[TF-27661] Add support for HYOK related attributes by iuri-slywitch-hashicorp · Pull Request #1192 · hashicorp/go-tfe

iuri-slywitch-hashicorp · 2025-08-20T21:07:06Z

Description

Add support for HYOK related attributes in existing go-tfe objects:

agent_pool related attributes:
- HYOKConfigurations: read only.
organization related attributes:
- EnforceHYOK: create, read, update.
- PrimaryHYOKConfiguration: read only.
- CanUpdateHYOKConfiguration added in OrganizationPermissions.
- CanViewHYOKFeatureInfo added in OrganizationPermissions.
plan related attributes:
- HYOKEncryptedDataKey: read only.
- SanitizedPlan: read only.
state_version related attributes:
- EncryptedStateDownloadURL: read only.
- SanitizedStateDownloadURL: read only.
- SanitizedStateUploadURL: read only.
- UploadSanitizedState(): function to upload sanitized state.
- HYOKEncryptedDataKey: read only.
workspace related attributes:
- HYOKEnabled: create, read, update.
- CanManageHYOK added in WorkspacePermissions.
- HYOKEncryptedDataKey: read only.

Testing plan

Test files ensure the attributes are populated when using the go-tfe objects.

External links

JIRA
- TF-27661

Output from tests

agent_pool test cases:

TestAgentPoolsRead

=== RUN   TestAgentPoolsRead
=== RUN   TestAgentPoolsRead/read_existing_hyok_configurations_of_an_agent_pool
--- PASS: TestAgentPoolsRead (0.38s)
    --- PASS: TestAgentPoolsRead/read_existing_hyok_configurations_of_an_agent_pool (0.16s)
PASS
ok      github.com/hashicorp/go-tfe     0.849s

organization test cases:

TestOrganizationsRead

=== RUN   TestOrganizationsRead
=== RUN   TestOrganizationsRead/read_existing_primary_hyok_configuration_of_an_organization
--- PASS: TestOrganizationsRead (0.46s)
    --- PASS: TestOrganizationsRead/read_existing_primary_hyok_configuration_of_an_organization (0.18s)
PASS
ok      github.com/hashicorp/go-tfe     0.976s

=== RUN   TestOrganizationsRead
=== RUN   TestOrganizationsRead/read_enforce_hyok_of_an_organization
--- PASS: TestOrganizationsRead (0.39s)
    --- PASS: TestOrganizationsRead/read_enforce_hyok_of_an_organization (0.15s)
PASS
ok      github.com/hashicorp/go-tfe     0.605s

TestOrganizationsUpdate

=== RUN   TestOrganizationsUpdate
=== RUN   TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_true
--- PASS: TestOrganizationsUpdate (0.73s)
    --- PASS: TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_true (0.21s)
PASS
ok      github.com/hashicorp/go-tfe     0.978s

=== RUN   TestOrganizationsUpdate
=== RUN   TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_false
--- PASS: TestOrganizationsUpdate (1.00s)
    --- PASS: TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_false (0.59s)
PASS
ok      github.com/hashicorp/go-tfe     1.242s

plan test cases:

TestPlansRead

=== RUN   TestPlansRead
=== RUN   TestPlansRead/read_sanitized_plan_of_a_plan
--- PASS: TestPlansRead (0.85s)
    --- PASS: TestPlansRead/read_sanitized_plan_of_a_plan (0.45s)
PASS
ok      github.com/hashicorp/go-tfe     1.335s

=== RUN   TestPlansRead
=== RUN   TestPlansRead/read_hyok_encrypted_data_key_of_a_plan
--- PASS: TestPlansRead (0.90s)
    --- PASS: TestPlansRead/read_hyok_encrypted_data_key_of_a_plan (0.50s)
PASS
ok      github.com/hashicorp/go-tfe     1.397s

state_version test cases:

TestStateVersionsRead

=== RUN   TestStateVersionsRead
=== RUN   TestStateVersionsRead/read_encrypted_state_download_url_of_a_state_version
--- PASS: TestStateVersionsRead (3.69s)
    --- PASS: TestStateVersionsRead/read_encrypted_state_download_url_of_a_state_version (0.45s)
PASS
ok      github.com/hashicorp/go-tfe     4.154s

