@intentius/chant-lexicon-terraform 0.124.44 → 0.124.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/__fixtures__/capabilities/chant.config.d.ts +26 -0
- package/dist/__fixtures__/capabilities/chant.config.d.ts.map +1 -0
- package/dist/__fixtures__/capabilities/chant.config.js +13 -0
- package/dist/__fixtures__/effective-topology/chant.config.d.ts +13 -0
- package/dist/__fixtures__/effective-topology/chant.config.d.ts.map +1 -0
- package/dist/__fixtures__/effective-topology/chant.config.js +9 -0
- package/dist/__fixtures__/kind-type/chant.config.d.ts +13 -0
- package/dist/__fixtures__/kind-type/chant.config.d.ts.map +1 -0
- package/dist/__fixtures__/kind-type/chant.config.js +9 -0
- package/dist/__fixtures__/search-roots/chant.config.d.ts +13 -0
- package/dist/__fixtures__/search-roots/chant.config.d.ts.map +1 -0
- package/dist/__fixtures__/search-roots/chant.config.js +9 -0
- package/dist/__fixtures__/sensitive-default/chant.config.d.ts +13 -0
- package/dist/__fixtures__/sensitive-default/chant.config.d.ts.map +1 -0
- package/dist/__fixtures__/sensitive-default/chant.config.js +9 -0
- package/dist/capabilities/adapter.d.ts +9 -0
- package/dist/capabilities/adapter.d.ts.map +1 -0
- package/dist/capabilities/adapter.js +25 -0
- package/dist/capabilities/mapping.json +166 -0
- package/dist/config.d.ts +52 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +23 -0
- package/dist/describe-resources.d.ts +101 -8
- package/dist/describe-resources.d.ts.map +1 -1
- package/dist/describe-resources.js +395 -56
- package/dist/hcl/parse.d.ts +10 -0
- package/dist/hcl/parse.d.ts.map +1 -1
- package/dist/hcl/parse.js +20 -2
- package/dist/hcl/redact.d.ts +26 -0
- package/dist/hcl/redact.d.ts.map +1 -0
- package/dist/hcl/redact.js +228 -0
- package/dist/integrity.json +2 -2
- package/dist/manifest.json +1 -1
- package/dist/op/activities/terraform.d.ts +109 -4
- package/dist/op/activities/terraform.d.ts.map +1 -1
- package/dist/op/activities/terraform.js +148 -7
- package/dist/plan-observation.d.ts +153 -0
- package/dist/plan-observation.d.ts.map +1 -0
- package/dist/plan-observation.js +354 -0
- package/dist/plugin.d.ts.map +1 -1
- package/dist/plugin.js +2 -0
- package/package.json +2 -2
- package/src/__fixtures__/ACCEPTANCE.md +53 -1
- package/src/__fixtures__/capabilities/catalog/main.tf +105 -0
- package/src/__fixtures__/capabilities/chant.config.ts +15 -0
- package/src/__fixtures__/capabilities/findings/main.tf +225 -0
- package/src/__fixtures__/capabilities/ledger/main.tf +265 -0
- package/src/__fixtures__/capabilities/package.json +1 -0
- package/src/__fixtures__/effective-topology/chant.config.ts +11 -0
- package/src/__fixtures__/effective-topology/net/main.tf +176 -0
- package/src/__fixtures__/effective-topology/package.json +6 -0
- package/src/__fixtures__/kind-type/app/main.tf +35 -0
- package/src/__fixtures__/kind-type/chant.config.ts +11 -0
- package/src/__fixtures__/kind-type/package.json +6 -0
- package/src/__fixtures__/live-plan-depth/README.md +59 -0
- package/src/__fixtures__/live-plan-depth/live-plan.json +110 -0
- package/src/__fixtures__/live-plan-depth/show-plan-sensitive.json +1 -0
- package/src/__fixtures__/live-plan-depth/show-plan.json +1 -0
- package/src/__fixtures__/plan-read/main.tf +46 -0
- package/src/__fixtures__/plan-read/next.tfvars +1 -0
- package/src/__fixtures__/plan-read-drift/README.md +33 -0
- package/src/__fixtures__/plan-read-drift/main.tf +63 -0
- package/src/__fixtures__/plan-read-drift/next.tfvars +1 -0
- package/src/__fixtures__/search-roots/chant.config.ts +11 -0
- package/src/__fixtures__/search-roots/net/main.tf +73 -0
- package/src/__fixtures__/search-roots/package.json +6 -0
- package/src/__fixtures__/sensitive-default/chant.config.ts +11 -0
- package/src/__fixtures__/sensitive-default/net/main.tf +38 -0
- package/src/__fixtures__/sensitive-default/package.json +6 -0
- package/src/__fixtures__/show-plan.json +663 -0
- package/src/capabilities/adapter.ts +32 -0
- package/src/capabilities/mapping.json +166 -0
- package/src/capabilities-workspace.e2e.test.ts +251 -0
- package/src/capabilities.test.ts +264 -0
- package/src/config.ts +26 -0
- package/src/describe-resources.live-plan.test.ts +302 -0
- package/src/describe-resources.live-root-unchanged.test.ts +126 -0
- package/src/describe-resources.plan.test.ts +437 -0
- package/src/describe-resources.ts +445 -52
- package/src/effective-topology.test.ts +134 -0
- package/src/hcl/parse.ts +30 -2
- package/src/hcl/redact.ts +181 -0
- package/src/live-plan-depth.acceptance.e2e.test.ts +193 -0
- package/src/op/activities/terraform.test.ts +118 -1
- package/src/op/activities/terraform.ts +213 -9
- package/src/plan-observation.ts +428 -0
- package/src/plan-read.acceptance.test.ts +184 -0
- package/src/plugin.ts +2 -0
- package/src/redact-ir.e2e.test.ts +79 -0
- package/src/redact.test.ts +111 -0
- package/src/search-build-roots.test.ts +125 -0
- package/src/search-count.test.ts +144 -0
- package/src/search-kind-type.test.ts +136 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4MG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAEhB,mBAAmB,EAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,cAAc,EAInB,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,iBAAiB,EACjB,aAAa,EAEd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAMtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACtB;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CA6BjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAE9F;AAWD,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7C;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAmF9D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CAmB5F,CAAC;AAgBF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,CAE3E;AASD,uEAAuE;AACvE,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,CA4B3F;AAsGD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAE3E,iHAAiH;AACjH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAyFD,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,qFAAqF;AACrF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAqC3D;AAYD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkBlG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C,GAAG,iBAAiB,EACrB,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAsC3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,iBAAiB,EAC7E,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CA6C9B;AAYD,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,iGAAiG;IACjG,QAAQ,EAAE,OAAO,yBAAyB,CAAC;IAC3C,MAAM,EAAE,OAAO,eAAe,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,iBAAiB,CAAC;CACrC;AAUD,wFAAwF;AACxF,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,iBAAiB,CActI;AAgHD,6CAA6C;AAC7C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAK5D,mGAAmG;AACnG,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AA+GD,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,MAAM,CAAC;AAwEvD,kGAAkG;AAClG,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AA4B/D,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAqGlC"}
|
|
@@ -24,18 +24,26 @@
|
|
|
24
24
|
* is a different one.
|
|
25
25
|
*
|
|
26
26
|
* So the returned `ObservationResult` carries `sources`, keyed by chant entity
|
|
27
|
-
* name, with one of exactly
|
|
27
|
+
* name, with one of exactly four values:
|
|
28
28
|
*
|
|
29
|
-
* - `"state"
|
|
30
|
-
* - `"live"
|
|
29
|
+
* - `"state"`: this entity's root was read with `terraform show -json`.
|
|
30
|
+
* - `"live"`: this entity's root was read with `choudoufu live-plan -json`.
|
|
31
|
+
* - `"plan"`: this entity's root was read at the plan depth (#4358), a saved
|
|
32
|
+
* plan's `show -json`, which says what the next apply would do. See the
|
|
33
|
+
* plan depth section below.
|
|
34
|
+
* - `"live+plan"`: a live root at the plan depth (#4371), where both reads
|
|
35
|
+
* answered: `live-plan -json` for presence and ownership, the plan read for
|
|
36
|
+
* the attributes. A live root whose plan read failed says `"live"`.
|
|
31
37
|
*
|
|
32
38
|
* Three guarantees a consumer may rely on. Every entity `describeResources`
|
|
33
39
|
* was asked about that belongs to a root has an entry, whatever verdict it
|
|
34
40
|
* came back with: present, absent and not-observed alike, because which read
|
|
35
|
-
* was attempted is a fact independent of what it found.
|
|
36
|
-
* declared entity's own `props.mode`
|
|
37
|
-
* decides both, so `props.mode` is also a
|
|
38
|
-
* holding the declared graph and no
|
|
41
|
+
* was attempted is a fact independent of what it found. On a root read at the
|
|
42
|
+
* default depth the value equals the declared entity's own `props.mode`
|
|
43
|
+
* (`./hcl/parse.ts`), since one fact decides both, so `props.mode` is also a
|
|
44
|
+
* valid join key for a consumer holding the declared graph and no
|
|
45
|
+
* observation; the plan depth is chosen at read time, so only `sources` says
|
|
46
|
+
* it was used. And a project mixing stock
|
|
39
47
|
* and live roots gets both values in one document, which is why this is a map
|
|
40
48
|
* and not a field on the result as a whole.
|
|
41
49
|
*
|
|
@@ -144,6 +152,49 @@
|
|
|
144
152
|
* (`live-ls`'s own help text) and a listing taken right after an apply can
|
|
145
153
|
* otherwise show a resource under both its old and new estate, or neither.
|
|
146
154
|
*
|
|
155
|
+
* ## The plan depth (#4358)
|
|
156
|
+
*
|
|
157
|
+
* A stock root can be read one depth further: `terraform.observe` (or a
|
|
158
|
+
* root's own `observe`) set to `"plan"`, or `CHANT_TERRAFORM_OBSERVE=plan`,
|
|
159
|
+
* or `depth: "plan"` from a caller. The read is `terraformPlanRead`:
|
|
160
|
+
* `plan -input=false -lock=false -out=<tmp>/plan.tfplan`, then `show -json`,
|
|
161
|
+
* with `<tmp>` under the OS temp directory and removed afterwards, and no
|
|
162
|
+
* `init`. Presence and ownership come from the plan's `prior_state` by the
|
|
163
|
+
* state read's own rule; `./plan-observation.ts` adds the plan's attributes
|
|
164
|
+
* (`planAction`, `planReplacePaths`, `planAfterUnknown`, `planDrift`, ...)
|
|
165
|
+
* to each present block, with sensitive values redacted.
|
|
166
|
+
*
|
|
167
|
+
* It falls back by depth (`planAdapter`): no provider credentials -> the
|
|
168
|
+
* state read; no backend, or a root that needs `init` -> declared only. Each
|
|
169
|
+
* root gets a note saying which read answered. A planned create has no row in
|
|
170
|
+
* `prior_state` and reads absent, as on the state read, so its plan
|
|
171
|
+
* attributes have nowhere to ride.
