Skip to content

feat(workers): add write-only secret support for Access IdP and bindings - #7246

Closed
jeszican wants to merge 1 commit into
cloudflare:mainfrom
jeszican:feat/write-only-secret-fields
Closed

feat(workers): add write-only secret support for Access IdP and bindings#7246
jeszican wants to merge 1 commit into
cloudflare:mainfrom
jeszican:feat/write-only-secret-fields

Conversation

@jeszican

@jeszican jeszican commented Jul 8, 2026

Copy link
Copy Markdown
  • I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

Add write-only support for secret-bearing fields while preserving backwards compatibility:

  • cloudflare_zero_trust_access_identity_provider
    • add config.client_secret_wo (write-only, sensitive)
    • add config.client_secret_wo_version
    • prefer client_secret_wo when constructing create/update payloads
  • cloudflare_workers_script and cloudflare_worker_version
    • add bindings[*].text_wo (write-only, sensitive)
    • add bindings[*].text_wo_version
    • map text_wo into API payload text for create/update
  • keep legacy secret fields (client_secret, text) and enforce conflict validation between legacy and _wo fields
  • update docs for all new attributes

Acceptance test run results

  • I have added or updated acceptance tests for my changes
  • I have run acceptance tests for my changes and included the results below

Steps to run acceptance tests

Targeted package tests used for this change:

go test ./internal/services/zero_trust_access_identity_provider ./internal/services/workers_script ./internal/services/worker_version

Test output

ok  github.com/cloudflare/terraform-provider-cloudflare/internal/services/zero_trust_access_identity_provider  1.828s
ok  github.com/cloudflare/terraform-provider-cloudflare/internal/services/workers_script                        3.269s
ok  github.com/cloudflare/terraform-provider-cloudflare/internal/services/worker_version                        2.600s

Additional context & links

  • SKIP_BREW=1 ./scripts/bootstrap and ./scripts/build dev both succeed locally.
  • ./scripts/test (go test -v ./...) is long-running in this environment and was interrupted before completion.

Add write-only `_wo` fields for Access IdP client secrets and Workers binding text values to keep secrets out of Terraform state while preserving backward compatibility with existing sensitive attributes.
@jeszican
jeszican force-pushed the feat/write-only-secret-fields branch from 72653df to f88a8d5 Compare July 8, 2026 11:24
@jeszican jeszican closed this Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant