terraform-provider-portainer Updates & Release Notes

Release v1.34.3

Bug Fixes

• portainer_stack: active = false now persists on repository stacks (#139) -
  the update path stopped the stack before the git redeploy, which restarted it,
  so active = false never took effect (perpetual true -> false diff). The stop
  now runs after the redeploy.

• portainer_environment: type = 4 creates a Docker Edge Agent, not Kubernetes
  (#140) - an Edge Agent create now sends ContainerEngine=docker, so Portainer
  provisions the requested Docker edge (type 4) instead of a Kubernetes edge (type 7).

Release v1.34.0

Features

Proxy support: the provider now honors the standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY environment variables when connecting to the Portainer endpoint. No-op when unset, so existing setups are unaffected. (#131)

portainer_stack: new source_id attribute for Portainer 2.43 STS, which replaced shared Git credentials with the Sources model. Both source_id (2.43+) and repository_git_credential_id (< 2.43) are sent, so one configuration works against old and new Portainer. (#132)

Fixes

portainer_stack: deploying a Git stack against Portainer 2.43 STS no longer fails with "Password must be specified when authentication is enabled"; set source_id (or fall back to inline repository_username/password). (#132)

Internal / Maintenance

Centralized duplicated auth-header and d.Set handling into shared helpers (setAuthHeader, setFields); no behavior change.

Raised unit-test coverage from ~77% to 85%.

Release v1.34.1

Bug Fixes

• portainer_stack: honor active = false on create (#134) — a stack created
  with active = false is now stopped right after deployment instead of coming up
  running. Previously the flag was only applied on update, so a new stack always
  started, and with ignore_changes = [active] it never stopped at all.

Internal / Maintenance

• Unify direct-HTTP call sites behind a single doJSON helper (auth + status +
  JSON decode) across 97 files, with typed API errors and 404 handling.
• Add a table-driven CRUD test harness (crudCase).
• Add a schema↔docs drift-check linter as a new CI guard.
• Parallelize the e2e CI pipeline (shared composite setup action + split
  docker/kubernetes/swarm, edge and ssl jobs).

Documentation

• Document previously-missing schema fields: portainer_edge_stack.always_clone,
  portainer_settings.black_listed_labels, portainer_settings.edge_portainer_url.

Release v1.33.0

Highlights

Kubernetes brownfield adoption - terraform import and drift/deletion detection are now available for all 17 Kubernetes resources.

Fix: portainer_stack Kubernetes deployments no longer fail with Object not found (key=0) after a successful create (#130).

Added

Read + Importer implemented for all 17 Kubernetes resources: application, clusterrole, clusterrolebinding, configmap, cronjob, helm, ingress, job, namespace, namespace_system, role, rolebinding, secret, service, serviceaccount, storage, volume. This enables importing existing infrastructure and detects out-of-band deletion (404 → resource is recreated on the next plan). A shared k8sConfirmExistsByGET helper backs the 13 manifest-based resources.

Fixed

portainer_stack with deployment_type = "kubernetes" failed during the finalize step with 404 Object not found (key=0) when Portainer's create response did not include a usable stack Id (observed on Portainer 2.21.x). The provider now resolves the real stack ID by name + endpoint before finalizing.

Changed

Bump go.mongodb.org/mongo-driver 1.17.6 -> 1.17.7.

Upgrade notes

Read for the Kubernetes resources intentionally does not refresh the authored manifest / values / spec fields (the K8s API returns server-expanded objects that would cause permanent diffs and, since Update is delete+recreate, churn workloads). After terraform import, set those fields in config to match the live object, otherwise the next apply will recreate it.

Per-resource import IDs and the fields you must set are documented in each resource's docs page.

Release v1.32.0

Bug fixes

edge_stack: non-destructive brownfield import. Read now populates the full state from GET /edge_stacks/{id} (git config, edge groups, deployment metadata, AutoUpdate/webhook fields) instead of only ~6 of ~20 returned fields, so terraform import no longer forces a destroy + recreate. repository_reference_name is no longer ForceNew (the git endpoint updates it in place); other git fields keep ForceNew. Verified live: import now yields No changes, and a ref-name change plans as ~ update in-place.

docker_secret: stable driver/templating on refresh. Read now flattens the API's {Name, Options} shape back into the flat map schema, fixing a refresh-time type error and state drift.

Internal modernization & quality (no breaking config changes)

Migrated all resources and data sources to context-aware CRUD (CreateContext/ReadContext/UpdateContext/DeleteContext returning diag.Diagnostics).

HTTP requests now honor Terraform's context (cancellation / timeouts) via http.NewRequestWithContext.

Importer.State → StateContext (dropped deprecated ImportStatePassthrough) and removed the -SA1019 staticcheck suppression.

Re-enabled errcheck on d.Set so schema-mapping bugs surface instead of being silently ignored.

Enabled 9 additional golangci-lint linters and fixed the fallout.

Raised unit-test coverage 66% → ~78% (+350 tests).

Bumped Go toolchain to 1.26.4 (resolves govulncheck GO-2026-5037 / GO-2026-5039).

Release 1.30.0

Fixes three broken resources, marks credential fields as sensitive, and updates the Go toolchain and dependencies.

Action required

Several token/credential fields are now Sensitive. If you expose any of them in an output, add sensitive = true or terraform apply will fail:

portainer_user.api_key_raw

portainer_webhook.token (resource and data source)

portainer_webhook_execute.token

portainer_cloud_credentials.credentials

portainer_settings → oauth_settings.kube_secret_key

output "generated_api_key" {
value = portainer_user.ci.api_key_raw
sensitive = true # now required
}

No state migration needed - values stay in state, just masked in CLI output.

Bug fixes

portainer_edge_configurations: fix "Missing form data value" on update against Portainer 2.39+ (correct multipart form fields). (#119)

portainer_shared_git_credential: fix create always failing with HTTP 500 ... key=0 (response envelope is now unwrapped). (#120)

portainer_open_amt: fix a doubled endpoint URL that prevented the resource from working.

Security & dependencies

Resolve all govulncheck findings (Go stdlib + golang.org/x/net).

Build with Go 1.26.3; bump terraform-plugin-sdk/v2 to v2.40.1 and refresh go-cty, go-openapi, and golang.org/x/net.

Documentation & examples

Added an Import section to every importable resource's docs page.

Populated a description for every schema attribute (resources and data sources), improving the generated registry documentation.

Added example projects for every data source and the remaining resources.