|
|
172
|
+
*
|
|
173
|
+
* ### On a live root (#4371)
|
|
174
|
+
*
|
|
175
|
+
* `live-plan -json` carries ownership and no attribute values (behold#404),
|
|
176
|
+
* and `choudoufu plan -out` writes a stock plan file (choudoufu #878). So a
|
|
177
|
+
* live root at the plan depth runs both (`livePlanDepthAdapter`):
|
|
178
|
+
* `live-plan -json` first, unchanged, for presence and ownership, then the
|
|
179
|
+
* same `terraformPlanRead` a stock root gets, whose attributes are added to
|
|
180
|
+
* each block `live-plan` bound. A foreign or adoptable block gets none: the
|
|
181
|
+
* plan proposes a create there, which is choudoufu's answer for an instance
|
|
182
|
+
* it does not own, not a fact about the live resource. `sources` reads
|
|
183
|
+
* `"live+plan"`.
|
|
184
|
+
*
|
|
185
|
+
* choudoufu rebuilds prior state from the account on every run, so on a live
|
|
186
|
+
* root out-of-band drift is not in `resource_drift`. It is the planned
|
|
187
|
+
* `update` itself: `planChanges` has the live value as `before` and the
|
|
188
|
+
* declared one as `after`, and `planDrift` stays empty. That is where #2472's
|
|
189
|
+
* property-level drift for a live root comes from.
|
|
190
|
+
*
|
|
191
|
+
* Falling back is one step: if the plan read fails, `live-plan` alone
|
|
192
|
+
* answered, the note says why, and `sources` reads `"live"`. If `live-plan`
|
|
193
|
+
* fails the root is not observed, as at the default depth, and the plan read
|
|
194
|
+
* is not tried, since its attributes would have no present block to ride.
|
|
195
|
+
* The cost is two refreshes of the estate per read, run one after the other
|
|
196
|
+
* so they never share the root's cache file.
|
|
197
|
+
*
|
|
147
198
|
* ## Nothing from `values` is surfaced
|
|
148
199
|
*
|
|
149
200
|
* A state row's `values` are the resource's full attribute set, secrets
|
|
@@ -153,7 +204,10 @@
|
|
|
153
204
|
* `id`, which is the physical id every observation carries.
|
|
154
205
|
*/
|
|
155
206
|
import { mergeObservations, normalizeObservation, observation, observeEntities, } from "@intentius/chant/observation";
|
|
156
|
-
import {
|
|
207
|
+
import { mkdirSync, writeFileSync } from "node:fs";
|
|
208
|
+
import { isAbsolute, join } from "node:path";
|
|
209
|
+
import { choudoufuLiveLs, choudoufuLivePlanDocument, terraformInit, terraformPlanRead, terraformShow, TerraformPlanReadError, } from "./op/activities/terraform.js";
|
|
210
|
+
import { blockAddressOf, indexPlan, planAttributesFor, plannedAttributesFor } from "./plan-observation.js";
|
|
157
211
|
import { DATA_TYPE, MODULE_TYPE, RESOURCE_TYPE, callersOfKey } from "./hcl/parse.js";
|
|
158
212
|
// The channel keys live in their own module so `plugin.ts` can declare
|
|
159
213
|
// `ownershipChannel` without loading this reader. Re-exported here because
|
|
@@ -496,6 +550,41 @@ function readLiveResource(entity, index, root, queried) {
|
|
|
496
550
|
queried,
|
|
497
551
|
};
|
|
498
552
|
}
|
|
553
|
+
/**
|
|
554
|
+
* The environment variable that asks for each live root's `live-plan -json`
|
|
555
|
+
* document as a file, in a directory the caller owns (behold#924).
|
|
556
|
+
*
|
|
557
|
+
* The overlay keeps chant's verdict per block and drops the rows behind it:
|
|
558
|
+
* each instance's omission reason and detail, `identity_values`, the adoptable
|
|
559
|
+
* row's own fields. A caller that paints ownership from those rows and wants
|
|
560
|
+
* the plan's attributes from the plan depth would otherwise run its own
|
|
561
|
+
* `live-plan` beside this one, two refreshes of the estate that can disagree
|
|
562
|
+
* (choudoufu #1014). With this set to an absolute directory, the document this
|
|
563
|
+
* read used is written there as `<root>.live-plan.json`, so the caller reads
|
|
564
|
+
* the same `live-plan` the verdicts came from.
|
|
565
|
+
*
|
|
566
|
+
* Opt-in, and never inside the root: a relative path is ignored, so nothing
|
|
567
|
+
* lands in the root by accident (#4379). A write that fails is ignored too;
|
|
568
|
+
* the read answers either way, and the caller sees no file.
|
|
569
|
+
*/
|
|
570
|
+
export const TERRAFORM_LIVE_PLAN_DIR_ENV = "CHANT_TERRAFORM_LIVE_PLAN_DIR";
|
|
571
|
+
/** The file {@link TERRAFORM_LIVE_PLAN_DIR_ENV} names for a root: the root's name, made safe for a file name. */
|
|
572
|
+
export function livePlanDocumentFile(root) {
|
|
573
|
+
return `${root.replace(/[^A-Za-z0-9._-]/g, "_")}.live-plan.json`;
|
|
574
|
+
}
|
|
575
|
+
/** Write a live root's document where {@link TERRAFORM_LIVE_PLAN_DIR_ENV} asks, if it asks. */
|
|
576
|
+
function handLivePlanDocument(root, json) {
|
|
577
|
+
const out = process.env[TERRAFORM_LIVE_PLAN_DIR_ENV];
|
|
578
|
+
if (!out || !isAbsolute(out))
|
|
579
|
+
return;
|
|
580
|
+
try {
|
|
581
|
+
mkdirSync(out, { recursive: true });
|
|
582
|
+
writeFileSync(join(out, livePlanDocumentFile(root)), JSON.stringify(json));
|
|
583
|
+
}
|
|
584
|
+
catch {
|
|
585
|
+
// Best effort: the read's answer does not depend on the copy.
