Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opentofu for openSUSE:Factory checked in at 2025-12-20 21:46:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opentofu (Old) and /work/SRC/openSUSE:Factory/.opentofu.new.1928 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opentofu" Sat Dec 20 21:46:35 2025 rev:41 rq:1323743 version:1.11.2 Changes: -------- --- /work/SRC/openSUSE:Factory/opentofu/opentofu.changes 2025-12-11 18:43:31.542979718 +0100 +++ /work/SRC/openSUSE:Factory/.opentofu.new.1928/opentofu.changes 2025-12-20 21:49:00.141426536 +0100 @@ -1,0 +2,31 @@ +Sat Dec 20 07:01:10 UTC 2025 - Johannes Kastl <[email protected]> + +- Update to version 1.11.2: + * UPGRADE NOTES: + - The change from #2643, that was announced previously in + v1.11.0, has been reverted in this release. OpenTofu will no + longer directly recommend using the -exclude= option to work + around problems caused by unknown values in provider + configurations. + - Unfortunately there are existing providers that spuriously + report that they cannot plan due to unknown values even when + planning would have been successful, and so we cannot rely on + providers to accurately signal when unknown values are the + cause of an error. Using -exclude is still a valid workaround + for these problems even though OpenTofu cannot accurately + detect when it's useful to make that suggestion. + * BUG FIXES: + - Fix crash in plan -generate-config-out with read-only nested + attributes (#3553) + - It's now possible again to plan changes with the + hashicorp/helm and hashicorp/kubernetes providers when the + provider configuration contains unknown values, as long as + the configuration is carefully written to avoid the plan + phase actually depending on those values. (#3592) + - When running tofu init on Windows with an azurerm backend, + the subscription_id is quoted correctly allowing successful + authentication. (#3602) + - Fix serialization error in apply when using cloud backend + (#3611) + +------------------------------------------------------------------- Old: ---- opentofu-1.11.1.obscpio New: ---- opentofu-1.11.2.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opentofu.spec ++++++ --- /var/tmp/diff_new_pack.ttJhNR/_old 2025-12-20 21:49:08.461771745 +0100 +++ /var/tmp/diff_new_pack.ttJhNR/_new 2025-12-20 21:49:08.465771911 +0100 @@ -19,7 +19,7 @@ %define executable_name tofu Name: opentofu -Version: 1.11.1 +Version: 1.11.2 Release: 0 Summary: Declaratively manage your cloud infrastructure License: MPL-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.ttJhNR/_old 2025-12-20 21:49:08.505773571 +0100 +++ /var/tmp/diff_new_pack.ttJhNR/_new 2025-12-20 21:49:08.513773903 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/opentofu/opentofu/</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v1.11.1</param> + <param name="revision">v1.11.2</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.ttJhNR/_old 2025-12-20 21:49:08.541775064 +0100 +++ /var/tmp/diff_new_pack.ttJhNR/_new 2025-12-20 21:49:08.545775230 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/opentofu/opentofu/</param> - <param name="changesrevision">85de3d40fae67efb8cfe9020bba738433b49c409</param></service></servicedata> + <param name="changesrevision">c0b3d3d37b345579908012f0c9b8caa26499f7e4</param></service></servicedata> (No newline at EOF) ++++++ opentofu-1.11.1.obscpio -> opentofu-1.11.2.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/CHANGELOG.md new/opentofu-1.11.2/CHANGELOG.md --- old/opentofu-1.11.1/CHANGELOG.md 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/CHANGELOG.md 2025-12-19 19:25:13.000000000 +0100 @@ -1,6 +1,21 @@ The v1.11.x release series is supported until **August 1 2026**. -## 1.11.2 (Unreleased) +## 1.11.3 (Unreleased) + +## 1.11.2 + +UPGRADE NOTES: + +* The change from [#2643](https://github.com/opentofu/opentofu/pull/2643), that was announced previously in v1.11.0, has been reverted in this release. OpenTofu will no longer directly recommend using the `-exclude=` option to work around problems caused by unknown values in provider configurations. + + Unfortunately there are existing providers that spuriously report that they cannot plan due to unknown values even when planning would have been successful, and so we cannot rely on providers to accurately signal when unknown values are the cause of an error. Using `-exclude` still a valid workaround for these problems even though OpenTofu cannot accurately detect when it's useful to make that suggestion. + +BUG FIXES: + +* Fix crash in plan -generate-config-out with read-only nested attributes ([#3553](https://github.com/opentofu/opentofu/pull/3553)) +* It's now possible again to plan changes with the `hashicorp/helm` and `hashicorp/kubernetes` providers when the provider configuration contains unknown values, as long as the configuration is carefully written to avoid the plan phase actually depending on those values. ([#3592](https://github.com/opentofu/opentofu/pull/3592)) +* When running `tofu init` on Windows with an azurerm backend, the subscription_id is quoted correctly allowing successful authentication. ([#3602](https://github.com/opentofu/opentofu/pull/3602)) +* Fix serialization error in apply when using cloud backend ([#3611](https://github.com/opentofu/opentofu/pull/3611)) ## 1.11.1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/go.mod new/opentofu-1.11.2/go.mod --- old/opentofu-1.11.1/go.mod 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/go.mod 2025-12-19 19:25:13.000000000 +0100 @@ -13,8 +13,8 @@ require ( cloud.google.com/go/kms v1.23.2 cloud.google.com/go/storage v1.57.0 - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 @@ -131,7 +131,7 @@ github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/Azure/go-ntlmssp v0.0.0-20200615164410-66371956d46c // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/BurntSushi/toml v1.2.1 // indirect github.com/ChrisTrenkamp/goxpath v0.0.0-20190607011252-c5096ec8773d // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/go.sum new/opentofu-1.11.2/go.sum --- old/opentofu-1.11.1/go.sum 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/go.sum 2025-12-19 19:25:13.000000000 +0100 @@ -27,10 +27,10 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= github.com/AlecAivazis/survey/v2 v2.3.6 h1:NvTuVHISgTHEHeBFqt6BHOe4Ny/NwGZr7w+F8S9ziyw= github.com/AlecAivazis/survey/v2 v2.3.6/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 h1:KpMC6LFL7mqpExyMC9jVOYRiVhLmamjeZfRsUpB7l4s= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= @@ -56,8 +56,8 @@ github.com/Azure/go-ntlmssp v0.0.0-20200615164410-66371956d46c/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs= +github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak= github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/cloud/state.go new/opentofu-1.11.2/internal/cloud/state.go --- old/opentofu-1.11.1/internal/cloud/state.