terrakube-io/terrakube 2.34.0

on GitHub

🌟 Highlights & Key Improvements

• Terraform / OpenTofu CLI OAuth Login Broker: Seamless browser-based login for CLI workflows via terraform login / tofu login, full support for CLI variable flags (-var, -var-file, TF_VAR), and key/value tags in the TFE-compatible API.

• Durable Structured Output & Streaming Resilience: Resilient recovery of plan/apply structured output via cloud storage spooling, real-time chunked log archiving, isolated streaming for slow viewers, and bounded diffs rendered into VCS PR comments.

• Scheduler FIFO & Queue Reliability: Prevented head-of-line blocking in executor FIFO queues for locked workspaces and zero-pending-step jobs, added Microsoft SQL Server and Azure SQL dialect compatibility, and hardened watchdog heartbeat intervals.

• Registry & Cloud Storage Enhancements: Direct presigned URL download redirects for AWS S3, Azure Blob, and GCP Cloud Storage; configurable S3 path-style access; server-side parsing of module inputs/outputs; and module version deprecation support.

• UI Overhaul & Responsive Experience: New responsive mobile navigation drawer (<768px), project-level search, collapsible project workspace groups, server-side cursor pagination, and Monaco editor asset tree-shaking for faster load times.

• Enterprise OPA Policy Governance & Fleet Management: Native Open Policy Agent (OPA) policy evaluation on Terraform plans across three enforcement levels (advisory, soft_mandatory, hard_mandatory), featuring organization-wide policy sets, workspace attachments, and multi-tiered exemption workflows.

• Workspace Dependency Graphs & Run Triggers: Declarative multi-workspace pipelines that automatically trigger downstream runs upon qualified state changes in upstream workspaces, protected by strict acyclic DAG validation.

• Native Terraform HTTP State Backend: Added built-in HTTP state backend REST endpoints to Terrakube API, authenticated via scoped short-lived tokens and supported by a dedicated executor implementation.

• Branch Protection for Apply & Destroy: Security controls enforcing that apply and destroy operations only execute against commits on the configured workspace branch (including VCS webhook triggers), along with dedicated destroy RBAC permissions.

• Framework Upgrade: Upgraded core Spring Boot framework runtime to 4.1.2.

Deployment

Please use helm chart version 4.7.16 to update

What's Changed

🚀 Features

• feat: Spring.boot 4.1.1 support by @alfespa17 in #3470
• feat: make the module refresh delays configurable by @rtrompier in #3456
• feat(registry): presigned URL redirect for AWS S3, Azure Blob, and GCP Cloud Storage by @alfespa17 in #3471
• feat: scale job log viewing to many concurrent viewers and large logs by @jakegroves in #3472
• perf(ui): reduce initial bundle and cache assets by @Macbet in #3476
• feat: optional S3 endpoint region, chunked encoding and checksum validation parameters by @7487 in #3473
• feat: configure Elide to maintain second-level precision for ISO-8601 date serialization and parsing by @alfespa17 in #3500
• feat: Job Details resilience for transient S3/context unavailability by @jakegroves in #3501
• feat(security): enhance federated authentication with multi-audience OIDC workload identity by @Macbet in #3474
• feat(scheduler): reconcile zero-pending-step jobs so they can't block the executor FIFO queue by @jakegroves in #3509
• feat: make S3 path-style access configurable by @azakri66 in #3524
• feat: add workspace settings to change VCS id by @alfespa17 in #3542
• feat: workspace dependency graph and run triggers by @klinux in #3547
• feat: Enterprise Open Policy Agent (OPA) Policy Governance & Fleet Management by @alfespa17 in #3548
• feat(workspaces): add GraphQL cursor pagination by @Macbet in #3514
• perf: aggregate organization summaries for UI navigation by @Macbet in #3488
• perf(ui): load only the Monaco languages and features the editors use by @Macbet in #3568
• feat(jobs): track and display plan approver by @Macbet in #3565
• feat(api): support key/value workspace tags in the TFE-compatible API by @hirokimatsueda in #3580
• feat(ui): run approval bar on the run details page by @Macbet in #3571
• feat(dev): support cross-platform local development by @jakegroves in #3598
• feat(registry): deprecate and remove module and provider versions by @Macbet in #3596
• feat: add Terraform/OpenTofu CLI login via Terrakube OAuth broker by @jakegroves in #3599
• perf(registry): parse module inputs, outputs and resources server-side by @Macbet in #3567
• feat(ui): edit, show and filter key/value workspace tags by @hirokimatsueda in #3649
• feat(ui): refresh the account and organization settings pages by @Macbet in #3648
• feat(api,ui): add a public provider page and default imports to the latest version by @Macbet in #3647
• feat(ui): responsive layout below 768px and a sidebar drawer on narrow viewports by @Macbet in #3569
• feat(executor): allow apply steps to require a saved plan by @JvitorA in #3639
• feat(ui): refresh the workspace, run, state, settings and registry pages by @Macbet in #3653
• feat(executor): make ephemeral job deadline, backoff limit, ttl, and grace period configurable by @putz612 in #3564
• feat: surface plan-only output changes in structured output (#3675) by @jakegroves in #3684
• feat(api,ui): ordered live-output replay and slow-viewer isolation by @jakegroves in #3703
• feat(ui): redesign the workspace webhook settings by @jakegroves in #3716
• feat(ui): collapsible project groups in the workspace list by @jakegroves in #3721
• feat(ui): last run and server paging in the project workspaces tab by @jakegroves in #3722
• perf: Redis log streaming, executor step waits and registry module packaging by @Macbet in #3683
• feat(ui): workspace overview shows the run that needs action by @jakegroves in #3732
• feat(executor,api): durable structured output recovery via cloud storage spooling (#3692) by @alfespa17 in #3724
• feat(executor): carry plan-built artifacts through to apply by @jakegroves in #3392
• feat(ui): run-level diagnostics and explicit output completeness on the run page by @jakegroves in #3749
• feat(executor): bound the memory used by step output and live log delivery by @jakegroves in #3750
• feat: support run-specific Terraform variables by @jakegroves in #3767
• feat(executor,api): stream the rendered plan and bound the text published for the PR comment by @jakegroves in #3769
• feat(api): add project claim to federated credential tokens by @Macbet in #3771
• feat(ui): Add search to the Projects page by @ktella in #3779
• feat: archive step output in parts while the step runs by @jakegroves in #3772
• feat(ui): edit the workspace repository URL in general settings by @Macbet in #3792
• feat(api): use GitHub usernames for push runs by @JvitorA in #3764
• feat(api,ui): restrict apply and destroy to the workspace branch by @jakegroves in #3817
• feat(api,executor): check that an apply or destroy commit is on the configured branch by @jakegroves in #3820
• feat(api): apply the branch restriction to runs that webhook events start by @jakegroves in #3821
• feat(api,ui): add a destroy permission and an opt-in approve rule for runs nobody approves by @jakegroves in #3833
• feat(api): add current Terraform state write and delete methods to StorageTypeService by @alfespa17 in #3826
• feat(api): add scoped WORKSPACE_EXECUTOR token authorization for HTTP state backend by @alfespa17 in #3827
• feat(api): add HTTP state backend REST endpoints to TerraformStateController by @alfespa17 in #3828
• feat(executor): add HttpTerraformStateImpl and dynamic HTTP backend configuration by @alfespa17 in #3829
• feat(executor): tie HTTP backend token TTL to ExecutorJobMaxDurationMinutes by @alfespa17 in #3850

