Merge branch 'main' into ds-fix-wait-for-rollout

.changelog/2372.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+`data_source/kubernetes_resources`: fix an issue where the provider exit with an error when the data source `kubernetes_resources` receives multiple Kubernetes objects containing tuples with different numbers of elements.
+```

.changelog/2402.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+`resource/kubernetes_node_taint`: Fix the error check for nonexistant nodes so that terraform does not fail if there is a taint in the state file for a node that has been deleted.
+```

.changelog/2428.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+Add provider defined functions: `manifest_encode`, `manifest_decode`, `manifest_decode_multi`
+```

.changelog/2461.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+`manifest_decode()`: fix handling of manifests containing null values
+```

.changelog/2464.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+data-sources: revert a recently introduced deviation on datasources where querying a non-existent resource would cause an error (#2434).
+```

.changelog/2470.txt

@@ -0,0 +1,3 @@
+```release-note:doc
+Migrate legacy structure to new tfplugindocs template structure
+```

.changelog/2485.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+`kubernetes_manifest`: fix issue preventing KUBE_PROXY_URL environment variable from being used in client configuration (#1733)
+```

.changelog/2488.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+`resource/kubernetes_persistent_volume_v1`: support `ReadWriteOncePod` access mode for PVs
+```

.changelog/2494.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+`resource/resource_kubernetes_network_policy_v1`: add support for `end_port`
+```

.changelog/2510.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+Add support for Terraform's experimental deferred actions
+```

.copywrite.hcl

@@ -11,5 +11,6 @@ project {
     ".markdownlint.yml",
     ".release/**",
     "vendor/**",
+    "examples/**"
   ]
 }

.github/labeler-pull-request-triage.yml

@@ -1,4 +1,6 @@
-dependencies:
-  - vendor/**/*
-documentation:
-  - website/**/*
+Dependencies:
+- changed-files:
+  - any-glob-to-any-file: 'vendor/*'
+Documentation:
+- changed-files:
+  - any-glob-to-any-file: 'docs/*'

.github/workflows/acceptance_test_dfa.yaml

@@ -0,0 +1,33 @@
+name: Deferred Actions
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "manifest/**/*.go"
+      - 'kubernetes/**/*.go'
+      - "go.mod"
+  workflow_dispatch:
+    inputs:
+      terraformVersion:
+        description: Terraform version
+        default: 1.9.0-alpha20240516
+
+jobs:
+  acceptance_tests:
+    if: ${{ github.repository_owner == 'hashicorp' }}
+    runs-on: custom-linux-medium
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+      - name: Set up Go
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version-file: 'go.mod'
+      - name: Run Tests
+        env:
+          TF_ACC: 1
+          TF_ACC_TERRAFORM_VERSION: ${{ github.event.inputs.terraformVersion || '1.9.0-alpha20240516' }}
+        run: |
+          go test -v -run '^TestAccKubernetesDeferredActions' ./kubernetes/test-dfa

.github/workflows/acceptance_tests_aks.yaml

@@ -38,10 +38,11 @@ env:
 
 jobs:
   acceptance_tests_aks:
-    runs-on: [custom, linux, medium]
+    if: ${{ github.repository_owner == 'hashicorp' }}
+    runs-on: custom-linux-medium
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:

.github/workflows/acceptance_tests_eks.yaml

@@ -43,10 +43,11 @@ env:
 
 jobs:
   acceptance_tests_eks:
-    runs-on: [custom, linux, medium]
+    if: ${{ github.repository_owner == 'hashicorp' }}
+    runs-on: custom-linux-medium
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:

.github/workflows/acceptance_tests_gke.yaml

@@ -44,10 +44,11 @@ env:
 
 jobs:
   acceptance_tests_gke:
-    runs-on: [custom, linux, medium]
+    if: ${{ github.repository_owner == 'hashicorp' }}
+    runs-on: custom-linux-medium
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:

.github/workflows/acceptance_tests_kind.yaml

@@ -26,16 +26,17 @@ on:
 
 env:
   KUBECONFIG: ${{ github.workspace }}/.kube/config
-  KIND_VERSION: ${{ github.event.inputs.kindVersion || vars.KIND_VERSION }}
-  PARALLEL_RUNS: ${{ github.event.inputs.parallelRuns || vars.PARALLEL_RUNS }}
-  TERRAFORM_VERSION: ${{ github.event.inputs.terraformVersion || vars.TERRAFORM_VERSION }}
+  KIND_VERSION: ${{ github.event.inputs.kindVersion || vars.KIND_VERSION || '0.23.0' }}
+  PARALLEL_RUNS: ${{ github.event.inputs.parallelRuns || vars.PARALLEL_RUNS || '8' }}
+  TERRAFORM_VERSION: ${{ github.event.inputs.terraformVersion || vars.TERRAFORM_VERSION || '1.9.2' }}
 
 jobs:
   acceptance_tests_kind:
-    runs-on: [custom, linux, medium]
+    if: ${{ github.repository_owner == 'hashicorp' }}
+    runs-on: custom-linux-medium
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:

.github/workflows/changelog-checker.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 # by default the checkout action doesn't checkout all branches

