Terraform state backend for Flow runs issue #252 closed: completed andymccall opened this 18 days ago · 0 comments

The hub keeps Terraform/OpenTofu state for each repository, so Flow pipelines need no cloud credentials just to hold state.

Approach:

• Backend: Terraform's standard HTTP backend, with locking (LOCK/UNLOCK), at a per-repository path such as /api/v1/repos/OWNER/NAME/terraform/state/NAME.
• Auth: a Flow job authenticates with its job token. People use their API tokens, with access from their repository role.
• Storage: state is kept outside repository history, because it often holds secrets. It is encrypted at rest (see the customer-keys issue), with earlier versions kept for rollback.
• Fit: pairs with the approval gates that already exist for plans.
• Caveat: the hub's own infrastructure (oxygenhub-gcp) must not keep its state on the hub it deploys.

Low priority: after the core work. The smallest of the three ideas filed together.