=== RUN   TestStateVersionsRead
=== RUN   TestStateVersionsRead/read_sanitized_state_download_url_of_a_state_version
--- PASS: TestStateVersionsRead (3.41s)
    --- PASS: TestStateVersionsRead/read_sanitized_state_download_url_of_a_state_version (0.30s)
PASS
ok      github.com/hashicorp/go-tfe     3.641s

=== RUN   TestStateVersionsRead
=== RUN   TestStateVersionsRead/read_hyok_encrypted_data_key_of_a_state_version
--- PASS: TestStateVersionsRead (4.34s)
    --- PASS: TestStateVersionsRead/read_hyok_encrypted_data_key_of_a_state_version (0.28s)
PASS
ok      github.com/hashicorp/go-tfe     4.573s

workspace test cases:

TestWorkspacesCreate

=== RUN   TestWorkspacesCreate
=== RUN   TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_true
--- PASS: TestWorkspacesCreate (4.41s)
    --- PASS: TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_true (3.62s)
PASS
ok      github.com/hashicorp/go-tfe     4.655s

=== RUN   TestWorkspacesCreate
=== RUN   TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_false
--- PASS: TestWorkspacesCreate (1.73s)
    --- PASS: TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_false (1.02s)
PASS

TestWorkspacesRead

=== RUN   TestWorkspacesRead
=== RUN   TestWorkspacesRead/read_hyok_enabled_of_a_workspace
--- PASS: TestWorkspacesRead (0.87s)
    --- PASS: TestWorkspacesRead/read_hyok_enabled_of_a_workspace (0.58s)
PASS
ok      github.com/hashicorp/go-tfe     1.359s

TestWorkspacesUpdate

=== RUN   TestWorkspacesUpdate
=== RUN   TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_false
--- PASS: TestWorkspacesUpdate (1.34s)
    --- PASS: TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_false (0.92s)
PASS
ok      github.com/hashicorp/go-tfe     1.827s

=== RUN   TestWorkspacesUpdate
=== RUN   TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_true
--- PASS: TestWorkspacesUpdate (3.05s)
    --- PASS: TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_true (2.69s)
PASS
ok      github.com/hashicorp/go-tfe     3.289s

=== RUN   TestWorkspacesUpdate
=== RUN   TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_true
--- PASS: TestWorkspacesUpdate (1.87s)
    --- PASS: TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_true (1.24s)
PASS
ok      github.com/hashicorp/go-tfe     2.413s

=== RUN   TestWorkspacesUpdate
=== RUN   TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_false
--- PASS: TestWorkspacesUpdate (0.70s)
    --- PASS: TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_false (0.32s)
PASS
ok      github.com/hashicorp/go-tfe     0.934s

