Merge branch 'main' into lilac/idp-sync

Author: aslilac

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           version: latest
           args: release --clean

.github/workflows/test.yml

@@ -54,8 +54,10 @@ jobs:
 
       - name: git diff
         run: |
-          git diff --compact-summary --exit-code || \
-            (echo; echo "Unexpected difference in directories after code generation. Run 'go generate ./...' command and commit."; exit 1)
+          if [[ -n $(git ls-files --other --modified --exclude-standard) ]]; then
+            echo "Unexpected difference in directories after code generation. Run 'make gen' and include the output in the commit."
+            exit 1
+          fi
 
   # Run acceptance tests in a matrix with Terraform CLI versions
   test:

docs/resources/license.md

@@ -4,19 +4,29 @@ page_title: "coderd_license Resource - terraform-provider-coderd"
 subcategory: ""
 description: |-
   A license for a Coder deployment.
-  It's recommended to create multiple instances of this resource when updating a license. Modifying an existing license will cause the resource to be replaced, which may result in a brief unlicensed period.
+  It's recommended to set create_before_destroy https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#create_before_destroy on license resources. Without setting this, Terraform will remove the old license before adding the updated license. This will result in a temporary disruption to your users; during which they may be unable to use features that require a license.
   Terraform does not guarantee this resource will be created before other resources or attributes that require a licensed deployment. The depends_on meta-argument is instead recommended.
 ---
 
 # coderd_license (Resource)
 
 A license for a Coder deployment.
 
-It's recommended to create multiple instances of this resource when updating a license. Modifying an existing license will cause the resource to be replaced, which may result in a brief unlicensed period.
+It's recommended to set [`create_before_destroy`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#create_before_destroy) on license resources. Without setting this, Terraform will remove the old license before adding the updated license. This will result in a temporary disruption to your users; during which they may be unable to use features that require a license.
 
 Terraform does not guarantee this resource will be created before other resources or attributes that require a licensed deployment. The `depends_on` meta-argument is instead recommended.
 
+## Example Usage
 
+```terraform
+resource "coderd_license" "license" {
+  license = "<…>"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema

docs/resources/provisioner_key.md

@@ -0,0 +1,29 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "coderd_provisioner_key Resource - terraform-provider-coderd"
+subcategory: ""
+description: |-
+  A provisioner key for a Coder deployment.
+---
+
+# coderd_provisioner_key (Resource)
+
+A provisioner key for a Coder deployment.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the key.
+- `organization_id` (String) The organization that provisioners connected with this key will be connected to.
+
+### Optional
+
+- `tags` (Map of String) The tags that provisioners connected with this key will accept jobs for.
+
+### Read-Only
+
+- `key` (String, Sensitive) The acquired provisioner key

examples/resources/coderd_license/resource.tf

@@ -0,0 +1,7 @@
+resource "coderd_license" "license" {
+  license = "<…>"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/docker/docker v27.2.1+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/terraform-plugin-docs v0.19.4
+	github.com/hashicorp/terraform-plugin-docs v0.20.0
 	github.com/hashicorp/terraform-plugin-framework v1.13.0
 	github.com/hashicorp/terraform-plugin-framework-validators v0.15.0
 	github.com/hashicorp/terraform-plugin-go v0.25.0
@@ -40,7 +40,7 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
@@ -83,7 +83,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.22.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.21.0 // indirect
-	github.com/hashicorp/terraform-json v0.22.1 // indirect
+	github.com/hashicorp/terraform-json v0.23.0 // indirect
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.34.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
@@ -133,7 +133,7 @@ require (
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/yuin/goldmark v1.7.4 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
 	github.com/zclconf/go-cty v1.15.0 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect

go.sum

@@ -62,8 +62,8 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
 github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
-github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
+github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bool64/shared v0.1.5 h1:fp3eUhBsrSjNCQPcSdQqZxxh9bBwrYiZ+zOKFkM0/2E=
 github.com/bool64/shared v0.1.5/go.mod h1:081yz68YC9jeFB3+Bbmno2RFWvGKv1lPKkMP6MHJlPs=
 github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
@@ -249,10 +249,10 @@ github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/terraform-exec v0.21.0 h1:uNkLAe95ey5Uux6KJdua6+cv8asgILFVWkd/RG0D2XQ=
 github.com/hashicorp/terraform-exec v0.21.0/go.mod h1:1PPeMYou+KDUSSeRE9szMZ/oHf4fYUmB923Wzbq1ICg=
-github.com/hashicorp/terraform-json v0.22.1 h1:xft84GZR0QzjPVWs4lRUwvTcPnegqlyS7orfb5Ltvec=
-github.com/hashicorp/terraform-json v0.22.1/go.mod h1:JbWSQCLFSXFFhg42T7l9iJwdGXBYV8fmmD6o/ML4p3A=
-github.com/hashicorp/terraform-plugin-docs v0.19.4 h1:G3Bgo7J22OMtegIgn8Cd/CaSeyEljqjH3G39w28JK4c=
-github.com/hashicorp/terraform-plugin-docs v0.19.4/go.mod h1:4pLASsatTmRynVzsjEhbXZ6s7xBlUw/2Kt0zfrq8HxA=
+github.com/hashicorp/terraform-json v0.23.0 h1:sniCkExU4iKtTADReHzACkk8fnpQXrdD2xoR+lppBkI=
+github.com/hashicorp/terraform-json v0.23.0/go.mod h1:MHdXbBAbSg0GvzuWazEGKAn/cyNfIB7mN6y7KJN6y2c=
+github.com/hashicorp/terraform-plugin-docs v0.20.0 h1:ox7rm1FN0dVZaJBUzkVVh10R1r3+FeMQWL0QopQ9d7o=
+github.com/hashicorp/terraform-plugin-docs v0.20.0/go.mod h1:A/+4SVMdAkQYtIBtaxV0H7AU862TxVZk/hhKaMDQB6Y=
 github.com/hashicorp/terraform-plugin-framework v1.13.0 h1:8OTG4+oZUfKgnfTdPTJwZ532Bh2BobF4H+yBiYJ/scw=
 github.com/hashicorp/terraform-plugin-framework v1.13.0/go.mod h1:j64rwMGpgM3NYXTKuxrCnyubQb/4VKldEKlcG8cvmjU=
 github.com/hashicorp/terraform-plugin-framework-validators v0.15.0 h1:RXMmu7JgpFjnI1a5QjMCBb11usrW2OtAG+iOTIj5c9Y=
@@ -413,8 +413,8 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
@@ -489,8 +489,8 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.4 h1:BDXOHExt+A7gwPCJgPIIq7ENvceR7we7rOS9TNoLZeg=
-github.com/yuin/goldmark v1.7.4/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
+github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
+github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
 github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
 github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ=

internal/provider/license_resource.go

@@ -39,9 +39,12 @@ func (r *LicenseResource) Metadata(ctx context.Context, req resource.MetadataReq
 
 func (r *LicenseResource) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
 	resp.Schema = schema.Schema{
-		MarkdownDescription: "A license for a Coder deployment.\n\nIt's recommended to create multiple instances of this " +
-			"resource when updating a license. Modifying an existing license will cause the resource to be replaced, " +
-			"which may result in a brief unlicensed period.\n\n" +
+		MarkdownDescription: "A license for a Coder deployment.\n\nIt's recommended to set " +
+			"[`create_before_destroy`](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#create_before_destroy) " +
+			"on license resources. Without setting this, Terraform will remove the old " +
+			"license before adding the updated license. This will result in a temporary " +
+			"disruption to your users; during which they may be unable to use features " +
+			"that require a license.\n\n" +
 			"Terraform does not guarantee this resource " +
 			"will be created before other resources or attributes that require a licensed deployment. " +
 			"The `depends_on` meta-argument is instead recommended.",

internal/provider/license_resource_test.go

@@ -24,7 +24,7 @@ func TestAccLicenseResource(t *testing.T) {
 		t.Skip("No license found for license resource tests, skipping")
 	}
 
-	cfg1 := testAccLicenseResourceconfig{
+	cfg1 := testAccLicenseResourceConfig{
 		URL:     client.URL.String(),
 		Token:   client.SessionToken(),
 		License: license,
@@ -42,13 +42,13 @@ func TestAccLicenseResource(t *testing.T) {
 	})
 }
 
-type testAccLicenseResourceconfig struct {
+type testAccLicenseResourceConfig struct {
 	URL     string
 	Token   string
 	License string
 }
 
-func (c testAccLicenseResourceconfig) String(t *testing.T) string {
+func (c testAccLicenseResourceConfig) String(t *testing.T) string {
 	t.Helper()
 	tpl := `
 provider coderd {

internal/provider/organization_resource.go

@@ -165,7 +165,13 @@ func (r *OrganizationResource) Create(ctx context.Context, req resource.CreateRe
 		return
 	}
 
