanges = detectPlanChanges(planOutput);
-        if (hasChanges) {
-            yield {
-                item,
-                reason: op,
-                type: 'OUT_OF_SYNC',
-                status: 'True',
-                message: 'Plan has changes',
-            };
-            yield {
-                item,
-                reason: op,
-                type: 'PROVISIONED',
-                status: 'False',
-                message: 'Plan has changes',
-            };
-        }
-        else {
-            yield {
-                item,
-                reason: op,
-                type: 'OUT_OF_SYNC',
-                status: 'False',
-                message: 'Plan has no changes',
-            };
-            yield {
-                item,
-                reason: op,
-                type: 'PROVISIONED',
-                status: 'True',
-                message: 'Plan has no changes',
-            };
-        }
-        // Store plan details for later reference
-        yield {
-            item,
-            reason: op,
-            type: 'LAST_PLAN_DETAILS',
-            status: 'Unknown',
-            message: planOutput,
-        };
-        yield {
-            item,
-            reason: op,
-            type: 'PLANNING',
-            status: 'False',
-            message: 'Planning process finished',
-        };
-        if (hasStatePr) {
-            await addPlanStatusCheck(statePr, hasChanges ? 'Plan has changes' : 'Plan has no changes', 'completed');
-        }
-    }
-    catch (e) {
-        operator_src_logger.error(`CDKTF plan failed: ${e}`);
-        if (checkRunCtl) {
-            checkRunCtl.fnOnError(e);
-        }
-        yield {
-            item,
-            reason: op,
-            type: 'ERROR',
-            status: 'True',
-            message: PLAN_DEFAULT_ERROR_MESSAGE,
-        };
-        yield {
-            item,
-            reason: op,
-            type: 'PLANNING',
-            status: 'False',
-            message: PLAN_DEFAULT_ERROR_MESSAGE,
-        };
-        yield {
-            item,
-            reason: op,
-            type: 'PROVISIONED',
-            status: 'False',
-            message: PLAN_DEFAULT_ERROR_MESSAGE,
-        };
-        const statePr = item?.metadata?.annotations?.[cdktf_LAST_STATE_PR_ANNOTATION];
-        if (statePr) {
-            const summaryText = tryCreateErrorSummary('CDKTF Plan failed', e);
-            await addPlanStatusCheck(statePr, summaryText, 'completed', true);
-        }
-        await handler.writeTerraformOutputInTfResult(item, e);
-        void handler.error();
-    }
-}
-/**
- * Detects if a Terraform plan output contains changes
- * Handles multiple Terraform versions and output formats
- * @param planOutput - The text output from terraform plan
- * @returns true if changes are detected, false otherwise
- */
-function detectPlanChanges(planOutput) {
-    if (!planOutput || planOutput.trim().length === 0) {
-        return false;
-    }
-    // Pattern 1: "Plan: X to add, Y to change, Z to destroy"
-    // Matches: "Plan: 1 to add, 0 to change, 0 to destroy"
-    const planPattern = /plan:\s*(\d+)\s+to\s+add,\s*(\d+)\s+to\s+change,\s*(\d+)\s+to\s+destroy/i;
-    const planMatch = planOutput.match(planPattern);
-    if (planMatch) {
-        const add = Number(planMatch[1]);
-        const change = Number(planMatch[2]);
-        const destroy = Number(planMatch[3]);
-        if (add > 0 || change > 0 || destroy > 0) {
-            return true;
-        }
-        // Explicitly found "Plan:" with 0/0/0 - no changes
-        return false;
-    }
-    // Pattern 2: Individual change indicators
-    // Handles variations like "1 to add", "2 to change", "3 to destroy"
-    const hasAdditions = /\d+\s+to\s+add/i.test(planOutput);
-    const hasChanges = /\d+\s+to\s+change/i.test(planOutput);
-    const hasDestructions = /\d+\s+to\s+destroy/i.test(planOutput);
-    const hasImports = /\d+\s+to\s+import/i.test(planOutput);
-    if (hasAdditions || hasChanges || hasDestructions || hasImports) {
-        return true;
-    }
-    // Pattern 3: Resource-level change indicators
-    // Matches: "# resource will be created", "# resource will be updated", etc.
-    const resourceChangePatterns = [
-        /will\s+be\s+(created|destroyed|updated|replaced)/i,
-        /must\s+be\s+(created|destroyed|updated|replaced)/i,
-        /#.*\s+(create|destroy|update|replace)/i,
-    ];
-    for (const pattern of resourceChangePatterns) {
-        if (pattern.test(planOutput)) {
-            return true;
-        }
-    }
-    // Pattern 4: Action symbols in plan output
-    // Terraform uses symbols like +, -, ~, -/+ to indicate changes
-    const actionSymbols = [
-        /^\s*[+]\s+/m,
-        /^\s*[-]\s+/m,
-        /^\s*[~]\s+/m,
-        /^\s*[-][/][+]\s+/m, // Replace
-    ];
-    for (const pattern of actionSymbols) {
-        if (pattern.test(planOutput)) {
-            return true;
-        }
-    }
-    // Pattern 5: No changes messages (inverse check)
-    const noChangesPatterns = [
-        /no\s+changes/i,
-        /infrastructure\s+is\s+up[-\s]to[-\s]date/i,
-        /your\s+infrastructure\s+matches\s+the\s+configuration/i,
-        /0\s+to\s+add,\s*0\s+to\s+change,\s*0\s+to\s+destroy/i,
-    ];
-    for (const pattern of noChangesPatterns) {
-        if (pattern.test(planOutput)) {
-            return false;
-        }
-    }
-    // If we find "Plan:" keyword but couldn't parse it, log a warning and err on the side of caution
-    if (planOutput.toLowerCase().includes('plan:')) {
-        operator_src_logger.warn('Found "Plan:" in output but could not parse change counts. ' +
-            'Raw output excerpt (first 500 chars):\n' +
-            planOutput.slice(0, 500) +
-            '\nErring on the side of caution and assuming changes.');
-        return true;
-    }
-    // Default: assume no changes if we can't detect any
-    return false;
-}
 function cleanTerraformState() {
     external_fs_.rmSync('/library/packages/provisioner/cdktf.out', {
         recursive: true,
@@ -372299,6 +372014,8 @@ ${this.mainBlock}
 }
 
