Skip to content

Feature Branch for Terraform Lifecycle #11042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
ytimocin wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Feature Branch for Terraform Lifecycle #11042

ytimocin wants to merge 2 commits into from

Conversation

@ytimocin
Copy link
Contributor

@ytimocin ytimocin commented Jan 21, 2026 •
edited
Loading

Description

Feature branch for Radius.Core/terraformSettings, Radius.Core/bicepSettings, rad terraform commands, and more:

Tasks

Phase 1 - Core Implementation

Type of change

  • This pull request adds or changes features of Radius and has an approved issue (issue link required).

Fixes: #10615

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

  • An overview of proposed schema changes is included in a linked GitHub issue.
    • Yes
    • Not applicable
  • A design document PR is created in the design-notes repository, if new APIs are being introduced.
    • Yes
    • Not applicable
  • The design document has been reviewed and approved by Radius maintainers/approvers.
    • Yes
    • Not applicable
  • A PR for the samples repository is created, if existing samples are affected by the changes in this PR.
    • Yes
    • Not applicable
  • A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
    • Yes
    • Not applicable
  • A PR for the recipes repository is created, if existing recipes are affected by the changes in this PR.
    • Yes
    • Not applicable

@ytimocin ytimocin requested review from a team as code owners January 21, 2026 04:04
kachawla
kachawla previously approved these changes Jan 21, 2026
View reviewed changes
@ytimocin ytimocin force-pushed the features/terraform-bicep-settings branch from 968531a to 51932d8 Compare January 21, 2026 07:17
@ytimocin ytimocin temporarily deployed to functional-tests January 21, 2026 07:17 — with GitHub Actions Inactive
@ytimocin ytimocin changed the title Add env terraform/bicep settings schema (#11013) Feature Branch for Terraform Lifecycle Jan 21, 2026
@ytimocin
Copy link
Contributor Author

ytimocin commented Jan 21, 2026

Hey @kachawla ! Thanks for the approval but this is the feature branch and there will be a lot of additions to this branch. This branch will only be merged once all of them are complete.

@kachawla
Copy link
Contributor

kachawla commented Jan 21, 2026

Hey @kachawla ! Thanks for the approval but this is the feature branch and there will be a lot of additions to this branch. This branch will only be merged once all of them are complete.

I see. Thanks for letting me know. Should we move this PR to draft for now then?

@ytimocin ytimocin marked this pull request as draft January 21, 2026 17:59
@ytimocin ytimocin force-pushed the features/terraform-bicep-settings branch from 51932d8 to 133ec36 Compare January 22, 2026 21:19
@ytimocin ytimocin force-pushed the features/terraform-bicep-settings branch from 133ec36 to 45c1a6a Compare January 23, 2026 00:33
@ytimocin ytimocin temporarily deployed to functional-tests January 23, 2026 00:34 — with GitHub Actions Inactive
@radius-functional-tests
Copy link

radius-functional-tests bot commented Jan 23, 2026 •
edited
Loading

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details
Name Value
Repository radius-project/radius
Commit ref 45c1a6a
Unique ID func3e687c178d
Image tag pr-func3e687c178d
  • gotestsum 1.13.0
  • KinD: v0.29.0
  • Dapr: 1.14.4
  • Azure KeyVault CSI driver: 1.4.2
  • Azure Workload identity webhook: 1.3.0
  • Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func3e687c178d
  • Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
  • applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func3e687c178d
  • dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func3e687c178d
  • controller test image location: ghcr.io/radius-project/dev/controller:pr-func3e687c178d
  • ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func3e687c178d
  • deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

@ytimocin
Add env terraform/bicep settings schema (#11013)
f61aa49 
# Description

This pull request introduces conversion logic and related tests for the
new `BicepSettingsResource` type in the `v20250801preview` API version,
enabling seamless translation between versioned API models and internal
datamodel representations. Additionally, it updates the
`EnvironmentResource` conversion to include `BicepSettings` and
`TerraformSettings`, and marks several dependencies as peer dependencies
in package lock files.

**API resource conversion logic:**

* Added `bicepsettings_conversion.go` in
`pkg/corerp/api/v20250801preview` to implement bidirectional conversion
between `BicepSettingsResource` (versioned API type) and its internal
datamodel, including detailed mapping for authentication registry
settings.
* Updated `environment_conversion.go` to support conversion of
`BicepSettings` and `TerraformSettings` properties in
`EnvironmentResource`.

**Testing:**

* Added comprehensive unit tests in `bicepsettings_conversion_test.go`
to verify conversion logic for `BicepSettingsResource`, including
authentication scenarios and error handling for invalid types.

