Skip to content

chore(deps): update terraform cloudflare to v5 #1836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update terraform cloudflare to v5 #1836

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tf/shared/modules/cloudflare-pages-project/config.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
cloudflare = {
source = "cloudflare/cloudflare"
version = "~>4.46"
version = "~> 5.0"

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Convert the Pages build configuration to a v5 object

The project still declares build_config { ... } in project.tf. Cloudflare v5 defines this as a single nested attribute, so selecting v5 makes Terraform reject the block and prevents planning this module.

Suggested fix

Convert project.tf's block to build_config = { ... }, retaining the analytics fields and existing build-caching lifecycle exclusion.

Prompt for a coding agent 
In tf/shared/modules/cloudflare-pages-project/project.tf, convert lines 6-9 from a build_config block to the object attribute build_config = { ... }, retaining both analytics values and the build_caching ignore_changes entry, before enabling v5 in config.tf.

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Migrate both name-based zone lookups

Both Pages modules still configure data "cloudflare_zone" with top-level name = var.domain. In v5, name is computed-only; name-based lookup now belongs in filter.name. The domain module also reads .zone_id, which is now an optional input rather than the returned identifier, so it must read .id after switching to a filter.

Suggested fix

Change both zone lookups to filter = { name = var.domain } and change the DNS record's zone ID expression to data.cloudflare_zone.domain.id.

Prompt for a coding agent 
Update the cloudflare_zone data sources in tf/shared/modules/cloudflare-pages-project/project.tf and tf/shared/modules/cloudflare-pages/domain.tf to use filter = { name = var.domain } instead of the top-level name input. In the Pages domain module, use data.cloudflare_zone.domain.id as the DNS record's zone_id.

}
}
}
2 changes: 1 addition & 1 deletion tf/shared/modules/cloudflare-pages/config.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
cloudflare = {
source = "cloudflare/cloudflare"
version = "~>4.46"
version = "~> 5.0"

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Rename the Pages custom-domain argument for v5

The existing cloudflare_pages_domain.pages_domain resource still sets domain = module.domain.fqdn. The v5 schema replaces domain with required name, so this provider bump leaves an unsupported argument and a missing required argument in the module.

Suggested fix

Rename the Pages domain resource's domain argument to name, preserving its value.

Prompt for a coding agent 
In tf/shared/modules/cloudflare-pages/domain.tf, replace domain = module.domain.fqdn in cloudflare_pages_domain.pages_domain with name = module.domain.fqdn to match the v5 provider schema.

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Migrate the DNS record resource and its outputs

domain.tf still manages cloudflare_record.pages_subdomain, which v5 renames to cloudflare_dns_record. outputs.tf also references the old resource and its hostname attribute, absent from the v5 DNS schema. The module cannot plan under v5 without migrating the resource and its outputs; existing managed records also need a state migration rather than treating the rename as a new record.

Suggested fix

Rename the resource and its references, use .name for the hostname output, and include the supported state-migration procedure for existing DNS records.

Prompt for a coding agent 
Migrate cloudflare_record.pages_subdomain in tf/shared/modules/cloudflare-pages/domain.tf to cloudflare_dns_record.pages_subdomain. Update both references in outputs.tf and replace the removed hostname output access with the v5 record's name attribute. Provide the provider-supported state migration for the resource-type rename and check that an existing record is not destroyed and recreated.

}
}
}
2 changes: 1 addition & 1 deletion tf/shared/modules/cloudflare-r2-bucket/config.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
cloudflare = {
source = "cloudflare/cloudflare"
version = "~> 4.46"
version = "~> 5.0"

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Migrate the R2 permission-group lookup

main.tf still uses cloudflare_api_token_permission_groups.all.r2[...]. The v5 provider removes this data source and exposes permission groups through cloudflare_api_token_permission_groups_list.result instead of scope-indexed maps. As written, the bucket-token permission lookup cannot be evaluated with the newly required provider.

Suggested fix

Use the v5 permission-groups list data source and resolve the read/write IDs from its result entries, preserving the R2 scope restriction and aliased provider.

Prompt for a coding agent 
In tf/shared/modules/cloudflare-r2-bucket/main.tf, replace the removed cloudflare_api_token_permission_groups data source with cloudflare_api_token_permission_groups_list, retaining the cloudflare.api_keys provider. Resolve the two Workers R2 Storage Bucket Item permission IDs from result entries by name and R2 scope instead of indexing all.r2.

@futo-kritika futo-kritika Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[blocking · correctness] Convert the bucket token policy and conditions to v5

The token resource in main.tf retains v4's policy block, string permission IDs, map-valued resources, and dynamic condition block. V5 requires a policies list with explicit effect, permission-group objects, JSON-string resources, and object-valued conditions. Consequently the module still fails planning even after migrating its permission lookup; the conversion must also preserve the configured CIDR restriction.

Suggested fix

Convert the token to the v5 policies/object schema, JSON-encode the bucket resource map, explicitly set effect = "allow", and express the optional IP condition as an object or null.

Prompt for a coding agent 
In tf/shared/modules/cloudflare-r2-bucket/main.tf, migrate cloudflare_api_token.bucket_api_token to policies = [{ effect = "allow", permission_groups = [{ id = ... }, { id = ... }], resources = jsonencode({ ... }) }]. Replace the dynamic condition block with condition = length(var.allowed_cidrs) > 0 ? { request_ip = { in = var.allowed_cidrs } } : null, preserving the existing bucket-specific resource key.

configuration_aliases = [cloudflare.api_keys]
}
onepassword = {
Expand Down
Loading