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/resolutor/resolver.ts
+
+const REG_IS_CLAIM_SECRET_REF = new RegExp(/^secret-ref-\d+$/);
 function resolveString(value, refs) {
     const regex = new RegExp(/(\$\{\{\s*references\.[\w\-.]+\s*\}\})/);
     if (hasRefs(value, regex) > 0) {
@@ -372352,6 +372069,18 @@ function getRefNameFromKey(key) {
     // name is in the first matching group
     return match[1];
 }
+function resolveClaimSecret(value, refs) {
+    if (typeof value === 'string' && REG_IS_CLAIM_SECRET_REF.test(value)) {
+        if (!Object.prototype.hasOwnProperty.call(refs, value)) {
+            terraform_provisioner_src_logger.error(`SecretsClaim ref ${value} is not present on references`);
+            throw new Error(`SecretsClaim ref ${value} is not present on references`);
+        }
+        return refs[value];
+    }
+    else {
+        return value;
+    }
+}
 function resolveRef(key, references, wantsInterpolation = false) {
     const refName = getRefNameFromKey(key);
     // check if key exists
@@ -372400,6 +372129,9 @@ function walkList(list, resolveScalar) {
 function resolveValues(values, refs) {
     return walker_walk(values, (value) => resolveScalar(value, refs));
 }
+function resolveClaimSecrets(values, refs) {
+    return walker_walk(values, (value) => resolveClaimSecret(value, refs));
+}
 
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_tfvars_json.ts
 
@@ -372411,7 +372143,9 @@ class WriterTfVarsJson extends writer {
         this.references = references;
     }
     __replaceReferences(values, references) {
-        return resolveValues(values, references);
+        values = resolveValues(values, references);
+        values = resolveClaimSecrets(values, references);
+        return values;
     }
     __resolveDeps() {
         const replaced = this.__replaceReferences(this.values, this.references);
@@ -372878,6 +372612,40 @@ function tf_checkrun_helperCreateCheckRunName(cmd) {
     return `TFWorkspace - ${cmd}`;
 }
 
+;// CONCATENATED MODULE: ../operator/src/utils/index.ts
+const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
+function replaceConfigSecrets(config, secrets) {
+    for (const key in config) {
+        if (typeof config[key] === 'object' && config[key] !== null) {
+            // If the property is an object, call this function recursively
+            replaceConfigSecrets(config[key], secrets);
+        }
+        else if (typeof config[key] === 'string') {
+            // If the property is a string and its value is equal to secrets.something,
+            // replace the value with the value of the 'something' key in the secrets object
+            config[key] = config[key].replace(secretRegex, (_, group1) => {
+                if (!secrets[group1]) {
+                    throw new Error(`Secret ${group1} not found in secrets`);
+                }
+                return secrets[group1];
+            });
+        }
+    }
+    return config;
+}
+function replaceInlineSecrets(inline, secrets) {
+    if (typeof inline !== 'string' || !inline)
+        return inline;
+    let result = inline;
+    result = result.replace(secretRegex, (_, group1) => {
+        if (!secrets[group1]) {
+            throw new Error(`Secret ${group1} not found in secrets`);
+        }
+        return secrets[group1];
+    });
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../operator/src/tfworkspaces/process-operation.ts
 
