Repository navigation
chore(deps): update terraform cloudflare to v5 - #1836
renovate[bot] wants to merge 1 commit into
Conversation
Terraform PlanShared✅ |
7f7005e to
1abcf15
Compare
161fb6c to
73ef31c
Compare
renovate
Bot
changed the title
9fbf119 to
9d2a0bb
Compare
7c882c3 to
2da5a7f
Compare
eb0f305 to
addbbe3
Compare
 |
![futo-kritika[bot]](https://avatars.githubusercontent.com/in/5211018?s=60&v=4){kind=small}
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~>4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Convert the Pages build configuration to a v5 object
The project still declares build_config { ... } in project.tf. Cloudflare v5 defines this as a single nested attribute, so selecting v5 makes Terraform reject the block and prevents planning this module.
Suggested fix
Convert project.tf's block to build_config = { ... }, retaining the analytics fields and existing build-caching lifecycle exclusion.
Prompt for a coding agent
In tf/shared/modules/cloudflare-pages-project/project.tf, convert lines 6-9 from a build_config block to the object attribute build_config = { ... }, retaining both analytics values and the build_caching ignore_changes entry, before enabling v5 in config.tf.
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~>4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Migrate both name-based zone lookups
Both Pages modules still configure data "cloudflare_zone" with top-level name = var.domain. In v5, name is computed-only; name-based lookup now belongs in filter.name. The domain module also reads .zone_id, which is now an optional input rather than the returned identifier, so it must read .id after switching to a filter.
Suggested fix
Change both zone lookups to filter = { name = var.domain } and change the DNS record's zone ID expression to data.cloudflare_zone.domain.id.
Prompt for a coding agent
Update the cloudflare_zone data sources in tf/shared/modules/cloudflare-pages-project/project.tf and tf/shared/modules/cloudflare-pages/domain.tf to use filter = { name = var.domain } instead of the top-level name input. In the Pages domain module, use data.cloudflare_zone.domain.id as the DNS record's zone_id.
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~>4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Rename the Pages custom-domain argument for v5
The existing cloudflare_pages_domain.pages_domain resource still sets domain = module.domain.fqdn. The v5 schema replaces domain with required name, so this provider bump leaves an unsupported argument and a missing required argument in the module.
Suggested fix
Rename the Pages domain resource's domain argument to name, preserving its value.
Prompt for a coding agent
In tf/shared/modules/cloudflare-pages/domain.tf, replace domain = module.domain.fqdn in cloudflare_pages_domain.pages_domain with name = module.domain.fqdn to match the v5 provider schema.
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~>4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Migrate the DNS record resource and its outputs
domain.tf still manages cloudflare_record.pages_subdomain, which v5 renames to cloudflare_dns_record. outputs.tf also references the old resource and its hostname attribute, absent from the v5 DNS schema. The module cannot plan under v5 without migrating the resource and its outputs; existing managed records also need a state migration rather than treating the rename as a new record.
Suggested fix
Rename the resource and its references, use .name for the hostname output, and include the supported state-migration procedure for existing DNS records.
Prompt for a coding agent
Migrate cloudflare_record.pages_subdomain in tf/shared/modules/cloudflare-pages/domain.tf to cloudflare_dns_record.pages_subdomain. Update both references in outputs.tf and replace the removed hostname output access with the v5 record's name attribute. Provide the provider-supported state migration for the resource-type rename and check that an existing record is not destroyed and recreated.
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~> 4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Migrate the R2 permission-group lookup
main.tf still uses cloudflare_api_token_permission_groups.all.r2[...]. The v5 provider removes this data source and exposes permission groups through cloudflare_api_token_permission_groups_list.result instead of scope-indexed maps. As written, the bucket-token permission lookup cannot be evaluated with the newly required provider.
Suggested fix
Use the v5 permission-groups list data source and resolve the read/write IDs from its result entries, preserving the R2 scope restriction and aliased provider.
Prompt for a coding agent
In tf/shared/modules/cloudflare-r2-bucket/main.tf, replace the removed cloudflare_api_token_permission_groups data source with cloudflare_api_token_permission_groups_list, retaining the cloudflare.api_keys provider. Resolve the two Workers R2 Storage Bucket Item permission IDs from result entries by name and R2 scope instead of indexing all.r2.
| cloudflare = { | ||
| source = "cloudflare/cloudflare" | ||
| version = "~> 4.46" | ||
| version = "~> 5.0" |
There was a problem hiding this comment.
[blocking · correctness] Convert the bucket token policy and conditions to v5
The token resource in main.tf retains v4's policy block, string permission IDs, map-valued resources, and dynamic condition block. V5 requires a policies list with explicit effect, permission-group objects, JSON-string resources, and object-valued conditions. Consequently the module still fails planning even after migrating its permission lookup; the conversion must also preserve the configured CIDR restriction.
Suggested fix
Convert the token to the v5 policies/object schema, JSON-encode the bucket resource map, explicitly set effect = "allow", and express the optional IP condition as an object or null.
Prompt for a coding agent
In tf/shared/modules/cloudflare-r2-bucket/main.tf, migrate cloudflare_api_token.bucket_api_token to policies = [{ effect = "allow", permission_groups = [{ id = ... }, { id = ... }], resources = jsonencode({ ... }) }]. Replace the dynamic condition block with condition = length(var.allowed_cidrs) > 0 ? { request_ip = { in = var.allowed_cidrs } } : null, preserving the existing bucket-specific resource key.
This PR contains the following updates:
~> 4.46→~> 5.0~>4.46→~> 5.0Release Notes
cloudflare/terraform-provider-cloudflare (cloudflare)
v5.27.0Compare Source
Full Changelog: v5.26.0...v5.27.0
⚠ BREAKING CHANGES
One change requires a configuration edit. The rest of this release's schema movement is read-only reshaping with no action required — see Schema Changes at the end.
featureandwith_schemasattributes have been removed from the resource. They were never resource state — both are read-shaping query parameters on the list/get endpoints, and there is no create or update endpoint that accepts them. Remove them from anycloudflare_api_shield_operationblock; leaving them in place produces an "Unsupported argument" error. The schema version moves from 500 to 501 and an automatic state upgrader strips both fields from existing state, so no manual state editing is required. This also fixes the.with_schemas: was cty.False, but now nullerror raised when upgrading from v5.26.0.Notes
ha_modeno longer forces replacement. The upstream API added update support, so the site is modified in place.ha_linkno longer forces replacement, for the same reason.health_check_rateis now configurable (previously read-only).hybrid_search_enablednow reflects the API default oftruefor newly created instances. Existing instances keep the value already in state, so upgrading does not plan a change.nameservers.ns_setis now computed. It applies only to custom nameserver types and is preserved from state when the API does not return it.foundation_dnsis deprecated and will be removed in a future API version. Setnameservers.typetocloudflare.advancedto turn Advanced Nameservers on, orcloudflare.standardto turn it off.spend_limits.rules.idchanged from865b4d33to00000000. Configurations that do not setidexplicitly will show a one-time diff on the next plan.profile_typenow forces replacement. The field is set when the profile is created and cannot be changed, so an in-place update was never possible. Configurations that omitprofile_typeare unaffected.Features
New Resources
New Data Sources
New Attributes
load_balance_inner_flowsstrict_service_token_authnameservers.nameserver_set_idhostnamefiltercategoryandis_selectableNew Accepted Values
rules.conditions[...].operatoracceptshasandnot_hastypeacceptsbasin_catalogbindings.typeacceptsartifactsbindings.typeacceptsartifacts,flagship,k2andmessagingnameservers.typeacceptscloudflare.advancedandcustomOther
terraform importapplies_to_all_integrationsisfalseand no integration IDs resolve. Existing policies that omitintegration_idsand retain IDs in state continue to plan normally.Bug Fixes
normalizefield to v500 migration target modelai_bots_migration_opt_outinto the API modelkey_idfrom the API'suidafter create, so plan, refresh, update and destroy no longer fail with "missing required key_id parameter"include_shadow_metadatato false on importfieldsresult mapdecode_null_to_zerotofilter_attack_traffictoken_idto the v500 migration target modelfrequencyorregionchange, as the API has no update endpoint for scheduled testsquery_stringwildcardomit_sourceto false on importpage/per_pageto their spec values on importobservability.redact_query_stringexports_reconciliationfrom the v0 legacy schemaexpiration/expiration_ttlto the v500 migration target modelbase_pathandobservability.issuesattributesstreamattribute to the bindings schemaforcefield to the legacy V0 migration structclient_secret; redactauth_credentialsandclient_secretfrom debug logsaccounts/<account_id>orzones/<zone_id>prefix. Account and zone IDs are both 32-character hex, so the previous length-based detection always resolved to account scope and zone-scoped resources could not be imported.warp_auth_non_browser_401to the v4 source model, unblocking v4 to v5 migrationmfa_configuration_allowed/service_token_inactivityon importmfa_configuration_allowed,service_token_inactivity,trusted_accountshafrommetadata.haon import and readSchema Changes (no action required)
Upstream Cloudflare API schema changes picked up via the cloudflare-go v7.12.0 bump. These are listed for completeness; none require a change to a working configuration.
