mattrobinsonsre/terrapod v1.6.0

on GitHub

Terrapod is a free, open-source platform replacement for Terraform Enterprise. This release makes secrets a first-class part of the variable model: a variable can now hold a reference to a HashiCorp Vault secret instead of a value, and variable sets can target workspaces by rule rather than one at a time.

Highlights

• Vault as a variable value source — a workspace or variable-set variable can hold a reference ({mount, path, field}) instead of a literal. Terrapod reads the secret when a runner claims the run and delivers it through the same per-run Kubernetes Secret every other variable uses, so nothing is copied into Terrapod's database and dynamic credentials (database/creds/…, aws/creds/…) are minted fresh per run. Multiple Vault instances, Kubernetes auth, and a write-only reference model. See docs/vault.md.
• Rule-based workspace assignment for variable sets — a set can target workspaces by label, name glob, execution mode, agent pool and more, in the same shape autodiscovery already uses, instead of being assigned workspace by workspace. Define a credential once and let it follow the estate.
• Role reach preview, and the reverse access view — when writing a role, see which workspaces, agent pools, registry entries and catalog items it actually grants on, and why each matched. From the other side, a workspace can answer "who can reach this, and through which rule". An allow_all grant covers the estate-wide case explicitly rather than by a wildcard that never worked.
• Runner Job extraVolumes / extraVolumeMounts and hostAliases — mount an internal CA bundle or a shared cache into runner Jobs, and resolve internal hostnames without a DNS change. Both are plain pass-throughs to the Job pod spec.
• Narrower reserved label keys — the reserved set drops from ten keys to two (status and owner). Only those two are load-bearing: status is implemented as a virtual filter term, and owner maps to owner_email, which grants workspace admin. pool, mode, backend, drift, version, vcs, locked and branch are yours to use as labels.

Bug Fixes

• Org-scoped git_http_auth credentials could never match a real repository URL when git's useHttpPath was enabled, so a credential scoped to an organisation silently failed to serve repositories beneath it.
• The runner had no writable $HOME, and git credential configuration failed silently rather than reporting it.
• Verifying git configuration no longer requires an HTTP credential to be present.
• A Vault-sourced variable planned sensitive = false and applied sensitive = true in the Terraform provider, which is an inconsistent-result error followed by a diff that never converges. The same defect affected the git-auth categories.
• A variable set carrying a Vault reference could be assigned to a local-execution workspace, where references resolve to nothing because resolution happens only when a runner claims a run. All three write paths that can create that pairing now refuse it.
• Vault-sourced variables are refused on the git-auth categories, where a single resolved field cannot satisfy the JSON credential envelope those categories expect.
• Variable-set variables had no mobile layout; the page now renders cards at phone width, sharing one edit panel with the desktop table.
• A Slack integration that cannot connect no longer prevents the API from starting.
• Agent pool names are shown on the workspace page instead of internal pool identifiers.

Upgrading

Additive throughout — no API, wire-protocol, configuration, Helm-value or database change removes or renames anything, so a lagging runner, listener, SDK, provider or existing values.yaml keeps working. Vault support is off unless configured.

Status

Stable. Vault support is new in this release; the remaining known gap is documented in docs/vault.md under Limits.

Full Changelog: v1.5.4...v1.6.0