feat(ske): add ephemeral ske kubeconfig by h3adex · Pull Request #1448 · stackitcloud/terraform-provider-stackit

h3adex · 2026-05-08T08:22:53Z

Description

This PR adds the stackit_ske_kubeconfig ephemeral resource. The default expiration has been reduced to 30 minutes. Since these credentials only need to persist for the duration of a Terraform run, where even slow Helm deployments rarely exceed a 10-15 minute window, a 60-minute expiration is excessive.

Tested example code:
https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/pulls/18

Checklist

Issue was linked above
Code format was applied: make fmt
Examples were added / adjusted (see examples/ directory)
Docs are up-to-date: make generate-docs (will be checked by CI)
Unit tests got implemented or updated
Acceptance tests got implemented or updated (see e.g. here)
Unit tests are passing: make test (will be checked by CI)
No linter issues: make lint (will be checked by CI)

h3adex · 2026-05-08T10:01:47Z

~~don't review yet. E2E tests still open~~

h3adex · 2026-05-11T12:01:13Z

E2E Tests

github-actions · 2026-05-29T05:40:46Z

This PR was marked as stale after 7 days of inactivity and will be closed after another 7 days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it.

Signed-off-by: Mauritz Uphoff <mauritz.uphoff@stackit.cloud>

rubenhoenle · 2026-06-23T15:45:38Z

+)
+
+const (
+	defaultKubeconfigExpiration = 1800


Suggested change

defaultKubeconfigExpiration = 1800

defaultKubeconfigExpirationSeconds = 1800

Please add a time unit to that one

rubenhoenle · 2026-06-23T15:48:38Z

+			},
+			"expiration": schema.Int64Attribute{
+				Description: "Expiration time of the kubeconfig in seconds. Must be between `600` (10m) and `14400` (4h). " +
+					"Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).",


Suggested change

"Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).",

"Defaults to `1800` (30m) for optimal security during Terraform operations.",

Isn't the point of Terraform that users don't have to care about the underlying APIs? 😄

rubenhoenle · 2026-06-23T15:49:51Z

+	// Defaulted to 1800s (30m) for better security than the API default (3600s).
+	expiration := conversion.Int64ValueToPointer(model.Expiration)
+	if expiration == nil {
+		expiration = new(int64)


Suggested change

expiration = new(int64)

expiration = new(int64(defaultKubeconfigExpiration))

rubenhoenle · 2026-06-23T15:58:11Z

+		*expirationStringPtr = strconv.FormatInt(*expiration, 10)
+	}
+
+	payload := ske.CreateKubeconfigPayload{


If you turn the order around you don't need the ugly expirationStringPtr variable.

payload := ske.CreateKubeconfigPayload{} if expiration != nil { payload.ExpirationSeconds = new(strconv.FormatInt(*expiration, 10)) }

But I have so many questions in my mind here.

Why is ExpirationSeconds a string in the API?

Why is the expiration parameter in this getKubeconfig function implementation a pointer type? I thought there was a default expiration time? What you're doing is critical since you risk that there's no expiration set by accident.

rubenhoenle · 2026-06-23T15:59:39Z

+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				expectedPath := fmt.Sprintf("/v2/projects/%s/regions/%s/clusters/%s/kubeconfig", projectId, region, clusterName)


I don't think this is needed, please use the SDK mocks instead if possible. See the link below for reference.

https://github.com/stackitcloud/stackit-sdk-go/blob/f40e129190c6736017f4904a6220c6dd28061a07/services/ske/v2api/api_default_mock.go#L22

rubenhoenle · 2026-06-23T16:05:03Z

+  project_id = var.project_id
+  # cluster_name is unknown during the plan phase because stackit_ske_cluster.cluster.id is computed.
+  # This forces Terraform to defer the Open call until the Apply phase, after the cluster is ready.
+  cluster_name = stackit_ske_cluster.cluster.id != "" ? stackit_ske_cluster.cluster.name : ""


I don't think this will work as you expect it. The internal id attribute of the cluster resource might be already set BEFORE the cluster creation wait handler is called / finished.

