chore(deps): update terraform cloudflare to v5 #29
No reviewers
Labels
No labels
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
shivering-isles/infrastructure-gitops!29
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/cloudflare-5.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.52.9→5.28.0Release Notes
cloudflare/terraform-provider-cloudflare (cloudflare)
v5.28.0Compare Source
Full Changelog: v5.27.0...v5.28.0
⚠ BREAKING CHANGES
operation_idhas been renamed todiscovery_id,zone_idis now required, and the computedidattribute has been removed. Update resource arguments and any expressions referencingid. This resource remains deprecated and cannot be imported. No new state upgrader is included for these schema changes.is_recent,is_regex, andis_similarityare now required instead of optional. Set all three explicitly, usingfalsefor protections that should not be bypassed.cloudflare_registrar_domainresource and data source, and thecloudflare_registrar_domainslist data source, have been removed. Configurations using these types must be updated before upgrading; this release does not provide a replacement Terraform resource or data source.word_listattribute is now a list of strings instead of a JSON-encoded string, on resources and their data sources. The same change applies to nestedword_listvalues in thezero_trust_dlp_custom_profileandzero_trust_dlp_predefined_profiledata sources. Removejsondecode(...)around these values and update expressions expecting a string. No new state upgrader is included for this type change.mfa_ssh_piv_key_requirementshas been replaced withmfa_piv_key_requirementson the resource and data source, restoring the field name accepted by the API. Rename the argument and any references to it; the nested attributes are unchanged. No new state upgrader is included for this rename. This also restores API serialization and empty-list normalization, so PIV requirements use the correct API field name and empty SSH key lists do not cause perpetual diffs.Notes
deployment_configs.preview.build_image_major_versionordeployment_configs.production.build_image_major_versionto 1 are rejected. Use version 3 for those projects.target_testsattribute is deprecated on the resource and its data sources.deprecatedattribute no longer defaults tofalse.Features
New Resources
exact,upto, andorigin_controlledpayment schemes. Supportsterraform importusing the zone ID.New Data Sources
New Attributes
metadata.created_from_emdash_plugin, withtype(nativeorrest) andversion.build_image_auto_upgrade.from_versionandbuild_image_auto_upgrade.to_version, identifying projects moved from a retired build image.bindings.retry.max_attemptsandbindings.retry.timeout_ms.max_attemptscounts retries after the initial request and accepts 0–10; zero disables retries.timeout_msaccepts 500–60000 and controls the retry window, not the initial-request timeout.mode; setmode = "instant"when creating a namespace to use KV Instant, or omit it for a classic namespace. Changing the resource's mode forces replacement.bindings_inherit = "strict"makes uploads fail when an inherited binding cannot be resolved, instead of silently dropping that binding.target_criteria.include,target_criteria.require, andtarget_criteria.exclude, supporting hostname and tag selectors for infrastructure targets. The rule format requiresinclude;requireandexcludeare optional. Each rule must contain a hostname selector or tags, with selector sizes and empty values validated at plan time. The legacytarget_criteria.target_attributesformat remains supported for unchanged persisted maps, including non-hostname keys. For new or changed criteria, prefer the rule format. The legacy format and rule format cannot be combined in the same criterion.config.login_page_auto_prompt, defaulting tofalseon the resource, to automatically prompt for passkey authentication on the Access login page.region, identifying where the certificate authority's key material is pinned.lookupquery support for finding complete application name mentions in a phrase. Usefilter.lookupon the singular data source orlookupon the list data source. It cannot be combined withsearch.New Accepted Values
session_durationis now supported for infrastructure applications and defaults to24h, fixing creation failures when the API returns this default. It sets the maximum connection duration and must uses,m, orhin whole seconds.typeacceptspasskeys.matchexpressions supportdevice.tags.Bug Fixes
read_replicationoptional and computed with a nested custom type, allowing API-returned replication settings to populate state when the block is omitted.include_shadow_metadatatofalseduring refresh and v4 to v5 migration, avoiding spurious updates for older state. Allowmodified_onto change whenprivate_routingorinclude_shadow_metadatachanges, preventing inconsistent-result errors after updates.setting_idduring import, so imported hostname TLS settings can be refreshed and managed.content_converterfields. Preserve configuredcontent_convertervalues and existing v5 state, including rules managed withlifecycle.ignore_changes.previews_base_config, including configuration-derived unknown values, so preview-only updates do not incorrectly retain the previousupdated_onvalue or suppress the planned change.CF-Entrypointheader when refreshing multipart script content, allowing renamed entrypoints to surface as drift instead of failing to find a stale module name. Preserve service-workerbody_partformat during refresh.v5.27.0Compare Source
Full Changelog: v5.26.0...v5.27.0
⚠ BREAKING CHANGES
One change requires a configuration edit. The rest of this release's schema movement is read-only reshaping with no action required — see Schema Changes at the end.
