feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q) by grubmeshi · Pull Request #226 · meshcloud/terraform-provider-meshstack

grubmeshi · 2026-07-07T15:56:02Z

What

Backs the stable meshstack_tenant resource/data source with the v4 tenant API.

meshstack_tenant: spec.platform_ref ({uuid, kind}) and spec.landing_zone_ref ({name, kind}) replace the identifier strings; spec.quotas is a set; new computed ref, richer status, and wait_for_completion. In-place state upgrade from meshstack_tenant_v4, a moved block, and import by tenant uuid or the legacy workspace.project.location.platform composite.
meshstack_landingzone resource + data source expose a computed ref.
Deprecates the meshstack_tenant_v4 resource and the singular tenant data sources in favor of the plural meshstack_tenants.
CHANGELOG v0.24.0. Works against a GA backend via the v4-preview alias; gated by the ≥ 0.24.0 version floor.

Base: main.

Cross-repo PRs

meshcloud/meshfed-release#10338 — A0: auto-serve legacy -preview clients from the GA endpoint (base of the stack)
meshcloud/meshfed-release#10308 — A1 (on A0): evolve meshTenant v4-preview — platform/landing-zone refs, status.lifecycle, non-null tags
meshcloud/meshfed-release#10309 — A2 (on A1): promote meshTenant v4 to GA
feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q) #226 — provider B0: meshstack_tenant on the v4 body; deprecate meshstack_tenant_v4
feat!: move tenant resources to the meshTenant v4 GA media type (CU-86c0j0r7q) #227 — provider B1 (on B0): flip the tenant client to the GA media type

grubmeshi · 2026-07-07T15:56:44Z

Related PRs (CU-86c0j0r7q, make-tenant-v4-ga):

meshfed PR-1 (align v4-preview): meshcloud/meshfed-release#10308
meshfed PR-2 (promote to GA, stacked on PR-1): meshcloud/meshfed-release#10309
provider PR-1 (meshstack_tenant on v4 + migration): feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q) #226
provider PR-2 (flip to GA media type, stacked on PR-1): feat!: move tenant resources to the meshTenant v4 GA media type (CU-86c0j0r7q) #227

Merge order: meshfed PR-1 → PR-2 (deploy) → provider PR-1 (release, works via the preview alias) → provider PR-2 (GA flip).

github-actions · 2026-07-07T20:56:03Z

📊 Test Coverage

Scope	Coverage
Unit tests (mock client)	`74.6%`
Combined (unit + acceptance)	`80.0%` — ✅ acceptance passed

Uncovered functions (combined run)

github.com/meshcloud/terraform-provider-meshstack/client/api_key_permissions.go:225:							AllApiKeyPermissions					0.0%
github.com/meshcloud/terraform-provider-meshstack/client/buildingblock.go:97:								Delete							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/client.go:48:									NewApiTokenAuthorization				0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:27:							Debug							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:31:							Info							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:35:							Warn							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/retry.go:228:								Close							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/retry.go:249:								Write							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/project_group_binding.go:27:							Read							0.0%
github.com/meshcloud/terraform-provider-meshstack/client/project_group_binding.go:31:							Create							0.0%

Combined with go tool covdata merge over the unit and acceptance coverage data. The acceptance suite runs ./internal/provider against the live backend; coverage is attributed across all packages (-coverpkg=./...).

Copilot

Pull request overview

Backs the stable meshstack_tenant resource (and related tenant/landing zone surfaces) with the meshTenant v4 API body, adds ref-based addressing, and introduces migration paths (state upgrade + moved support) while deprecating older/singular tenant entrypoints.

Changes:

Switch tenant resources/data sources to v4 ref fields (platform_ref, landing_zone_ref) and set-based quotas, plus richer status/ref outputs.
Add non-destructive migration support: meshstack_tenant state upgrade from v3 and moved support from meshstack_tenant_v4.
Add computed ref to landing zones and update examples/docs/tests/mocks accordingly.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
internal/provider/tenants_data_source.go	Renames/aligns plural tenants data source and exposes v4 ref fields in results.
internal/provider/tenants_data_source_test.go	Renames acceptance test to match new plural tenants data source constructor/name.
internal/provider/tenant_v4_resource.go	Deprecates `meshstack_tenant_v4` and factors shared v4 body/state mapping.
internal/provider/tenant_v4_resource_test.go	Updates v4 tenant resource test expectations to ref-based fields.
internal/provider/tenant_v4_data_source.go	Deprecates singular v4 DS and updates schema to expose v4 refs.
internal/provider/tenant_resource.go	Reimplements stable `meshstack_tenant` on v4 body with import/move/upgrade support and wait behavior.
internal/provider/tenant_resource_test.go	Adds tests for create path and `moved` migration from `meshstack_tenant_v4`.
internal/provider/tenant_data_source.go	Moves singular tenant DS to v4 list-based resolution; marks deprecated; adds richer outputs.
internal/provider/tenant_data_source_test.go	Adjusts DS test to use real backend (acceptance) and new v4 shape.
internal/provider/schema_utils.go	Adds helper for name-based computed refs (`meshNameRefOutputAttribute`).
internal/provider/provider.go	Registers the renamed plural tenants data source constructor.
internal/provider/platform_resource.go	Updates platform `ref` description to include tenant usage.
internal/provider/platform_data_source.go	Updates platform `ref` description to include tenant usage.
internal/provider/landingzone_resource.go	Adds computed name-based `ref` and wraps state model to include it.
internal/provider/landingzone_resource_test.go	Asserts landing zone `ref` is set and well-formed.
internal/provider/landingzone_data_source.go	Adds computed `ref` and reuses landing zone state model wrapper.
internal/provider/building_block_resource_test.go	Updates tenant identifier/platform wiring to match new tenant/platform shapes.
internal/provider/acctest/testconfig/config.go	Adds `WithRawBlock` to support raw HCL blocks (e.g., `moved {}`) in tests.
internal/provider/acctest/testconfig/build_tenant_v4.go	Updates tenant v4 testconfig builder to set `platform_ref`/`landing_zone_ref`.
internal/provider/acctest/testconfig/build_tenant_v3.go	Replaces v3 tenant builder with v4-body `Tenant` builder for stable resource.
internal/provider/acctest/testconfig/build_building_block.go	Updates building block tenant config to use refs instead of identifiers.
internal/provider/acctest/testconfig/build_building_block_v1.go	Updates v1 building block tenant identifier construction for new shapes.
internal/clientmock/mock_tenant_v4.go	Adapts mock tenant v4 implementation to platform/landing zone refs.
internal/clientmock/mock_buildingblock.go	Adjusts mock tenant resolution logic to work with v4 ref-based naming constraints.
examples/resources/meshstack_tenant/resource.tf	Updates example to use `platform_ref`/`landing_zone_ref` and shows wait toggle.
examples/resources/meshstack_tenant_v4/resource.tf	Updates v4 example to ref-based fields and simplified deps.
docs/resources/tenant.md	Regenerates docs for new stable tenant schema (refs/status/ref/wait).
docs/resources/tenant_v4.md	Updates v4 resource docs for ref fields and new nesting.
docs/resources/platform.md	Updates platform docs to mention tenant usage of `ref`.
docs/resources/landingzone.md	Documents new computed landing zone `ref`.
docs/data-sources/tenants.md	Updates plural tenants DS docs for ref fields.
docs/data-sources/tenant.md	Updates singular tenant DS docs for ref fields/status and preview note.
docs/data-sources/tenant_v4.md	Updates singular v4 DS docs for ref fields.
docs/data-sources/platform.md	Updates platform DS docs to mention tenant usage of `ref`.
docs/data-sources/landingzone.md	Documents new computed landing zone `ref` in DS.
client/tenant_v4.go	Introduces v4 platform/landing zone ref structs and updates tenant v4 DTOs.
CHANGELOG.md	Bumps to v0.24.0 and documents breaking changes/features/deprecations for tenant v4 migration.

grubmeshi · 2026-07-13T08:46:50Z


+// meshNameRefOutputAttribute is the name-based analogue of meshUuidRefOutputAttribute, for computed-only
+// output refs to meshObjects identified by name rather than uuid (e.g. meshLandingZone).
+func meshNameRefOutputAttribute(kind string) map[string]schema.Attribute {


d: adding this extra helper makes that whole schema_utils.go file look even more weird. although not strictly in scope of this PR, wholistically look at "ref" handling in the codebase. the goal would be that there's a single schema helpfer for resource, and i expect that usually it's uuid attribute ref, but sometimes also name, except for 1-2 exceptions like the BBD version ref to BB. come up with a well researched plan to reach that goal.

Plan-only for this PR (larger refactor, out of scope for the fixup round). Researched the ref-handling landscape and wrote a plan: collapse the uuid/name x input/output helper family in schema_utils.go into one parameterized meshRef(kind, identifier, computed) constructor, keeping two documented exceptions (target_ref discriminated uuid-or-name, and the uuid-only building_block_definition_version_ref), and migrate call sites one resource per commit. Leaving this thread open to schedule the refactor.

grubmeshi · 2026-07-13T08:48:06Z

-			Descend("platform_identifier")(SetAddr(platformAddr, "identifier")),
-			Descend("landing_zone_identifier")(SetAddr(landingZoneAddr, "metadata", "name")),
+			Descend("platform_ref")(SetRawExpr("%s", platformAddr.Join("ref"))),
+			Descend("landing_zone_ref")(SetRawExpr("{name = %s}", landingZoneAddr.Join("metadata", "name"))),


f: this should use the landing_zone resource ref output and check if there's already a helper to commonly use the read only ref outputs (that should be useful at many different places)

Plan-only for this PR. build_building_block.go:52 should assign the landing zone computed ref output directly — Descend("landing_zone_ref")(SetAddr(landingZoneAddr, "ref")) — the same idiom build_tenant_v3.go already uses, now that B0 gives meshstack_landingzone a computed ref. No dedicated helper is needed (SetAddr(addr, "ref") is the shared idiom); the fix is to use it here and audit sibling builders for the hand-rolled {name = ...metadata.name} pattern. Leaving open to apply alongside the ref-handling cleanup.

Consolidate the family of near-duplicate reference schema helpers (meshUuidRefAttribute + meshUuidRefValidators, meshUuidRefOutputAttribute) into one meshRef constructor that returns the whole schema.SingleNestedAttribute — block scaffolding, identifier, kind discriminator and validators — with functional options (asOutput, required, optionalComputed) for the per-site variations. Repoint every call site of the superseded helpers at meshRef, reproducing the existing descriptions verbatim so `task generate` produces no doc diff. meshProjectRoleAttribute is intentionally left as-is: its always-Required block, name-Required/Computed toggle and bespoke identifier description do not fit meshRef's uuid/name input/output model without doc-visible changes. Refs #148 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Migrate the remaining hand-rolled reference blocks to meshRef: the workspace resource `.ref` output and the inline data-source refs (building-block-definitions / platform / platform-type / tenants / workspace `.ref`; location_ref, platform_type_ref, runner_ref, and the landingzone data-source platform_ref). Data-source computed outputs use the asOutput() option. This normalizes the reference descriptions, so `task generate` produces a docs diff limited to description text under the existing Read-Only sections — no Required/Optional or attribute changes. The two documented exceptions (target_ref, building_block_definition_version_ref) stay bespoke. The binding role_ref is also left bespoke: it is backed by the client's deprecated kind-less MeshProjectRoleRef, so routing it through meshRef would add a kind output attribute and require a client-struct change, which is out of scope here. Refs #148 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add a computed `kind` (always `meshBuildingBlockDefinitionVersion`) to the `building_block_definition_version_ref` in all four schema sites (the v2 and v3 building block resources, the building_block_v2 and building_blocks data sources) and to the `meshstack_building_block_definition` `version_latest`, `version_latest_release` and `versions` outputs, so the version reference carries a kind like every other meshObject reference. The client MeshBuildingBlockV2DefinitionVersionRef gains a `Kind` field that is sent to the backend (decision (a)); Read/Create wiring forces it to the fixed discriminator so it round-trips even if the backend omits it. On the v2 and v3 resources the ref's `kind` is Optional+Computed so wiring a full version object (e.g. `...version_latest`) keeps working without tripping the read-only guard; the data-source and version outputs expose it as read-only. This stays a documented meshRef exception (the v3 variant also carries `content_hash`); it simply now carries a kind, preparing the cross-resource wiring for the companion version resource. Refs #198 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replace spec.platform_identifier with spec.platform_ref ({uuid, kind}) and spec.landing_zone_identifier with spec.landing_zone_ref ({name, kind}, where name is the landing zone identifier), aligning meshstack_tenant_v4 with the meshTenant v4-preview contract. Client, resource, both data sources, mock, testconfig builders, example and docs updated. status.tags stays non-null; status.lifecycle is not exposed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add a name-based meshNameRefOutputAttribute helper and a computed `ref` ({name, kind}) output on the meshstack_landingzone resource and data source, so it can be wired directly into meshstack_tenant_v4's landing_zone_ref (mirroring the uuid-based ref outputs on other resources). Wrap the landing zone state in a model struct rather than mutating client types. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Reimplement meshstack_tenant on the shared v4 body (platform_ref, landing_zone_ref, platform_tenant_id, status, ref, wait_for_completion): - v3->v4 state upgrade (SchemaVersion 1): the upgrader resolves the tenant via the list endpoint (Configure runs before UpgradeResourceState) and backfills uuid + refs. - moved support from meshstack_tenant_v4 (shared body -> non-destructive). - import accepts a tenant UUID or the legacy workspace.project.location.platform composite. - singular data source reimplemented over TenantV4.List (composite key). - deprecate the meshstack_tenant_v4 resource (-> meshstack_tenant + moved) and the singular meshstack_tenant / meshstack_tenant_v4 data sources (-> plural meshstack_tenants). - rename the plural tenants data source's internal identifiers off the _v4 suffix (HCL name meshstack_tenants unchanged). Shared the v4 body schema + state mapping between meshstack_tenant and meshstack_tenant_v4. Adds a WithRawBlock test helper for moved-block configs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

grubmeshi mentioned this pull request Jul 7, 2026

feat!: move tenant resources to the meshTenant v4 GA media type (CU-86c0j0r7q) #227

Open

grubmeshi force-pushed the feature/adopt-tenant-v4 branch 2 times, most recently from eaec87a to 2168a82 Compare July 7, 2026 20:53

grubmeshi force-pushed the feature/adopt-tenant-v4 branch from 2168a82 to 9da0ded Compare July 9, 2026 20:06

grubmeshi requested a review from Copilot July 10, 2026 07:00

Copilot started reviewing on behalf of grubmeshi July 10, 2026 07:00 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

grubmeshi force-pushed the feature/adopt-tenant-v4 branch 2 times, most recently from 456bb92 to 33540dc Compare July 10, 2026 09:57

grubmeshi commented Jul 13, 2026

View reviewed changes

Comment thread docs/data-sources/tenant_v4.md

grubmeshi force-pushed the feature/adopt-tenant-v4 branch from 33540dc to fc80215 Compare July 13, 2026 09:57

grubmeshi and others added 5 commits July 14, 2026 14:09

grubmeshi force-pushed the feature/adopt-tenant-v4 branch from fc80215 to 0437e04 Compare July 14, 2026 13:06

grubmeshi changed the base branch from main to feature/consolidate-ref-handling July 14, 2026 13:06

grubmeshi force-pushed the feature/adopt-tenant-v4 branch from 0437e04 to b53643f Compare July 14, 2026 19:58

grubmeshi mentioned this pull request Jul 16, 2026

feat: migrate starterkit tenants to meshstack_tenant (anticipates provider v0.24.0) meshcloud/meshstack-hub#226

Open

grubmeshi force-pushed the feature/consolidate-ref-handling branch from 34cf6da to 74df186 Compare July 16, 2026 20:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q)#226

feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q)#226
grubmeshi wants to merge 6 commits into
feature/consolidate-ref-handlingfrom
feature/adopt-tenant-v4

grubmeshi commented Jul 7, 2026 •

edited

Loading

Uh oh!

grubmeshi commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grubmeshi Jul 13, 2026

Uh oh!

grubmeshi Jul 13, 2026

Uh oh!

grubmeshi Jul 13, 2026

Uh oh!

grubmeshi Jul 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

grubmeshi commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Cross-repo PRs

Uh oh!

grubmeshi commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Test Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grubmeshi Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

grubmeshi commented Jul 7, 2026 •

edited

Loading

github-actions Bot commented Jul 7, 2026 •

edited

Loading