 
@@ -372933,7 +372701,7 @@ async function* process_operation_observe(item, op, handler) {
         yield transition;
     }
 }
-async function* doPlanJSONFormat(item, op, handler) {
+async function* doPlanJSONFormat(item, op, handler, setResult = function (_r) { }) {
     let error = false;
     try {
         yield {
@@ -373034,34 +372802,83 @@ async function* doPlanJSONFormat(item, op, handler) {
     }
     finally {
         if (error) {
-            yield {
-                item,
-                reason: op,
-                type: 'PROVISIONED',
-                status: 'False',
-                message: PLAN_DEFAULT_ERROR_MESSAGE,
-            };
-            yield {
-                item,
-                reason: op,
-                type: 'PLANNING',
-                status: 'False',
-                message: PLAN_DEFAULT_ERROR_MESSAGE,
-            };
-            yield {
-                item,
-                reason: op,
-                type: 'OUT_OF_SYNC',
-                status: 'False',
-                message: PLAN_DEFAULT_ERROR_MESSAGE,
-            };
-            yield {
-                item,
-                reason: op,
-                type: 'ERROR',
-                status: 'True',
-                message: PLAN_DEFAULT_ERROR_MESSAGE,
-            };
+            if (op === OperationType.SYNC) {
+                // if there is an error on a sync we never put the state on error
+                // it would be problematic because the RETRY op kicks in
+                if (error) {
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'SYNCHRONIZED',
+                        status: 'True',
+                        message: SYNC_DEFAULT_ERROR_MESSAGE,
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'PROVISIONED',
+                        status: 'True',
+                        message: 'doPlanJSONFormat',
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'PLANNING',
+                        status: 'False',
+                        message: 'doPlanJSONFormat',
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'OUT_OF_SYNC',
+                        status: 'False',
+                        message: 'doPlanJSONFormat',
+                    };
+                    yield {
+                        item,
+                        reason: op,
+                        type: 'ERROR',
+                        status: 'False',
+                        message: 'doPlanJSONFormat',
+                    };
+                }
+                setResult('SYNC_ERROR_PLAN');
+            }
+            else {
+                yield {
+                    item,
+                    reason: op,
+                    type: 'PROVISIONED',
+                    status: 'False',
+                    message: PLAN_DEFAULT_ERROR_MESSAGE,
+                };
+                yield {
+                    item,
+                    reason: op,
+                    type: 'PLANNING',
+                    status: 'False',
+                    message: PLAN_DEFAULT_ERROR_MESSAGE,
+                };
+                yield {
+                    item,
+                    reason: op,
+                    type: 'OUT_OF_SYNC',
+                    status: 'False',
+                    message: PLAN_DEFAULT_ERROR_MESSAGE,
+                };
+                yield {
+                    item,
+                    reason: op,
+                    type: 'ERROR',
+                    status: 'True',
+                    message: PLAN_DEFAULT_ERROR_MESSAGE,
+                };
+            }
+        }
+        else {
+            if (op === OperationType.SYNC) {
+                setResult('SYNC_SUCCESS');
+            }
         }
     }
 }
@@ -373075,6 +372892,11 @@ async function* process_operation_renamed(item, op, handler) {
         yield transition;
     }
 }
+function getPolicy(item, annotation) {
+    const policy = item.metadata.annotations && item.metadata.annotations[annotation];
+    if (policy)
+        return policy;
+}
 async function* process_operation_updated(item, op, handler) {
     for await (const transition of process_operation_doApply(item, op, handler)) {
         yield transition;
@@ -373099,6 +372921,7 @@ function isDestroyRetry(item) {
     return false;
 }
 async function* process_operation_sync(item, op, handler, syncPolicy, generalPolicy) {
+    let doResult = '';
     if (!syncPolicy) {
         operator_src_logger.debug(`The Terraform processor is only observing item '${item.kind}/${item.metadata.name}' because no sync policy was found for operation '${op}'.`);
         yield* doPlanJSONFormat(item, op, handler);
@@ -373115,23 +372938,30 @@ async function* process_operation_sync(item, op, handler, syncPolicy, generalPol
                 break;
             }
             case 'observe': {
-                yield* doPlanJSONFormat(item, op, handler);
+                yield* doPlanJSONFormat(item, op, handler, (result) => {
+                    doResult = result;
+                });
                 break;
             }
             default: {
                 operator_src_logger.debug(`The Terraform processor detected a sync policy '${syncPolicy}' for item '${item.kind}/${item.metadata.name}' that is not supported.`);
-                yield* doPlanJSONFormat(item, op, handler);
+                yield* doPlanJSONFormat(item, op, handler, (result) => {
+                    doResult = result;
+                });
                 break;
             }
         }
     }
-    yield {
-        item,
-        reason: op,
-        type: 'SYNCHRONIZED',
-        status: 'True',
-        message: 'Sync process finished',
-    };
+    operator_src_logger.debug(`doResult is ${doResult}`);
+    if (doResult === 'SYNC_SUCCESS') {
+        yield {
+            item,
+            reason: op,
+            type: 'SYNCHRONIZED',
+            status: 'True',
+            message: 'Sync process finished',
+        };
+    }
 }
 async function* process_operation_markedToDeletion(item, op, handler) {
     let error = false;
@@ -373534,6 +373364,9 @@ function resolveReferences(item, deps) {
         // if(!process.env.TONISILLO) process.exit(1)
         for (const iRef of itemReferences) {
             const ref = deps[`${iRef.ref.kind}-${iRef.ref.name}`];
+            if (iRef.ref.kind === 'Secret') {
+                ref.secret = ref.cr;
+            }
             if (!ref) {
                 throw new Error(`Reference ${iRef.ref.kind}-${iRef.ref.name} not found`);
             }
@@ -373731,7 +373564,7 @@ const processOperationPlan_TF_PROJECTS_PATH = '/tmp/tfworkspaces';
 function processOperationPlan(item, op, handler) {
     try {
         processOperationPlan_clearLocalTfProjects();
-        const policy = getPolicy(item, 'firestartr.dev/policy');
+        const policy = processOperationPlan_getPolicy(item);
         if (policy === 'observe' || policy === 'apply') {
             return processOperationPlan_plan(item, op, handler);
         }
@@ -374190,6 +374023,12 @@ function processOperationPlan_getErrorOutputMessage(cr, key, ref) {
         throw new Error(`❌ Source ${cr.spec.source} not supported`);
     }
 }
+function processOperationPlan_getPolicy(item) {
+    const policy = item.metadata.annotations &&
+        item.metadata.annotations['firestartr.dev/policy'];
+    if (policy)
+        return policy;
+}
 
