GantryCD Provider

The GantryCD provider manages an organization’s GantryCD resources: stacks and the environment variables, contexts, and cloud integrations attached to them; runner groups; and IAM (roles, role assignments, service accounts, and tokens).

Every argument in the provider block falls back to an environment variable, so a provider block can stay empty and secret-free. Explicit configuration wins when both are set.

Manage several organizations from one root module with provider aliases, one per org_id.

Example Usage

terraform {
  required_providers {
    gantrycd = {
      source = "providers-preview-yuq4ybx.gantrycd.io/gantrycd/gantrycd"
    }
  }
}

# Every argument falls back to an environment variable, so a provider block
# can stay empty and secret-free:
#   endpoint -> GANTRYCD_API_URL
#   token    -> GANTRYCD_PAT
#   org_id   -> GANTRYCD_ORG_ID
provider "gantrycd" {}

# Explicit configuration wins over the environment. Use an alias to manage a
# second organization from the same root module.
provider "gantrycd" {
  alias    = "staging"
  endpoint = "https://gantrycd.example.com"
  token    = var.gantrycd_staging_token
  org_id   = "org_01HSTAGING"
}

Authorization labels

Stacks, contexts, runner groups, and service accounts carry an authz_labels set. IAM grants target these labels, not resource names, and the provider owns the complete set on each resource. How grants match and inherit is documented in Access in the GantryCD docs.

Installation

The provider is served from GantryCD’s own provider registry, so no CLI configuration is needed. Name it by that registry in required_providers and run tofu init (or terraform init):

terraform {
  required_providers {
    gantrycd = {
      source  = "providers-preview-yuq4ybx.gantrycd.io/gantrycd/gantrycd"
      version = "~> 1.0"
    }
  }
}

Checksums are GPG-signed and verified by the CLI on install, and recorded in .terraform.lock.hcl like any registry provider.

Schema

Optional

• endpoint (String) GantryCD API base URL (e.g. https://gantrycd.example.com). Defaults to $GANTRYCD_API_URL.
• identity_realm (String) Environment qualifier for resource identity. Defaults to $GANTRYCD_IDENTITY_REALM or empty for the default environment.
• org_id (String) Organization id every resource belongs to. Defaults to $GANTRYCD_ORG_ID. For multi-org workspaces use provider aliases.
• token (String, Sensitive) Personal access token used to authenticate every request. Defaults to $GANTRYCD_PAT.

Identity realms

Every resource and data source records its provider’s identity_realm. Leave it empty for local output inference. Use a provider alias for another environment:

provider "gantrycd" {
  alias          = "external"
  endpoint       = "https://other-gantrycd.example.com"
  org_id         = "platform"
  identity_realm = "other-installation"
}

data "gantrycd_state_outputs" "external_network" {
  provider = gantrycd.external
  stack_id = "network"
}