spiceai · ewgenius · Feb 18, 2026 · Feb 16, 2026 · Feb 16, 2026 · Feb 16, 2026
diff --git a/.gitignore b/.gitignore
@@ -16,6 +16,8 @@ website/node_modules
 *.backup
 ./*.tfstate
 .terraform/
+.terraform.lock.hcl
+terraform.tfstate
 *.log
 *.bak
 *~

diff --git a/README.md b/README.md
@@ -1,16 +1,19 @@
 # Terraform Provider for Spice.ai
 
-This Terraform provider allows you to manage [Spice.ai Cloud](https://spice.ai) resources including apps and deployments.
+[![Terraform Registry](https://img.shields.io/badge/terraform-registry-blueviolet?logo=terraform)](https://registry.terraform.io/providers/spiceai/spiceai/latest)
+[![CI](https://github.com/spiceai/terraform-provider-spiceai/actions/workflows/test.yml/badge.svg)](https://github.com/spiceai/terraform-provider-spiceai/actions/workflows/test.yml)
+[![License: MPL-2.0](https://img.shields.io/badge/License-MPL--2.0-brightgreen.svg)](LICENSE)
+
+Terraform provider for managing [Spice.ai Cloud](https://spice.ai) resources.
 
 ## Requirements
 
 - [Terraform](https://www.terraform.io/downloads.html) >= 1.0 (or [OpenTofu](https://opentofu.org/) >= 1.0)
-- [Go](https://golang.org/doc/install) >= 1.21 (for building from source)
-- A Spice.ai account with OAuth client credentials
+- A [Spice.ai Cloud](https://spice.ai) account with [OAuth client credentials](https://docs.spice.ai/api/management#id-2.-oauth-2.0-client-credentials)
 
 ## Installation
 
-### From Terraform Registry (Recommended)
+Add the provider to your Terraform configuration:
 
 ```hcl
 terraform {
@@ -23,177 +26,29 @@ terraform {
 }
 ```
 
-### Building from Source
-
-```bash
-git clone https://github.com/spiceai/terraform-provider-spiceai.git
-cd terraform-provider-spiceai
-go build -o terraform-provider-spiceai
-```
-
-Then move the binary to your Terraform plugins directory or use a [dev override](https://developer.hashicorp.com/terraform/cli/config/config-file#development-overrides-for-provider-developers).
-
 ## Authentication
 
-The provider uses OAuth client credentials to authenticate with the Spice.ai API. You can obtain these credentials from your Spice.ai account.
+The provider authenticates using OAuth 2.0 client credentials. Create an OAuth client in [Spice.ai Cloud](https://docs.spice.ai/api/management#id-2.-oauth-2.0-client-credentials) to obtain a client ID and secret.
 
-### Configuration Options
+### Configuration
 
 ```hcl
 provider "spiceai" {
-  client_id      = "your-client-id"      # Or use SPICEAI_CLIENT_ID env var
-  client_secret  = "your-client-secret"  # Or use SPICEAI_CLIENT_SECRET env var
-  api_endpoint   = "https://api.spice.ai" # Optional
-  oauth_endpoint = "https://spice.ai/api/oauth/token" # Optional
+  client_id     = var.spiceai_client_id     # Or set SPICEAI_CLIENT_ID env var
+  client_secret = var.spiceai_client_secret # Or set SPICEAI_CLIENT_SECRET env var
 }
 ```
 