featureandwith_schemasattributes have been removed from the resource. They were never resource state — both are read-shaping query parameters on the list/get endpoints, and there is no create or update endpoint that accepts them. Remove them from anycloudflare_api_shield_operationblock; leaving them in place produces an "Unsupported argument" error. The schema version moves from 500 to 501 and an automatic state upgrader strips both fields from existing state, so no manual state editing is required. This also fixes the.with_schemas: was cty.False, but now nullerror raised when upgrading from v5.26.0.Notes
ha_modeno longer forces replacement. The upstream API added update support, so the site is modified in place.ha_linkno longer forces replacement, for the same reason.health_check_rateis now configurable (previously read-only).hybrid_search_enablednow reflects the API default oftruefor newly created instances. Existing instances keep the value already in state, so upgrading does not plan a change.nameservers.ns_setis now computed. It applies only to custom nameserver types and is preserved from state when the API does not return it.foundation_dnsis deprecated and will be removed in a future API version. Setnameservers.typetocloudflare.advancedto turn Advanced Nameservers on, orcloudflare.standardto turn it off.spend_limits.rules.idchanged from865b4d33to00000000. Configurations that do not setidexplicitly will show a one-time diff on the next plan.profile_typenow forces replacement. The field is set when the profile is created and cannot be changed, so an in-place update was never possible. Configurations that omitprofile_typeare unaffected.Features
New Resources
New Data Sources
New Attributes
load_balance_inner_flowsstrict_service_token_authnameservers.nameserver_set_idhostnamefiltercategoryandis_selectableNew Accepted Values
rules.conditions[...].operatoracceptshasandnot_hastypeacceptsbasin_catalogbindings.typeacceptsartifactsbindings.typeacceptsartifacts,flagship,k2andmessagingnameservers.typeacceptscloudflare.advancedandcustomOther
terraform importapplies_to_all_integrationsisfalseand no integration IDs resolve. Existing policies that omitintegration_idsand retain IDs in state continue to plan normally.Bug Fixes
normalizefield to v500 migration target modelai_bots_migration_opt_outinto the API modelkey_idfrom the API'suidafter create, so plan, refresh, update and destroy no longer fail with "missing required key_id parameter"include_shadow_metadatato false on importfieldsresult mapdecode_null_to_zerotofilter_attack_traffictoken_idto the v500 migration target modelfrequencyorregionchange, as the API has no update endpoint for scheduled testsquery_stringwildcardomit_sourceto false on importpage/per_pageto their spec values on importobservability.redact_query_stringexports_reconciliationfrom the v0 legacy schemaexpiration/expiration_ttlto the v500 migration target modelbase_pathandobservability.issuesattributesstreamattribute to the bindings schemaforcefield to the legacy V0 migration structclient_secret; redactauth_credentialsandclient_secretfrom debug logsaccounts/<account_id>orzones/<zone_id>prefix. Account and zone IDs are both 32-character hex, so the previous length-based detection always resolved to account scope and zone-scoped resources could not be imported.warp_auth_non_browser_401to the v4 source model, unblocking v4 to v5 migrationmfa_configuration_allowed/service_token_inactivityon importmfa_configuration_allowed,service_token_inactivity,trusted_accountshafrommetadata.haon import and readSchema Changes (no action required)
Upstream Cloudflare API schema changes picked up via the cloudflare-go v7.12.0 bump. These are listed for completeness; none require a change to a working configuration.
