feat(iaas): volume encryption #1103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

rubenhoenle wants to merge 2 commits into main from feat/STACKITTPR-413-iaas-volume-encryption

Member

rubenhoenle commented Dec 19, 2025 •

edited

Loading

Description

relates to STACKITTPR-413 and #1045

Checklist

Issue was linked above
Code format was applied: make fmt
Examples were added / adjusted (see examples/ directory)
Docs are up-to-date: make generate-docs (will be checked by CI)
Unit tests got implemented or updated
Acceptance tests got implemented or updated (see e.g. here)
Unit tests are passing: make test (will be checked by CI)
No linter issues: make lint (will be checked by CI)

rubenhoenle requested a review from a team as a code owner

December 19, 2025 15:02


          feat(iaas): volume encryption

e6b092c

relates to STACKITTPR-413 and #1045

rubenhoenle force-pushed the feat/STACKITTPR-413-iaas-volume-encryption branch from 98d324f to e6b092c Compare

December 19, 2025 15:05


          update description of encryption parameters

991cfcf

rubenhoenle self-assigned this

rubenhoenle added the ignore-stale label

github-actions bot commented Dec 19, 2025

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas	0.00% (ø)
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/volume	25.31% (+10.10%)	🎉

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/volume/datasource.go	41.56% (+41.56%)	77 (+37)	32 (+32)	45 (+5)	🌟
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/volume/resource.go	20.16% (+2.37%)	243 (+7)	49 (+7)	194	👍

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/iaas_acc_test.go
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/volume/datasource_test.go
github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/iaas/volume/resource_test.go

marceljk reviewed

View reviewed changes

stackit/internal/services/iaas/volume/resource.go

    
              							validate.NoSeparator(),

              						},

              					},

              					"key_payload_base64": schema.StringAttribute{

Contributor

marceljk Dec 19, 2025

key_payload_base64 can be set as WriteOnly attribute. Most providers offer both options, so a normal field and a WriteOnly field.
Because the WriteOnly isn't stored in the state, we would need a WriteOnlyVersion field as well. When the version field changes, a replaces can be triggered.
See https://developer.hashicorp.com/terraform/language/manage-sensitive-data/write-only

marceljk reviewed

View reviewed changes

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttrSet("stackit_volume.volume_encrypted_no_key_payload", "volume_id"),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "region", testutil.Region),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "availability_zone", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["availability_zone"])),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "size", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["size"])),

Contributor

marceljk Jan 9, 2026

nitpick: check of description & labels attribute is missing in both encrypted volumes

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "encryption_parameters.service_account", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["service_account_mail"])),

              					// Volume encrypted - with key payload

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),

Contributor

marceljk Jan 9, 2026

I think you wanted to check here and in the following lines the resource "volume_encrypted_with_key_payload" 😄

Suggested change

      
            					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),
          
            					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_with_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),

stackit/internal/services/iaas/iaas_acc_test.go

    
              						"stackit_kms_key.key", "keyring_id",

              						"stackit_volume.volume_encrypted_no_key_payload", "encryption_parameters.kek_keyring_id",

              					),

              					resource.TestCheckNoResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "encryption_parameters.key_payload_base64"),

Contributor

marceljk Jan 9, 2026

This check must be changed then as well, to compare if the correct value for key_payload_base64 is set

Suggested change

      
            					resource.TestCheckNoResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "encryption_parameters.key_payload_base64"),
          
            					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_with_key_payload", "encryption_parameters.key_payload_base64", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["key_payload_base64"])),

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttrSet("data.stackit_volume.volume_encrypted_no_key_payload", "volume_id"),

              					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "region", testutil.Region),

              					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "availability_zone", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["availability_zone"])),

              					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "size", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["size"])),

Contributor

marceljk Jan 9, 2026

Check for description and labels missing in the encrypted volumes

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "encrypted", "true"),

              					// Volume encrypted - with key payload

              					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),

Contributor

marceljk Jan 9, 2026

wrong datasource here and the following lines

Suggested change

      
            					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_no_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),
          
            					resource.TestCheckResourceAttr("data.stackit_volume.volume_encrypted_with_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMax["project_id"])),

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttrSet("stackit_volume.volume_encrypted_no_key_payload", "volume_id"),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "region", testutil.Region),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "availability_zone", testutil.ConvertConfigVariable(testConfigVolumeVarsMaxUpdated["availability_zone"])),

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "size", testutil.ConvertConfigVariable(testConfigVolumeVarsMaxUpdated["size"])),

Contributor

marceljk Jan 9, 2026

description & labels checks are missing in both updated encrypted volumes

stackit/internal/services/iaas/iaas_acc_test.go

    
              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "encryption_parameters.service_account", testutil.ConvertConfigVariable(testConfigVolumeVarsMaxUpdated["service_account_mail"])),

              					// Volume encrypted - with key payload

              					resource.TestCheckResourceAttr("stackit_volume.volume_encrypted_no_key_payload", "project_id", testutil.ConvertConfigVariable(testConfigVolumeVarsMaxUpdated["project_id"])),

Contributor

marceljk Jan 9, 2026

wrong resource

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels