Migrate to vault_kv_secret_v2 resource #120

New issue

Open

opened 2026-07-14 04:10:38 +00:00 by anish · 0 comments

anish commented

2026-07-14 04:10:38 +00:00

(Migrated from codeberg.org)

The vault_kv_secret_v2 data source that we are currently using is deprecated, and it materializes secrets into terraform state, which is bad

atlantis logs:

│ Warning: Deprecated Resource
│ 
│   with data.vault_kv_secret_v2.cachix,
│   on forgejo.tf line 5, in data "vault_kv_secret_v2" "cachix":
│    5: data "vault_kv_secret_v2" "cachix" {
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
│ 
│ (and 3 more similar warnings elsewhere)
╵
╷
│ Warning: Value derived from a deprecated source
│ 
│   with forgejo_organization_action_secret.cachix_auth_token,
│   on forgejo.tf line 17, in resource "forgejo_organization_action_secret" "cachix_auth_token":
│   17:     organization_id = data.forgejo_organization.this.id
│ 
│ This value is derived from data.vault_kv_secret_v2.cachix, which is
│ deprecated with the following message:
│ 
│ Deprecated. Please use new Ephemeral KVV2 Secret resource
│ `vault_kv_secret_v2` instead
│ 
│ (and one more similar warning elsewhere)

A note from claude explaining what must be done first:

The clean fix, ephemeral read plus a write-only data_wo on the forgejo resource, isn't available until the forgejo provider adds write-only support for action-secret data. Worth a tracked note to revisit then.

The `vault_kv_secret_v2` data source that we are currently using is deprecated, and it materializes secrets into terraform state, which is bad atlantis logs: ``` │ Warning: Deprecated Resource │ │ with data.vault_kv_secret_v2.cachix, │ on forgejo.tf line 5, in data "vault_kv_secret_v2" "cachix": │ 5: data "vault_kv_secret_v2" "cachix" { │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead │ │ (and 3 more similar warnings elsewhere) ╵ ╷ │ Warning: Value derived from a deprecated source │ │ with forgejo_organization_action_secret.cachix_auth_token, │ on forgejo.tf line 17, in resource "forgejo_organization_action_secret" "cachix_auth_token": │ 17: organization_id = data.forgejo_organization.this.id │ │ This value is derived from data.vault_kv_secret_v2.cachix, which is │ deprecated with the following message: │ │ Deprecated. Please use new Ephemeral KVV2 Secret resource │ `vault_kv_secret_v2` instead │ │ (and one more similar warning elsewhere) ``` A note from claude explaining what must be done first: ``` The clean fix, ephemeral read plus a write-only data_wo on the forgejo resource, isn't available until the forgejo provider adds write-only support for action-secret data. Worth a tracked note to revisit then. ```