Of the 54 removed attributes, 52 are read-only (computed): existing state files load without user action and plans are unaffected, so only configurations that reference them — in an
outputblock or an expression — need updating. The two attributes that becomeRequiredwere already mandatory server-side, so a request omitting them was always rejected; the failure simply moves from apply time to plan time. The one type change is on data sources only, and HCL converts numeric strings automatically.policies.permission_groups.meta.key/.valuepair has been replaced with typed fields —category,deprecated,description,editable,eol_at,label,scopes,visibility. Expressions readingmeta.key/meta.valuemust move to the named field.integration.integrationhas been renamed tointegration.hyperdrive_config_provider.settings.email,settings.pagerdutyandsettings.webhooksdetail attributes are no longer surfaced on thecloudflare_queueresource or the queue data sources. Relatedly,notificationis no longer an accepted value for the read-onlyconsumers.typeattribute on those surfaces. Queue configuration is unaffected — thecloudflare_queue_consumerresource is unchanged and still accepts and manages all three settings blocks.rulesis nowRequiredinstead ofOptional. The API already rejects a request that omits it, so this moves the failure from apply time to plan time rather than breaking a working configuration.nameservers.typeis nowRequiredinstead ofOptional.nameserversbecame a discriminated union upstream andtypeis its discriminator, so it was already mandatory in practice.limitchanged fromStringtoInt64and is now constrained to between 1 and 200. These are data sources only, so there is no state to migrate, and HCL converts numeric strings automatically —limit = "10"continues to work.v5.26.0Compare Source
Full Changelog: v5.25.0...v5.26.0
Features
New Resources
New Data Sources
New Attributes
Bug Fixes
private_keyoptional to unblock settingcustom_csr_idsupport_subaddressto resource schemaedge_cache_ttlmaximum to allow one-year valuesuser_agent_operator_suffixunquoted and read fallback from environment variableUseNonNullStateForUnknownoncreated_onto prevent perpetual diffv5.25.0Compare Source
Full Changelog: v5.24.0...v5.25.0
Features
New Resources
New Data Sources
New Attributes
Bug Fixes
bot_preference_sync_enabledoptional-only;Computedcaused "unknown after apply" errorsaccount_idas required in data sourcesprimaryandsite_idfields; markaccount_idas required in data sourcesaccount_idas required in list data sourceVersion: 500on new resources to enable correct state upgrade pathv5.24.0Compare Source
Full Changelog: v5.23.0...v5.24.0
BREAKING CHANGES
The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before
terraform planwill succeed.cloudflare_hostname_tls_settingdata source now requireshostnameas an input parameter instead of returning it as a computed attribute. The computedidattribute has been removed; usesetting_idinstead. (ece27fe)variantnested attribute has been removed. The API no longer returns this wrapper object; theid,options, andnever_require_signed_urlsfields remain available at the top level. Remove any references tocloudflare_image_variant.<name>.variantfrom your configurations. (738bd28)meta.flagsnested attribute has been renamed tometa.tenant_flags. Two new computed sub-attributes (enterprise_capability,member_management) have been added. Update any references from.meta.flagsto.meta.tenant_flags. (ece27fe)allow_code_modeattribute is now deprecated and no longer computed with a default oftrue. Use the newcode_modeattribute ("off","opt_in","default_on","enforced") instead. Configurations that relied on the computed default must explicitly setcode_modeorallow_code_mode. (ece27fe)session_durationattribute is no longer computed with a default of"24h". It is now optional-only. Existing configurations that omittedsession_durationand relied on the provider default will see a plan diff; explicitly setsession_duration = "24h"to preserve the previous behavior. (ae4f5a1)allowed_authenticatorsenum valuessh_piv_keyhas been renamed topiv_key, and a new valuessh_fido2_keyhas been added. Configurations using"ssh_piv_key"must be updated to"piv_key". (ece27fe)idattribute type changed fromStringtoInt64. The computedintel_idattribute has been removed. Thehostnames,ip_subnets,port_protocols,support_domains, andsupportedattributes changed fromListtoSet(element ordering is no longer significant). These changes apply to both the resource data source and the list data source. (ece27fe)idattribute type changed fromStringtoInt64on both the data source and list data source. (ece27fe)is_pending_reconnectattribute has been removed fromconnections. The upstream API no longer returns this field. Remove any references toconnections[*].is_pending_reconnectfrom your configurations. (ece27fe)is_pending_reconnectattribute has been removed fromconnections, matching thezero_trust_tunnel_cloudflaredchange above. (ece27fe)New Resources