**Dependency management:**

* Marked several dependencies as peer dependencies in
`package-lock.json` for both `autorest.bicep` and `generator` packages
to improve dependency resolution and avoid duplication.
[[1]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R160)
[[2]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R1661)
[[3]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R1696)
[[4]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R1731)
[[5]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R1888)
[[6]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R2205)
[[7]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R2658)
[[8]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R3612)
[[9]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R5345)
[[10]](diffhunk://#diff-075b4bbd5a7ae383d7c25934867346d6019accb02b5c5830c2fe6854ce420203R5426)
[[11]](diffhunk://#diff-2c80cff24f8409b4ace1d93aae9e72fe0245398a137e056279b4fba9a788b99eR672)
[[12]](diffhunk://#diff-2c80cff24f8409b4ace1d93aae9e72fe0245398a137e056279b4fba9a788b99eR741)
[[13]](diffhunk://#diff-2c80cff24f8409b4ace1d93aae9e72fe0245398a137e056279b4fba9a788b99eR898)
[[14]](diffhunk://#diff-2c80cff24f8409b4ace1d93aae9e72fe0245398a137e056279b4fba9a788b99eR1265)
[[15]](diffhunk://#diff-2c80cff24f8409b4ace1d93aae9e72fe0245398a137e056279b4fba9a788b99eR2564)

## Type of change
- This pull request adds or changes features of Radius and has an
approved issue (issue link required).

Fixes: #issue_number

## Contributor checklist
Please verify that the PR meets the following requirements, where
applicable:

<!--
This checklist uses "TaskRadio" comments to make certain options
mutually exclusive.
See:
https://github.com/mheap/require-checklist-action?tab=readme-ov-file#radio-groups
For details on how this works and why it's required.
-->

- An overview of proposed schema changes is included in a linked GitHub
issue.
    - [ ] Yes <!-- TaskRadio schema -->
    - [x] Not applicable <!-- TaskRadio schema -->
- A design document PR is created in the [design-notes
repository](https://github.com/radius-project/design-notes/), if new
APIs are being introduced.
    - [ ] Yes <!-- TaskRadio design-pr -->
    - [x] Not applicable <!-- TaskRadio design-pr -->
- The design document has been reviewed and approved by Radius
maintainers/approvers.
    - [ ] Yes <!-- TaskRadio design-review -->
    - [x] Not applicable <!-- TaskRadio design-review -->
- A PR for the [samples
repository](https://github.com/radius-project/samples) is created, if
existing samples are affected by the changes in this PR.
    - [ ] Yes <!-- TaskRadio samples-pr -->
    - [x] Not applicable <!-- TaskRadio samples-pr -->
- A PR for the [documentation
repository](https://github.com/radius-project/docs) is created, if the
changes in this PR affect the documentation or any user facing updates
are made.
    - [ ] Yes <!-- TaskRadio docs-pr -->
    - [x] Not applicable <!-- TaskRadio docs-pr -->
- A PR for the [recipes
repository](https://github.com/radius-project/recipes) is created, if
existing recipes are affected by the changes in this PR.
    - [ ] Yes <!-- TaskRadio recipes-pr -->
    - [x] Not applicable <!-- TaskRadio recipes-pr -->

---------

Signed-off-by: ytimocin <ytimocin@microsoft.com>
@ytimocin ytimocin force-pushed the features/terraform-bicep-settings branch from 45c1a6a to f61aa49 Compare January 24, 2026 04:08
@ytimocin
feat: Terraform controller for install/uninstall/status (#11014)
2f83c6b 
# Description

This pull request introduces a new API and supporting backend for
installing, uninstalling, and tracking the status of Terraform binaries
in the Universal Control Plane (UCP). It includes new documentation, API
endpoints, configuration options, and backend logic for managing
Terraform installations, with a focus on supporting mirrored downloads
and robust status tracking.

The most important changes are:

**API and Documentation Enhancements:**

* Added a new section to the UCP documentation and created
`terraform-installer.md` describing the Terraform Installer API,
including endpoints for install, uninstall, and status, as well as usage
notes.
[[1]](diffhunk://#diff-314cc86e95eed998ca73d6e14e038dd28b57ab90a3e427d5850865329af88325L6-R16)
[[2]](diffhunk://#diff-9463bcacbdcc18c9cdff7c3094700cd9756b440dddb69177fc6a04341f0a8867R1-R8)

**Installer API Endpoints and Handlers:**

* Implemented new HTTP endpoints under `/installer/terraform` for
installing, uninstalling, and querying the status of Terraform binaries,
with handlers for request validation, queueing, and status response.
(`pkg/terraform/installer/routes.go`)
* Introduced request/response types, status models, and enums for
installer operations, version states, health, and API response
formatting. (`pkg/terraform/installer/types.go`)

**Installer Backend and Status Management:**

* Added a persistent status store for installer metadata, including
current/previous versions, per-version status, queue info, and error
tracking, with database-backed implementation.
(`pkg/terraform/installer/status_store.go`)
* Added helper for updating queue information in the installer status
(e.g., incrementing pending operations).
(`pkg/terraform/installer/queue_status.go`)

**Configuration and Constants:**

* Added a new configuration option `sourceBaseUrl` in `TerraformOptions`
to allow downloading Terraform from a mirror, supporting air-gapped
setups. (`pkg/armrpc/hostoptions/providerconfig.go`)
* Defined installer queue and status storage constants for consistent
resource naming. (`pkg/terraform/installer/constants.go`)

**Server Integration:**

* Updated API service initialization to support the new handler
registration pattern, improving clarity and maintainability.
(`pkg/server/apiservice.go`)

## Type of change

- This pull request adds or changes features of Radius and has an
approved issue (issue link required).

Fixes: #issue_number

## Contributor checklist
Please verify that the PR meets the following requirements, where
applicable:

<!--
This checklist uses "TaskRadio" comments to make certain options
mutually exclusive.
See:
https://github.com/mheap/require-checklist-action?tab=readme-ov-file#radio-groups
For details on how this works and why it's required.
-->

- An overview of proposed schema changes is included in a linked GitHub
issue.
    - [ ] Yes <!-- TaskRadio schema -->
    - [x] Not applicable <!-- TaskRadio schema -->
- A design document PR is created in the [design-notes
repository](https://github.com/radius-project/design-notes/), if new
APIs are being introduced.
    - [ ] Yes <!-- TaskRadio design-pr -->
    - [x] Not applicable <!-- TaskRadio design-pr -->
- The design document has been reviewed and approved by Radius
maintainers/approvers.
    - [ ] Yes <!-- TaskRadio design-review -->
    - [x] Not applicable <!-- TaskRadio design-review -->
- A PR for the [samples
repository](https://github.com/radius-project/samples) is created, if
existing samples are affected by the changes in this PR.
    - [ ] Yes <!-- TaskRadio samples-pr -->
    - [x] Not applicable <!-- TaskRadio samples-pr -->
- A PR for the [documentation
repository](https://github.com/radius-project/docs) is created, if the
changes in this PR affect the documentation or any user facing updates
are made.
    - [ ] Yes <!-- TaskRadio docs-pr -->
    - [x] Not applicable <!-- TaskRadio docs-pr -->
- A PR for the [recipes
repository](https://github.com/radius-project/recipes) is created, if
existing recipes are affected by the changes in this PR.
    - [ ] Yes <!-- TaskRadio recipes-pr -->
    - [x] Not applicable <!-- TaskRadio recipes-pr -->

Signed-off-by: ytimocin <ytimocin@microsoft.com>
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 24, 2026
View reviewed changes
pkg/terraform/installer/handler.go
}

targetDir := h.versionDir(job.Version)
if err := os.MkdirAll(targetDir, 0o755); err != nil {

Check failure

Code scanning / gosec

Expect directory permissions to be 0750 or less Error

Expect directory permissions to be 0750 or less
pkg/terraform/installer/handler.go
log.V(1).Info("failed to remove download archive", "path", archivePath, "error", err)
}

if err := os.Chmod(binaryPath, 0o755); err != nil {

Check failure

Code scanning / gosec

Expect file permissions to be 0600 or less Error

Expect file permissions to be 0600 or less
pkg/terraform/installer/handler.go
}

tmp := opts.Dst + ".tmp"
out, err := os.Create(tmp)

Check failure

Code scanning / gosec

Potential file inclusion via variable Error

Potential file inclusion via variable
pkg/terraform/installer/handler.go

// isZipArchive checks if a file is a ZIP archive by reading its magic bytes.
func isZipArchive(path string) (bool, error) {
f, err := os.Open(path)

Check failure

Code scanning / gosec

Potential file inclusion via variable Error

Potential file inclusion via variable
pkg/terraform/installer/handler.go
}

func copyFile(src, dst string) error {
in, err := os.Open(src)

Check failure

Code scanning / gosec

Potential file inclusion via variable Error

Potential file inclusion via variable
pkg/terraform/installer/handler.go

func writeFile(r io.Reader, dst string, perm os.FileMode) error {
tmp := dst + ".tmp"
out, err := os.Create(tmp)

Check failure

Code scanning / gosec

Potential file inclusion via variable Error

Potential file inclusion via variable
pkg/terraform/installer/handler.go

func (h *Handler) acquireLock() (*os.File, error) {
lockPath := filepath.Join(h.rootPath(), ".terraform-installer.lock")
f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o600)

Check failure

Code scanning / gosec

Potential file inclusion via variable Error

Potential file inclusion via variable
pkg/terraform/installer/handler.go
}

func (h *Handler) ensureRoot() error {
return os.MkdirAll(h.rootPath(), 0o755)

Check failure

Code scanning / gosec

Expect directory permissions to be 0750 or less Error

Expect directory permissions to be 0750 or less
pkg/terraform/installer/handler.go
}
// Cleanup temp file on any error; os.Remove will no-op if file was renamed.
defer func() {
out.Close()

Check warning

Code scanning / gosec

Errors unhandled Warning

Errors unhandled
pkg/terraform/installer/handler.go
// Cleanup temp file on any error; os.Remove will no-op if file was renamed.
defer func() {
out.Close()
os.Remove(tmp) // Safe: will fail silently if file was already renamed

Check warning

Code scanning / gosec

Errors unhandled Warning

Errors unhandled
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kachawla kachawla kachawla left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Terraform/Bicep Settings Lifecycle

3 participants

@ytimocin @kachawla