feat(workflows): Onboarding STACKIT Workflows by c-thiel · Pull Request #1528 · stackitcloud/terraform-provider-stackit

c-thiel · 2026-06-19T09:07:04Z

Adds Terraform support for STACKIT Workflows (Apache Airflow 3 as a service):

  resources:    stackit_workflows_instance, stackit_workflows_dag_bundle
  data sources: stackit_workflows_instance, stackit_workflows_instances,
                stackit_workflows_dag_bundle, stackit_workflows_dag_bundles,
                stackit_workflows_provider_options

All seven surfaces are gated behind the workflows experiment flag.

Notes for reviewers:

The workflows Go SDK is not yet on a published tag; this PR uses a replace-directive in go.mod pointing at the bot-generated branch. This is per the dev-tools team's request to enable an early review pass. The replace will be dropped once the SDK release lands.
dag_bundle list/get endpoints currently return 403 in prod for service-account-authenticated callers. The server-side fix is merged upstream and awaiting deploy; acceptance tests against those endpoints will only pass once that ships.
The Workflows team recently split DAG bundles out of the instance Create payload into a separate /dag-bundles resource. Two follow-up items are still in flight and are not provider bugs:
- The new /dag-bundles list/get endpoints currently return 403 for
  service-account callers in production. The fix is merged upstream
  and awaiting deploy; acceptance tests against those endpoints will
  pass once it ships.
- The instance helm chart still unconditionally provisions an
  ExternalSecret for the DAG-bundle git credentials, which means an
  Airflow 3 instance created without a bundle can't reach active.
  The team is working on this; in the meantime a follow-up provider
  PR will inline the bundles back onto the instance Create payload
  (which the API already supports) to side-step it.

Description

relates to #1234

Checklist

Issue was linked above
Code format was applied: make fmt
Examples were added / adjusted (see examples/ directory)
Docs are up-to-date: make generate-docs (will be checked by CI)
Unit tests got implemented or updated
Acceptance tests got implemented or updated (see e.g. here)
Unit tests are passing: make test (will be checked by CI)
No linter issues: make lint (will be checked by CI)

Adds Terraform support for STACKIT Workflows (Apache Airflow 3 as a service): resources: stackit_workflows_instance, stackit_workflows_dag_bundle data sources: stackit_workflows_instance, stackit_workflows_instances, stackit_workflows_dag_bundle, stackit_workflows_dag_bundles, stackit_workflows_provider_options All seven surfaces are gated behind the `workflows` experiment flag. Notes for reviewers: * The workflows Go SDK is not yet on a published tag; this PR uses a replace-directive in `go.mod` pointing at the bot-generated branch. This is per the dev-tools team's request to enable an early review pass. The replace will be dropped once the SDK release lands. * `dag_bundle` list/get endpoints currently return 403 in prod for service-account-authenticated callers. The server-side fix is merged upstream and awaiting deploy; acceptance tests against those endpoints will only pass once that ships. * A separate cluster-side issue (helm chart unconditionally provisions an ExternalSecret for the git-bundle credentials) means Airflow 3 instances cannot reach `active` unless a dag_bundle is configured at Create time. This is owned by the API team. Subsequent provider PR will inline dag_bundles onto the instance Create payload to work around it cleanly.

github-actions · 2026-06-30T02:15:17Z

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

Fyusel · 2026-07-07T06:21:49Z

+			"region": schema.StringAttribute{Description: schemaDescriptions["region"], Optional: true, Computed: true},
+			"instance_id": schema.StringAttribute{
+				Description: schemaDescriptions["instance_id"],
+				Required:    true,


Please sort: required - optional here please

Fyusel · 2026-07-07T06:24:42Z

+		return
+	}
+	d.client = apiClient
+}


tflog.Info() message missing here (... client configured...)

Fyusel · 2026-07-07T06:25:13Z

+		return
+	}
+	resp.Diagnostics.Append(resp.State.Set(ctx, model)...)
+	tflog.Debug(ctx, "Workflows DAG bundle read")


Suggested change

tflog.Debug(ctx, "Workflows DAG bundle read")

tflog.Info(ctx, "Workflows DAG bundle read")

Fyusel · 2026-07-07T06:32:29Z

+
+	bundle, err := d.client.DefaultAPI.GetDagBundle(ctx, projectID, region, instanceID, name).Execute()
+	if err != nil {
+		var oapiErr *oapierror.GenericOpenAPIError


This block "http.StatusNotFound" can be put into the tfutils.LogError() -> can be handled there.

Fyusel · 2026-07-07T06:35:36Z

+	if resp.Diagnostics.HasError() {
+		return
+	}
+	r.client = apiClient


Info message missing

Fyusel · 2026-07-07T08:43:17Z

+	}
+	list, diags := types.ListValue(objType, elements)
+	if diags.HasError() {
+		return fmt.Errorf("%v", diags.Errors())


same here: core.DiagsToError(diags)

Fyusel · 2026-07-07T09:29:32Z

+// requireEnv collects a set of required env vars for these tests; if any are
+// missing, skips the test with a clear message. Keeps test runs cheap when
+// workflows-specific secrets aren't provisioned in the runner.
+func requireEnv(t *testing.T, keys ...string) map[string]string {


I like this function but thought more about checking the general env variables here like TF_ACC_PROJECT_ID

Fyusel · 2026-07-07T09:34:38Z

+		"TF_ACC_WORKFLOWS_IDP_CLIENT_ID",
+		"TF_ACC_WORKFLOWS_IDP_CLIENT_SECRET",
+		"TF_ACC_WORKFLOWS_IDP_SCOPE",
+		"TF_ACC_WORKFLOWS_IDP_DISCOVERY_ENDPOINT",


Our acceptance tests are structured as following:
All needed information and additional instances should be defined in the acceptance test. There should be no need to set special things beforehand or creating other instances in a manual step. You can have a look at other acceptance tests. Besides some general environment variables like PROJECT_ID or ORGANIZATION_ID (+ some more) no special values are passed to an acceptance test.

Another thing: We have a Test...Min and a Test...Max for all those tests (where it makes sense of course).
Min test: only the required parameters are set in order to test that this is working as expected.
Max test: all parameters are set (to one example value if "a lot" of values would be possible).

Fyusel · 2026-07-07T09:35:20Z

+		"TF_ACC_WORKFLOWS_DAGS_GIT_URL",
+		"TF_ACC_WORKFLOWS_DAGS_GIT_BRANCH",
+		"TF_ACC_WORKFLOWS_DAGS_GIT_USER",
+		"TF_ACC_WORKFLOWS_DAGS_GIT_PAT",


Same here: I don't want to pass them before running the acceptance test

Fyusel · 2026-07-07T09:36:43Z

 )

+replace github.com/stackitcloud/stackit-sdk-go/services/workflows => /Users/cht/code/schwarz/stackit-sdk-go/services/workflows
+


Just a reminder: Replace before merging

github-actions · 2026-07-15T02:13:38Z

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

ChrsBaur · 2026-07-15T17:26:44Z

Hey @c-thiel, thanks for putting this together — we're currently evaluating STACKIT Workflows for a couple of scheduled data pipelines (one daily, one weekly batch job) and would love to manage the instance via Terraform once this lands.

We poked at the v1alpha REST API directly in the meantime and can confirm that providing dagBundles inline on instance create (rather than via the separate /dag-bundles endpoint) works well as a way to sidestep the two issues you mentioned — nice workaround.

Do you have a rough sense of timeline for the SDK tag and the backend fixes landing? Happy to test against a real instance once those are in place, if that's useful.

c-thiel requested a review from a team as a code owner June 19, 2026 09:07

Fyusel added the has internal tracking issue label Jun 22, 2026

github-actions Bot added the Stale PR is marked as stale due to inactivity. label Jun 30, 2026

Fyusel removed the Stale PR is marked as stale due to inactivity. label Jul 7, 2026

Fyusel requested changes Jul 7, 2026

View reviewed changes

github-actions Bot added the Stale PR is marked as stale due to inactivity. label Jul 15, 2026

github-actions Bot removed the Stale PR is marked as stale due to inactivity. label Jul 16, 2026

	tflog.Debug(ctx, "Workflows DAG bundle read")
	tflog.Info(ctx, "Workflows DAG bundle read")

		)

		replace github.com/stackitcloud/stackit-sdk-go/services/workflows => /Users/cht/code/schwarz/stackit-sdk-go/services/workflows

Uh oh!

Conversation

c-thiel commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

github-actions Bot commented Jun 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

ChrsBaur commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

c-thiel commented Jun 19, 2026 •

edited

Loading