v0.30.0: this provider is moving to the jamf namespace soon!

Advance notice of the namespace move, plus the fixes reported against v0.29.0.

The jamf namespace

A future release will publish this provider as jamf/jamfplatform in place of jamf-concepts/jamfplatform. Terraform records that namespace in state, so a version bump will not pick it up.

Change nothing today. Releases under jamf-concepts/jamfplatform keep working. From this release the provider warns you on every plan and apply.

When you upgrade to that release, in each workspace and state file holding jamfplatform resources:

1. terraform state replace-provider jamf-concepts/jamfplatform jamf/jamfplatform
2. Point source at jamf/jamfplatform in required_providers.
3. terraform init -upgrade

Step 1 asks for confirmation and writes a backup; add -auto-approve for CI. OpenTofu works the same way, with tofu for terraform. Reference.

Platform API GA follow-up

v0.28.1 and earlier cannot reach the Jamf Platform API, which retired its beta gateway and revoked beta credentials at GA. Register a replacement API integration in Jamf Account, environment-scoped, and read Upgrading to the Platform API GA.

The provider now refuses the wrong integration scope at configure time, before an apply starts: a tenant-scoped credential aimed at Blueprints or Compliance Benchmarks stops in under a second with a named diagnostic, and that diagnostic names the swap, since tenant_id and environment_id are mutually exclusive. Jamf Account will not grant either family's permissions to a tenant-scoped integration. Platform devices, device groups and device actions still work under tenant_id.

Every "Required Jamf permissions" table now names the integration scope alongside the boxes to tick.

Fixes

• An unstable upload URL failed a first apply with "Provider produced inconsistent final plan" on jamfplatform_pro_icon, jamfplatform_pro_self_service_branding_image and jamfplatform_pro_enrollment_customization. Apple's iTunes artwork CDN answers one URL with different bytes per request. All three now hash the bytes they upload, during apply. A local path is still hashed on every plan. A URL is not fetched during a plan, so the provider will not see a new image published behind an unchanged URL. Commit the file instead. (#373)
• Import dropped attributes. jamfplatform_device_group left description and members null. jamfplatform_pro_account left the whole privileges grid null, so terraform plan -generate-config-out emitted a Full Access account with no privileges block. (#372)
• Corrected the branding image documentation. Jamf Pro stores an uploaded branding image verbatim, so point image_file_source at your own file. The re-encode warning belongs to jamfplatform_pro_icon.
• Fixed a nil-pointer crash on a Terraform client with no resource-identity support. Terraform 1.13 and later are unaffected.

Built on jamfplatform-go-sdk v0.22.0.

Full Changelog: v0.29.0...v0.30.0