-	tflog.Trace(ctx, "creating organization")
+	tflog.Trace(ctx, "creating organization", map[string]any{
+		"id":           data.ID.ValueUUID(),
+		"name":         data.Name.ValueString(),
+		"display_name": data.DisplayName.ValueString(),
+		"description":  data.Description.ValueString(),
+		"icon":         data.Icon.ValueString(),
+	})
 	org, err := r.Client.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
 		Name:        data.Name.ValueString(),
 		DisplayName: data.DisplayName.ValueString(),
@@ -177,7 +183,11 @@ func (r *OrganizationResource) Create(ctx context.Context, req resource.CreateRe
 		return
 	}
 	tflog.Trace(ctx, "successfully created organization", map[string]any{
-		"id": org.ID,
+		"id":           org.ID,
+		"name":         org.Name,
+		"display_name": org.DisplayName,
+		"description":  org.Description,
+		"icon":         org.Icon,
 	})
 	// Fill in `ID` since it must be "computed".
 	data.ID = UUIDValue(org.ID)
@@ -202,12 +212,12 @@ func (r *OrganizationResource) Update(ctx context.Context, req resource.UpdateRe
 	// Update the organization metadata
 	tflog.Trace(ctx, "updating organization", map[string]any{
 		"id":               orgID,
-		"new_name":         data.Name,
-		"new_display_name": data.DisplayName,
-		"new_description":  data.Description,
-		"new_icon":         data.Icon,
+		"new_name":         data.Name.ValueString(),
+		"new_display_name": data.DisplayName.ValueString(),
+		"new_description":  data.Description.ValueString(),
+		"new_icon":         data.Icon.ValueString(),
 	})
-	_, err := r.Client.UpdateOrganization(ctx, orgID.String(), codersdk.UpdateOrganizationRequest{
+	org, err := r.Client.UpdateOrganization(ctx, orgID.String(), codersdk.UpdateOrganizationRequest{
 		Name:        data.Name.ValueString(),
 		DisplayName: data.DisplayName.ValueString(),
 		Description: data.Description.ValueStringPointer(),
@@ -217,7 +227,14 @@ func (r *OrganizationResource) Update(ctx context.Context, req resource.UpdateRe
 		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to update organization %s, got error: %s", orgID, err))
 		return
 	}
-	tflog.Trace(ctx, "successfully updated organization")
+
+	tflog.Trace(ctx, "successfully updated organization", map[string]any{
+		"id":           orgID,
+		"name":         org.Name,
+		"display_name": org.DisplayName,
+		"description":  org.Description,
+		"icon":         org.Icon,
+	})
 
 	if data.GroupSync.IsNull() {
 		err = r.patchGroupSync(ctx, orgID, data.GroupSync)
@@ -242,14 +259,18 @@ func (r *OrganizationResource) Delete(ctx context.Context, req resource.DeleteRe
 	orgID := data.ID.ValueUUID()
 
 	tflog.Trace(ctx, "deleting organization", map[string]any{
-		"id": orgID,
+		"id":   orgID,
+		"name": data.Name.ValueString(),
 	})
 	err := r.Client.DeleteOrganization(ctx, orgID.String())
 	if err != nil {
 		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to delete organization %s, got error: %s", orgID, err))
 		return
 	}
-	tflog.Trace(ctx, "successfully deleted organization")
+	tflog.Trace(ctx, "successfully deleted organization", map[string]any{
+		"id":   orgID,
+		"name": data.Name.ValueString(),
+	})
 
 	// Read Terraform prior state data into the model
 	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)

internal/provider/organization_resource_test.go

@@ -61,6 +61,7 @@ func TestAccOrganizationResource(t *testing.T) {
 					ResourceName:      "coderd_organization.test",
 					ImportState:       true,
 					ImportStateVerify: true,
+					ImportStateId:     *cfg1.Name,
 				},
 				// Update and Read
 				{

internal/provider/provider.go

@@ -139,6 +139,7 @@ func (p *CoderdProvider) Resources(ctx context.Context) []func() resource.Resour
 		NewWorkspaceProxyResource,
 		NewLicenseResource,
 		NewOrganizationResource,
+		NewProvisionerKeyResource,
 	}
 }
 