Output hyok-testing.sh

TestAgentPoolsRead/read_hyok_configurations_of_an_agent_pool: PASS
TestPlansRead/read_hyok_encrypted_data_key_of_a_plan: PASS
TestPlansRead/read_sanitized_plan_of_a_plan: PASS
TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_false: PASS
TestWorkspacesCreate/create_workspace_with_hyok_enabled_set_to_true: PASS
TestWorkspacesRead/read_hyok_enabled_of_a_workspace: PASS
TestWorkspacesRead/read_hyok_encrypted_data_key_of_a_workspace: PASS
TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_false: PASS
TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_false_to_true: PASS
TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_true: PASS
TestWorkspacesUpdate/update_hyok_enabled_of_a_workspace_from_true_to_false: PASS
TestOrganizationsRead/read_primary_hyok_configuration_of_an_organization: PASS
TestOrganizationsRead/read_enforce_hyok_of_an_organization: PASS
TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_true: PASS
TestOrganizationsUpdate/update_enforce_hyok_of_an_organization_to_false: PASS
TestStateVersionsRead/read_encrypted_state_download_url_of_a_state_version: PASS
TestStateVersionsRead/read_sanitized_state_download_url_of_a_state_version: PASS
TestStateVersionsRead/read_hyok_encrypted_data_key_of_a_state_version: PASS
TestStateVersionsUpload/uploading_state_using_SanitizedStateUploadURL_and_verifying_SanitizedStateDownloadURL_exists: PASS
TestStateVersionsUpload/SanitizedStateUploadURL_is_required_when_uploading_sanitized_state: PASS
TestAWSOIDCConfigurationCreateDelete/with_valid_options: PASS
TestAWSOIDCConfigurationCreateDelete/missing_role_ARN: PASS
TestAWSOIDCConfigurationRead/fetch_existing_configuration: PASS
TestAWSOIDCConfigurationRead/fetching_non-existing_configuration: PASS
TestAWSOIDCConfigurationsUpdate/with_valid_options: PASS
TestAWSOIDCConfigurationsUpdate/missing_role_ARN: PASS
TestAzureOIDCConfigurationCreateDelete/with_valid_options: PASS
TestAzureOIDCConfigurationCreateDelete/missing_client_ID: PASS
TestAzureOIDCConfigurationCreateDelete/missing_subscription_ID: PASS
TestAzureOIDCConfigurationCreateDelete/missing_tenant_ID: PASS
TestAzureOIDCConfigurationRead/fetch_existing_configuration: PASS
TestAzureOIDCConfigurationRead/fetching_non-existing_configuration: PASS
TestAzureOIDCConfigurationUpdate/update_all_fields: PASS
TestAzureOIDCConfigurationUpdate/client_ID_not_provided: PASS
TestAzureOIDCConfigurationUpdate/subscription_ID_not_provided: PASS
TestAzureOIDCConfigurationUpdate/tenant_ID_not_provided: PASS
TestGCPOIDCConfigurationCreateDelete/with_valid_options: PASS
TestGCPOIDCConfigurationCreateDelete/missing_workload_provider_name: PASS
TestGCPOIDCConfigurationCreateDelete/missing_service_account_email: PASS
TestGCPOIDCConfigurationCreateDelete/missing_project_number: PASS
TestGCPOIDCConfigurationRead/fetch_existing_configuration: PASS
TestGCPOIDCConfigurationRead/fetching_non-existing_configuration: PASS
TestGCPOIDCConfigurationUpdate/update_all_fields: PASS
TestGCPOIDCConfigurationUpdate/workload_provider_name_not_provided: PASS
TestGCPOIDCConfigurationUpdate/service_account_email_not_provided: PASS
TestGCPOIDCConfigurationUpdate/project_number_not_provided: PASS
TestVaultOIDCConfigurationCreateDelete/with_valid_options: PASS
TestVaultOIDCConfigurationCreateDelete/missing_address: PASS
TestVaultOIDCConfigurationCreateDelete/missing_role_name: PASS
TestVaultOIDCConfigurationRead/fetch_existing_configuration: PASS
TestVaultOIDCConfigurationRead/fetching_non-existing_configuration: PASS
TestVaultOIDCConfigurationUpdate/update_all_fields: PASS
TestVaultOIDCConfigurationUpdate/address_not_provided: PASS
TestVaultOIDCConfigurationUpdate/role_name_not_provided: PASS
TestVaultOIDCConfigurationUpdate/namespace_not_provided: PASS
TestVaultOIDCConfigurationUpdate/JWTAuthPath_not_provided: PASS
TestVaultOIDCConfigurationUpdate/TLSCACertificate_not_provided: PASS
TestHYOKCustomerKeyVersionsList/with_no_list_options: PASS
TestHYOKCustomerKeyVersionsRead/read_an_existing_key_version: PASS
TestHYOKEncryptedDataKeyRead/read_an_existing_encrypted_data_key: PASS
TestHYOKConfigurationCreateRevokeDelete/AWS_with_valid_options: PASS
TestHYOKConfigurationCreateRevokeDelete/AWS_with_missing_key_region: PASS
TestHYOKConfigurationCreateRevokeDelete/GCP_with_valid_options: PASS
TestHYOKConfigurationCreateRevokeDelete/GCP_with_missing_key_location: PASS
TestHYOKConfigurationCreateRevokeDelete/GCP_with_missing_key_ring_ID: PASS
TestHYOKConfigurationCreateRevokeDelete/Vault_with_valid_options: PASS
TestHYOKConfigurationCreateRevokeDelete/Azure_with_valid_options: PASS
TestHYOKConfigurationCreateRevokeDelete/with_missing_KEK_ID: PASS
TestHYOKConfigurationCreateRevokeDelete/with_missing_agent_pool: PASS
TestHYOKConfigurationCreateRevokeDelete/with_missing_OIDC_config: PASS
TestHyokConfigurationList/without_list_options: PASS
TestHyokConfigurationRead/AWS: PASS
TestHyokConfigurationRead/Azure: PASS
TestHyokConfigurationRead/GCP: PASS
TestHyokConfigurationRead/Vault: PASS
TestHyokConfigurationRead/fetching_non-existing_configuration: PASS
TestHYOKConfigurationUpdate/AWS_with_valid_options: PASS
TestHYOKConfigurationUpdate/GCP_with_valid_options: PASS
TestHYOKConfigurationUpdate/Vault_with_valid_options: PASS
TestHYOKConfigurationUpdate/Azure_with_valid_options: PASS