🐛 Fixes

• refactor(ui): components factorisation & settings pages cleanup by @BaptisteCentreon in #3465
• fix(registry): handle null gitTag in module version path resolution by @alfespa17 in #3485
• fix(ui): restore workspace card click navigation in card view by @jakegroves in #3484
• fix(executor): restore full diagnostic text in CLI-driven plan/apply outputFix/executor cli plan diagnostic output by @jakegroves in #3483
• fix(executor): preserve streamed plan/apply output when the terraform client fails by @jakegroves in #3491
• fix(notification): stop spurious failed alerts for runs that recover and complete by @jakegroves in #3497
• fix(vcs): match webhook headers case-insensitively by @jakegroves in #3499
• fix(security): resolve JWT algorithm mismatch between token generation and validation by @alfespa17 in #3487
• fix: remove Quartz job context when job history pruning deletes jobs by @adeeelsameer in #3442
• fix: NullPointerException for Workspace/Project Scoped Workloads using federated credentials by @alfespa17 in #3511
• fix: scope workflow permissions and ensure stream closure in TerraformOutputController by @alfespa17 in #3512
• Fix: Ignore GitLab MR discussion resolutions to prevent rerunning the job by @ctpeter in #3508
• fix(scheduler): prevent trigger churn, in-flight step anomaly flagging, and stale status overwrites in the reconciliation sweep process. by @alfespa17 in #3516
• fix: improve job reliability by ensuring immediate heartbeat writes in JobExecutionWatchdog and relaxing reconciliation sweep grace periods. by @alfespa17 in #3522
• fix(ui): prevent invalid workspace sources from crashing the UI by @Macbet in #3527
• fix(storage): configure S3 checksum behavior on the client only by @7487 in #3529
• ci(workflows): skip builds for draft pull requests from forks [skip ci] by @alfespa17 in #3537
• fix: allow users with project write and org read access to link VCS to workspaces (#3530) by @alfespa17 in #3536
• fix: display correct job via source for webhook runs (#3535) by @alfespa17 in #3539
• fix: read job log stream with a single offset in RemoteTfeService by @putz612 in #3543
• fix: downgrade FlowConfig log from INFO to DEBUG to prevent false ERROR detection (#3544) by @alfespa17 in #3546
• fix: Microsoft SQL Server & Azure SQL compatibility for FIFO job dispatch queries and schema migrations by @alfespa17 in #3549
• fix(api): lift Elide's implicit 500-row cap on workspace collections by @alfespa17 in #3556
• Add Jake Groves as a maintainer by @alfespa17 in #3574
• Add jakegroves as a code owner by @alfespa17 in #3576
• refactor(compose): replace minio images with pgsty/silo by @at0miqx in #3575
• fix(api): bound outbound release index requests by @jakegroves in #3578
• fix: honor disabled ephemeral executor flag by @jakegroves in #3585
• fix(api): persist workspace job status as string enum by @jakegroves in #3586
• fix(api): migrate workspace job status enum values by @jakegroves in #3593
• fix(executor): keep the executable bit when unpacking CLI uploads by @SulimanAbdulrazzaq in #3581
• test(api): keep the lastJobStatus changeset in sync with JobStatus by @Macbet in #3566
• fix(registry): mint Azure SP/MI token before empty access token guard by @ZoesDev in #3600
• fix(executor): resolve Terraform version constraints before running commands by @jakegroves in #3603
• fix(executor): stop a failed plan-summary save leaving a stale "no changes" plan by @jakegroves in #3604
• fix(api): require manage rights to change module and provider versions by @Macbet in #3605
• fix(executor): keep terraform state and outputs out of the executor log by @Macbet in #3606
• fix(executor): allow CustomTofuReleasesUrl property override for tofu releases by @alfespa17 in #3619
• fix(api): encode encrypted log-read-url values with URL-safe Base64 by @Macbet in #3617
• fix(ui): dark theme, contrast and accessibility fixes by @Macbet in #3570
• fix(executor): self-heal invalid terraform/tofu binary cache archives by @jakegroves in #3622
• fix(api,ui): lift Elide's implicit 500-row cap on tags and add pagination to tag management (#3609) by @alfespa17 in #3635
• fix(api,ui): return 409 conflict and add client validation for duplicate global variables (#3607) by @alfespa17 in #3636
• fix(triggers): qualify run triggers by state serial and md5 identity (#3625) by @alfespa17 in #3634
• fix(executor): explicitly autowire BinaryCacheRecoveryService's two-arg constructor by @jakegroves in #3654
• fix: resolve SonarCloud reliability C rating issues by @alfespa17 in #3637
• fix(api): enforce the run trigger fan-out limit at edge creation, not dispatch by @jakegroves in #3631
• fix(api): serialize run trigger graph mutations with an organization-scoped lock by @jakegroves in #3632
• fix: working directory check in RemoteTfeService by @alfespa17 in #3662
• fix: correctness fixes for the download counter, Quartz threads, job context reads and the structured-output drain by @Macbet in #3667
• fix(registry): stop module cache keys colliding across organizations by @Macbet in #3640
