DOC-2199, ENG-1063: Document Terraform redpanda_secret and cross-region AWS PrivateLink#635
DOC-2199, ENG-1063: Document Terraform redpanda_secret and cross-region AWS PrivateLink#635Feediver1 wants to merge 5 commits into
Conversation
The redpanda_secret resource shipped in provider v2.0.0. Remove the now-incorrect Secrets limitation, add a Manage cluster secrets section with the write-only rotation pattern, add a What's New entry, and cross-link from the Secrets and Connect secret-management pages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughThe documentation now covers cluster secret management with the Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
modules/manage/pages/terraform-provider.adoc (1)
185-190: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winBump the provider constraint in the secret-management setup example
modules/manage/pages/terraform-provider.adoc:185-190— theredpanda_secretsection requires provider v2.0.0+, but this snippet still pins~> 1.0, which prevents users from using the documented resource.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@modules/manage/pages/terraform-provider.adoc` around lines 185 - 190, Update the provider version constraint in the Terraform configuration for the redpanda_secret example within terraform-provider.adoc from ~> 1.0 to a constraint supporting provider v2.0.0 or later, such as ~> 2.0.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modules/manage/pages/terraform-provider.adoc`:
- Around line 326-328: Add redpanda_secret to the introductory
supported-resources list near the top of the terraform-provider documentation,
linking it to the resource’s existing documentation section or anchor. Ensure
the list reflects the newly documented resource and no longer omits secret
management.
- Around line 339-345: The Terraform example’s redpanda_secret.example
references an undefined redpanda_cluster.example. Replace cluster_api_url with
the existing data.redpanda_cluster.byoc.cluster_api_url pattern, or define a
matching redpanda_cluster.example resource before this example.
- Around line 334-350: Update the redpanda_secret example’s secret_data
assignment to pass base64encode(var.secret_value), or explicitly document that
secret_value must already be Base64-encoded; keep the surrounding variable and
resource documentation consistent with the chosen behavior.
---
Outside diff comments:
In `@modules/manage/pages/terraform-provider.adoc`:
- Around line 185-190: Update the provider version constraint in the Terraform
configuration for the redpanda_secret example within terraform-provider.adoc
from ~> 1.0 to a constraint supporting provider v2.0.0 or later, such as ~> 2.0.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c8a7312f-35e3-4126-8fdd-70d97383d234
📒 Files selected for processing (4)
modules/develop/pages/connect/configuration/secret-management.adocmodules/get-started/pages/whats-new-cloud.adocmodules/manage/pages/terraform-provider.adocmodules/security/pages/secrets.adoc
| variable "secret_value" { | ||
| description = "Value to store in the secret" | ||
| sensitive = true | ||
| } | ||
|
|
||
| resource "redpanda_secret" "example" { | ||
| name = "EXAMPLE_SECRET" | ||
| secret_data = var.secret_value | ||
| secret_data_version = 1 | ||
| scopes = ["SCOPE_REDPANDA_CONNECT"] | ||
| cluster_api_url = redpanda_cluster.example.cluster_api_url | ||
| allow_deletion = true | ||
| } | ||
| ---- | ||
|
|
||
| * `name`: An uppercase identifier matching `^[A-Z][A-Z0-9_]*$`. You cannot rename a secret after you create it. | ||
| * `secret_data`: The secret value, Base64-encoded. Requires Terraform 1.11 or later. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Target doc section"
sed -n '320,360p' modules/manage/pages/terraform-provider.adoc
echo
echo "## Search for redpanda_secret and secret_data references"
rg -n "redpanda_secret|secret_data|secret_data_version|Base64|base64" modules . --glob '!**/node_modules/**' --glob '!**/dist/**' --glob '!**/build/**' || trueRepository: redpanda-data/cloud-docs
Length of output: 14808
🌐 Web query:
redpanda terraform provider redpanda_secret secret_data Base64 encoded registry docs
💡 Result:
In the Redpanda Terraform provider, the secret_data attribute for the redpanda_secret resource is a sensitive, write-only string that must be Base64-encoded [1][2]. Key technical details include: 1. Encoding Requirement: The value provided to secret_data must be Base64-encoded before being passed to the Terraform resource [1][2]. Redpanda Cloud APIs also require this Base64-encoded format for secret management [3][4]. 2. Resource Handling: Because secret_data is marked as sensitive and write-only, the plaintext value is never stored in the Terraform state file [1]. 3. Rotation: To rotate or update a secret, you must provide the new Base64-encoded value to secret_data and increment the secret_data_version attribute [1]. Terraform uses the version counter to detect changes since the actual secret value cannot be compared directly [1]. 4. Usage: Secrets created via redpanda_secret are referenced in other configurations (such as shadow links or Kafka Connect) using the ${secrets.SECRET_NAME} syntax [1][3][5]. Example Usage: resource "redpanda_secret" "example" { name = "EXAMPLE_SECRET" secret_data = base64encode("your-plaintext-secret") # Base64 encoding applied secret_data_version = 1 scopes = ["SCOPE_REDPANDA_CLUSTER"] cluster_api_url = redpanda_cluster.example.cluster_api_url allow_deletion = true }
Citations:
- 1: https://registry.terraform.io/providers/redpanda-data/redpanda/latest/docs/resources/secret
- 2: https://library.tf/providers/redpanda-data/redpanda/latest/docs/resources/secret
- 3: https://docs.redpanda.com/redpanda-cloud/develop/connect/configuration/secret-management/
- 4: https://docs.redpanda.com/cloud-data-platform/manage/api/cloud-dataplane-api/
- 5: https://registry.terraform.io/providers/redpanda-data/redpanda/latest/docs/resources/shadow_link
Encode secret_data in the example. The redpanda_secret attribute expects Base64-encoded input, but the sample passes var.secret_value directly. Change it to base64encode(var.secret_value) or state that the variable already contains Base64.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@modules/manage/pages/terraform-provider.adoc` around lines 334 - 350, Update
the redpanda_secret example’s secret_data assignment to pass
base64encode(var.secret_value), or explicitly document that secret_value must
already be Base64-encoded; keep the surrounding variable and resource
documentation consistent with the chosen behavior.
There was a problem hiding this comment.
Rejecting this one per SME review (see @david-yu's comment on the PR): the provider sends raw string bytes with no Base64 encode/decode (resource_secret.go: SecretData: []byte(cfg.SecretData.ValueString())), and the provider's live-tested shadow_link example stores a raw SCRAM password that authenticates via ${secrets.<NAME>}. The 'Must be Base64-encoded' note in the registry docs is itself a bug (copied from the REST/JSON wire encoding of the proto bytes field) and will be fixed provider-side. The example correctly passes the raw value, and 86005d7 removes the remaining 'Base64-encoded' wording from the attribute list.
|
Thanks for doing this, I'll also add cross-region private link a commit as well. |
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
david-yu
changed the title
|
Reviewed against the terraform-provider-redpanda source. The content is largely accurate, but three things need fixing before merge: 1. Cross-region PrivateLink is v1.7.0+, not v2.0.0+
2. "You cannot change labels after you create the secret" is incorrectAs of provider v2.1.0 (released 2026-06-24), 3. Base64 (the open SME question): the shipped example is authoritative — drop "Base64-encoded"The provider sends the raw string bytes with no Base64 encode/decode anywhere ( |
- Cross-region PrivateLink Terraform support is provider v1.7.0+ (2026-02-26), not v2.0.0+; fold the What's New mention into the existing February 2026 cross-region PrivateLink entry instead of a standalone June entry - Labels on redpanda_secret update in place as of provider v2.1.0; replace the incorrect "cannot change labels" claim - secret_data takes the raw secret value; drop "Base64-encoded" (the registry doc's Base64 note is a provider-doc bug, per SME) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@david-yu Thanks for the source-level review — all three items are applied in 86005d7:
|
- Add Secrets to the supported-resources list - Point the redpanda_secret example at data.redpanda_cluster.byoc, matching the page's other write-only-attribute examples, instead of an undefined redpanda_cluster.example Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2 participants
Description
This PR documents two shipped Terraform provider features on the Redpanda Terraform Provider page:
1.
redpanda_secretresource (ENG-1062, resolves DOC-2199)The Redpanda Terraform provider v2.0.0 (released 2026-06-03) added the
redpanda_secretresource for managing cluster secrets. Itssecret_dataattribute is write-only (Terraform 1.11+), so the plaintext never lands in state; rotation uses thesecret_data_versioncounter.manage/terraform-provider.adoc:Secretsfrom the Limitations list — it has been incorrect on the live site since v2.0.0 shipped.redpanda_secret(secret_data/secret_data_version, no plaintext variant).develop/connect/configuration/secret-management.adoc: mentions Terraform as a management option (this was the originating customer use case: pipeline auth viaSCOPE_REDPANDA_CONNECT).security/secrets.adoc: added a sentence listing the management interfaces for the cluster secret store, including the Terraform provider.2. Cross-region AWS PrivateLink (ENG-1063)
Cross-region AWS PrivateLink was already documented for the UI and API on the AWS PrivateLink page but not for Terraform. The provider supports it via the optional
supported_regionsattribute of theaws_private_linkblock onredpanda_cluster(v2.0.0+, up to 50 unique regions, updates in place).manage/terraform-provider.adoc:service_nameoutput for creating VPC endpoints, and links to the networking page for the cross-region VPC endpoint workflow.supported_regionsinline) at the new section.networking/aws-privatelink.adoc: the Configure cross-region PrivateLink section now links to the new Terraform section.What's New
get-started/whats-new-cloud.adoc: added June 2026 entries (v2.0.0) for both features, grouped with the existing Terraform SQL entry, following the established Terraform What's New pattern.For SME confirmation (@Gene): the registry doc says
secret_datamust be Base64-encoded, but the shipped provider example passes a plainsensitivevariable withoutbase64encode(). This PR mirrors the shipped example and states the Base64 requirement in the attribute list — please confirm which is authoritative.Not covered here:
redpanda_shadow_link(also v2.0.0) — assumed tracked separately; say the word if the What's New entry should cover both.Resolves DOC-2199
Documents ENG-1063
Page previews
Checks
🤖 Generated with Claude Code
Preview pages