ovh/terraform-provider-ovh v2.23.0

on GitHub

2.23.0 (October 22, 2026)

🎉 Features:

• New resource: ovh_dedicated_ceph_pool (#1463)

• New resource: ovh_dedicated_ceph_user (#1463)

• New resource: ovh_email_domain_dkim (#1413)

• New resource: ovh_email_domain_redirection (#1417)

• New resource: ovh_iam_log_subscription, to forward the access policy logs of the account to a Logs Data Platform stream (#1514)

• New resource: ovh_me_api_log_subscription, to forward the activity logs of the account to a Logs Data Platform stream (#1514)

• New resource: ovh_me_logs_audit_log_subscription, to forward the audit logs of the account to a Logs Data Platform stream (#1514)

• New datasource: ovh_cloud_project_database_mongodb_users (#1476)

💪 Improvements:

• r/ovh_cloud_instance_snapshot, d/ovh_cloud_instance_snapshot, d/ovh_cloud_instance_snapshots, d/ovh_cloud_instance_image, d/ovh_cloud_instance_images: Add the computed os_type attribute (LINUX, WINDOWS or BAREMETAL_LINUX), to tell a Windows snapshot, which can only be restored on a Windows flavor, from a Linux one (#1465)
• d/ovh_cloud_project_database_users: Add the computed users list with the id, name, created_at and status of each user. user_ids is kept (#1476)
• d/ovh_cloud_project_database_user, d/ovh_cloud_project_database_clickhouse_user, d/ovh_cloud_project_database_mongodb_user, d/ovh_cloud_project_database_opensearch_user, d/ovh_cloud_project_database_postgresql_user, d/ovh_cloud_project_database_valkey_user: Allow looking up a user by id instead of name (#1477)
• r/ovh_cloud_storage_block_volume_snapshot, d/ovh_cloud_storage_block_volume_snapshot, d/ovh_cloud_storage_block_volume_snapshots: Add the computed snapshot status (current_state.status on the resource, status on the data sources), so a snapshot stuck in ERROR_DELETING no longer looks healthy (#1485)
• d/ovh_cloud_storage_file_share_snapshots: Add the optional share_id argument, to list only the snapshots of one file share (#1519)
• r/ovh_cloud_project_kube, d/ovh_cloud_project_kube: Add disable_public_networking and private_network_configuration.use_user_gateway, to create a standard cluster without public networking that uses its own gateway. Both can only be set at creation: changing them replaces the cluster. default_vrack_gateway and private_network_routing_as_default are now optional (#1511)
• r/ovh_dbaas_logs_input: Changing the configuration now updates the input in place and restarts it, instead of replacing it with a new ID, hostname and certificate. Switching between logstash and flowgger still replaces it (#1487)
• r/ovh_dedicated_server_reinstall_task: Add customizations.app_to_install, to install an application on top of the OS with an OS that supports it, like ubuntu2404-withapp_64 (#1412)
• r/ovh_dedicated_server_reinstall_task: Add storage.erase. Set it to false on a disk group not used for the OS installation to keep its data (#1409)
• r/ovh_ip_firewall_rule, d/ovh_ip_firewall_rule: Add destination_port_range and source_port_range (from, to). A rule changed outside of Terraform now shows as drift. Rules with a range that were created outside of Terraform and imported need the matching block in their configuration to avoid a replacement (#1512)

🐜 Bug fixes:

• r/ovh_cloud_project_alerting, r/ovh_cloud_project_gateway_interface, r/ovh_cloud_project_instance_snapshot, r/ovh_cloud_project_loadbalancer, r/ovh_cloud_project_region, r/ovh_cloud_project_region_network, r/ovh_cloud_project_ssh_key, r/ovh_cloud_project_storage, r/ovh_cloud_project_storage_object_bucket_lifecycle_configuration, r/ovh_cloud_project_storage_replication_job, r/ovh_cloud_project_volume, r/ovh_cloud_project_volume_backup: When service_name is omitted and taken from the OVH_CLOUD_PROJECT_SERVICE environment variable, it is now kept from the state. Before, every plan changed it, which replaced the resources that cannot update it in place (#1399)
• r/ovh_cloud_project_containerregistry_ip_restrictions_management, r/ovh_cloud_project_containerregistry_ip_restrictions_registry: Wait for the registry to be READY after each update, instead of failing with a 409 when the registry is still UPDATING (#1489)
• r/ovh_cloud_project_kube_iprestrictions, r/ovh_cloud_project_kube_log_subscription, r/ovh_cloud_project_kube_oidc: Destroying them after their cluster was deleted outside of Terraform no longer fails, and ovh_cloud_project_kube_oidc no longer makes every plan fail when its cluster or configuration is gone (#1522)
• r/ovh_cloud_project_volume: Renaming a volume created without availability_zone no longer replaces it (#1521)
• r/ovh_cloud_key_manager_secret: secret_type, algorithm and mode in lower case are now refused at validation, instead of failing with Provider produced invalid plan (#1492)
• r/ovh_cloud_project_database: advanced_configuration only keeps the keys set in the configuration, so the default values returned by the API no longer show as a change on every plan. The full advanced configuration can be read with d/ovh_cloud_project_database (#1364)
• r/ovh_cloud_storage_object_bucket: Removing tags now deletes them on the bucket. Before, the API kept the stored tags (#1486, #1509)
• r/ovh_vrack_ip: New resources get the same ID format as imported ones, vrack_<service_name>-block_<block>. Existing resources are migrated to this ID on their next refresh (#1421, #1470)
• r/ovh_vrack_dedicated_server_interface: Imported resources get the same ID format as created ones, vrack_<service_name>-dedicatedserverinterface_<interface_id>. Resources imported with the previous format are migrated to this ID on their next refresh (#1468)
• r/ovh_cloud_project_database: When the creation fails with NoMatchingCompute, the error now names the first value of the configuration (engine, version, plan, region, flavor, network, number of nodes or disk size) that matches no available configuration, with the available values (#1483)
• r/ovh_domain_zone_record, r/ovh_domain_zone_redirection: A failed zone refresh now fails the apply, instead of reporting success while the change is not served by the DNS servers. Credentials without the dnsZone:apiovh:refresh permission now get an error (#1410)
• r/ovh_domain_zone_dnssec: Save the status read from the API, so a DNSSEC activation cancelled by the API shows up as drift (#1480)
• r/ovh_savings_plan: Import now sets every argument, and a flavor or a period written differently from the API (b3-8 / B3-8, P12M / P1Y) no longer plans a replacement, which subscribed a new Savings Plan. The documentation and examples now use the P1Y and P3Y periods, the only ones offered (#1508)
• r/ovh_ip_firewall_rule: tcp_option and fragments are now refused at plan time when protocol is not tcp, instead of failing at apply (#1513)
• Resources created through the order workflow (e.g. r/ovh_domain_zone): Changing a configuration of plan or plan_option, like a DNS zone template, now replaces the resource instead of failing at apply (#1479)
• d/ovh_cloud_network_private_vrack: Fix the Value Conversion Error that made every read of the data source fail (#1499)

📚 Documentation:

• r/ovh_domain_zone: Clarify the DNS zone templates, and document stub as an empty zone containing only NS records (#1464)
• r/ovh_cloud_project_database: Explain that the number of nodes blocks sets the number of nodes, list the capabilities guide of each engine, and update the examples to plans, flavors and versions that are still available (#1498)
• r/ovh_cloud_project_storage: Add a replication example (#1517)
• New guide on choosing the plan, the duration and the pricing_mode of the resources created through the order workflow, and clearer descriptions of these arguments (#1510)
• Examples: Use the GRA11 and BHS5 regions instead of GRA1 and BHS1, which are no longer Public Cloud regions (#1505)
• README.md, CONTRIBUTING.md: Update the requirements (Terraform 1.0+), the build steps and the links (#1504)

⚙️ General:

• Bump Go to 1.27.3 and dependencies (#1481, #1516)
• Enable Dependabot version updates for Go modules and GitHub Actions (#1501, #1502)

❤️ Thanks for your contributions ❤️