gantrycd_context (Resource)

A GantryCD context: a reusable, org-scoped bundle of environment variables and secrets that stacks reference by id. The context owns its entire variable set.

Example Usage

# A context is a reusable, org-scoped bundle of variables, secrets, and hooks.
# Stacks reference it explicitly (gantrycd_stack_contexts) or it auto-attaches
# to every stack whose labels match auto_attach_selector.
resource "gantrycd_context" "shared" {
  name         = "shared-defaults"
  authz_labels = ["platform"]

  variable {
    key   = "LOG_FORMAT"
    value = "json"
  }

  secret {
    key              = "SHARED_API_TOKEN"
    value            = var.shared_api_token
    value_wo_version = 1
  }

  # Hooks on a context are inherited by every stack that references it.
  hook {
    name     = "announce"
    phase    = "pre_init"
    priority = 5
    script   = "echo \"applying shared context defaults\""
  }
}

# Auto-attach to every production stack without listing it per stack.
resource "gantrycd_context" "production" {
  name = "production-defaults"

  auto_attach_selector = { env = "production" }
  auto_attach_priority = 10

  variable {
    key   = "TF_LOG"
    value = "WARN"
  }
}

Schema

Required

• name (String) Context name. Mutable in place — the id is stable, so a rename does not detach referencing stacks.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• authz_labels (Set of String) Protected authorization labels, matched exactly by role grants. Owns the full set; omit or set [] to clear. Adding or removing a label requires context:assign_label for that label, in addition to permission to create or update the resource. Separate from ordinary metadata labels.
• auto_attach_priority (Number) Orders auto-attached contexts on a stack: higher wins on a conflicting variable key. Auto-attached contexts always rank below contexts a stack references explicitly. Defaults to 0; ignored when auto_attach_selector is empty.
• auto_attach_selector (Map of String) Stack-label selector as key=value pairs. When set, this context auto-attaches to every stack whose labels are a superset of these pairs, without the stack listing it in gantrycd_stack_contexts. Omit to disable auto-attach.
• hook (Block List) A lifecycle hook: a bash script run at a phase of the tofu init/plan/apply for every stack that references this context. Repeatable; omit entirely to leave the context with no hooks. Block order is preserved: it breaks ties between hooks sharing a phase and priority, and it means editing a hook shows as an in-place change rather than as one hook removed and another added. (see below for nested schema)
• secret (Block List) A secret environment variable. Its value is write-only — never persisted in Terraform state or plan. (see below for nested schema)
• variable (Block Set) A plain (non-secret) environment variable. Its value is stored in Terraform state. (see below for nested schema)

Read-Only

• id (String) Server-assigned context UUID. Stable across renames; used as the Terraform import id.
• identity_realm (String) Identity realm inherited from the configured provider.

Nested Schema for hook

Required:

• phase (String) Lifecycle phase the hook runs at: one of pre_init, post_init, pre_plan, post_plan, pre_apply, post_apply.
• priority (Number) Ordering priority within the phase, 1-99. Lower runs first.
• script (String) Bash script executed via bash -e -o pipefail -x -c.

Optional:

• name (String) Optional label for the hook, surfaced in run logs.

Nested Schema for secret

Required:

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• key (String) Environment variable name.
• value (String, Sensitive, Write-only) Secret value. Write-only: read from configuration during apply and never stored in state.

Optional:

• value_wo_version (Number) Trigger for secret rotation. Because value is write-only Terraform cannot detect a changed secret; bump this number to force the new value to be sent.

Nested Schema for variable

Required:

• key (String) Environment variable name.
• value (String) Environment variable value.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import by context id. Secret values are never returned by the API: re-declare
# each secret block's value in configuration after import and apply.
terraform import gantrycd_context.shared ctx_01HXXXXXXXXXXXXXXXXXXXXXXX