resource `coderd_template` make the `active` or `versions` attribute optional

[jatcod3r]

Not sure if this would be an anti-pattern or require a massive re-write, but was curious if it's possible to make the active attribute optional. The coder templates push command, even if you were to set --activate to false, if a template doesn't exist already, will automatically still set the first version to "active".

Use-case for this is to make it so that the active status doesn't need to be tracked through Terraform. Rather, I can manually set active versions without accidentally deleting/replacing versions that are being tracked by coderd if another terraform apply is executed.

Update: This could be applicable to the versions attribute as well for customers looking into allowing an external job to push the template version. Maybe this is a change required on the Coder side, but would it be possible to have an empty scaffold template deploying our "https://github.com/coder/coder/blob/main/examples/templates/scratch/main.tf" template that doesn't manage active versions? On the initial create it'll just flag the scratch template as active, but not really track it.

[angrycub]

@jatcod3r - This seems like we're aggressively working against Terraform here; but would using ignore_changes work? Since the TF should use a data source to check the current state of the template in later apply operations—to prevent drift from breaking things or causing your template versions created in the UI to revert. On destroy of a TF environment that created templates, it seems to me that having all of the drifted template versions being cleaned up as part of deleting the original template is desirable.

resource "coderd_template" "my_template" {
   # ...
   lifecycle {
      ignore_changes = [
         versions
      ]  
   }
}

To make this a complete solution, I think ignoring acl would also be necessary as it too is likely to drift.

[jatcod3r]

Was playing around with this recently and surprisingly it's doing what I was expecting it to do now? It still requires at least one active attribute, but essentially the goal was to still retain those versions without needing them to be also kept track of locally.

Since it's working, I'll probably close issue unless there's another use-case someone else can think of for having the active attribute be optional.

For context, last time I tackled this, I remember running into the problem where I would have some latest "stable" version pushed, but I would accidentally wipe out previous version since it would require keeping a separate sub-directory that had the original template. In other words, I needed to create copies of these template dirs and track them via the coderd_template, even though they were being already tracked remotely.

I didn't want to ignore the versions attribute as well for the sake of having that auto-push feature each time the directory was changed. I found it super helpful for a CI pipeline where I don't need check myself if some sub-directory for the template was changed. Rather, I just run terraform plan -out tf.plan and terraform apply tf.plan.

Here's my little module though for what I'm doing now:

Provider Version: v0.0.12

terraform {
    required_providers {
        coderd = {
            source = "coder/coderd"
        }
        null = {
            source = "hashicorp/null"
        }
        time = {
            source = "hashicorp/time"
        }
    }
}

variable "org_id" {
    type = string   
}

variable "access_url" {
    type = string
}

variable "token" {
    type = string   
    sensitive = true
}

variable "templates" {
    type = map(object({
        path        = string
        display_name = optional(string, "")
        icon        = optional(string, "")
        description = optional(string, "")
        platform = optional(string, "linux_amd64")
    }))
}

locals {
    env = {
        CODER_SESSION_TOKEN = nonsensitive(var.token)
        CODER_URL = var.access_url
    }
}

data "archive_file" "init" {
  for_each = var.templates
  type        = "zip"
  excludes    = ["${each.value.path}/.terraform"]
  source_dir = each.value.path
  output_path = "/tmp/${each.key}.zip"
}

# Initialize template & lockfile to ensure consistency
resource "null_resource" "upgrade-and-init" {
    for_each = var.templates
    triggers = {
        # Ensure that modules are always re-initialized when checksum changes.
        run_on_checksum = "${data.archive_file.init[each.key].id}" 
    }
    provisioner "local-exec" {
        working_dir = each.value.path
        command = "terraform init -upgrade && terraform providers lock -platform=${each.value.platform}"
        environment = local.env
    }
}

resource "time_static" "this" {
    for_each = var.templates
    triggers = {
        # Ensure that modules are always re-initialized when checksum changes.
        run_on_checksum = "${data.archive_file.init[each.key].id}" 
    }
}

resource "coderd_template" "this" {
    for_each = var.templates
    depends_on = [ null_resource.upgrade-and-init ]
    organization_id = var.org_id
    name = each.key
    display_name = each.value.display_name == "" ? each.key : each.value.display_name
    icon = each.value.icon
    description = each.value.description
    # At least 1 template must be stable. 
    # We'll keep track of this via Terraform.
    versions = [{
        name        = "stable-${formatdate("YYYY-MM-DD_hh-mm-ss", time_static.this[each.key].rfc3339)}"
        description = "Stable Version."
        directory   = each.value.path
        active = true
    }]
}

# Intentionally remove all access once. 
# Owners should manually set to avoid accidental exposure. 
# Will not re-run unless template is replaced.
resource "null_resource" "remove-public-access" {
    for_each = var.templates
    triggers = {
        template_id = coderd_template.this[each.key].id
    }
    provisioner "local-exec" {
        working_dir = each.value.path
        command = "coder templates edit --private -O ${var.org_id} ${each.key}"
        environment = local.env
    }
}