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/cloud/state.go 2025-12-19 19:25:13.000000000 +0100 @@ -222,19 +222,19 @@ return err } + stateFile, err := statefile.Read(bytes.NewReader(buf.Bytes()), s.encryption) + if err != nil { + return fmt.Errorf("failed to read state: %w", err) + } + var jsonState []byte if schemas != nil { - jsonState, err = jsonstate.Marshal(f, schemas) + jsonState, err = jsonstate.Marshal(stateFile, schemas) if err != nil { return err } } - stateFile, err := statefile.Read(bytes.NewReader(buf.Bytes()), s.encryption) - if err != nil { - return fmt.Errorf("failed to read state: %w", err) - } - ov, err := jsonstate.MarshalOutputs(stateFile.State.RootModule().OutputValues) if err != nil { return fmt.Errorf("failed to translate outputs: %w", err) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/cloud/state_test.go new/opentofu-1.11.2/internal/cloud/state_test.go --- old/opentofu-1.11.1/internal/cloud/state_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/cloud/state_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -8,11 +8,16 @@ import ( "bytes" "context" + "maps" "os" + "slices" "testing" "time" tfe "github.com/hashicorp/go-tfe" + "github.com/opentofu/opentofu/internal/configs/configschema" + "github.com/opentofu/opentofu/internal/providers" + "github.com/opentofu/opentofu/internal/tofu" "github.com/zclconf/go-cty/cty" "github.com/opentofu/opentofu/internal/addrs" @@ -430,3 +435,103 @@ } } } + +func TestState_PersistStateCorrectlyWithoutEphemeral(t *testing.T) { + // This test is meant to test that a state containing ephemeral resources can be marshalled correctly + // by filtering out the ephemeral ones from the content. + remoteClientMock := &MockStateVersions{ + states: map[string][]byte{}, + outputStates: map[string][]byte{}, + stateVersions: map[string]*tfe.StateVersion{}, + workspaces: map[string][]string{}, + } + cloudState := &State{ + state: states.NewState(), + readState: states.NewState(), + workspace: &tfe.Workspace{ + ID: "test", + }, + tfeClient: &tfe.Client{ + StateVersions: remoteClientMock, + }, + encryption: encryption.Disabled().State(), + } + // prepare addresses + provAddr := addrs.MustParseProviderSourceString("test") + ephAddr, diags := addrs.ParseAbsResourceInstanceStr("ephemeral.test_resource.test") + if diags != nil { + t.Fatalf("could not parse ephemeral resource address: %s", diags) + } + resAddr, diags := addrs.ParseAbsResourceInstanceStr("test_resource.test") + if diags != nil { + t.Fatalf("could not parse ephemeral resource address: %s", diags) + } + + resSchema := configschema.Block{ + Attributes: map[string]*configschema.Attribute{ + "id": { + Type: cty.String, + Optional: true, + }, + }, + } + schemas := &tofu.Schemas{ + Providers: map[addrs.Provider]providers.ProviderSchema{ + provAddr: { + EphemeralResources: map[string]providers.Schema{ + "test_resource": { + Block: &resSchema, + }, + }, + ResourceTypes: map[string]providers.Schema{ + "test_resource": { + Block: &resSchema, + }, + }, + }, + }, + } + // prepare new state + cloudState.state.SyncWrapper().SetResourceInstanceCurrent(ephAddr, &states.ResourceInstanceObjectSrc{ + AttrsJSON: []byte(`{"id":"test"}`), + Status: states.ObjectReady, + }, addrs.AbsProviderConfig{ + Provider: provAddr, + }, addrs.NoKey) + + cloudState.state.SyncWrapper().SetResourceInstanceCurrent(resAddr, &states.ResourceInstanceObjectSrc{ + AttrsJSON: []byte(`{"id":"test"}`), + Status: states.ObjectReady, + }, addrs.AbsProviderConfig{ + Provider: provAddr, + }, addrs.NoKey) + + if err := cloudState.PersistState(t.Context(), schemas); err != nil { + t.Fatalf("expected no error, got %q", err) + } + + var expectedSerial uint64 = 1 + if cloudState.readSerial != expectedSerial { + t.Fatalf("expected initial state readSerial to be %d, got %d", expectedSerial, cloudState.readSerial) + } + if got, want := len(remoteClientMock.states), 1; got != want { + t.Fatalf("expected to have %d state objects but got %d", want, got) + } + // since the key is an url with randomly generated keys, we just get the values to work with + dat := slices.Collect(maps.Values(remoteClientMock.states))[0] + unmarshalledState, err := statefile.Read(bytes.NewReader(dat), encryption.Disabled().State()) + if err != nil { + t.Fatalf("failed to unmarshal the generated state: %s", err) + } + moduleState := unmarshalledState.State.Modules[addrs.RootModule.String()] + if got, want := len(moduleState.Resources), 1; got != want { + t.Fatalf("expected to have %d resources in the module state but got %d: %#v", want, got, moduleState.Resources) + } + resState, ok := moduleState.Resources[resAddr.String()] + if !ok { + t.Fatalf("expected to have in the state a resource for %s but is not there: %#v", resAddr.String(), moduleState.Resources) + } + if got, want := resState.Addr.Resource.Mode, addrs.ManagedResourceMode; got != want { + t.Fatalf("expected the resource to be %s but it's %s", want, got) + } +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/configs/configschema/filter.go new/opentofu-1.11.2/internal/configs/configschema/filter.go --- old/opentofu-1.11.1/internal/configs/configschema/filter.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/configs/configschema/filter.go 2025-12-19 19:25:13.000000000 +0100 @@ -57,7 +57,7 @@ ret.Attributes[name] = &attr } - if attr.NestedType != nil { + if ret.Attributes[name] != nil && attr.NestedType != nil { ret.Attributes[name].NestedType = filterNestedType((&attr).NestedType, filterAttribute) } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/configs/configschema/filter_test.go new/opentofu-1.11.2/internal/configs/configschema/filter_test.go --- old/opentofu-1.11.1/internal/configs/configschema/filter_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/configs/configschema/filter_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -176,6 +176,18 @@ Nesting: NestingList, }, }, + "read_only_nested": { + NestedType: &Object{ + Attributes: map[string]*Attribute{ + "string": { + Type: cty.String, + Optional: true, + }, + }, + Nesting: NestingList, + }, + Computed: true, + }, }, BlockTypes: map[string]*NestedBlock{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin/convert/deferral.go new/opentofu-1.11.2/internal/plugin/convert/deferral.go --- old/opentofu-1.11.1/internal/plugin/convert/deferral.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin/convert/deferral.go 1970-01-01 01:00:00.000000000 +0100 @@ -1,24 +0,0 @@ -// Copyright (c) The OpenTofu Authors -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2023 HashiCorp, Inc. -// SPDX-License-Identifier: MPL-2.0 - -package convert - -import ( - "github.com/opentofu/opentofu/internal/providers" - "github.com/opentofu/opentofu/internal/tfplugin5" -) - -func DeferralReasonFromProto(reason tfplugin5.Deferred_Reason) providers.DeferralReason { - switch reason { - case tfplugin5.Deferred_RESOURCE_CONFIG_UNKNOWN: - return providers.DeferredBecauseResourceConfigUnknown - case tfplugin5.Deferred_PROVIDER_CONFIG_UNKNOWN: - return providers.DeferredBecauseProviderConfigUnknown - case tfplugin5.Deferred_ABSENT_PREREQ: - return providers.DeferredBecausePrereqAbsent - default: - return providers.DeferredReasonUnknown - } -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin/grpc_provider.go new/opentofu-1.11.2/internal/plugin/grpc_provider.go --- old/opentofu-1.11.1/internal/plugin/grpc_provider.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin/grpc_provider.go 2025-12-19 19:25:13.000000000 +0100 @@ -34,14 +34,6 @@ } var clientCapabilities = &proto.ClientCapabilities{ - // DeferralAllowed tells the provider that it is allowed to respond to - // all of the various post-configuration requests (as described by the - // [providers.Configured] interface) by reporting that the request - // must be "deferred" because there isn't yet enough information to - // satisfy the request. Setting this means that we need to be prepared - // for there to be a "deferred" object in the response from various - // other provider RPC functions. - DeferralAllowed: true, // WriteOnlyAttributesAllowed indicates that the current system version // supports write-only attributes. // This enables the SDK to run specific validations and enable the @@ -502,11 +494,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.NewState, resSchema.Block.ImpliedType()) if err != nil { @@ -589,11 +576,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.PlannedState, resSchema.Block.ImpliedType()) if err != nil { @@ -716,11 +698,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } for _, imported := range protoResp.ImportedResources { resource := providers.ImportedResource{ @@ -839,11 +816,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.State, dataSchema.Block.ImpliedType()) if err != nil { @@ -902,9 +874,6 @@ renewAt := protoResp.RenewAt.AsTime() resp.RenewAt = &renewAt } - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - resp.Deferred = &providers.EphemeralResourceDeferred{DeferralReason: convert.DeferralReasonFromProto(protoDeferred.Reason)} - } return resp } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin/grpc_provider_test.go new/opentofu-1.11.2/internal/plugin/grpc_provider_test.go --- old/opentofu-1.11.1/internal/plugin/grpc_provider_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin/grpc_provider_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -14,7 +14,6 @@ "testing" "time" - "github.com/davecgh/go-spew/spew" "github.com/google/go-cmp/cmp" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/msgpack" @@ -826,52 +825,6 @@ } } -func TestGRPCProvider_PlanResourceChange_deferred(t *testing.T) { - client := mockProviderClient(t) - p := &GRPCProvider{ - client: client, - } - - client.EXPECT().PlanResourceChange( - gomock.Any(), - gomock.Any(), - ).Return(&proto.PlanResourceChange_Response{ - PlannedState: &proto.DynamicValue{ - Msgpack: []byte("\x81\xa4attr\xa3bar"), - }, - Deferred: &proto.Deferred{ - Reason: proto.Deferred_PROVIDER_CONFIG_UNKNOWN, - }, - }, nil) - - resp := p.PlanResourceChange(t.Context(), providers.PlanResourceChangeRequest{ - TypeName: "resource", - PriorState: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("foo"), - }), - ProposedNewState: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("bar"), - }), - Config: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("bar"), - }), - }) - - if len(resp.Diagnostics) != 1 { - t.Fatal("wrong number of diagnostics; want one\n" + spew.Sdump(resp.Diagnostics)) - } - desc := resp.Diagnostics[0].Description() - if got, want := desc.Summary, `Provider configuration is incomplete`; got != want { - t.Errorf("wrong error summary\ngot: %s\nwant: %s", got, want) - } - if got, want := desc.Detail, `The provider was unable to work with this resource because the associated provider configuration makes use of values from other resources that will not be known until after apply.`; got != want { - t.Errorf("wrong error detail\ngot: %s\nwant: %s", got, want) - } - if !providers.IsDeferralDiagnostic(resp.Diagnostics[0]) { - t.Errorf("diagnostic is not marked as being a \"deferral diagnostic\"") - } -} - func TestGRPCProvider_PlanResourceChangeJSON(t *testing.T) { client := mockProviderClient(t) p := &GRPCProvider{ @@ -1301,9 +1254,6 @@ }, Private: []byte("private data"), RenewAt: timestamppb.New(future), - Deferred: &proto.Deferred{ - Reason: proto.Deferred_RESOURCE_CONFIG_UNKNOWN, - }, }, nil) resp := p.OpenEphemeralResource(t.Context(), providers.OpenEphemeralResourceRequest{ @@ -1327,14 +1277,6 @@ if got, want := resp.Private, []byte("private data"); !slices.Equal(got, want) { t.Fatalf("unexpected private data. got: %q, want %q", got, want) } - { - if resp.Deferred == nil { - t.Fatal("expected to have a deferred object but got none") - } - if got, want := resp.Deferred.DeferralReason, providers.DeferredBecauseResourceConfigUnknown; got != want { - t.Fatalf("unexpected deferred reason. got: %d, want %d", got, want) - } - } }) t.Run("requested type is not in schema", func(t *testing.T) { client := mockProviderClient(t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin6/convert/deferral.go new/opentofu-1.11.2/internal/plugin6/convert/deferral.go --- old/opentofu-1.11.1/internal/plugin6/convert/deferral.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin6/convert/deferral.go 1970-01-01 01:00:00.000000000 +0100 @@ -1,24 +0,0 @@ -// Copyright (c) The OpenTofu Authors -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2023 HashiCorp, Inc. -// SPDX-License-Identifier: MPL-2.0 - -package convert - -import ( - "github.com/opentofu/opentofu/internal/providers" - "github.com/opentofu/opentofu/internal/tfplugin6" -) - -func DeferralReasonFromProto(reason tfplugin6.Deferred_Reason) providers.DeferralReason { - switch reason { - case tfplugin6.Deferred_RESOURCE_CONFIG_UNKNOWN: - return providers.DeferredBecauseResourceConfigUnknown - case tfplugin6.Deferred_PROVIDER_CONFIG_UNKNOWN: - return providers.DeferredBecauseProviderConfigUnknown - case tfplugin6.Deferred_ABSENT_PREREQ: - return providers.DeferredBecausePrereqAbsent - default: - return providers.DeferredReasonUnknown - } -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin6/grpc_provider.go new/opentofu-1.11.2/internal/plugin6/grpc_provider.go --- old/opentofu-1.11.1/internal/plugin6/grpc_provider.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin6/grpc_provider.go 2025-12-19 19:25:13.000000000 +0100 @@ -491,11 +491,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.NewState, resSchema.Block.ImpliedType()) if err != nil { @@ -578,11 +573,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.PlannedState, resSchema.Block.ImpliedType()) if err != nil { @@ -705,11 +695,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } for _, imported := range protoResp.ImportedResources { resource := providers.ImportedResource{ @@ -828,11 +813,6 @@ return resp } resp.Diagnostics = resp.Diagnostics.Append(convert.ProtoToDiagnostics(protoResp.Diagnostics)) - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - reason := convert.DeferralReasonFromProto(protoDeferred.Reason) - resp.Diagnostics = resp.Diagnostics.Append(providers.NewDeferralDiagnostic(reason)) - return resp - } state, err := decodeDynamicValue(protoResp.State, dataSchema.Block.ImpliedType()) if err != nil { @@ -891,9 +871,6 @@ renewAt := protoResp.RenewAt.AsTime() resp.RenewAt = &renewAt } - if protoDeferred := protoResp.Deferred; protoDeferred != nil { - resp.Deferred = &providers.EphemeralResourceDeferred{DeferralReason: convert.DeferralReasonFromProto(protoDeferred.Reason)} - } return resp } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/plugin6/grpc_provider_test.go new/opentofu-1.11.2/internal/plugin6/grpc_provider_test.go --- old/opentofu-1.11.1/internal/plugin6/grpc_provider_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/plugin6/grpc_provider_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -14,7 +14,6 @@ "testing" "time" - "github.com/davecgh/go-spew/spew" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" "github.com/zclconf/go-cty/cty" @@ -833,52 +832,6 @@ } } -func TestGRPCProvider_PlanResourceChange_deferred(t *testing.T) { - client := mockProviderClient(t) - p := &GRPCProvider{ - client: client, - } - - client.EXPECT().PlanResourceChange( - gomock.Any(), - gomock.Any(), - ).Return(&proto.PlanResourceChange_Response{ - PlannedState: &proto.DynamicValue{ - Msgpack: []byte("\x81\xa4attr\xa3bar"), - }, - Deferred: &proto.Deferred{ - Reason: proto.Deferred_PROVIDER_CONFIG_UNKNOWN, - }, - }, nil) - - resp := p.PlanResourceChange(t.Context(), providers.PlanResourceChangeRequest{ - TypeName: "resource", - PriorState: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("foo"), - }), - ProposedNewState: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("bar"), - }), - Config: cty.ObjectVal(map[string]cty.Value{ - "attr": cty.StringVal("bar"), - }), - }) - - if len(resp.Diagnostics) != 1 { - t.Fatal("wrong number of diagnostics; want one\n" + spew.Sdump(resp.Diagnostics)) - } - desc := resp.Diagnostics[0].Description() - if got, want := desc.Summary, `Provider configuration is incomplete`; got != want { - t.Errorf("wrong error summary\ngot: %s\nwant: %s", got, want) - } - if got, want := desc.Detail, `The provider was unable to work with this resource because the associated provider configuration makes use of values from other resources that will not be known until after apply.`; got != want { - t.Errorf("wrong error detail\ngot: %s\nwant: %s", got, want) - } - if !providers.IsDeferralDiagnostic(resp.Diagnostics[0]) { - t.Errorf("diagnostic is not marked as being a \"deferral diagnostic\"") - } -} - func TestGRPCProvider_PlanResourceChangeJSON(t *testing.T) { client := mockProviderClient(t) p := &GRPCProvider{ @@ -1308,9 +1261,6 @@ }, Private: []byte("private data"), RenewAt: timestamppb.New(future), - Deferred: &proto.Deferred{ - Reason: proto.Deferred_RESOURCE_CONFIG_UNKNOWN, - }, }, nil) resp := p.OpenEphemeralResource(t.Context(), providers.OpenEphemeralResourceRequest{ @@ -1334,14 +1284,6 @@ if got, want := resp.Private, []byte("private data"); !slices.Equal(got, want) { t.Fatalf("unexpected private data. got: %q, want %q", got, want) } - { - if resp.Deferred == nil { - t.Fatal("expected to have a deferred object but got none") - } - if got, want := resp.Deferred.DeferralReason, providers.DeferredBecauseResourceConfigUnknown; got != want { - t.Fatalf("unexpected deferred reason. got: %d, want %d", got, want) - } - } }) t.Run("requested type is not in schema", func(t *testing.T) { client := mockProviderClient(t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/providers/deferral.go new/opentofu-1.11.2/internal/providers/deferral.go --- old/opentofu-1.11.1/internal/providers/deferral.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/providers/deferral.go 1970-01-01 01:00:00.000000000 +0100 @@ -1,141 +0,0 @@ -// Copyright (c) The OpenTofu Authors -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2023 HashiCorp, Inc. -// SPDX-License-Identifier: MPL-2.0 - -package providers - -import ( - "github.com/opentofu/opentofu/internal/tfdiags" -) - -// DeferralReason is an enumeration of the different reasons a provider might -// return when reporting why it is unable to perform a requested action with -// the currently-available context. -type DeferralReason int - -//go:generate go tool golang.org/x/tools/cmd/stringer -type=DeferralReason - -const ( - // DeferredReasonUnknown is the zero value of DeferralReason, used when - // a provider returns an unsupported deferral reason. - DeferredReasonUnknown DeferralReason = 0 - - // DeferredBecauseResourceConfigUnknown indicates that the request cannot - // be completed because of unknown values in the resource configuration. - DeferredBecauseResourceConfigUnknown DeferralReason = 1 - - // DeferredBecauseProviderConfigUnknown indicates that the request cannot - // be completed because of unknown values in the provider configuration. - DeferredBecauseProviderConfigUnknown DeferralReason = 2 - - // DeferredBecausePrereqAbsent indicates that the request cannot be - // completed because a hard dependency has not been satisfied. - DeferredBecausePrereqAbsent DeferralReason = 3 -) - -// NewDeferralDiagnostic returns a contextual error diagnostic reporting that -// an operation cannot be completed for the given deferral reason. -// -// The returned diagnostic will cause [IsDeferralDiagnostic] to return true, -// so that callers can optionally annotate the diagnostic with suggestions -// for how to skip the affected request so that other unaffected requests can -// still be completed. -func NewDeferralDiagnostic(reason DeferralReason) tfdiags.Diagnostic { - summary := DeferralReasonSummary(reason) - - var detail string - switch reason { - case DeferredBecauseResourceConfigUnknown: - detail = "The provider was unable to act on this resource configuration because it makes use of values from other resources that will not be known until after apply." - case DeferredBecauseProviderConfigUnknown: - detail = "The provider was unable to work with this resource because the associated provider configuration makes use of values from other resources that will not be known until after apply." - default: - // This is the most general (and therefore least helpful) message, which - // we'll return if the provider produces a reason that we don't know about - // yet, such as one added in a later protocol version. This fallback - // is very much a last resort. - // (Note that this also currently handles DeferredBecausePrereqAbsent, - // because there are not yet any known examples of providers using that - // reason and so we don't yet know what it will turn out to mean in - // practice. If it becomes used in more providers in future then we can - // hopefully devise a better message that describes what those providers - // use it to mean.) - detail = "The provider reported that it is not able to perform the requested operation until more information is available." - } - - // We start with a "whole-body" contextual diagnostic, so that the caller - // can elaborate this with any configuration body whose presence caused - // the request to be made and thus add useful source location information - // that we cannot determine at the provider layer. - contextual := tfdiags.WholeContainingBody(tfdiags.Error, summary, detail) - - // We then further wrap that contextual diagnostic in an override so that - // we can annotate it with the "extra info" that IsDeferralDiagnostic - // will use to recognize diagnostics returned from this function. - return tfdiags.Override(contextual, tfdiags.Error, func() tfdiags.DiagnosticExtraWrapper { - return &deferralDiagnosticExtraImpl{reason: reason} - }) -} - -// DeferralReasonSummary returns a more informative string representation of the given DeferralReason to be used -// it other places too. -// For more details, check the comments from NewDeferralDiagnostic. -func DeferralReasonSummary(reason DeferralReason) string { - switch reason { - case DeferredBecauseResourceConfigUnknown: - return "Resource configuration is incomplete" - case DeferredBecauseProviderConfigUnknown: - return "Provider configuration is incomplete" - default: - return "Operation cannot be completed yet" - } -} - -// IsDeferralDiagnostic returns true if the given diagnostic was constructed -// with NewDeferralDiagnostic, meaning that it describes a situation where a -// provider reported that it is not yet able to complete an operation with the -// currently-available context. -func IsDeferralDiagnostic(diag tfdiags.Diagnostic) bool { - // NOTE: We're intentionally not actually exposing the deferral reason - // in the first incarnation of this functionality because the associated - // plugin protocol feature is not yet well-deployed and so we're trying - // to keep our use of it as confined to the provider-related packages - // as possible in case ongoing protocol evolution causes us to need to - // revise this in a later version. However, once the underlying protocol - // has settled it would be reasonable to actually expose the reason - // so that callers can substitute more contextually-relevant versions of - // the error diagnostics when appropriate, or indeed choose to handle - // this situation in a way that doesn't return an error to the user at all. - extra := tfdiags.ExtraInfo[deferralDiagnosticExtra](diag) - return extra != nil -} - -type deferralDiagnosticExtra interface { - deferralReason() DeferralReason -} - -// deferralDiagnosticExtraImpl is an indirection used to combine -// deferralDiagnosticExtra with tfdiags.DiagnosticExtraWrapper because the -// design of tfdiags.Override unfortunately exposes its implementation -// detail of possibly needing to preserve an existing "extra info" -// as part of its public API. -// -// (Maybe we can improve tfdiags.Override to encapsulate this better in -// future, so that the type representing the union of two "extra info" -// values can be an unexported struct within package tfdiags, but -// this API is already being used elsewhere and so is risky to change.) -type deferralDiagnosticExtraImpl struct { - reason DeferralReason - wrapped any -} - -// WrapDiagnosticExtra implements deferralDiagnosticExtra. -func (d *deferralDiagnosticExtraImpl) deferralReason() DeferralReason { - return d.reason -} - -// WrapDiagnosticExtra implements tfdiags.DiagnosticExtraWrapper. -func (d *deferralDiagnosticExtraImpl) WrapDiagnosticExtra(inner any) { - d.wrapped = inner -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/providers/deferralreason_string.go new/opentofu-1.11.2/internal/providers/deferralreason_string.go --- old/opentofu-1.11.1/internal/providers/deferralreason_string.