 ### Environment Variables
 
-| Variable | Description |
-|----------|-------------|
-| `SPICEAI_CLIENT_ID` | OAuth client ID |
-| `SPICEAI_CLIENT_SECRET` | OAuth client secret |
-| `SPICEAI_API_ENDPOINT` | API endpoint (default: `https://api.spice.ai`) |
-| `SPICEAI_OAUTH_ENDPOINT` | OAuth token endpoint (default: `https://spice.ai/api/oauth/token`) |
-
-## Resources
-
-### spiceai_app
-
-Manages a Spice.ai app and its configuration. This resource combines app creation with spicepod and runtime configuration.
-
-```hcl
-resource "spiceai_app" "example" {
-  name        = "my-app"
-  description = "My Spice.ai application"
-  visibility  = "private"
-
-  # Spicepod configuration (YAML or JSON)
-  spicepod = <<-YAML
-    version: v1beta1
-    kind: Spicepod
-    name: my-app
-    datasets:
-      - name: taxi_trips
-        from: s3://spiceai-demo-datasets/taxi_trips/2024/
-        params:
-          file_format: parquet
-  YAML
-
-  # Runtime configuration
-  image_tag             = "latest"
-  replicas              = 2
-  node_group            = "default"
-  region                = "us-east-1"
-  storage_claim_size_gb = 10.0
-  production_branch     = "main"
-}
-```
-
-#### Arguments
-
-| Name | Type | Required | Description |
-|------|------|----------|-------------|
-| `name` | string | Yes | The name of the app (min 4 chars, alphanumeric and hyphens only). Changing this forces a new resource. |
-| `description` | string | No | A description of the app |
-| `visibility` | string | No | The visibility (`public` or `private`, default: `private`) |
-| `spicepod` | string | No | Spicepod configuration (YAML or JSON string) |
-| `image_tag` | string | No | Spice.ai runtime image tag (e.g., `latest`, `v0.18.0`) |
-| `replicas` | int | No | Number of replicas (1-10) |
-| `node_group` | string | No | Node group for deployment |
-| `region` | string | No | Deployment region |
-| `storage_claim_size_gb` | float | No | Storage claim size in GB |
-| `production_branch` | string | No | Production branch name for git-based deployments |
-
-#### Read-Only Attributes
-
-| Name | Description |
-|------|-------------|
-| `id` | The unique identifier of the app |
-| `created_at` | Timestamp when the app was created |
-| `api_key` | The API key for the app (sensitive) |
-
-### spiceai_deployment
-
-Creates a deployment for a Spice.ai app. Deployments are immutable - any changes will trigger creation of a new deployment.
-
-```hcl
-resource "spiceai_deployment" "example" {
-  app_id = spiceai_app.example.id
-
-  # Optional overrides
-  image_tag      = "v0.18.0"
-  replicas       = 2
-  branch         = "main"
-  commit_sha     = "abc123def456"
-  commit_message = "Deploy from Terraform"
-  debug          = false
-}
-```
-
-#### Arguments
-
-| Name | Type | Required | Description |
-|------|------|----------|-------------|
-| `app_id` | string | Yes | The ID of the app to deploy. Changing this forces a new deployment. |
-| `image_tag` | string | No | Override image tag for this deployment. Changing this forces a new deployment. |
-| `replicas` | int | No | Override replicas (1-10). Changing this forces a new deployment. |
-| `branch` | string | No | Git branch name. Changing this forces a new deployment. |
-| `commit_sha` | string | No | Git commit SHA. Changing this forces a new deployment. |
-| `commit_message` | string | No | Git commit message. Changing this forces a new deployment. |
-| `debug` | bool | No | Enable debug mode (default: false). Changing this forces a new deployment. |
-
-#### Read-Only Attributes
-
-| Name | Description |
-|------|-------------|
-| `id` | The unique identifier of the deployment |
-| `status` | Current status (`queued`, `deploying`, `running`, `failed`, `stopped`) |
-| `created_at` | Timestamp when the deployment was created |
-| `started_at` | Timestamp when the deployment started running |
-| `finished_at` | Timestamp when the deployment finished |
-| `error_message` | Error message if deployment failed |
-
-> **Note:** Deployments are immutable. Any changes to deployment parameters will trigger a replacement (new deployment).
-
-## Data Sources
-
-### spiceai_app
-
-Retrieves details about an existing app by ID.
-
-```hcl
-data "spiceai_app" "example" {
-  id = "12345"
-}
-
-output "app_name" {
-  value = data.spiceai_app.example.name
-}
-
-output "app_replicas" {
-  value = data.spiceai_app.example.replicas
-}
-```
-
-### spiceai_apps
-
-Lists all apps in the organization.
-
-```hcl
-data "spiceai_apps" "all" {}
-
-output "app_names" {
-  value = [for app in data.spiceai_apps.all.apps : app.name]
-}
-
-output "private_apps" {
-  value = [for app in data.spiceai_apps.all.apps : app.name if app.visibility == "private"]
-}
-```
+| Variable                       | Description                                                        |
+| ------------------------------ | ------------------------------------------------------------------ |
+| `SPICEAI_CLIENT_ID`            | OAuth client ID                                                    |
+| `SPICEAI_CLIENT_SECRET`        | OAuth client secret                                                |
+| `SPICEAI_API_ENDPOINT`         | API endpoint (default: `https://api.spice.ai`)                     |
+| `SPICEAI_OAUTH_ENDPOINT`       | OAuth token endpoint (default: `https://spice.ai/api/oauth/token`) |
 