agent_pool.go

workspace.go

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

…butes

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

SwiftEngineer

I only had one nit, other than that this looks great to me 👍

That being said, I would recommend waiting to merge this branch until we've implemented the terraform provider HYOK support, just to make sure it's got everything we need and to reduce the chances of us releasing a version of go-tfe with "broken" support for HYOK.

organization_integration_test.go

dominic-retli-hashi · 2025-09-05T13:55:14Z

Do we need representation for hyok_customer_key_version?
I noticed its not mentioned in this ticket, but we do plan to add a terraform-tfe-provider data source for it.

EDIT: Nevermind I see this was already added in a different PR!

organization_integration_test.go

iuri-slywitch-hashicorp · 2025-09-10T00:00:25Z

Setting up staging environment for testing:

envchain --set STAGING_ENVCHAIN TFE_ADDRESS TFE_TOKEN SKIP_HYOK_INTEGRATION_TESTS HYOK_ORGANIZATION_NAME HYOK_WORKSPACE_NAME HYOK_POOL_ID HYOK_PLAN_ID HYOK_STATE_VERSION_ID HYOK_CUSTOMER_KEY_VERSION_ID HYOK_ENCRYPTED_DATA_KEY_ID

hyok-testing.sh

#!/bin/bash

env="STAGING_ENVCHAIN"
pairs=(
    # HYOK Attributes testing
    # -- Agent Pools
    "TestAgentPoolsRead:read_hyok_configurations_of_an_agent_pool"
    # -- Plans
    "TestPlansRead:read_hyok_encrypted_data_key_of_a_plan"
    "TestPlansRead:read_sanitized_plan_of_a_plan"
    # -- Workspaces
    "TestWorkspacesCreate:create_workspace_with_hyok_enabled_set_to_false"
    "TestWorkspacesCreate:create_workspace_with_hyok_enabled_set_to_true"
    "TestWorkspacesRead:read_hyok_enabled_of_a_workspace"
    "TestWorkspacesRead:read_hyok_encrypted_data_key_of_a_workspace"
    "TestWorkspacesUpdate:update_hyok_enabled_of_a_workspace_from_false_to_false"
    "TestWorkspacesUpdate:update_hyok_enabled_of_a_workspace_from_false_to_true"
    "TestWorkspacesUpdate:update_hyok_enabled_of_a_workspace_from_true_to_true"
    "TestWorkspacesUpdate:update_hyok_enabled_of_a_workspace_from_true_to_false"
    # -- Organizations
    "TestOrganizationsRead:read_primary_hyok_configuration_of_an_organization"
    "TestOrganizationsRead:read_enforce_hyok_of_an_organization"
    "TestOrganizationsUpdate:update_enforce_hyok_of_an_organization_to_true"
    "TestOrganizationsUpdate:update_enforce_hyok_of_an_organization_to_false"
    # -- State Versions
    "TestStateVersionsRead:read_encrypted_state_download_url_of_a_state_version"
    "TestStateVersionsRead:read_sanitized_state_download_url_of_a_state_version"
    "TestStateVersionsRead:read_hyok_encrypted_data_key_of_a_state_version"
    "TestStateVersionsUpload:uploading_state_using_SanitizedStateUploadURL_and_verifying_SanitizedStateDownloadURL_exists"
    "TestStateVersionsUpload:SanitizedStateUploadURL_is_required_when_uploading_sanitized_state"