.github/workflows/check_examples.yaml

@@ -28,15 +28,16 @@ jobs:
           - "1.3.9"
           - "1.4.0"
           - "1.6.0"
-          - "1.7.5"
+          - "1.7.0"
+          - "1.8.0"
     env:
       TF_X_KUBERNETES_MANIFEST_RESOURCE: 1
       TERM: linux
     steps:
       - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
         with:
           terraform_version: ${{ matrix.terraform_version }}
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:

.github/workflows/checkers-and-linters.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
     - name: Set up Go
-      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version-file: 'go.mod'
     # Secrets are not available on pull requests.
     - name: Login to Docker Hub
       if: github.ref == 'refs/heads/main'
-      uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+      uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
       with:
         username: ${{ secrets.RO_DOCKERHUB_USER }}
         password: ${{ secrets.RO_DOCKERHUB_TOKEN }}
@@ -36,5 +36,5 @@ jobs:
         make vet
     - name: Run linters
       run: |
-        make website-lint
+        make docs-lint
         make tests-lint

.github/workflows/codeql-analysis.yml

@@ -30,15 +30,15 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
         fetch-depth: 2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # codeql-bundle-v2.13.4
+      uses: github/codeql-action/init@c4fb451437765abf5018c6fbf22cce1a7da1e5cc # codeql-bundle-v2.17.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # codeql-bundle-v2.13.4
+      uses: github/codeql-action/autobuild@c4fb451437765abf5018c6fbf22cce1a7da1e5cc # codeql-bundle-v2.17.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # codeql-bundle-v2.13.4
+      uses: github/codeql-action/analyze@c4fb451437765abf5018c6fbf22cce1a7da1e5cc # codeql-bundle-v2.17.1

.github/workflows/documentation-check.yaml

@@ -0,0 +1,42 @@
+name: "Documentation Updates"
+
+on:
+    pull_request:
+      paths:
+        - 'docs/**'
+      types: [opened, synchronize, labeled]       
+
+    push:
+      branches:
+        - main
+
+jobs:
+    check-docs:
+      runs-on: ubuntu-latest
+
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-documentation') }}
+
+      steps:
+        - name: Checkout repository
+          uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+
+        - name: Set up Go
+          uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+          with:
+            go-version-file: 'go.mod'
+
+        - name: Install tfplugindocs command
+          run: go install github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@latest
+
+        - name: Run tfplugindocs command
+          run: tfplugindocs generate
+
+        - name: Check for changes
+          run: |
+            git diff --exit-code
+  
+        - name: Undocumented changes 
+          run: |
+            echo "Documentation is not up to date. Please refer to the `Making Changes` in the Contribution Guide on how to properly update documentation."
+            exit 1
+          if: failure()

.github/workflows/golangci-lint.yaml

@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Set up Go
-        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: 'go.mod'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
+        uses: golangci/golangci-lint-action@82d40c283aeb1f2b6595839195e95c2d6a49081b # v5.0.0
         with:
           version: 'v1.55.2'
           skip-pkg-cache: true

.github/workflows/hc-copywrite.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
     - name: Install copywrite
-      uses: hashicorp/setup-copywrite@3ace06ad72e6ec679ea8572457b17dbc3960b8ce # v1.0.0
+      uses: hashicorp/setup-copywrite@32638da2d4e81d56a0764aa1547882fc4d209636 # v1.1.3
 
     - name: Validate Header Compliance
       run: copywrite headers --plan

.github/workflows/issue-opened.yml

@@ -8,9 +8,48 @@ jobs:
   issue_triage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-    - uses: github/issue-labeler@e24a3eb6b2e28c8904d086302a2b760647f5f45c # v3.1
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         configuration-path: .github/labeler-issue-triage.yml
         enable-versioned-regex: 0
+  oncall_review_assigner:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/setup-node@v4
+    - run: npm install @pagerduty/pdjs
+    - uses: actions/github-script@e69ef5462fd455e02edcaf4dd7708eda96b9eda0 # v7.0.0
+      env:
+        PAGERDUTY_TOKEN: ${{ secrets.PAGERDUTY_TOKEN }}
+      with:
+        script: |
+              const { PAGERDUTY_TOKEN } = process.env
+              const { api } = require('@pagerduty/pdjs');
+              const pd = api({token: PAGERDUTY_TOKEN});
+              const reviewerList = new Map([
+                  ["Sheneska Williams", "sheneska"],
+                  ["Mauricio Alvarez Leon", "BBBmau"],
+                  ["Alex Somesan", "alexsomesan"],
+                  ["Alex Pilon", "appilon"],
+                  ["John Houston", "jrhouston"],
+                  ["Sacha Rybolovlev", "arybolovlev"],
+                ]);
+
+              let resp = await pd.get('oncalls?escalation_policy_ids%5B%5D=PH8IF3M')
+              if (resp.status != 200){
+                core.setFailed("PagerDuty Error: " + resp.statusText)
+              }
+              const reviewer = resp.data.oncalls[0].user.summary
+              const reviewerGH = reviewerList.get(reviewer)
+              console.log("Assigning issue to " + reviewerGH);
+
+              resp = await github.rest.issues.addAssignees({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    assignees: reviewerGH,
+                    issue_number: context.issue.number,
+              })
+              if (resp.status != 201){
+                core.setFailed("error assigning reviewer: user doesn't have the appropriate permissions to be assigned an issue.")
+              }

.github/workflows/lock.yml

@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21 # v4.0.1
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           github-token: ${{ github.token }}
           issue-lock-comment: >