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/providers/deferralreason_string.go 1970-01-01 01:00:00.000000000 +0100 @@ -1,27 +0,0 @@ -// Code generated by "stringer -type=DeferralReason"; DO NOT EDIT. - -package providers - -import "strconv" - -func _() { - // An "invalid array index" compiler error signifies that the constant values have changed. - // Re-run the stringer command to generate them again. - var x [1]struct{} - _ = x[DeferredReasonUnknown-0] - _ = x[DeferredBecauseResourceConfigUnknown-1] - _ = x[DeferredBecauseProviderConfigUnknown-2] - _ = x[DeferredBecausePrereqAbsent-3] -} - -const _DeferralReason_name = "DeferredReasonUnknownDeferredBecauseResourceConfigUnknownDeferredBecauseProviderConfigUnknownDeferredBecausePrereqAbsent" - -var _DeferralReason_index = [...]uint8{0, 21, 57, 93, 120} - -func (i DeferralReason) String() string { - idx := int(i) - 0 - if i < 0 || idx >= len(_DeferralReason_index)-1 { - return "DeferralReason(" + strconv.FormatInt(int64(i), 10) + ")" - } - return _DeferralReason_name[_DeferralReason_index[idx]:_DeferralReason_index[idx+1]] -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/providers/provider.go new/opentofu-1.11.2/internal/providers/provider.go --- old/opentofu-1.11.1/internal/providers/provider.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/providers/provider.go 2025-12-19 19:25:13.000000000 +0100 @@ -608,8 +608,6 @@ Result cty.Value // Private is the provider information that needs to be used later on Renew/Close call. Private []byte - // Deferred returns only a reason of why the provider is asking deferring the opening. - Deferred *EphemeralResourceDeferred // RenewAt indicates if(!=nil) and when(<=time.Now()) the Renew call needs to be performed. RenewAt *time.Time @@ -617,10 +615,6 @@ Diagnostics tfdiags.Diagnostics } -type EphemeralResourceDeferred struct { - DeferralReason DeferralReason -} - type RenewEphemeralResourceRequest struct { // TypeName is the name of the ephemeral resource to Renew. TypeName string diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/context_plan2_test.go new/opentofu-1.11.2/internal/tofu/context_plan2_test.go --- old/opentofu-1.11.1/internal/tofu/context_plan2_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/context_plan2_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -5064,97 +5064,6 @@ } } -func TestContext2Plan_providerDefersPlanning(t *testing.T) { - m := testModuleInline(t, map[string]string{ - "main.tf": ` - resource "test" "test" { - } - `, - }) - - tests := []struct { - DeferralReason providers.DeferralReason - WantDiagSummary, WantDiagDetail string - }{ - { - DeferralReason: providers.DeferredBecauseProviderConfigUnknown, - WantDiagSummary: `Provider configuration is incomplete`, - WantDiagDetail: `The provider was unable to work with this resource because the associated provider configuration makes use of values from other resources that will not be known until after apply. - -To work around this, use the planning option -exclude="test.test" to first apply without this object, and then apply normally to converge.`, - }, - { - DeferralReason: providers.DeferredBecauseResourceConfigUnknown, - WantDiagSummary: `Resource configuration is incomplete`, - WantDiagDetail: `The provider was unable to act on this resource configuration because it makes use of values from other resources that will not be known until after apply. - -To work around this, use the planning option -exclude="test.test" to first apply without this object, and then apply normally to converge.`, - }, - { - // This one is currently a generic fallback message because it's - // unclear what this reason is intended to mean and no providers - // are using it yet at the time of writing. - DeferralReason: providers.DeferredBecausePrereqAbsent, - WantDiagSummary: `Operation cannot be completed yet`, - WantDiagDetail: `The provider reported that it is not able to perform the requested operation until more information is available. - -To work around this, use the planning option -exclude="test.test" to first apply without this object, and then apply normally to converge.`, - }, - { - // This special reason is the one we use if a provider returns - // a later-added reason that the current OpenTofu version doesn't - // know about. - DeferralReason: providers.DeferredReasonUnknown, - WantDiagSummary: `Operation cannot be completed yet`, - WantDiagDetail: `The provider reported that it is not able to perform the requested operation until more information is available. - -To work around this, use the planning option -exclude="test.test" to first apply without this object, and then apply normally to converge.`, - }, - } - - for _, test := range tests { - t.Run(test.DeferralReason.String(), func(t *testing.T) { - provider := &MockProvider{ - GetProviderSchemaResponse: &providers.GetProviderSchemaResponse{ - ResourceTypes: map[string]providers.Schema{ - "test": { - Block: &configschema.Block{}, - }, - }, - }, - PlanResourceChangeFn: func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse { - var diags tfdiags.Diagnostics - diags = diags.Append(providers.NewDeferralDiagnostic( - test.DeferralReason, - )) - return providers.PlanResourceChangeResponse{ - Diagnostics: diags, - } - }, - } - tofuCtx := testContext2(t, &ContextOpts{ - Providers: map[addrs.Provider]providers.Factory{ - addrs.NewDefaultProvider("test"): testProviderFuncFixed(provider), - }, - }) - _, diags := tofuCtx.Plan(t.Context(), m, states.NewState(), DefaultPlanOpts) - if !diags.HasErrors() { - t.Fatal("plan succeeded; want an error") - } - if len(diags) != 1 { - t.Fatal("wrong number of diagnostics; want one\n" + spew.Sdump(diags.ForRPC())) - } - desc := diags[0].Description() - if got, want := test.WantDiagSummary, desc.Summary; got != want { - t.Errorf("wrong error summary\ngot: %s\nwant: %s", got, want) - } - if got, want := test.WantDiagDetail, desc.Detail; got != want { - t.Errorf("wrong error detail\ngot: %s\nwant: %s", got, want) - } - }) - } -} - func TestContext2Plan_ignoredMarkedValue(t *testing.T) { m := testModuleInline(t, map[string]string{ "main.tf": ` @@ -8584,111 +8493,6 @@ } } -// TestContext2Plan_ephemeralResourceDeferred is testing that an ephemeral resource gets deferred -// correctly: -// * gets deferred when a dependency is having planned changes, so OpenEphemeralResource is not called. -// * gets deferred when the response from OpenEphemeralResource is indicating so. -func TestContext2Plan_ephemeralResourceDeferred(t *testing.T) { - // Ephemeral resource is deferred by opentofu itself, before calling OpenEphemeralResource. This is - // due to pending changes in the ephemeral's dependencies. - t.Run("before open", func(t *testing.T) { - m := testModuleInline(t, map[string]string{ - "main.tf": ` - resource "test_object" "testres" { - } - ephemeral "test_object" "testeph" { - depends_on = [ - test_object.testres - ] - } - `, - }) - - state := states.BuildState(func(s *states.SyncState) {}) - - p := simpleMockProvider() - ctx := testContext2(t, &ContextOpts{ - Providers: map[addrs.Provider]providers.Factory{ - addrs.NewDefaultProvider("test"): testProviderFuncFixed(p), - }, - }) - hook := &testHook{} - ctx.hooks = append(ctx.hooks, hook) - - _, diags := ctx.Plan(context.Background(), m, state, &PlanOpts{ - Mode: plans.NormalMode, - }) - - if diags.HasErrors() { - t.Fatalf("unexpected errors: %s", diags.Err()) - } - - // last call should have been on the ephemeral defer - deferCall := hook.Calls[len(hook.Calls)-1] - if wantAction, wantInstID := "Deferred", "ephemeral_test_object.testeph"; deferCall.Action != wantAction && deferCall.InstanceID != wantInstID { - t.Fatalf("expected the last call to be a %q for %q. got action %q for %q", wantAction, wantInstID, deferCall.Action, deferCall.InstanceID) - } - }) - // Ephemeral is deferred because of the defer reason returned from OpenEphemeralResource. - t.Run("from open", func(t *testing.T) { - m := testModuleInline(t, map[string]string{ - "main.tf": ` - resource "test_object" "testres" { - test_string = "test value" - } - ephemeral "test_object" "testeph" { - depends_on = [ - test_object.testres - ] - } - `, - }) - - addr := mustAbsResourceAddr("test_object.testres") - state := states.BuildState(func(s *states.SyncState) { - s.SetResourceInstanceCurrent(addr.Instance(addrs.NoKey), &states.ResourceInstanceObjectSrc{ - AttrsJSON: []byte(`{"test_string": "test value"}`), - Status: states.ObjectReady, - }, mustProviderConfig(`provider["registry.opentofu.org/hashicorp/test"]`), addrs.NoKey) - }) - - p := simpleMockProvider() - p.OpenEphemeralResourceResponse = &providers.OpenEphemeralResourceResponse{ - Result: cty.Value{}, - Deferred: &providers.EphemeralResourceDeferred{DeferralReason: providers.DeferredBecauseResourceConfigUnknown}, - } - p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) (resp providers.PlanResourceChangeResponse) { - cfg := req.Config.AsValueMap() - resp.PlannedState = cty.ObjectVal(cfg) - return resp - } - ctx := testContext2(t, &ContextOpts{ - Providers: map[addrs.Provider]providers.Factory{ - addrs.NewDefaultProvider("test"): testProviderFuncFixed(p), - }, - }) - hook := &testHook{} - ctx.hooks = append(ctx.hooks, hook) - - _, diags := ctx.Plan(context.Background(), m, state, &PlanOpts{ - Mode: plans.NormalMode, - }) - - if diags.HasErrors() { - t.Fatalf("unexpected errors: %s", diags.Err()) - } - - if !p.OpenEphemeralResourceCalled { - t.Fatal("expected OpenEphemeralResource to be called but it was not") - } - // last call should have been on the ephemeral defer - deferCall := hook.Calls[len(hook.Calls)-1] - if wantAction, wantInstID := "Deferred", "ephemeral_test_object.testeph"; deferCall.Action != wantAction && deferCall.InstanceID != wantInstID { - t.Fatalf("expected the last call to be a %q for %q. got action %q for %q", wantAction, wantInstID, deferCall.Action, deferCall.InstanceID) - } - }) -} - func TestContext2Plan_importResourceWithSensitiveDataSource(t *testing.T) { addr := mustResourceInstanceAddr("test_object.b") m := testModuleInline(t, map[string]string{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/node_resource_abstract_instance.go new/opentofu-1.11.2/internal/tofu/node_resource_abstract_instance.go --- old/opentofu-1.11.1/internal/tofu/node_resource_abstract_instance.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/node_resource_abstract_instance.go 2025-12-19 19:25:13.000000000 +0100 @@ -1844,7 +1844,7 @@ return metaConfigVal, diags } -func (n *NodeAbstractResourceInstance) openEphemeralResource(ctx context.Context, evalCtx EvalContext, configVal cty.Value) (cty.Value, providers.DeferralReason, tfdiags.Diagnostics) { +func (n *NodeAbstractResourceInstance) openEphemeralResource(ctx context.Context, evalCtx EvalContext, configVal cty.Value) (cty.Value, tfdiags.Diagnostics) { var diags tfdiags.Diagnostics var newVal cty.Value @@ -1853,13 +1853,13 @@ provider, providerSchema, err := n.getProvider(ctx, evalCtx) diags = diags.Append(err) if diags.HasErrors() { - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } schema, _ := providerSchema.SchemaForResourceAddr(n.Addr.ContainingResource().Resource) if schema == nil { // Should be caught during validation, so we don't bother with a pretty error here diags = diags.Append(fmt.Errorf("provider %q does not support ephemeral resource %q", n.ResolvedProvider.ProviderConfig, n.Addr.ContainingResource().Resource.Type)) - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } // Unmark before sending to provider, will re-mark before returning @@ -1876,7 +1876,7 @@ ) diags = diags.Append(validateResp.Diagnostics.InConfigBody(config.Config, n.Addr.String())) if diags.HasErrors() { - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } // If we get down here then our configuration is complete and we're ready @@ -1887,7 +1887,7 @@ return h.PreOpen(n.Addr) })) if diags.HasErrors() { - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } req := providers.OpenEphemeralResourceRequest{ @@ -1897,12 +1897,9 @@ resp := provider.OpenEphemeralResource(ctx, req) diags = diags.Append(resp.Diagnostics.InConfigBody(config.Config, n.Addr.String())) if diags.HasErrors() { - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } - if resp.Deferred != nil { - return newVal, resp.Deferred.DeferralReason, diags - } newVal = resp.Result for _, err := range newVal.Type().TestConformance(schema.ImpliedType()) { @@ -1916,7 +1913,7 @@ )) } if diags.HasErrors() { - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } if newVal.IsNull() { @@ -1928,7 +1925,7 @@ n.ResolvedProvider.ProviderConfig.InstanceString(n.ResolvedProviderKey), n.Addr, ), )) - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } if !newVal.IsNull() && !newVal.IsWhollyKnown() { @@ -1940,7 +1937,7 @@ n.ResolvedProvider.ProviderConfig.InstanceString(n.ResolvedProviderKey), n.Addr, ), )) - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } if len(pvm) > 0 { @@ -1965,7 +1962,7 @@ // when calling provider.CloseEphemeralResource. go n.startEphemeralRenew(ctx, evalCtx, provider, resp.RenewAt, resp.Private) - return newVal, providers.DeferredReasonUnknown, diags + return newVal, diags } // planDataSource deals with the main part of the data resource lifecycle: @@ -3023,63 +3020,6 @@ return provider, schema, nil } -func maybeImproveResourceInstanceDiagnostics(diags tfdiags.Diagnostics, excludeAddr addrs.Targetable) tfdiags.Diagnostics { - // We defer allocating a new diagnostics array until we know we need to - // change something, because most of the time we'll just be returning - // the given diagnostics verbatim. - var ret tfdiags.Diagnostics - for i, diag := range diags { - if excludeAddr != nil && providers.IsDeferralDiagnostic(diag) { - // We've found a diagnostic we want to change, so we'll allocate - // a new diagnostics array if we didn't already. - if ret == nil { - ret = make(tfdiags.Diagnostics, len(diags)) - copy(ret, diags) - } - // FIXME: The following is a hack to slightly modify the diagnostic - // with an extra paragraph of detail content. If this becomes a - // more common need elsewhere then we should find a less clunky way - // to do this, probably with a new feature in tfdiags. - desc := diag.Description() - src := diag.Source() - extraDetail := fmt.Sprintf( - // FIXME: This should use a technique similar to evalchecks.commandLineArgumentsSuggestion - // to generate appropriate quoting/escaping of the address for the current platform. - "\n\nTo work around this, use the planning option -exclude=%q to first apply without this object, and then apply normally to converge.", - excludeAddr.String(), - ) - newDiag := &hcl.Diagnostic{ - Severity: diag.Severity().ToHCL(), - Summary: desc.Summary, - Detail: desc.Detail + extraDetail, - } - if src.Subject != nil { - newDiag.Subject = src.Subject.ToHCL().Ptr() - } - if src.Context != nil { - newDiag.Context = src.Context.ToHCL().Ptr() - } - // The following is a little awkward because of how tfdiags is - // designed: we need to "append" a new diagnostic over the - // one we're trying to replace so that tfdiags has an opportunity - // to transform it, so we'll make a zero-length slice whose - // capacity covers the one element we're trying to replace. - appendTo := ret[i : i : i+1] - appendTo = appendTo.Append(newDiag) - // appendTo.Append isn't _actually_ required to use the - // capacity we gave it (that's an implementation detail) - // so just to make sure we'll copy from what was returned - // into the final slot. This is likely to be a no-op in most - // cases. - ret[i] = appendTo[0] - } - } - if ret == nil { // We didn't change anything - return diags - } - return ret -} - func (n *NodeAbstractResourceInstance) applyEphemeralResource(ctx context.Context, evalCtx EvalContext) (*states.ResourceInstanceObject, instances.RepetitionData, tfdiags.Diagnostics) { var diags tfdiags.Diagnostics var keyData instances.RepetitionData @@ -3124,17 +3064,7 @@ // We have a complete configuration with no dependencies to wait on, so we // can open the ephemeral resource and store its value in the state. - newVal, deferralReason, readDiags := n.openEphemeralResource(ctx, evalCtx, configVal) - if deferralReason != providers.DeferredReasonUnknown { - diags = diags.Append(&hcl.Diagnostic{ - Severity: hcl.DiagError, - Summary: "Ephemeral resource deferred during apply", - Detail: fmt.Sprintf("Ephemeral resource %q asked for being deferred. This is a provider error.", n.Addr.String()), - Subject: n.Config.TypeRange.Ptr(), - Context: n.Config.DeclRange.Ptr(), - }) - return nil, instances.RepetitionData{}, diags - } + newVal, readDiags := n.openEphemeralResource(ctx, evalCtx, configVal) diags = diags.Append(readDiags) if diags.HasErrors() { return nil, keyData, diags @@ -3228,14 +3158,7 @@ // We have a complete configuration with no dependencies to wait on, so we // can open the ephemeral resource and store its value in the state. - newVal, deferralReason, readDiags := n.openEphemeralResource(ctx, evalCtx, configVal) - if deferralReason != providers.DeferredReasonUnknown { - reason := providers.DeferralReasonSummary(deferralReason) - - plannedChange, plannedNewState, deferDiags := n.deferEphemeralResource(evalCtx, schema, priorVal, configVal, reason) - diags = diags.Append(deferDiags) - return plannedChange, plannedNewState, keyData, diags - } + newVal, readDiags := n.openEphemeralResource(ctx, evalCtx, configVal) diags = diags.Append(readDiags) if diags.HasErrors() { return nil, nil, instances.RepetitionData{}, diags diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/node_resource_abstract_instance_test.go new/opentofu-1.11.2/internal/tofu/node_resource_abstract_instance_test.go --- old/opentofu-1.11.1/internal/tofu/node_resource_abstract_instance_test.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/node_resource_abstract_instance_test.go 2025-12-19 19:25:13.000000000 +0100 @@ -15,9 +15,7 @@ "github.com/opentofu/opentofu/internal/addrs" "github.com/opentofu/opentofu/internal/configs" "github.com/opentofu/opentofu/internal/configs/configschema" - "github.com/opentofu/opentofu/internal/providers" "github.com/opentofu/opentofu/internal/states" - "github.com/opentofu/opentofu/internal/tfdiags" ) func TestNodeAbstractResourceInstanceProvider(t *testing.T) { @@ -268,72 +266,3 @@ }) } } - -func TestMaybeImproveResourceInstanceDiagnostics(t *testing.T) { - // This test is focused mainly on whether - // maybeImproveResourceInstanceDiagnostics is able to correctly identify - // deferral-related diagnostics and transform them, while keeping - // other unrelated diagnostics intact and unmodified. - // TestContext2Plan_providerDefersPlanning tests that the effect of - // this function is exposed externally when a provider's PlanResourceChange - // method returns a suitable diagnostic. - - var input tfdiags.Diagnostics - input = input.Append(tfdiags.Sourceless( - tfdiags.Warning, - "This is not a deferral-related diagnostic", - "This one should not be modified at all.", - )) - input = input.Append(providers.NewDeferralDiagnostic(providers.DeferredBecauseProviderConfigUnknown)) - input = input.Append(tfdiags.Sourceless( - tfdiags.Error, - "This is not a deferral-related diagnostic", - "This one should not be modified at all.", - )) - input = input.Append(providers.NewDeferralDiagnostic(providers.DeferredBecauseResourceConfigUnknown)) - input = input.Append(tfdiags.Sourceless( - tfdiags.Error, - "This is not a deferral-related diagnostic either", - "Leave this one alone too.", - )) - - // We'll use ForRPC here just to make the diagnostics easier to compare, - // since we care primarily about their description test here. - got := maybeImproveResourceInstanceDiagnostics(input, mustAbsResourceAddr("foo.bar").Instance(addrs.IntKey(1))).ForRPC() - var want tfdiags.Diagnostics - want = want.Append(tfdiags.Sourceless( - tfdiags.Warning, - "This is not a deferral-related diagnostic", - "This one should not be modified at all.", - )) - want = want.Append(tfdiags.Sourceless( - tfdiags.Error, - "Provider configuration is incomplete", - `The provider was unable to work with this resource because the associated provider configuration makes use of values from other resources that will not be known until after apply. - -To work around this, use the planning option -exclude="foo.bar[1]" to first apply without this object, and then apply normally to converge.`, - )) - want = want.Append(tfdiags.Sourceless( - tfdiags.Error, - "This is not a deferral-related diagnostic", - "This one should not be modified at all.", - )) - want = want.Append(tfdiags.Sourceless( - tfdiags.Error, - "Resource configuration is incomplete", - `The provider was unable to act on this resource configuration because it makes use of values from other resources that will not be known until after apply. - -To work around this, use the planning option -exclude="foo.bar[1]" to first apply without this object, and then apply normally to converge.`, - )) - want = want.Append(tfdiags.Sourceless( - tfdiags.Error, - "This is not a deferral-related diagnostic either", - "Leave this one alone too.", - )) - want = want.ForRPC() - - if diff := cmp.Diff(want, got); diff != "" { - t.Error("wrong result\n" + diff) - } - -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/node_resource_import.go new/opentofu-1.11.2/internal/tofu/node_resource_import.go --- old/opentofu-1.11.1/internal/tofu/node_resource_import.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/node_resource_import.go 2025-12-19 19:25:13.000000000 +0100 @@ -121,7 +121,7 @@ TypeName: n.Addr.Resource.Resource.Type, ID: n.ID, }) - diags = diags.Append(maybeImproveResourceInstanceDiagnostics(resp.Diagnostics, n.Addr)) + diags = diags.Append(resp.Diagnostics) if diags.HasErrors() { return diags } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/node_resource_plan_instance.go new/opentofu-1.11.2/internal/tofu/node_resource_plan_instance.go --- old/opentofu-1.11.1/internal/tofu/node_resource_plan_instance.