• fix(api): make run trigger dispatch durable instead of an afterCommit callback by @jakegroves in #3633
• fix: classify GitHub token failures and bound dispatch retry to stop stuck jobs blocking the FIFO queue (#3665, #3666) by @jakegroves in #3668
• fix(executor): fail with a clear error when a releases list can't be fetched by @Macbet in #3652
• fix(ui): keep workspace variable tables inside their card by @user-cube in #3687
• fix: stop storage backends from silently swallowing errors (#3671) by @jakegroves in #3686
• fix(executor): correct resource status when only a diagnostic reports a failure by @jakegroves in #3676
• fix(api): handle OpenTofu encrypted state in current-state-version by @user-cube in #3685
• fix(api): reschedule the Quartz trigger when a workspace schedule is updated by @user-cube in #3688
• fix(executor,api): stop duplicating execution logs into the PR "Show Plan" comment by @jakegroves in #3677
• fix(ui,api): handle null executionMode on workspace overview by @alfespa17 in #3689
• fix(ui): keep resource warnings reachable when filtered out or no-op by @jakegroves in #3678
• fix(api,ui): validate collection name and description length by @muzfuz in #3698
• fix(api): restore state history access for state managers by @jakegroves in #3709
• test: update integration tests and executor token generation for job and step validation by @alfespa17 in #3714
• fix(api,executor): resolve a version constraint once per job by @jakegroves in #3708
• fix(api): append -target/-replace to an existing TF_CLI_ARGS_plan by @jozwior in #3700
• fix(executor,ui): preserve structured diagnostics across failed and interrupted executions (#3690) by @alfespa17 in #3705
• fix(api,executor): order structured-output context writes and stop stale overwrites by @Macbet in #3702
• fix(api,ui): raise workspace name limit to 128 and return a clear 400 when exceeded by @medlabib in #3720
• fix(api): preserve webhook run creators by @JvitorA in #3704
• fix(api): locked workspaces no longer block the global FIFO queue by @jakegroves in #3730
• fix(api): publish a job's PR result comment only once by @jakegroves in #3731
• fix(vcs): escape control characters in PR comments by @JvitorA in #3742
• Preserve Unicode in GitHub and Bitbucket requests by @JvitorA in #3745
• fix(api): a job with unresolved policy violations cannot be approved by @jakegroves in #3747
• test(api): fix JobPlanArtifactsPermissionTest after approval became guarded by @jakegroves in #3759
• fix(api): federated teams can read job context and logs by @jakegroves in #3757
• fix(api): the workspace status is the one of the run that holds the queue by @jakegroves in #3746
• fix(api,ui): runs waiting for approval no longer time out, and status changes outside Elide are not lost by @jakegroves in #3735
• fix(api,ui): recreate a shared repository webhook that was deleted on GitHub or GitLab by @jakegroves in #3770
• fix(api): increase Reactor Netty HTTP response header limit to 32 KiB (#3773) by @alfespa17 in #3775
• docs: refresh README screenshots and tidy the docs by @jakegroves in #3781
• refactor(executor): the policy step writes its output to a StepOutputBuffer by @jakegroves in #3768
• fix(executor,api): order human plan diff before apply output and fix remote CLI apply log streaming by @alfespa17 in #3778
• fix(api): identify workload runs without an email claim by @jakegroves in #3780
• docs: add the output delivery contract and correct the stale statements by @jakegroves in #3789
• refactor(executor,api): update configuration property loading and ephemeral job volume bindings by @alfespa17 in #3774
• fix(api): require plan permission to create a job. by @jakegroves in #3793
• fix(executor): keep the archived parts readable when the final step output cannot be saved by @jakegroves in #3790
• fix(api): raise implicit project collection cap to 10,000 by @ktella in #3784
• fix(api): apply the -var, -var-file and TF_VAR inputs of Terraform CLI runs by @jakegroves in #3804
• fix(api): wait for CLI approval readiness before finishing plans by @jakegroves in #3805
• fix(executor,devcontainer): resolve ephemeral secrets directory and file collision by @alfespa17 in #3791
• refactor(api): exclude deprecated tcl field from Schedule by @alfespa17 in #3814
• fix(api): cancel the jobs of a deleted workspace without stopping the reconciliation sweep by @jakegroves in #3832
• test(api): add end-to-end integration tests for Terraform HTTP state backend by @alfespa17 in #3830
• chore(devcontainer): use HttpTerraformStateImpl by default for local storage in setupDevelopmentEnvironment.sh by @alfespa17 in #3831

📦 Dependencies

New Contributors

• @azakri66 made their first contribution in #3524
• @SulimanAbdulrazzaq made their first contribution in #3581
• @JvitorA made their first contribution in #3639
• @user-cube made their first contribution in #3687
• @muzfuz made their first contribution in #3698
• @jozwior made their first contribution in #3700
• @medlabib made their first contribution in #3720
• @ktella made their first contribution in #3779

Full Changelog: 2.33.0...2.34.0