|
|
586
|
+
}
|
|
587
|
+
}
|
|
499
588
|
/**
|
|
500
589
|
* One live root's reader: `live-plan -json`, then address matching against
|
|
501
590
|
* the document. `terraform show` is never run here, and there is no state
|
|
@@ -508,6 +597,7 @@ function liveAdapter(root, cwd, deps) {
|
|
|
508
597
|
async bind() {
|
|
509
598
|
const planned = await deps.livePlan({ root, ...where });
|
|
510
599
|
dir = planned.dir;
|
|
600
|
+
handLivePlanDocument(root, planned.json);
|
|
511
601
|
return indexLivePlan(planned.json);
|
|
512
602
|
},
|
|
513
603
|
classifyBindFailure(err) {
|
|
@@ -785,6 +875,7 @@ const REAL_DEPS = {
|
|
|
785
875
|
show: terraformShow,
|
|
786
876
|
livePlan: choudoufuLivePlanDocument,
|
|
787
877
|
liveLs: choudoufuLiveLs,
|
|
878
|
+
planRead: terraformPlanRead,
|
|
788
879
|
};
|
|
789
880
|
/**
|
|
790
881
|
* Split a `<root>/<address>` entity key, or a descended child module's
|
|
@@ -836,7 +927,11 @@ export function declaredOf(name, entity) {
|
|
|
836
927
|
...(asString(props.mode) ? { mode: asString(props.mode) } : {}),
|
|
837
928
|
};
|
|
838
929
|
}
|
|
839
|
-
/**
|
|
930
|
+
/**
|
|
931
|
+
* One root's reader: `init`, then `show` over state, then address matching.
|
|
932
|
+
* The entity-level reads are {@link readStateEntity}, which the plan depth's
|
|
933
|
+
* fallback shares.
|
|
934
|
+
*/
|
|
840
935
|
function adapter(root, cwd, deps) {
|
|
841
936
|
const where = cwd ? { cwd } : {};
|
|
842
937
|
let dir;
|
|
@@ -859,56 +954,263 @@ function adapter(root, cwd, deps) {
|
|
|
859
954
|
};
|
|
860
955
|
},
|
|
861
956
|
async read(index, entity) {
|
|
862
|
-
|
|
863
|
-
|
|
864
|
-
|
|
865
|
-
|
|
866
|
-
|
|
867
|
-
|
|
868
|
-
|
|
869
|
-
|
|
870
|
-
|
|
871
|
-
|
|
872
|
-
|
|
873
|
-
|
|
874
|
-
|
|
875
|
-
|
|
876
|
-
|
|
877
|
-
|
|
878
|
-
|
|
879
|
-
|
|
880
|
-
|
|
881
|
-
|
|
882
|
-
|
|
957
|
+
return readStateEntity(index, entity, root, `terraform show -json (root "${root}", address "${entity.address}")`);
|
|
958
|
+
},
|
|
959
|
+
};
|
|
960
|
+
}
|
|
961
|
+
/** True when the index carries any row for the block `address`, at any instance key. */
|
|
962
|
+
function blockRows(address, index) {
|
|
963
|
+
const exact = index.rows.get(address);
|
|
964
|
+
if (exact)
|
|
965
|
+
return [exact];
|
|
966
|
+
return [...index.rows.values()].filter((row) => blockAddressOf(row.address) === address);
|
|
967
|
+
}
|
|
968
|
+
/**
|
|
969
|
+
* One declared entity against a state index: the state read's whole verdict,
|
|
970
|
+
* and the plan depth's too, since a plan's `prior_state` is the same shape.
|
|
971
|
+
* `extra` is what the plan depth adds to a present resource or data block.
|
|
972
|
+
*/
|
|
973
|
+
function readStateEntity(index, entity, root, queried, extra) {
|
|
974
|
+
const { address } = entity;
|
|
975
|
+
if (entity.type === RESOURCE_TYPE || entity.type === DATA_TYPE) {
|
|
976
|
+
// The exact row first, which is the state read's rule since #2087; the
|
|
977
|
+
// plan depth also finds a `count` or `for_each` block by its instances.
|
|
978
|
+
const rows = extra ? blockRows(address, index) : index.rows.get(address) ? [index.rows.get(address)] : [];
|
|
979
|
+
if (rows.length === 0)
|
|
980
|
+
return { absent: true, queried };
|
|
981
|
+
const row = rows[0];
|
|
982
|
+
return {
|
|
983
|
+
present: {
|
|
984
|
+
type: entity.type,
|
|
985
|
+
physicalId: rows.length === 1 ? (row.id ?? address) : address,
|
|
986
|
+
status: row.mode ?? "managed",
|
|
987
|
+
ownership: "owned",
|
|
988
|
+
attributes: {
|
|
989
|
+
address,
|
|
990
|
+
root,
|
|
991
|
+
...(row.type ? { resourceType: row.type } : {}),
|
|
992
|
+
...(row.mode ? { mode: row.mode } : {}),
|
|
993
|
+
...(row.providerName ? { provider: row.providerName } : {}),
|
|
994
|
+
...(rows.length > 1 ? { instances: rows.map((r) => r.address).sort() } : {}),
|
|
995
|
+
...(extra ? extra(address) : {}),
|
|
996
|
+
},
|
|
997
|
+
},
|
|
998
|
+
queried,
|
|
999
|
+
};
|
|
1000
|
+
}
|
|
1001
|
+
if (entity.type === MODULE_TYPE) {
|
|
1002
|
+
if (!moduleIsLive(address, index))
|
|
1003
|
+
return { absent: true, queried };
|
|
1004
|
+
// The state has resources under this module but no row for the block
|
|
1005
|
+
// itself, so state membership, which is the whole ownership channel
|
|
1006
|
+
// here, has nothing to say about it. See the module doc.
|
|
1007
|
+
return {
|
|
1008
|
+
present: {
|
|
1009
|
+
type: entity.type,
|
|
1010
|
+
physicalId: address,
|
|
1011
|
+
status: "module",
|
|
1012
|
+
ownership: classifyStateOwnership(address, index),
|
|
1013
|
+
attributes: { address, root },
|
|
1014
|
+
},
|
|
1015
|
+
queried,
|
|
1016
|
+
};
|
|
1017
|
+
}
|
|
1018
|
+
return {
|
|
1019
|
+
unobserved: {
|
|
1020
|
+
reason: "unsupported-kind",
|
|
1021
|
+
detail: `${entity.type} has no row in terraform state: only resource and data blocks do`,
|
|
1022
|
+
},
|
|
1023
|
+
queried,
|
|
1024
|
+
};
|
|
1025
|
+
}
|
|
1026
|
+
/** Does this text name a credentials or authorization failure? Exported for the fallback tests. */
|
|
1027
|
+
export function planFailureIsCredentials(text) {
|
|
1028
|
+
return readsAsCredentials(text) || /no valid credential sources|could not find default credentials|failed to refresh cached credentials|NoCredentialProviders|AADSTS|InvalidAccessKeyId|token has expired/i.test(text);
|
|
1029
|
+
}
|
|
1030
|
+
/**
|
|
1031
|
+
* One plan-depth root's reader. `bind` is the fallback ladder:
|
|
1032
|
+
*
|
|
1033
|
+
* 1. An uninitialised root (or one that needs `init` again) is refused with
|
|
1034
|
+
* the line to run, and nothing else is read: the state read would need
|
|
1035
|
+
* `init` too, and chant never runs it on a read. Declared only.
|
|
1036
|
+
* 2. The plan read answers: `"plan"`.
|
|
1037
|
+
* 3. The plan read failed reaching the backend: the state read needs the
|
|
1038
|
+
* same backend, so declared only.
|
|
1039
|
+
* 4. The plan read failed any other way, missing provider credentials
|
|
1040
|
+
* first among them: `terraform show -json` over state, with no `init`
|
|
1041
|
+
* (the root is initialised, step 1 checked). `"state"`.
|
|
1042
|
+
* 5. That failed too: declared only.
|
|
1043
|
+
*
|
|
1044
|
+
* `answered` is filled as the ladder runs, for the caller's `sources` and
|
|
1045
|
+
* notes.
|
|
1046
|
+
*/
|
|
1047
|
+
function planAdapter(root, cwd, deps, outcome) {
|
|
1048
|
+
const where = cwd ? { cwd } : {};
|
|
1049
|
+
const planRead = deps.planRead ?? terraformPlanRead;
|
|
1050
|
+
let dir;
|
|
1051
|
+
let refusal;
|
|
1052
|
+
const firstLine = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
|
|
1053
|
+
return {
|
|
1054
|
+
async bind() {
|
|
1055
|
+
outcome.answered = "declared";
|
|
1056
|
+
let planErr;
|
|
1057
|
+
try {
|
|
1058
|
+
const read = await planRead({ root, ...where });
|
|
1059
|
+
dir = read.dir;
|
|
1060
|
+
const plan = indexPlan(read.json);
|
|
1061
|
+
outcome.answered = "plan";
|
|
1062
|
+
outcome.read = { depth: "plan" };
|
|
1063
|
+
outcome.note = `terraform.roots.${root}: the plan read answered (\`${read.command.replace(read.planDir, "<tmp>")}\`)`;
|
|
1064
|
+
return { kind: "plan", plan, state: indexStateResources({ values: asRecord(plan.priorState).values }) };
|
|
1065
|
+
}
|
|
1066
|
+
catch (err) {
|
|
1067
|
+
planErr = err;
|
|
1068
|
+
if (err instanceof TerraformPlanReadError)
|
|
1069
|
+
dir = err.dir;
|
|
1070
|
+
}
|
|
1071
|
+
const kind = planErr instanceof TerraformPlanReadError ? planErr.kind : "plan";
|
|
1072
|
+
if (kind === "not-initialised" || kind === "backend") {
|
|
1073
|
+
refusal = {
|
|
1074
|
+
reason: kind === "backend" && planFailureIsCredentials(String(planErr.message)) ? "no-credentials" : kind === "backend" ? "read-failed" : "no-binding",
|
|
1075
|
+
detail: `terraform.roots.${root}${dir ? ` (${dir})` : ""}: declared only. ${firstLine(planErr)}${kind === "backend" ? " The state read needs the same backend, so it was not tried." : ""}`,