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/node_resource_plan_instance.go 2025-12-19 19:25:13.000000000 +0100 @@ -342,7 +342,7 @@ // The import process handles its own refresh if !n.skipRefresh && !importing { s, refreshDiags := n.refresh(ctx, evalCtx, states.NotDeposed, instanceRefreshState) - diags = diags.Append(maybeImproveResourceInstanceDiagnostics(refreshDiags, addr)) + diags = diags.Append(refreshDiags) if diags.HasErrors() { return diags } @@ -380,7 +380,7 @@ change, instancePlanState, repeatData, planDiags := n.plan( ctx, evalCtx, nil, instanceRefreshState, n.ForceCreateBeforeDestroy, n.forceReplace, ) - diags = diags.Append(maybeImproveResourceInstanceDiagnostics(planDiags, addr)) + diags = diags.Append(planDiags) if diags.HasErrors() { // If we are importing and generating a configuration, we need to // ensure the change is written out so the configuration can be diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/internal/tofu/upgrade_resource_state.go new/opentofu-1.11.2/internal/tofu/upgrade_resource_state.go --- old/opentofu-1.11.1/internal/tofu/upgrade_resource_state.go 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/internal/tofu/upgrade_resource_state.go 2025-12-19 19:25:13.000000000 +0100 @@ -111,7 +111,7 @@ } resp := args.provider.UpgradeResourceState(context.TODO(), req) - diags := maybeImproveResourceInstanceDiagnostics(resp.Diagnostics, args.currentAddr) + diags := resp.Diagnostics if diags.HasErrors() { log.Printf("[TRACE] upgradeResourceStateTransform: failed - address: %s", args.currentAddr) return cty.NilVal, nil, diags diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/version/VERSION new/opentofu-1.11.2/version/VERSION --- old/opentofu-1.11.1/version/VERSION 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/version/VERSION 2025-12-19 19:25:13.000000000 +0100 @@ -1 +1 @@ -1.11.1 +1.11.2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/website/docs/language/meta-arguments/enabled.mdx new/opentofu-1.11.2/website/docs/language/meta-arguments/enabled.mdx --- old/opentofu-1.11.1/website/docs/language/meta-arguments/enabled.mdx 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/website/docs/language/meta-arguments/enabled.mdx 2025-12-19 19:25:13.000000000 +0100 @@ -7,11 +7,11 @@ # The `enabled` Meta-Argument :::note -A given resource or module block cannot use `enabled` together with `count` or `for_each`. +A given resource or module block cannot use `enabled` together with `count` or `for_each`. See [Restrictions](#restrictions) for more details. ::: -The `enabled` meta-argument in a `lifecycle` block provides a cleaner way to conditionally create or skip a -single resource or module instance. Unlike the traditional `count = var.enabled ? 1 : 0` +The `enabled` meta-argument, introduced in OpenTofu v1.11, provides a cleaner way to conditionally create or skip a +single resource or module instance in a `lifecycle` block. Unlike the traditional `count = var.enabled ? 1 : 0` workaround, which requires array indexing to access single instances, `enabled` allows direct access when the resource is created and properly handles the null state when disabled. @@ -36,6 +36,58 @@ When `enabled` is `true` (or not specified), the resource behaves normally. When `enabled` is `false`, the resource is not created and evaluates to `null`. +## Migrating from count + +If you have existing resources using the `count = var.enabled ? 1 : 0` pattern, +you can migrate to `enabled` without manual state manipulation. + +After migration, you no longer need to reference your resource using the `[0]` +instance key. Instead of `aws_instance.example[0]`, you can simply use +`aws_instance.example`. OpenTofu automatically handles the state migration +from the indexed instance to the non-indexed instance. + +### Before + +```hcl +variable "create_instance" { + type = bool + default = true +} + +resource "aws_instance" "example" { + count = var.create_instance ? 1 : 0 + # ... +} + +output "instance_id" { + value = length(aws_instance.example) > 0 ? aws_instance.example[0].id : "not-created" +} +``` + +### After + +```hcl +variable "create_instance" { + type = bool + default = true +} + +resource "aws_instance" "example" { + # ... + lifecycle { + enabled = var.create_instance + } +} + +output "instance_id" { + value = aws_instance.example != null ? aws_instance.example.id : "not-created" +} +``` + +When you apply this change, OpenTofu will automatically move your existing +resource from `aws_instance.example[0]` to `aws_instance.example`. No `moved` +block or manual state manipulation is required. + ## Accessing Disabled Resources When a resource might be disabled, it evaluates to `null` and cannot be accessed directly. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/website/docs/language/syntax/json.mdx new/opentofu-1.11.2/website/docs/language/syntax/json.mdx --- old/opentofu-1.11.1/website/docs/language/syntax/json.mdx 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/website/docs/language/syntax/json.mdx 2025-12-19 19:25:13.000000000 +0100 @@ -409,9 +409,6 @@ ### `module` blocks -The `source` and `version` meta-arguments must be given as literal strings. The -values are not interpreted as string templates. - The `providers` meta-argument must be given as a JSON object whose properties are the compact provider addresses to expose into the child module and whose values are the provider addresses to use from the current module, both @@ -454,9 +451,10 @@ ### `terraform` blocks -Since no settings within `terraform` blocks accept named object references or -function calls, all setting values are taken literally. String values are not -interpreted as string templates. +Settings within `terraform` blocks are generally interpreted literally, except +for the `backend` block, which supports expressions. Other settings do not +accept named object references or function calls and therefore do not treat +string values as string templates. Since only one `backend` block is allowed per `terraform` block, the compact block mapping can be used to represent it, with a nested object containing diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.11.1/website/docs/language/values/variables.mdx new/opentofu-1.11.2/website/docs/language/values/variables.mdx --- old/opentofu-1.11.1/website/docs/language/values/variables.mdx 2025-12-10 17:59:49.000000000 +0100 +++ new/opentofu-1.11.2/website/docs/language/values/variables.mdx 2025-12-19 19:25:13.000000000 +0100 @@ -272,8 +272,7 @@ ### Ephemerality [inpage-ephemeral]: #ephemeral-variables -If a variable is set to `ephemeral`, the module author will limit its usage -only to the allowed ephemeral contexts: +Setting a variable as `ephemeral` restricts its usage to the following ephemeral contexts: * [Ephemeral Resources](../ephemerality/ephemeral-resources.mdx) * [Ephemeral Variables](../values/variables.mdx#ephemerality) * [Ephemeral Outputs](../values/outputs.mdx#ephemerality) @@ -283,8 +282,8 @@ * [Resource `connection` blocks](../resources/provisioners/connection.mdx#ephemeral-usage) * [Resource `write-only` attributes](../ephemerality/write-only-attributes.mdx) -OpenTofu will not store this type of variables in the [state](../../language/state/index.mdx) at all. -These will be saved in the plan only by their name for further processing during apply. +OpenTofu will not store ephemeral variable values in the [state](../../language/state/index.mdx) at all. +Only the variable names will be saved in the plan for further processing during apply. Declare a variable as ephemeral by setting the `ephemeral` argument to `true`: ```hcl @@ -342,7 +341,7 @@ [inpage-deprecated]: #marking-variable-as-deprecated The `deprecated` argument in a variable block indicates its deprecation and potential -removal in the future. This attribute should contain non-empty string and should provide +removal in the future. This attribute should contain a non-empty string and should provide instructions on how to migrate away from usage of this variable. Here is an example of the configuration: ++++++ opentofu.obsinfo ++++++ --- /var/tmp/diff_new_pack.ttJhNR/_old 2025-12-20 21:49:14.650028495 +0100 +++ /var/tmp/diff_new_pack.ttJhNR/_new 2025-12-20 21:49:14.654028661 +0100 @@ -1,5 +1,5 @@ name: opentofu -version: 1.11.1 -mtime: 1765385989 -commit: 85de3d40fae67efb8cfe9020bba738433b49c409 +version: 1.11.2 +mtime: 1766168713 +commit: c0b3d3d37b345579908012f0c9b8caa26499f7e4 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/opentofu/vendor.tar.gz /work/SRC/openSUSE:Factory/.opentofu.new.1928/vendor.tar.gz differ: char 13, line 1