    # AWS OIDC Configuration testing
    "TestAWSOIDCConfigurationCreateDelete:with_valid_options"
    "TestAWSOIDCConfigurationCreateDelete:missing_role_ARN"
    "TestAWSOIDCConfigurationRead:fetch_existing_configuration"
    "TestAWSOIDCConfigurationRead:fetching_non-existing_configuration"
    "TestAWSOIDCConfigurationsUpdate:with_valid_options"
    "TestAWSOIDCConfigurationsUpdate:missing_role_ARN"

    # Azure OIDC Configuration testing
    "TestAzureOIDCConfigurationCreateDelete:with_valid_options"
    "TestAzureOIDCConfigurationCreateDelete:missing_client_ID"
    "TestAzureOIDCConfigurationCreateDelete:missing_subscription_ID"
    "TestAzureOIDCConfigurationCreateDelete:missing_tenant_ID"
    "TestAzureOIDCConfigurationRead:fetch_existing_configuration"
    "TestAzureOIDCConfigurationRead:fetching_non-existing_configuration"
    "TestAzureOIDCConfigurationUpdate:update_all_fields"
    "TestAzureOIDCConfigurationUpdate:client_ID_not_provided"
    "TestAzureOIDCConfigurationUpdate:subscription_ID_not_provided"
    "TestAzureOIDCConfigurationUpdate:tenant_ID_not_provided"

    # GCP OIDC Configuration testing
    "TestGCPOIDCConfigurationCreateDelete:with_valid_options"
    "TestGCPOIDCConfigurationCreateDelete:missing_workload_provider_name"
    "TestGCPOIDCConfigurationCreateDelete:missing_service_account_email"
    "TestGCPOIDCConfigurationCreateDelete:missing_project_number"
    "TestGCPOIDCConfigurationRead:fetch_existing_configuration"
    "TestGCPOIDCConfigurationRead:fetching_non-existing_configuration"
    "TestGCPOIDCConfigurationUpdate:update_all_fields"
    "TestGCPOIDCConfigurationUpdate:workload_provider_name_not_provided"
    "TestGCPOIDCConfigurationUpdate:service_account_email_not_provided"
    "TestGCPOIDCConfigurationUpdate:project_number_not_provided"

    # Vault OIDC Configuration testing
    "TestVaultOIDCConfigurationCreateDelete:with_valid_options"
    "TestVaultOIDCConfigurationCreateDelete:missing_address"
    "TestVaultOIDCConfigurationCreateDelete:missing_role_name"
    "TestVaultOIDCConfigurationRead:fetch_existing_configuration"
    "TestVaultOIDCConfigurationRead:fetching_non-existing_configuration"
    "TestVaultOIDCConfigurationUpdate:update_all_fields"
    "TestVaultOIDCConfigurationUpdate:address_not_provided"
    "TestVaultOIDCConfigurationUpdate:role_name_not_provided"
    "TestVaultOIDCConfigurationUpdate:namespace_not_provided"
    "TestVaultOIDCConfigurationUpdate:JWTAuthPath_not_provided"
    "TestVaultOIDCConfigurationUpdate:TLSCACertificate_not_provided"

    # HYOK Customer Key Version testing
    "TestHYOKCustomerKeyVersionsList:with_no_list_options"
    "TestHYOKCustomerKeyVersionsRead:read_an_existing_key_version"