 ;// CONCATENATED MODULE: ../operator/src/ctx.ts
 class Ctx {
@@ -374462,6 +374301,7 @@ var sdk_metrics_build_src = __nccwpck_require__(84016);
 
 
 
+
 const INTERVAL_IN_SEGS = 60;
 class CRStateMetrics {
     constructor(kind, namespace, meter) {
@@ -374484,6 +374324,9 @@ class CRStateMetrics {
         this.deletedGauge = meter.createGauge('firestartr_deleted_total', {
             description: 'Total number of CRs in DELETED state',
         });
+        this.errorOnSyncGauge = meter.createGauge('firestartr_error_on_sync_total', {
+            description: 'Total number of CRs with failed SYNCs',
+        });
         this.namespace = namespace;
     }
     async start() {
@@ -374512,10 +374355,18 @@ class CRStateMetrics {
             let errorCount = 0;
             let planningCount = 0;
             let deletedCount = 0;
+            let errorOnSyncCount = 0;
             for (const item of items) {
                 const status = item.status?.conditions.find((condition) => condition.type !== 'SYNCHRONIZED' && condition.status === 'True');
                 if (!status)
                     continue;
+                const syncCondition = item.status.conditions.find((condition) => {
+                    return condition.type === 'SYNCHRONIZED';
+                });
+                if (syncCondition &&
+                    syncCondition.message === SYNC_DEFAULT_ERROR_MESSAGE) {
+                    errorOnSyncCount++;
+                }
                 switch (status.type) {
                     case 'PROVISIONED':
                         provisionedCount++;
@@ -374561,6 +374412,10 @@ class CRStateMetrics {
                 namespace: this.namespace,
                 kind: this.kind,
             });
+            this.errorOnSyncGauge.record(errorOnSyncCount, {
+                namespace: this.namespace,
+                kind: this.kind,
+            });
         }
         catch (err) {
             console.log(`CRStateMetrics: update ${err}`);