Migrate to vault_kv_secret_v2 resource #120

New issue

Open

opened 2026-07-14 04:10:38 +00:00 by anish · 2 comments

anish commented

2026-07-14 04:10:38 +00:00

(Migrated from codeberg.org)

The vault_kv_secret_v2 data source that we are currently using is deprecated, and it materializes secrets into terraform state, which is bad

atlantis logs:

│ Warning: Deprecated Resource
│ 
│   with data.vault_kv_secret_v2.cachix,
│   on forgejo.tf line 5, in data "vault_kv_secret_v2" "cachix":
│    5: data "vault_kv_secret_v2" "cachix" {
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
│ 
│ (and 3 more similar warnings elsewhere)
╵
╷
│ Warning: Value derived from a deprecated source
│ 
│   with forgejo_organization_action_secret.cachix_auth_token,
│   on forgejo.tf line 17, in resource "forgejo_organization_action_secret" "cachix_auth_token":
│   17:     organization_id = data.forgejo_organization.this.id
│ 
│ This value is derived from data.vault_kv_secret_v2.cachix, which is
│ deprecated with the following message:
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
│ 
│ (and one more similar warning elsewhere)

A note from claude explaining what must be done first:

The clean fix, ephemeral read plus a write-only data_wo on the forgejo resource, isn't available until the forgejo provider adds write-only support for action-secret data. Worth a tracked note to revisit then.

The `vault_kv_secret_v2` data source that we are currently using is deprecated, and it materializes secrets into terraform state, which is bad atlantis logs: ``` │ Warning: Deprecated Resource │ │ with data.vault_kv_secret_v2.cachix, │ on forgejo.tf line 5, in data "vault_kv_secret_v2" "cachix": │ 5: data "vault_kv_secret_v2" "cachix" { │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead │ │ (and 3 more similar warnings elsewhere) ╵ ╷ │ Warning: Value derived from a deprecated source │ │ with forgejo_organization_action_secret.cachix_auth_token, │ on forgejo.tf line 17, in resource "forgejo_organization_action_secret" "cachix_auth_token": │ 17: organization_id = data.forgejo_organization.this.id │ │ This value is derived from data.vault_kv_secret_v2.cachix, which is │ deprecated with the following message: │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead │ │ (and one more similar warning elsewhere) ``` A note from claude explaining what must be done first: ``` The clean fix, ephemeral read plus a write-only data_wo on the forgejo resource, isn't available until the forgejo provider adds write-only support for action-secret data. Worth a tracked note to revisit then. ```

anish added the

labels

2026-10-13 23:03:17 +00:00

anish self-assigned this

2026-10-25 22:41:28 +00:00

anish commented

2026-10-25 22:42:51 +00:00

Owner

part of the work is done in ScottyLabs/infrastructure#176. remaining todo from claude:

The only deprecated read left is keycloak_idp, and Google's client_secret is what keeps it alive because its IdP resource has no write-only variant. Slack, cmu and apple can move to client_secret_wo now, with apple's IDs written inline, but the data source can't go away until Google's secret moves to its own Vault path or the provider adds a write-only argument for it.

part of the work is done in https://git.cmu.dev/ScottyLabs/infrastructure/pulls/176. remaining todo from claude: ``` The only deprecated read left is keycloak_idp, and Google's client_secret is what keeps it alive because its IdP resource has no write-only variant. Slack, cmu and apple can move to client_secret_wo now, with apple's IDs written inline, but the data source can't go away until Google's secret moves to its own Vault path or the provider adds a write-only argument for it. ```

anish commented

2026-10-25 22:54:26 +00:00

Owner

the governance part of it is done in #550

the governance part of it is done in https://git.cmu.dev/ScottyLabs/governance/pulls/550