New Data Sources
Features
log_classificationattribute andunifiedbilling mode (ece27fe)discover_optionsfor link-following web crawler configuration (ece27fe)public_endpoint_paramswith MCP, rate limiting, custom domains, and chat completions configuration (ece27fe)oci_storagecloud provider type (ece27fe)uslocation restriction value (ece27fe)health_sourcesattribute for regional health steering (ece27fe)lv-LV) language support (ece27fe)preview_url_suffixandurlcomputed attributes to subdomain block (ece27fe)messagingbinding type (ece27fe)code_modeattribute for granular Code Mode policy control (ece27fe)authentication_statuscomputed attribute (ece27fe)contract_version,warnings, and newtypevalues (login,interstitial) (ece27fe)enabledattribute to control service token activation (ece27fe)deprecatedattribute to all DLP entry resources and data sources (ece27fe)warp_auth_non_browser_401attribute for non-browser 401 responses (ece27fe)webmcp_enabledandwebmcp_packssetting IDs (ece27fe)Bug Fixes
Documentation
v5.23.0Compare Source
Full Changelog: v5.22.0...v5.23.0
New Data Sources
Features
deployed_viaandlast_modified_viacomputed fields, and defaultofflabeltofalse(5952e95)global_accelerationblock for configuring custom tunnel and API endpoints (5952e95)delete_headerssupport in request header modification settings (5952e95)Bug Fixes
source.configdrift for API-populated fields by preserving computed state values (c63f15e)Chores
Documentation
v5.22.0Compare Source
Full Changelog: v5.21.1...v5.22.0
⚠ BREAKING CHANGES
The following upstream API schema changes required corresponding provider schema updates. Existing state files load without user action (the plugin framework silently drops attributes that no longer exist in the schema), but Terraform configurations that still reference removed attributes must be updated before
terraform planwill succeed.source_params.web_crawler.crawl_optionsblock has been removed. Cloudflare's AI Search API dropped this field from its public schema in June 2026 and no longer accepts it, so keeping it in the provider would surface as a runtime API error rather than a plan-time error. Remove anycrawl_options { ... }block from yourcloudflare_ai_search_instanceconfigurations. (0843c7f)serversattribute changed from a list to a set. HCL syntax is unchanged (servers = [ ... ]), but element ordering is no longer significant — Terraform will no longer plan a change when only the order ofserversentries differs, and any code that relied on stable list ordering (e.g.element(..., 0)) may need to be updated. (099fc24)Notes
managed_request_headersandmanaged_response_headersare nowOptionalinstead ofRequired. Existing configurations that set both blocks keep working unchanged; you may now omit either block if you don't need to manage those transforms. (928173)New Resources
Features
fileas valid RDP connection_rules value (2659e30)Bug Fixes
Chores
Documentation
v5.21.1Compare Source
Full Changelog: v5.21.0...v5.21.1
Bug Fixes
v5.21.0Compare Source
Full Changelog: v5.20.0...v5.21.0
Features
Bug Fixes
Chores
Documentation
v5.20.0Compare Source
Full Changelog: v5.19.1...v5.20.0
Features
Bug Fixes
Reverts
Chores
Documentation
Refactors
v5.19.1Compare Source
Full Changelog: v5.19.0...v5.19.1
Features
Bug Fixes
Chores
v5.19.0Compare Source
Full Changelog: v5.18.0...v5.19.0
New Resources
Features
content_converterandredirects_for_ai_trainingsupport to configuration rules (726b8e7)Bug Fixes
Chores
Documentation
v5.18.0Compare Source
Full Changelog: v5.17.0...v5.18.0
Features
next(c92a4cb)Bug Fixes
Chores
Documentation
Refactors
v5.17.0Compare Source
Full Changelog: v5.16.0...v5.17.0
Features
Bug Fixes
Reverts
Chores
Documentation
Refactors
v5.16.0Compare Source
Full Changelog: v5.15.0...v5.16.0
Features
Bug Fixes
Documentation
v5.15.0Compare Source
Full Changelog: v5.14.0...v5.15.0
Features
startup_time_ms(286ab55)upload_status(7dc0fe3)upload_status(7dc0fe3)upload_status(7dc0fe3)upload_status(7dc0fe3)forensic_copy(5741fd0)Bug Fixes
Chores
hostsis now a set, not a list (286ab55)custom_remote_entities(286ab55)Documentation
Refactors
v5.14.0Compare Source
Full Changelog: v5.13.0...v5.14.0
Features
Bug Fixes
Chores
v5.13.0Compare Source
Full Changelog: v5.12.0...v5.13.0
⚠ BREAKING CHANGES: cloudflare_api_token & cloudflare_account_token Schema Update
The 5.13 release includes major updates to the cloudflare_api_token resource to eliminate configuration drift caused by policy ordering differences in the Cloudflare API.