|
|
883
1076
|
};
|
|
1077
|
+
outcome.read = { depth: "plan", fellBackTo: "declared", reason: kind === "backend" ? "backend-unreachable" : "needs-init" };
|
|
1078
|
+
outcome.note = `terraform.roots.${root}: no read answered, declared only (${kind === "backend" ? "the plan read could not reach the backend" : "the root needs init, which chant never runs"})`;
|
|
1079
|
+
throw planErr;
|
|
884
1080
|
}
|
|
885
|
-
|
|
886
|
-
|
|
887
|
-
|
|
888
|
-
|
|
889
|
-
|
|
890
|
-
|
|
891
|
-
|
|
892
|
-
|
|
893
|
-
|
|
894
|
-
|
|
895
|
-
|
|
896
|
-
|
|
897
|
-
|
|
898
|
-
},
|
|
899
|
-
queried,
|
|
1081
|
+
const why = planFailureIsCredentials(String(planErr?.message ?? planErr)) ? "no provider credentials" : "the plan failed";
|
|
1082
|
+
try {
|
|
1083
|
+
const shown = await deps.show({ root, ...where });
|
|
1084
|
+
dir = shown.dir;
|
|
1085
|
+
outcome.answered = "state";
|
|
1086
|
+
outcome.read = { depth: "plan", fellBackTo: "state", reason: why === "no provider credentials" ? "no-credentials" : "plan-failed" };
|
|
1087
|
+
outcome.note = `terraform.roots.${root}: the plan read failed (${why}: ${firstLine(planErr)}), so the state read answered; plan attributes are absent`;
|
|
1088
|
+
return { kind: "state", state: indexStateResources(shown.json) };
|
|
1089
|
+
}
|
|
1090
|
+
catch (err) {
|
|
1091
|
+
refusal = {
|
|
1092
|
+
reason: "read-failed",
|
|
1093
|
+
detail: `terraform.roots.${root}${dir ? ` (${dir})` : ""}: declared only. The plan read failed (${firstLine(planErr)}) and the state read after it failed too (${firstLine(err)})`,
|
|
900
1094
|
};
|
|
1095
|
+
outcome.read = { depth: "plan", fellBackTo: "declared", reason: "state-read-failed" };
|
|
1096
|
+
outcome.note = `terraform.roots.${root}: no read answered, declared only (the plan read failed, ${why}, and the state read failed after it)`;
|
|
1097
|
+
throw err;
|
|
1098
|
+
}
|
|
1099
|
+
},
|
|
1100
|
+
classifyBindFailure(err) {
|
|
1101
|
+
return refusal ?? { reason: "read-failed", detail: `terraform.roots.${root}${dir ? ` (${dir})` : ""}: ${firstLine(err)}` };
|
|
1102
|
+
},
|
|
1103
|
+
async read(index, entity) {
|
|
1104
|
+
const { address } = entity;
|
|
1105
|
+
if (index.kind === "state") {
|
|
1106
|
+
return readStateEntity(index.state, entity, root, `terraform show -json (root "${root}", address "${address}", after the plan read failed)`);
|
|
1107
|
+
}
|
|
1108
|
+
const plan = index.plan;
|
|
1109
|
+
const seen = readStateEntity(index.state, entity, root, `terraform plan -lock=false + show -json <planfile> (root "${root}", address "${address}")`, (a) => planAttributesFor(a, plan));
|
|
1110
|
+
// A planned create (#4372): no row in `prior_state`, so absent, which is
|
|
1111
|
+
// what makes `lifecycle plan` propose the create. The plan still says
|
|
1112
|
+
// what it will do and which values stay unknown until apply, so those
|
|
1113
|
+
// ride as annotations, which never make the block present.
|
|
1114
|
+
if ("absent" in seen && (entity.type === RESOURCE_TYPE || entity.type === DATA_TYPE)) {
|
|
1115
|
+
const planned = plannedAttributesFor(address, plan);
|
|
1116
|
+
if (planned)
|
|
1117
|
+
return { ...seen, annotations: planned };
|
|
901
1118
|
}
|
|
1119
|
+
return seen;
|
|
1120
|
+
},
|
|
1121
|
+
};
|
|
1122
|
+
}
|
|
1123
|
+
/**
|
|
1124
|
+
* One live root's reader at the plan depth (#4371): {@link liveAdapter}'s
|
|
1125
|
+
* read, unchanged, with the plan's attributes added to every block it bound.
|
|
1126
|
+
* See "On a live root" in the module doc.