    # HYOK Encrypted Data Key testing
    "TestHYOKEncryptedDataKeyRead:read_an_existing_encrypted_data_key"

    # HYOK Configurations testing
    "TestHYOKConfigurationCreateRevokeDelete:AWS_with_valid_options"
    "TestHYOKConfigurationCreateRevokeDelete:AWS_with_missing_key_region"
    "TestHYOKConfigurationCreateRevokeDelete:GCP_with_valid_options"
    "TestHYOKConfigurationCreateRevokeDelete:GCP_with_missing_key_location"
    "TestHYOKConfigurationCreateRevokeDelete:GCP_with_missing_key_ring_ID"
    "TestHYOKConfigurationCreateRevokeDelete:Vault_with_valid_options"
    "TestHYOKConfigurationCreateRevokeDelete:Azure_with_valid_options"
    "TestHYOKConfigurationCreateRevokeDelete:with_missing_KEK_ID"
    "TestHYOKConfigurationCreateRevokeDelete:with_missing_agent_pool"
    "TestHYOKConfigurationCreateRevokeDelete:with_missing_OIDC_config"
    "TestHyokConfigurationList:without_list_options"
    "TestHyokConfigurationRead:AWS"
    "TestHyokConfigurationRead:Azure"
    "TestHyokConfigurationRead:GCP"
    "TestHyokConfigurationRead:Vault"
    "TestHyokConfigurationRead:fetching_non-existing_configuration"
    "TestHYOKConfigurationUpdate:AWS_with_valid_options"
    "TestHYOKConfigurationUpdate:GCP_with_valid_options"
    "TestHYOKConfigurationUpdate:Vault_with_valid_options"
    "TestHYOKConfigurationUpdate:Azure_with_valid_options"
)

for pair in "${pairs[@]}"; do
    IFS=':' read -r parent child <<< "$pair"
    result=$(envchain ${env} go test -run "^${parent}$/^${child}$" -v ./...)
    status="\033[33mUNKNOWN\033[0m" # yellow by default
    if echo "$result" | grep -q "^--- PASS: ${parent}"; then
        status="\033[32mPASS\033[0m" # green
    elif echo "$result" | grep -q "^--- FAIL: ${parent}"; then
        status="\033[31mFAIL\033[0m" # red
    fi
    echo -e "\033[34m${parent}/${child}\033[0m: ${status}"
done

…ng and new functions.

Maed223

Code changes are looking good. We could probably better encapsulate the use skipHYOKIntegrationTests into a helper similar to skipUnlessBeta or skipUnlessEnterprise for example, but that's non-blocking.

iuri-slywitch-hashicorp · 2025-09-15T17:11:04Z

Unsure what's the Lint error, would appreciate if anyone knows the reason?

iuri-slywitch-hashicorp · 2025-09-15T18:55:42Z

Testing again...
HYOK attributes:

OIDC configurations:

HYOK stuff:

iuri-slywitch-hashicorp · 2025-09-15T19:13:56Z

If the attribute ENABLE_HYOK_INTEGRATION_TESTS is not available or not set to 1:

helenjw

✨LGTM!

github-actions · 2025-09-15T20:02:34Z

Reminder to the contributor that merged this PR: if your changes have added important functionality or fixed a relevant bug, open a follow-up PR to update CHANGELOG.md with a note on your changes.

* initial attribute changes, wip * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Update workspace.go Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating attributes. * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating agent_pool. Added test case. * Updated agent pool integration test file. * Revert commented section. * Updating organization. WIP organization_integration_test. * Updated organization integration test. * Updating attributes. Updating test cases. * Added workspace integration test cases * Updated test cases. * Updated state_version. Updated Read test cases. * Updated hyok tests. Added environment variables. * Updated errors.go * WIP StateVersion * Updated skipHYOKIntegrationTests if-statement. * Added hyok-testing.sh to scripts folder. Finished state_version testing and new functions. * Updated uploading test. * Added comments to UploadSanitizedState. * Updated hyok test cases. * Updating state_version_mocks.go. --------- Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Helen Jiang <50344290+helenjw@users.noreply.github.com>

* Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * [TF-27661] Add support for HYOK related attributes (#1192) * initial attribute changes, wip * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Update workspace.go Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating attributes. * Add support for HYOK Configurations and OIDC Configurations (#1162) Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> * Add support for Customer Key Version and Encrypted Data Keys (#1203) Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> * Updating agent_pool. Added test case. * Updated agent pool integration test file. * Revert commented section. * Updating organization. WIP organization_integration_test. * Updated organization integration test. * Updating attributes. Updating test cases. * Added workspace integration test cases * Updated test cases. * Updated state_version. Updated Read test cases. * Updated hyok tests. Added environment variables. * Updated errors.go * WIP StateVersion * Updated skipHYOKIntegrationTests if-statement. * Added hyok-testing.sh to scripts folder. Finished state_version testing and new functions. * Updated uploading test. * Added comments to UploadSanitizedState. * Updated hyok test cases. * Updating state_version_mocks.go. --------- Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Helen Jiang <50344290+helenjw@users.noreply.github.com> * Update CHANGELOG.md * Remove UpdatedAt and RevokedAt fields from hyok_customer_key_version * added workplaces secured * renamed workplaces to workspaces... oops * Update agent_pool.go Co-authored-by: Sebastian Rivera <sebastian.rivera@hashicorp.com> * Moved valid function in aws_oidc_configuration.go * Removing "omitempty" from HYOKEncryptedDataKey relationships * Changed from "string" to "*string" in state_version.go and added url.PathEscape in request calls for hyok stuff. * Moving HYOK organization validation to helper_test.go * Updating mock file. --------- Co-authored-by: iuri-slywitch-hashicorp <170475063+iuri-slywitch-hashicorp@users.noreply.github.com> Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com> Co-authored-by: Dominic Retli <dominic.retli@hashicorp.com> Co-authored-by: Sebastian Rivera <sebastian.rivera@hashicorp.com> Co-authored-by: Iuri Slywitch <iuri.slywitch@hashicorp.com>

initial attribute changes, wip

cd56606

iuri-slywitch-hashicorp changed the title ~~Is/hyok attributes~~ [TF-27661] Add support for HYOK related attributes Aug 20, 2025

iuri-slywitch-hashicorp changed the base branch from feature/hyok to is/hyok_configurations August 20, 2025 21:55

helenjw force-pushed the is/hyok_configurations branch from a74d35e to 444b4b4 Compare August 21, 2025 13:35

JarrettSpiker reviewed Aug 26, 2025

View reviewed changes

agent_pool.go Show resolved Hide resolved

workspace.go Outdated Show resolved Hide resolved

workspace.go Outdated Show resolved Hide resolved

Add support for HYOK Configurations and OIDC Configurations (#1162)

8303c9e

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

Base automatically changed from is/hyok_configurations to feature/hyok August 26, 2025 20:07

iuri-slywitch-hashicorp and others added 3 commits August 26, 2025 16:05

Merge branch 'feature/hyok' into is/hyok_attributes

8a9b881

Update workspace.go

048ee45

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

Add support for HYOK Configurations and OIDC Configurations (#1162)

4dfed51

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

helenjw force-pushed the feature/hyok branch from 8303c9e to 4dfed51 Compare August 27, 2025 14:44

helenjw and others added 3 commits August 28, 2025 15:34

Add support for Customer Key Version and Encrypted Data Keys (#1203)

b60638c

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

Updating attributes.

7a638d2

Merge remote-tracking branch 'origin/feature/hyok' into is/hyok_attri…

bceb26e

…butes

iuri-slywitch-hashicorp added the no-changelog-needed check changelog entry github workflow label Aug 28, 2025

iuri-slywitch-hashicorp and others added 2 commits August 29, 2025 10:51

Add support for HYOK Configurations and OIDC Configurations (#1162)

47b0462

Co-authored-by: Helen Jiang <helen.jiang@hashicorp.com>

Add support for Customer Key Version and Encrypted Data Keys (#1203)

c006283

Co-authored-by: Jarrett Spiker <jarrett.spiker@hashicorp.com>

helenjw force-pushed the feature/hyok branch from b60638c to c006283 Compare August 29, 2025 14:51

iuri-slywitch-hashicorp marked this pull request as ready for review September 2, 2025 16:46

iuri-slywitch-hashicorp requested a review from a team as a code owner September 2, 2025 16:46

iuri-slywitch-hashicorp added 10 commits September 2, 2025 14:28

Updating agent_pool. Added test case.

cb2ff42

Updated agent pool integration test file.

fad93ab

Revert commented section.

52f3c43

Updating organization. WIP organization_integration_test.

8dcafc5

Updated organization integration test.

d29ec6c

Updating attributes. Updating test cases.

fdfe99e

Added workspace integration test cases

86452f0

Updated test cases.

f5cdb4b

Merge branch 'feature/hyok' into is/hyok_attributes

83a477e

Updated state_version. Updated Read test cases.

0caa562

SwiftEngineer approved these changes Sep 5, 2025

View reviewed changes

organization_integration_test.go Outdated Show resolved Hide resolved

JarrettSpiker approved these changes Sep 5, 2025

View reviewed changes

helenjw reviewed Sep 8, 2025

View reviewed changes

organization_integration_test.go Show resolved Hide resolved

Updated hyok tests. Added environment variables.

cb16e74

iuri-slywitch-hashicorp requested a review from helenjw September 10, 2025 17:10

iuri-slywitch-hashicorp added 5 commits September 11, 2025 11:10

Updated errors.go

8a03bc5

WIP StateVersion

1c28986

Updated skipHYOKIntegrationTests if-statement.

f5ca3bb

Added hyok-testing.sh to scripts folder. Finished state_version testi…

1241ba6

…ng and new functions.

Updated uploading test.

cfcf40c

iuri-slywitch-hashicorp requested review from JarrettSpiker and SwiftEngineer September 12, 2025 17:28

iuri-slywitch-hashicorp force-pushed the feature/hyok branch from c006283 to eaf7215 Compare September 12, 2025 17:32

iuri-slywitch-hashicorp added 2 commits September 12, 2025 12:53

Merge branch 'feature/hyok' into is/hyok_attributes

944f81f

Added comments to UploadSanitizedState.

a695907

Maed223 approved these changes Sep 12, 2025

View reviewed changes

Updated hyok test cases.

4b19496

Updating state_version_mocks.go.

bbaa38b

helenjw approved these changes Sep 15, 2025

View reviewed changes

iuri-slywitch-hashicorp merged commit 6a901a5 into feature/hyok Sep 15, 2025
8 checks passed

iuri-slywitch-hashicorp deleted the is/hyok_attributes branch September 15, 2025 20:02

helenjw mentioned this pull request Sep 15, 2025

Hold Your Own Key Support #1201

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TF-27661] Add support for HYOK related attributes#1192

[TF-27661] Add support for HYOK related attributes#1192
iuri-slywitch-hashicorp merged 30 commits intofeature/hyokfrom
is/hyok_attributes

iuri-slywitch-hashicorp commented Aug 20, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SwiftEngineer left a comment

Uh oh!

Uh oh!

dominic-retli-hashi commented Sep 5, 2025 •

edited

Loading

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 10, 2025 •

edited

Loading

Uh oh!

Maed223 left a comment

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

helenjw left a comment

Uh oh!

Uh oh!

github-actions bot commented Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

iuri-slywitch-hashicorp commented Aug 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing plan

External links

Output from tests

Output hyok-testing.sh

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SwiftEngineer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dominic-retli-hashi commented Sep 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

iuri-slywitch-hashicorp commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Maed223 left a comment

Choose a reason for hiding this comment

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

iuri-slywitch-hashicorp commented Sep 15, 2025

Uh oh!

helenjw left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

iuri-slywitch-hashicorp commented Aug 20, 2025 •

edited

Loading

dominic-retli-hashi commented Sep 5, 2025 •

edited

Loading

iuri-slywitch-hashicorp commented Sep 10, 2025 •

edited

Loading