🚀Support for Terraform Cloud Projects

[EmmanuelOgiji]

Description

Given the recent announcement of Terraform Cloud Projects, this should be supported in the workspace CRD.
It would also be worth having a project CRD as well. Otherwise, another option would be to have the operator check if the project in the CRD exists and if not, create it

Potential YAML Configuration

# workspace.yaml
apiVersion: app.terraform.io/v1alpha2
kind: Workspace
metadata:
  name: this
spec:
  organization: kubernetes-operator
  token:
    secretKeyRef:
      name: tfc-operator
      key: token
  name: workspace-demo
  description: Kubernetes Operator Automated Workspace
  project: demo-project
  applyMethod: auto
  terraformVersion: 1.3.2
  executionMode: remote
  terraformVariables:
    - name: counter
      hcl: true
      value: >
        [
        1,
        2,
        4,
        8,
        16,
        32
        ]
  tags:
    - demo

# project.yaml
apiVersion: app.terraform.io/v1alpha2
kind: Project
metadata:
  name: this
spec:
  organization: kubernetes-operator
  token:
    secretKeyRef:
      name: tfc-operator
      key: token
  name: demo-project

References

• https://developer.hashicorp.com/terraform/tutorials/cloud/projects
• https://www.hashicorp.com/blog/terraform-cloud-adds-projects-to-organize-workspaces-at-scale
• https://developer.hashicorp.com/terraform/cloud-docs/api-docs/projects

Community Note

• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

[arybolovlev]

Hi @EmmanuelOgiji,

Thank you for your proposal!

What do say if the reference to a project will be one of name or id? We do this now for most of the objects. Something like this:

# workspace.yaml
apiVersion: app.terraform.io/v1alpha2
kind: Workspace
spec:
  ...
  project:
    name: demo-project
    # OR
    id: prj-WsVcWRr7SfxRci1v

In addition to that, a good question here could be -- what to do if the project doesn't exist? Should we throw an error and exit from the reconciliation or make the workspace a part of the default project? In this case, we can report the project name and ID in the status. It will be either the default one or the one you have configured:

status:
  project:
    name: demo-project
    id: prj-WsVcWRr7SfxRci1v

Looking forward to hearing your thoughts.

Thank you! 👍🏻

[EmmanuelOgiji]

Hi @arybolovlev ,

Thanks for the response. I like the idea of the option of either project name or id. I think that is great.

For if a project exists or not, I think it depends. If there is going to be a CRD for Projects then I like the idea that if the project does not exist, it just goes to the default one. The user can then correct it if needed later without being blocked (say if it is something critical). Generating an error on the reconcile might be annoying for people. I think this is my preferred option.

However, if there is not going to be a Project CRD then maybe the operator can just create a project if it does not exist.

[arybolovlev]

Thank you! I will try to sum it up in the order it can potentially be implemented.

• Add the project Name and ID to the status. This will be the actual workspace project.

status:
  project:
    name: demo-project
    id: prj-WsVcWRr7SfxRci1v

• Add the ability to configure a project for the workspace by referring to it by either Name or ID. If the project exists, the workspace will be moved there. If the project does not exist, the workspace will remain in the default project and the workspace controller will raise an error and event without quitting from the reconciliation. If the project is not specified/removed, the workspace should stay or move to the default one. In all cases, if spec.project and status.project are not matching, it means that the workspace controller either couldn't move the workspace to the project or reconciliation didn't happen yet. 😊

apiVersion: app.terraform.io/v1alpha2
kind: Workspace
spec:
  ...
  project:
    name: demo-project
    # OR
    id: prj-WsVcWRr7SfxRci1v

As for a new controller to manage projects. I personally like your proposal. And I would really keep it "one-cr-one-project".

I cannot tell you when and if that will be implemented due to some other background tasks, however, I would like to ask you to keep posting your proposals or issues/bugs you found. If you feel that there is a question that is not covered in the documentation or FAQ, please let us know.

Thank you! 🫶🏻

[EmmanuelOgiji]

Thank you very much. That sounds good. Projects can be created externally at the moment so that should be fine. Looking forward to seeing the project feature

[ejhayes]

This seems like it'd be really useful, thanks for opening an issue on this!

[arybolovlev]

Hi @EmmanuelOgiji,

We are planning to cut a new release with project support this week, please keep an eye on releases.

Thanks!