Skip to content
GantryCD Provider

gantrycd_stack_environment_variables (Resource)

Environment variables for a GantryCD stack. Non-exclusive by default so multiple resources can manage disjoint keys on the same stack; set exclusive = true to own the whole set.

Example Usage

resource "gantrycd_stack" "payments" {
  name              = "payments-production"
  repository_url    = "https://github.com/example/infrastructure"
  working_directory = "/payments"
  branch            = "main"
  opentofu_version  = "1.11.0"
}

# Non-exclusive (the default): this resource owns only the keys it declares,
# so other resources or root modules can contribute variables to the same
# stack without deleting each other's entries.
resource "gantrycd_stack_environment_variables" "app" {
  stack_id = gantrycd_stack.payments.id

  variable {
    key   = "LOG_LEVEL"
    value = "info"
  }

  # Secrets are write-only: the value never reaches state. Rotate one by
  # bumping value_wo_version.
  secret {
    key              = "API_TOKEN"
    value            = var.payments_api_token
    value_wo_version = 1
  }
}

# Exclusive: the sole authority over the stack's whole set. Any key it does
# not declare is removed on apply, and out-of-band additions show as a diff.
resource "gantrycd_stack_environment_variables" "all" {
  stack_id  = gantrycd_stack.payments.id
  exclusive = true

  variable {
    key   = "DNS_ZONE"
    value = "example.com"
  }
}

Schema

Required

  • stack_id (String) Stack whose environment variables this resource manages.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

  • exclusive (Boolean) When true this resource owns the stack’s entire env-var set: any key it does not declare is deleted on apply. When false (default) it manages only its own keys and leaves others untouched.
  • secret (Block List) A secret environment variable. Its value is write-only — never persisted in Terraform state or plan. (see below for nested schema)
  • variable (Block Set) A plain (non-secret) environment variable. Its value is stored in Terraform state. (see below for nested schema)

Read-Only

  • id (String) Equals stack_id. Used as the Terraform import id.
  • identity_realm (String) Identity realm inherited from the configured provider.

Nested Schema for secret

Required:

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

  • key (String) Environment variable name.
  • value (String, Sensitive, Write-only) Secret value. Write-only: read from configuration during apply and never stored in state.

Optional:

  • value_wo_version (Number) Trigger for secret rotation. Because value is write-only Terraform cannot detect a changed secret; bump this number to force the new value to be sent.

Nested Schema for variable

Required:

  • key (String) Environment variable name.
  • value (String) Environment variable value.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import by stack id. The imported resource is marked exclusive = true so the
# first plan shows every variable currently on the stack; secret values are
# write-only and must be re-declared in configuration.
terraform import gantrycd_stack_environment_variables.all stk_01HXXXXXXXXXXXXXXXXXXXXXXX