Terraform LXD Provider 3.1.0 has been released

Project Discussion LXD News
,
1

Terraform LXD Provider 3.1.0 Released

We are pleased to announce the release of Terraform LXD Provider 3.1.0.

This release focuses on improving LXD authentication and authorization identity management through the provider, aligning it even more closely with current LXD capabilities.

Provider documentation is available on the Terraform Registry.
Full release notes are available in the Terraform LXD provider 3.1.0 release notes.

Highlights

Bearer tokens

The provider now allows issuing LXD bearer tokens.

resource "lxd_auth_identity" "admin" {
  name   = "server-admin"
  type   = "bearer"
  groups = ["admins"]
}

resource "lxd_auth_identity_token" "token" {
  identity = lxd_auth_identity.admin.name
  expiry   = "30d"
}

output "token" {
  value     = lxd_auth_identity_token.token.token
  sensitive = true
}

A bearer token issued for Client token bearer identity can be used to authenticate with the main LXD REST API.

A bearer token issued for DevLXD token bearer identity allows communication between an LXD instance and the DevLXD API. Such tokens are primarily used for the LXD CSI driver that allows dynamic management of LXD storage volumes for Kubernetes workloads.

With the introduction of DevLXD tokens, the instance resource no longer manages devices that are owned by a DevLXD identity, to prevent the provider from detaching devices that are dynamically created through LXD CSI.

Identity provider groups

A new resource and data source were added for managing identity provider groups.

resource "lxd_auth_group" "viewers" {
  name = "viewers"
  permissions = [
    {
      entitlement = "viewer"
      entity_type = "server"
    }
  ]
}

resource "lxd_auth_identity_provider_group" "viewers" {
  name   = "viewers"
  groups = [lxd_auth_group.viewers.name]
}

Pending TLS identities

If the identity type is set to tls and the tls_certificate is not provided, the provider creates a pending TLS identity and exposes the retrieved trust token. When the trust token is consumed, the pending TLS identity becomes active. Once the identity becomes active, the provider reads the new identity type into state and produces no diff.

resource "lxd_auth_identity" "pending-identity" {
  type   = "tls"
  name   = "jane"
  groups = ["admins"]
}

output "trust_token" {
  value     = lxd_auth_identity.pending-identity.trust_token
  sensitive = true
}

Cluster-aware server configuration

The server resource is now cluster-aware, similar to storage pool and network configuration, allowing global configuration, default local configuration, and per-member local configuration to be specified in the same resource.

resource "lxd_server" "global" {
  config = {
    "core.bgp_asn"      = "65000"
    "core.bgp_routerid" = "127.0.0.1" # Local key applied to all cluster members, unless overridden.
  }

  member_overrides = {
    "member-1" = {
      config = {
        "core.bgp_address" = "10.0.0.1:179"
      }
    }

    "member-2" = {
      config = {
        "core.bgp_address" = "10.0.0.2:179"
      }
    }
  }
}

Bug fixes

  • Storage pool and network configuration no longer fails to modify the plan when the configuration contains unknown values.

  • Storage pool and network configuration key placeholders retrieved from LXD configuration metadata are now correctly compared against user-provided configuration.

Upgrade note

The identity resource has a new type argument that accepts tls, bearer and devlxd. It replaces auth_method, which accepts only tls and bearer. The bearer auth method covers two identity types, Client token bearer and DevLXD token bearer, and auth_method has no way to say which of the two to create. On the other hand, type names the identity type directly.

To prevent breaking changes, auth_method is still accepted and mutually exclusive with type. If auth_method is set, a warning is displayed asking you to switch to type.

In future releases, auth_method will become a computed (read only) field and type will be required.

Having issues?

If you run into a bug, regression, or documentation issue, please reach out by opening an issue on GitHub.

1 Like