Of the 54 removed attributes, 52 are read-only (computed): existing state files load without user action and plans are unaffected, so only configurations that reference them — in an
outputblock or an expression — need updating. The two attributes that becomeRequiredwere already mandatory server-side, so a request omitting them was always rejected; the failure simply moves from apply time to plan time. The one type change is on data sources only, and HCL converts numeric strings automatically.policies.permission_groups.meta.key/.valuepair has been replaced with typed fields —category,deprecated,description,editable,eol_at,label,scopes,visibility. Expressions readingmeta.key/meta.valuemust move to the named field.integration.integrationhas been renamed tointegration.hyperdrive_config_provider.settings.email,settings.pagerdutyandsettings.webhooksdetail attributes are no longer surfaced on thecloudflare_queueresource or the queue data sources. Relatedly,notificationis no longer an accepted value for the read-onlyconsumers.typeattribute on those surfaces. Queue configuration is unaffected — thecloudflare_queue_consumerresource is unchanged and still accepts and manages all three settings blocks.rulesis nowRequiredinstead ofOptional. The API already rejects a request that omits it, so this moves the failure from apply time to plan time rather than breaking a working configuration.nameservers.typeis nowRequiredinstead ofOptional.nameserversbecame a discriminated union upstream andtypeis its discriminator, so it was already mandatory in practice.limitchanged fromStringtoInt64and is now constrained to between 1 and 200. These are data sources only, so there is no state to migrate, and HCL converts numeric strings automatically —limit = "10"continues to work.v5.26.0Compare Source
Full Changelog: v5.25.0...v5.26.0
Features
New Resources
New Data Sources
New Attributes
Bug Fixes
private_keyoptional to unblock settingcustom_csr_idsupport_subaddressto resource schemaedge_cache_ttlmaximum to allow one-year valuesuser_agent_operator_suffixunquoted and read fallback from environment variableUseNonNullStateForUnknownoncreated_onto prevent perpetual diffv5.25.0Compare Source
Full Changelog: v5.24.0...v5.25.0
Features
New Resources
New Data Sources
New Attributes
Bug Fixes
bot_preference_sync_enabledoptional-only;Computedcaused "unknown after apply" errorsaccount_idas required in data sourcesprimaryandsite_idfields; markaccount_idas required in data sourcesaccount_idas required in list data sourceVersion: 500on new resources to enable correct state upgrade pathv5.24.0Compare Source
Full Changelog: v5.23.0...v5.24.0
BREAKING CHANGES
The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before
terraform planwill succeed.cloudflare_hostname_tls_settingdata source now requireshostnameas an input parameter instead of returning it as a computed attribute. The computedidattribute has been removed; usesetting_idinstead. (ece27fe)variantnested attribute has been removed. The API no longer returns this wrapper object; theid,options, andnever_require_signed_urlsfields remain available at the top level. Remove any references tocloudflare_image_variant.<name>.variantfrom your configurations. (738bd28)meta.flagsnested attribute has been renamed tometa.tenant_flags. Two new computed sub-attributes (enterprise_capability,member_management) have been added. Update any references from.meta.flagsto.meta.tenant_flags. (ece27fe)allow_code_modeattribute is now deprecated and no longer computed with a default oftrue. Use the newcode_modeattribute ("off","opt_in","default_on","enforced") instead. Configurations that relied on the computed default must explicitly setcode_modeorallow_code_mode. (ece27fe)session_durationattribute is no longer computed with a default of"24h". It is now optional-only. Existing configurations that omittedsession_durationand relied on the provider default will see a plan diff; explicitly setsession_duration = "24h"to preserve the previous behavior. (ae4f5a1)allowed_authenticatorsenum valuessh_piv_keyhas been renamed topiv_key, and a new valuessh_fido2_keyhas been added. Configurations using"ssh_piv_key"must be updated to"piv_key". (ece27fe)idattribute type changed fromStringtoInt64. The computedintel_idattribute has been removed. Thehostnames,ip_subnets,port_protocols,support_domains, andsupportedattributes changed fromListtoSet(element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)idattribute type changed fromStringtoInt64on both the data source and list data source. (ece27fe)is_pending_reconnectattribute has been removed fromconnections. The upstream API no longer returns this field. Remove any references toconnections[*].is_pending_reconnectfrom your configurations. (ece27fe)is_pending_reconnectattribute has been removed fromconnections, matching thezero_trust_tunnel_cloudflaredchange above. (ece27fe)New Resources
New Data Sources
Features
log_classificationattribute andunifiedbilling mode (ece27fe)discover_optionsfor link-following web crawler configuration (ece27fe)public_endpoint_paramswith MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)oci_storagecloud provider type (ece27fe)uslocation restriction value (ece27fe)health_sourcesattribute for regional health steering (ece27fe)lv-LV) language support (ece27fe)preview_url_suffixandurlcomputed attributes to subdomain block (ece27fe)messagingbinding type (ece27fe)code_modeattribute for granular Code Mode policy control (ece27fe)authentication_statuscomputed attribute (ece27fe)contract_version,warnings, and newtypevalues (login,interstitial) (ece27fe)enabledattribute to control service token activation (ece27fe)deprecatedattribute to all DLP entry resources and data sources (ece27fe)warp_auth_non_browser_401attribute for non-browser 401 responses (ece27fe)webmcp_enabledandwebmcp_packssetting IDs (ece27fe)Bug Fixes
Documentation
v5.23.0Compare Source
Full Changelog: v5.22.0...v5.23.0
New Data Sources
Features
deployed_viaandlast_modified_viacomputed fields, and defaultofflabeltofalse(5952e95)global_accelerationblock for configuring custom tunnel and API endpoints (5952e95)delete_headerssupport in request header modification settings (5952e95)Bug Fixes
source.configdrift for API-populated fields by preserving computed state values (c63f15e)Chores
Documentation
v5.22.0Compare Source
Full Changelog: v5.21.1...v5.22.0
⚠ BREAKING CHANGES
The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before
terraform planwill succeed.source_params.web_crawler.crawl_optionsblock has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove anycrawl_options { ... }block from yourcloudflare_ai_search_instanceconfigurations. (0843c7f)serversattribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order ofserversentries differs, and any code that relied on stable list ordering (e.g.element(..., 0)) may need to be updated. (099fc24)Notes
managed_request_headersandmanaged_response_headersare nowOptionalinstead ofRequired. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)New Resources
Features
fileas valid RDP connection_rules value (2659e30)Bug Fixes
Chores
Documentation
v5.21.1Compare Source
Full Changelog: v5.21.0...v5.21.1
Bug Fixes
v5.21.0Compare Source
Full Changelog: v5.20.0...v5.21.0
Features
Bug Fixes
Chores
Documentation
v5.20.0Compare Source
Full Changelog: v5.19.1...v5.20.0
Features
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.