Fixes: #6092
Whats changed
Required Action (v5.13+)
Customers looking to upgrade to v5.13+ must update all cloudflare_api_token & cloudflare_account_token resources to wrap policy resource values in jsonencode()
Before:
After:
Features
Bug Fixes
Chores
v5.12.0Compare Source
Full Changelog: v5.11.0...v5.12.0
Features
PUT /workers/domainsas a create operation (8ff0c7d)Bug Fixes
Chores
cloudflare_pages_projectacceptance tests (#6318) (cb63e28)Documentation
v5.11.0Compare Source
Full Changelog: v5.10.1...v5.11.0
Features
assets.directoryattribute for handling assets uploads incloudflare_workers_scriptandcloudflare_worker_versionresources (#6160) (50168e5)dynamicvalidatorto do arbitrary semantic equivalence check (e1faeb8)Bug Fixes
Chores
tfplugindocsalways use/var/tmpfor compilation on linux (3ccb727)docs_searchtool at other URLs (195dbf4)e4c0f73](e4c0f736b9f339), 82c913f, 64ff1f0, 516b468, b9b674c, 0b6b710, fc1f691, 7139af1, 81d79a5, fcb14b6, efebe55, c0fb2a4, 2978db8, ced7790, 0ff7a11, 04c89cb, 4acb7ab, 04236ca, 7636b30, 5c2d985, e52ffb1, 133bb02, 3fd9175, b5f2c46, f52687d, f1164d2, e4a44a8, da6a341, 002316c)v5.10.1Compare Source
Full Changelog: v5.10.0...v5.10.1
Features
Bug Fixes
zone_settingmigrations (#6169) (6ba251f)run_worker_firstattribute (#6199) (13bf28d)Chores
Documentation
v5.10.0Compare Source
Full Changelog: v5.9.0...v5.10.0
Features
Bug Fixes
cloudflare_workers_scriptresource (#6158) (bcfc129), closes #6147Chores
Refactors
v5.9.0Compare Source
Full Changelog: v5.8.4...v5.9.0
Features
Bug Fixes
0rtt(4943ca2)cloudflare_zone_settings_override(3b6edda)Chores
v5.8.4Compare Source
Full Changelog: v5.8.3...v5.8.4
Bug Fixes
Chores
v5.8.3Compare Source
Full Changelog: v5.8.2...v5.8.3
Features
decode_null_to_zerotag option (71538e5)apijsoncustompackage (f5b955b)internal/apiformencoder can handle "force_encode" serialization tag (0d8e9ee)internal/apiformencoder can handle "force_encode" serialization tag (840ee94)Bug Fixes
rulesin API responses (7f15668)Chores
contentorcontent_fileis provided (e9d000c)Documentation
v5.8.2Compare Source
Full Changelog: v5.8.1...v5.8.2
Features
Chores
v5.7.1Compare Source
Full Changelog: v5.7.0...v5.7.1
Bug Fixes
Chores
v5.7.0Compare Source
Full Changelog: v5.6.0...v5.7.0
Features
content_fileandcontent_sha256attribute pair as alternative tocontent(6c850b0)Bug Fixes
Chores
v5.6.0Compare Source
Full Changelog: v5.5.0...v5.6.0
Features
Bug Fixes
Chores
v5.5.0Compare Source
Full Changelog: v5.4.0...v5.5.0
Features
Bug Fixes
Chores
Documentation
v5.4.0Compare Source
Full Changelog: v5.3.0...v5.4.0
Features
Bug Fixes
cloudflare_workers_kvstate refresh (2e61b3e)Chores
v5.3.0Compare Source
Full Changelog: v5.2.0...v5.3.0
Features
Bug Fixes
policies(#5433) (3f36851)data(#5461) (8a5e8ce)is_defaultwrite only value (#5434) (368ab5d)Chores
toListParamsmethods in singular data sources (#5371) (495ae4c)Documentation
v5.2.0Compare Source
Full Changelog: v5.1.0...v5.2.0
Features
identifierasid(#5344) (9705e1b)identifierasid(#5345) (5d1afaa)Bug Fixes
metaas read only (84e8c23)valuewrite only field (4cbb4b5)private_keywrite only field (78b9ff1)certificate_idfrom theid(2b53245)Chores
Documentation
v5.1.0Compare Source
Full Changelog: v5.0.0...v5.1.0
Features
Bug Fixes
Documentation
v5.0.0Compare Source
Migration guide (including changelog)
https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.
a8086aa38ato8daf2a31de8daf2a31de1c9a011c411c9a011c415d666e2bbc5d666e2bbcf735fb5f74f735fb5f7462a9b03b0962a9b03b0924dcda96d424dcda96d494b29805d794b29805d7toa057926a02a057926a02e4c6c70447e4c6c70447toc6aeb35ee4c6aeb35ee4to4119d36369View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.