-## Example Usage
+## Example
 
 ```hcl
 terraform {
@@ -205,96 +60,23 @@ terraform {
   }
 }
 
-provider "spiceai" {
-  # Credentials are read from environment variables:
-  # SPICEAI_CLIENT_ID and SPICEAI_CLIENT_SECRET
-}
-
-# Create an app with configuration
-resource "spiceai_app" "example" {
-  name        = "my-terraform-app"
-  description = "Managed by Terraform"
-  visibility  = "private"
-
-  spicepod = <<-YAML
-    version: v1beta1
-    kind: Spicepod
-    name: my-terraform-app
-    datasets:
-      - name: taxi_trips
-        from: s3://spiceai-demo-datasets/taxi_trips/2024/
-        params:
-          file_format: parquet
-  YAML
-
-  image_tag = "latest"
-  replicas  = 1
-}
-
-# Deploy the app
-resource "spiceai_deployment" "example" {
-  app_id = spiceai_app.example.id
-}
-
-output "app_id" {
-  value = spiceai_app.example.id
-}
-
-output "app_api_key" {
-  value     = spiceai_app.example.api_key
-  sensitive = true
+resource "spiceai_app" "app" {
+  name  = "my-spice-cloud-app"
+  cname = "us-west-2-prod-aws-data"
 }
 
-output "deployment_status" {
-  value = spiceai_deployment.example.status
+resource "spiceai_deployment" "deploy" {
+  app_id = spiceai_app.app.id
 }
 ```
 
-## Import
-
-Resources can be imported using their IDs:
-
-```bash
-# Import an app
-terraform import spiceai_app.example 12345
-
-# Import a deployment (format: app_id/deployment_id)
-terraform import spiceai_deployment.example 12345/67890
-```
-
-## Development
-
-### Building
-
-```bash
-go build -o terraform-provider-spiceai
-```
-
-### Testing
+## Documentation
 
-```bash
-go test ./...
-```
-
-### Running Locally
-
-Create a `~/.terraformrc` file with a dev override:
-
-```hcl
-provider_installation {
-  dev_overrides {
-    "spiceai/spiceai" = "/path/to/terraform-provider-spiceai"
-  }
-  direct {}
-}
-```
+For detailed documentation on all resources, data sources, and their attributes, see the [docs](docs/) directory:
 
-### Generating Documentation
-
-```bash
-go generate ./...
-```
+- **Resources:** [spiceai_app](docs/resources/app.md) · [spiceai_deployment](docs/resources/deployment.md) · [spiceai_secret](docs/resources/secret.md) · [spiceai_member](docs/resources/member.md)
+- **Data Sources:** [spiceai_app](docs/data-sources/app.md) · [spiceai_apps](docs/data-sources/apps.md) · [spiceai_regions](docs/data-sources/regions.md) · [spiceai_secrets](docs/data-sources/secrets.md) · [spiceai_members](docs/data-sources/members.md) · [spiceai_api_keys](docs/data-sources/api_keys.md) · [spiceai_container_images](docs/data-sources/container_images.md)
 
 ## License
 
-MPL-2.0. See [LICENSE](LICENSE) file.
+MPL-2.0. See [LICENSE](LICENSE) file.
diff --git a/docs/data-sources/api_keys.md b/docs/data-sources/api_keys.md
@@ -10,7 +10,28 @@ description: |-
 
 Retrieves the API keys for a Spice.ai app. Each app has two API keys to support key rotation.
 
-
+## Example Usage
+
+```terraform
+# Get API keys for an app
+data "spiceai_api_keys" "example" {
+  app_id = spiceai_app.example.id
+}
+
+# Use the primary API key
+output "primary_api_key" {
+  description = "The primary API key for the app"
+  value       = data.spiceai_api_keys.example.api_key
+  sensitive   = true
+}
+
+# Use the secondary API key (useful for key rotation)
+output "secondary_api_key" {
+  description = "The secondary API key for the app"
+  value       = data.spiceai_api_keys.example.api_key_2
+  sensitive   = true
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema

diff --git a/docs/data-sources/container_images.md b/docs/data-sources/container_images.md
@@ -10,7 +10,31 @@ description: |-
 
 Retrieves a list of available Spice.ai runtime container images.
 
-
+## Example Usage
+
+```terraform
+# Get available stable container images
+data "spiceai_container_images" "stable" {
+  channel = "stable"
+}
+
+# Get available enterprise container images
+data "spiceai_container_images" "enterprise" {
+  channel = "enterprise"
+}
+
+# Output the default image tag
+output "default_image_tag" {
+  description = "The default container image tag"
+  value       = data.spiceai_container_images.stable.default
+}
+
+# Output all available image tags
+output "available_image_tags" {
+  description = "List of available container image tags"
+  value       = [for image in data.spiceai_container_images.stable.images : image.tag]
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema