feat(workers): add write-only secret support for Access IdP and bindings - #7246
Closed
jeszican wants to merge 1 commit into
Closed
feat(workers): add write-only secret support for Access IdP and bindings#7246jeszican wants to merge 1 commit into
jeszican wants to merge 1 commit into
Conversation
jeszican
force-pushed
the
feat/write-only-secret-fields
branch
from
July 8, 2026 11:21
7f1e7ee to
f5c9773
Compare
jeszican
force-pushed
the
feat/write-only-secret-fields
branch
from
July 8, 2026 11:23
f5c9773 to
72653df
Compare
Add write-only `_wo` fields for Access IdP client secrets and Workers binding text values to keep secrets out of Terraform state while preserving backward compatibility with existing sensitive attributes.
jeszican
force-pushed
the
feat/write-only-secret-fields
branch
from
July 8, 2026 11:24
72653df to
f88a8d5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes being requested
Add write-only support for secret-bearing fields while preserving backwards compatibility:
cloudflare_zero_trust_access_identity_providerconfig.client_secret_wo(write-only, sensitive)config.client_secret_wo_versionclient_secret_wowhen constructing create/update payloadscloudflare_workers_scriptandcloudflare_worker_versionbindings[*].text_wo(write-only, sensitive)bindings[*].text_wo_versiontext_wointo API payloadtextfor create/updateclient_secret,text) and enforce conflict validation between legacy and_wofieldsAcceptance test run results
Steps to run acceptance tests
Targeted package tests used for this change:
go test ./internal/services/zero_trust_access_identity_provider ./internal/services/workers_script ./internal/services/worker_versionTest output
Additional context & links
SKIP_BREW=1 ./scripts/bootstrapand./scripts/build devboth succeed locally../scripts/test(go test -v ./...) is long-running in this environment and was interrupted before completion.