|
|
1127
|
+
*/
|
|
1128
|
+
function livePlanDepthAdapter(root, cwd, deps, outcome) {
|
|
1129
|
+
const where = cwd ? { cwd } : {};
|
|
1130
|
+
const live = liveAdapter(root, cwd, deps);
|
|
1131
|
+
const planRead = deps.planRead ?? terraformPlanRead;
|
|
1132
|
+
const firstLine = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
|
|
1133
|
+
let command = "";
|
|
1134
|
+
return {
|
|
1135
|
+
async bind() {
|
|
1136
|
+
outcome.answered = "live";
|
|
1137
|
+
outcome.note = `terraform.roots.${root}: no read answered (\`live-plan -json\` failed, so the plan read was not tried)`;
|
|
1138
|
+
const index = await live.bind();
|
|
1139
|
+
try {
|
|
1140
|
+
const read = await planRead({ root, ...where });
|
|
1141
|
+
command = read.command.replace(read.planDir, "<tmp>");
|
|
1142
|
+
outcome.answered = "live+plan";
|
|
1143
|
+
outcome.read = { depth: "live+plan" };
|
|
1144
|
+
outcome.note = `terraform.roots.${root}: the plan read answered (\`${command}\`), beside \`live-plan -json\`, which answered presence and ownership`;
|
|
1145
|
+
return { live: index, plan: indexPlan(read.json) };
|
|
1146
|
+
}
|
|
1147
|
+
catch (err) {
|
|
1148
|
+
const kind = err instanceof TerraformPlanReadError ? err.kind : "plan";
|
|
1149
|
+
const why = kind === "not-initialised"
|
|
1150
|
+
? "the root needs init, which chant never runs"
|
|
1151
|
+
: planFailureIsCredentials(String(err instanceof Error ? err.message : err))
|
|
1152
|
+
? "no provider credentials"
|
|
1153
|
+
: kind === "backend"
|
|
1154
|
+
? "the plan read could not reach the backend"
|
|
1155
|
+
: "the plan failed";
|
|
1156
|
+
outcome.read = {
|
|
1157
|
+
depth: "live+plan",
|
|
1158
|
+
fellBackTo: "live",
|
|
1159
|
+
reason: kind === "not-initialised" ? "needs-init" : kind === "backend" ? "backend-unreachable" : why === "no provider credentials" ? "no-credentials" : "plan-failed",
|
|
1160
|
+
};
|
|
1161
|
+
outcome.note = `terraform.roots.${root}: the plan read failed (${why}: ${firstLine(err)}), so \`live-plan -json\` alone answered; plan attributes are absent`;
|
|
1162
|
+
return { live: index };
|
|
1163
|
+
}
|
|
1164
|
+
},
|
|
1165
|
+
classifyBindFailure(err) {
|
|
1166
|
+
return live.classifyBindFailure(err);
|
|
1167
|
+
},
|
|
1168
|
+
async read(index, entity) {
|
|
1169
|
+
const observed = await live.read(index.live, entity);
|
|
1170
|
+
const { plan } = index;
|
|
1171
|
+
if (!plan)
|
|
1172
|
+
return observed;
|
|
1173
|
+
const queried = `${observed.queried}; ${command} + show -json <planfile>`;
|
|
1174
|
+
const present = "present" in observed ? observed.present : undefined;
|
|
1175
|
+
if (!present || entity.type !== RESOURCE_TYPE || present.ownership !== "owned")
|
|
1176
|
+
return { ...observed, queried };
|
|
1177
|
+
const { address } = entity;
|
|
902
1178
|
return {
|
|
903
|
-
|
|
904
|
-
|
|
905
|
-
detail: `${entity.type} has no row in terraform state: only resource and data blocks do`,
|
|
906
|
-
},
|
|
1179
|
+
...observed,
|
|
1180
|
+
present: { ...present, attributes: { ...present.attributes, ...planAttributesFor(address, plan) } },
|
|
907
1181
|
queried,
|
|
908
1182
|
};
|
|
909
1183
|
},
|
|
910
1184
|
};
|
|
911
1185
|
}
|
|
1186
|
+
/** The environment variable that overrides every root's observation depth for one run (#4358). */
|
|
1187
|
+
export const TERRAFORM_OBSERVE_ENV = "CHANT_TERRAFORM_OBSERVE";
|
|
1188
|
+
/**
|
|
1189
|
+
* Each root's observation depth, in precedence order: the caller's `depth`,
|
|
1190
|
+
* then {@link TERRAFORM_OBSERVE_ENV}, then the root's own `observe`, then the
|
|
1191
|
+
* namespace's, then `"state"`. The config is read only when neither of the
|
|
1192
|
+
* first two settles it, and a config that cannot be read means `"state"`,
|
|
1193
|
+
* which is what every root read before the plan depth existed.
|
|
1194
|
+
*/
|
|
1195
|
+
async function observeDepths(options, notes) {
|
|
1196
|
+
if (options.depth)
|
|
1197
|
+
return () => options.depth;
|
|
1198
|
+
const env = process.env[TERRAFORM_OBSERVE_ENV];
|
|
1199
|
+
if (env === "plan" || env === "state")
|
|
1200
|
+
return () => env;
|
|
1201
|
+
if (env)
|
|
1202
|
+
notes.push(`${TERRAFORM_OBSERVE_ENV}=${JSON.stringify(env)} is neither "state" nor "plan" and was ignored`);
|
|
1203
|
+
try {
|
|
1204
|
+
const { loadChantConfigUpward } = await import("@intentius/chant/config");
|
|
1205
|
+
const { resolve } = await import("node:path");
|
|
1206
|
+
const { config } = await loadChantConfigUpward(resolve(options.cwd ?? process.cwd()));
|
|
1207
|
+
const namespace = config.terraform;
|
|
1208
|
+
return (root) => namespace?.roots?.[root]?.observe ?? namespace?.observe ?? "state";
|
|
1209
|
+
}
|
|
1210
|
+
catch {
|
|
1211
|
+
return () => "state";
|
|
1212
|
+
}
|
|
1213
|
+
}
|
|
912
1214
|
/**
|
|
913
1215
|
* Observe every declared terraform entity, one `init` + `show` per configured
|
|
914
1216
|
* root. Roots are read independently, so a broken backend on one never
|
|
@@ -938,21 +1240,56 @@ export async function describeResources(options, deps = REAL_DEPS) {
|
|
|
938
1240
|
// over state the same green as a live read of the account is the drift lie
|
|
939
1241
|
// an overlay exists to prevent.
|
|
940
1242
|
const sources = {};
|
|
1243
|
+
const rootReads = {};
|
|
1244
|
+
const depthOf = byRoot.size > 0 ? await observeDepths(options, notes) : () => "state";
|
|
941
1245
|
for (const [root, declared] of byRoot) {
|
|
942
1246
|
// One fact decides the whole read, and the parse already recorded it on
|
|
943
1247
|
// every entity of the root (#2103). A root is live when its binary is
|
|
944
1248
|
// choudoufu AND it declares an estate, so a single entity carrying
|
|
945
1249
|
// `mode: "live"` settles it for the root.
|
|
946
1250
|
const live = declared.some((entity) => entity.mode === "live");
|
|
947
|
-
|
|
948
|
-
sources[entity.name] = live ? "live" : "state";
|
|
1251
|
+
const depth = depthOf(root);
|
|
949
1252
|
if (live) {
|
|
950
1253
|
notes.push(`terraform.roots.${root} is a live root: ownership came from choudoufu's tofu-estate/tofu-address markers via \`live-plan -json\`, not from a state file`);
|
|
1254
|
+
if (depth === "plan") {
|
|
1255
|
+
// Both reads (#4371): `live-plan` for ownership, the plan for the
|
|
1256
|
+
// attributes on what it bound. `sources` is known only after the read.
|
|
1257
|
+
const outcome = { answered: "live", note: "" };
|
|
1258
|
+
const read = await observeEntities(declared, livePlanDepthAdapter(root, options.cwd, deps, outcome));
|
|
1259
|
+
for (const entity of declared)
|
|
1260
|
+
sources[entity.name] = outcome.answered;
|
|
1261
|
+
if (outcome.read)
|
|
1262
|
+
rootReads[`terraform.roots.${root}`] = outcome.read;
|
|
1263
|
+
if (outcome.note)
|
|
1264
|
+
notes.push(outcome.note);
|
|
1265
|
+
parts.push(normalizeObservation(read));
|
|
1266
|
+
continue;
|
|
1267
|
+
}
|
|
1268
|
+
for (const entity of declared)
|
|
1269
|
+
sources[entity.name] = "live";
|
|
1270
|
+
parts.push(normalizeObservation(await observeEntities(declared, liveAdapter(root, options.cwd, deps))));
|
|
1271
|
+
continue;
|
|
951
1272
|
}
|
|
952
|
-
|
|
953
|
-
|
|
954
|
-
|
|
955
|
-
|
|
1273
|
+
if (depth === "plan") {
|
|
1274
|
+
// The third depth (#4358). `sources` says which read answered, which on
|
|
1275
|
+
// a plan-depth root is only known after the read: the plan, the state
|
|
1276
|
+
// read it fell back to, or neither, in which case it names the read
|
|
1277
|
+
// that was attempted last.
|
|
1278
|
+
const outcome = { answered: "declared", note: "" };
|
|
1279
|
+
const read = await observeEntities(declared, planAdapter(root, options.cwd, deps, outcome));
|
|
1280
|
+
const value = outcome.answered === "state" ? "state" : "plan";
|
|
1281
|
+
for (const entity of declared)
|
|
1282
|
+
sources[entity.name] = value;
|
|
1283
|
+
if (outcome.read)
|
|
1284
|
+
rootReads[`terraform.roots.${root}`] = outcome.read;
|
|
1285
|
+
if (outcome.note)
|
|
1286
|
+
notes.push(outcome.note);
|
|
1287
|
+
parts.push(normalizeObservation(read));
|
|
1288
|
+
continue;
|
|
1289
|
+
}
|
|
1290
|
+
for (const entity of declared)
|
|
1291
|
+
sources[entity.name] = "state";
|
|
1292
|
+
parts.push(normalizeObservation(await observeEntities(declared, adapter(root, options.cwd, deps))));
|
|
956
1293
|
}
|
|
957
1294
|
const merged = mergeObservations(parts);
|
|
958
1295
|
merged.notes.push(...notes);
|
|
@@ -980,5 +1317,7 @@ export async function describeResources(options, deps = REAL_DEPS) {
|
|
|
980
1317
|
};
|
|
981
1318
|
}
|
|
982
1319
|
}
|
|
983
|
-
|
|
1320
|
+
// A planned create's plan attributes (#4372) ride beside the verdict, never
|
|
1321
|
+
// in `resources`: the block stays absent.
|
|
1322
|
+
return observation(resources, unobserved, merged.queried, merged.notes, undefined, sources, merged.annotations, rootReads);
|
|
984
1323
|
}
|
package/dist/hcl/parse.d.ts
CHANGED
|
@@ -44,6 +44,16 @@ export interface TerraformEntity extends Declarable {
|
|
|
44
44
|
readonly props: {
|
|
45
45
|
/** Terraform address, e.g. `aws_s3_bucket.assets`, `var.region`, `module.cdn`. */
|
|
46
46
|
readonly address: string;
|
|
47
|
+
/**
|
|
48
|
+
* A `resource` or `data` block's type and name, its two labels
|
|
49
|
+
* (`aws_instance` and `web` for `aws_instance.web`, `aws_ami` and `ubuntu`
|
|
50
|
+
* for `data.aws_ami.ubuntu`). Absent on every other block. Every resource
|
|
51
|
+
* is `Terraform::Resource` to chant, so this is what core's
|
|
52
|
+
* `terraformType()` reads for `chant search "kind:aws_instance"`,
|
|
53
|
+
* `--count-by kind` and the effective-topology folds (chant #4366).
|
|
54
|
+
*/
|
|
55
|
+
readonly type?: string;
|
|
56
|
+
readonly name?: string;
|
|
47
57
|
/** The block body, verbatim from hcl2json (interpolations survive as `"${...}"`). */
|
|
48
58
|
readonly body: BlockBody;
|
|
49
59
|
/** File the block came from, as named by the parse input. */
|
package/dist/hcl/parse.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAIrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;WAKG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;KACzC,CAAC;IACF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,4BAA4B,qCAAqC,CAAC;AAC/E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAExE,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAmC,CAAC;AAEtF,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC3J,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CA6BjB;AASD,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAoIlC;AA8BD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAclC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}
|