This isn't currently the case, but I would like to see some actual long-term working strategy here please.

rubenhoenle · 2026-06-23T16:05:15Z

+  project_id = var.project_id
+  # cluster_name is unknown during the plan phase because stackit_ske_cluster.cluster.id is computed.
+  # This forces Terraform to defer the Open call until the Apply phase, after the cluster is ready.
+  cluster_name = stackit_ske_cluster.cluster.id != "" ? stackit_ske_cluster.cluster.name : ""


rubenhoenle · 2026-06-23T16:05:26Z

+# if inputs are known, which would trigger a 404 before the cluster exists.
+ephemeral "stackit_ske_kubeconfig" "example" {
+  project_id   = stackit_ske_cluster.example.project_id
+  cluster_name = stackit_ske_cluster.example.id != "" ? stackit_ske_cluster.example.name : ""


h3adex requested a review from a team as a code owner May 8, 2026 08:22

h3adex marked this pull request as draft May 8, 2026 08:23

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch 2 times, most recently from e7a7211 to 21ffd96 Compare May 8, 2026 08:25

h3adex mentioned this pull request May 8, 2026

Feature: Support stackit_ske_kubeconfig as an ephemeral resource #1419

Open

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch from 21ffd96 to 42e7091 Compare May 8, 2026 08:51

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch 9 times, most recently from 638204f to ad810c1 Compare May 11, 2026 11:24

h3adex marked this pull request as ready for review May 11, 2026 11:24

GokceGK added the has internal tracking issue label May 11, 2026

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch 3 times, most recently from cd6a220 to 0d06641 Compare May 18, 2026 06:23

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch from 0d06641 to 72e2165 Compare May 21, 2026 09:18

github-actions Bot added the Stale PR is marked as stale due to inactivity. label May 29, 2026

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch from 72e2165 to 23b550f Compare May 29, 2026 09:21

github-actions Bot removed the Stale PR is marked as stale due to inactivity. label May 30, 2026

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch 2 times, most recently from dd0520a to 08623d4 Compare June 5, 2026 11:47

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch from 08623d4 to 096316e Compare June 9, 2026 11:23

feat(ske): add ephemeral ske kubeconfig

7e5049b

Signed-off-by: Mauritz Uphoff <mauritz.uphoff@stackit.cloud>

h3adex force-pushed the feat/add-ephemeral-resource-ske-kubeconfig branch from 096316e to 7e5049b Compare June 16, 2026 12:19

rubenhoenle requested changes Jun 23, 2026

View reviewed changes

rubenhoenle added the needs-work PR needs changes by the author. label Jun 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ske): add ephemeral ske kubeconfig#1448

feat(ske): add ephemeral ske kubeconfig#1448
h3adex wants to merge 1 commit into
stackitcloud:mainfrom
h3adex:feat/add-ephemeral-resource-ske-kubeconfig

h3adex commented May 8, 2026 •

edited

Loading

Uh oh!

h3adex commented May 8, 2026 •

edited

Loading

Uh oh!

h3adex commented May 11, 2026

Uh oh!

github-actions Bot commented May 29, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

rubenhoenle Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	defaultKubeconfigExpiration = 1800
	defaultKubeconfigExpirationSeconds = 1800

	"Defaults to `1800` (30m) for optimal security during Terraform operations, which is more restrictive than the API default of `3600` (1h).",
	"Defaults to `1800` (30m) for optimal security during Terraform operations.",

	expiration = new(int64)
	expiration = new(int64(defaultKubeconfigExpiration))

Conversation

h3adex commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

h3adex commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

h3adex commented May 11, 2026

Uh oh!

github-actions Bot commented May 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

h3adex commented May 8, 2026 •

edited

Loading

h3adex commented May 8, 2026 •

edited

Loading