chore(incus): bump lxc/incus provider ~> 0.3 → ~> 1.0 (v1.1.1)#466
Open
ccrutchf wants to merge 1 commit into
Open
chore(incus): bump lxc/incus provider ~> 0.3 → ~> 1.0 (v1.1.1)#466ccrutchf wants to merge 1 commit into
ccrutchf wants to merge 1 commit into
Conversation
The `~> 0.3` constraint capped the provider below 1.0, so `tofu init -upgrade` could never cross to the 1.x line — bump the constraint and regenerate the lockfile (now pins v1.1.1). incus 1.0.0 reworked the provider configuration, which broke our remote block (`tofu validate` failed on scheme/port/default). Migrated to the 1.x schema: - remote.address is now a FULL URL (`scheme://host:port`); the separate `scheme`/`port` fields are gone. Built from the existing host+port vars (port still mirrors nix krg.incus.apiPort 1:1). - per-remote `default = true` -> provider-level `default_remote`. - Updated the load-bearing comments: the 1.x URL requirement INVERTS the 0.x "bare host or it falls back to the unix socket" gotcha. `tofu validate` passes against v1.1.1. Kept separate from the image-bump PR because it's a major provider jump on live tenant infra. NOTE: validate is schema-only. The remote-config rework is a runtime path, so a live `tofu plan` against krg-nat (via deploy-tofu.sh, PKI-minted cert) must be reviewed for no-op / expected diffs BEFORE apply. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The only dependency in the 2026-07-12 audit that was a major version behind and could not self-heal: the
~> 0.3constraint caps the provider under 1.0, sotofu init -upgradenever crosses to the 1.x line. Kept separate from the image-bump PR because it's a major provider jump on live tenant infra (theterraform/incusboundary drives the Incus NAT self-serve platform).What changed
~> 0.3→~> 1.0; lockfile regenerated → pins v1.1.1.remote {}block (tofu validatefailed:scheme/port/defaultare no longer valid args). Migrated to the 1.x schema:remote.addressis now a full URL (scheme://host:port); separatescheme/portfields removed. Built from the existing host+port vars (port still mirrors nixkrg.incus.apiPort1:1).default = true→ provider-leveldefault_remote.Verification
tofu init -upgrade -backend=false→ installs v1.1.1, lockfile updated.tofu validate→ passes against v1.1.1.validateis schema-only. The remote-config rework is a runtime path, so a livetofu planagainst krg-nat (viadeploy-tofu.shwith a PKI-minted client cert) must be reviewed for a clean no-op / expected diff before apply. I did not run a live plan (needs the OpenBao-brokered deploy creds).Also worth a skim of the 1.x resource changelog for
incus_network/incus_project/incus_network_forwardin case any managed attribute defaults shifted (none surfaced as an error in validate).🤖 Generated with Claude Code