internal/provider/provisioner_key_resource.go

@@ -0,0 +1,154 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/mapplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// Ensure provider defined types fully satisfy framework interfaces.
+var _ resource.Resource = &ProvisionerKeyResource{}
+
+func NewProvisionerKeyResource() resource.Resource {
+	return &ProvisionerKeyResource{}
+}
+
+// ProvisionerKeyResource defines the resource implementation.
+type ProvisionerKeyResource struct {
+	*CoderdProviderData
+}
+
+// ProvisionerKeyResourceModel describes the resource data model.
+type ProvisionerKeyResourceModel struct {
+	OrganizationID UUID         `tfsdk:"organization_id"`
+	Name           types.String `tfsdk:"name"`
+	Tags           types.Map    `tfsdk:"tags"`
+	Key            types.String `tfsdk:"key"`
+}
+
+func (r *ProvisionerKeyResource) Metadata(ctx context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_provisioner_key"
+}
+
+func (r *ProvisionerKeyResource) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "A provisioner key for a Coder deployment.",
+
+		Attributes: map[string]schema.Attribute{
+			"organization_id": schema.StringAttribute{
+				CustomType:          UUIDType,
+				MarkdownDescription: "The organization that provisioners connected with this key will be connected to.",
+				Required:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"name": schema.StringAttribute{
+				MarkdownDescription: "The name of the key.",
+				Required:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"tags": schema.MapAttribute{
+				MarkdownDescription: "The tags that provisioners connected with this key will accept jobs for.",
+				ElementType:         types.StringType,
+				Optional:            true,
+				PlanModifiers: []planmodifier.Map{
+					mapplanmodifier.RequiresReplace(),
+				},
+			},
+			"key": schema.StringAttribute{
+				MarkdownDescription: "The acquired provisioner key",
+				Computed:            true,
+				Sensitive:           true,
+			},
+		},
+	}
+}
+
+func (r *ProvisionerKeyResource) Configure(ctx context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	// Prevent panic if the provider has not been configured.
+	if req.ProviderData == nil {
+		return
+	}
+
+	data, ok := req.ProviderData.(*CoderdProviderData)
+
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Resource Configure Type",
+			fmt.Sprintf("Expected *CoderdProviderData, got: %T. Please report this issue to the provider developers.", req.ProviderData),
+		)
+
+		return
+	}
+
+	r.CoderdProviderData = data
+}
+
+func (r *ProvisionerKeyResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	// Read Terraform plan data into the model
+	var data ProvisionerKeyResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var tags map[string]string
+	resp.Diagnostics.Append(data.Tags.ElementsAs(ctx, &tags, false)...)
+	createKeyResult, err := r.Client.CreateProvisionerKey(ctx, data.OrganizationID.ValueUUID(), codersdk.CreateProvisionerKeyRequest{
+		Name: data.Name.ValueString(),
+		Tags: tags,
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to create provisioner_key, got error: %s", err))
+		return
+	}
+
+	data.Key = types.StringValue(createKeyResult.Key)
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+func (r *ProvisionerKeyResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	// Read Terraform prior state data into the model
+	var data ProvisionerKeyResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Provisioner keys are immutable, no reading necessary.
+
+	// Save updated data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+func (r *ProvisionerKeyResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	// Provisioner keys are immutable, updating is always invalid.
+	resp.Diagnostics.AddError("Invalid Update", "Terraform is attempting to update a resource which must be replaced")
+}
+
+func (r *ProvisionerKeyResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	// Read Terraform prior state data into the model
+	var data ProvisionerKeyResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	err := r.Client.DeleteProvisionerKey(ctx, data.OrganizationID.ValueUUID(), data.Name.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to delete provisionerkey, got error: %s", err))
+		return
+	}
+}

internal/provider/provisioner_key_resource_test.go

@@ -0,0 +1,114 @@
+package provider
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"text/template"
+
+	"github.com/coder/terraform-provider-coderd/integration"
+	"github.com/google/uuid"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccProvisionerKeyResource(t *testing.T) {
+	if os.Getenv("TF_ACC") == "" {
+		t.Skip("Acceptance tests are disabled.")
+	}
+	ctx := context.Background()
+	client := integration.StartCoder(ctx, t, "provisioner_key_acc", true)
+	orgs, err := client.Organizations(ctx)
+	require.NoError(t, err)
+	firstOrg := orgs[0].ID
+
+	cfg1 := testAccProvisionerKeyResourceConfig{
+		URL:   client.URL.String(),
+		Token: client.SessionToken(),
+
+		OrganizationID: firstOrg,
+		Name:           "example-provisioner-key",
+	}
+
+	cfg2 := cfg1
+	cfg2.Tags = map[string]string{
+		"wibble": "wobble",
+	}
+
+	cfg3 := cfg2
+	cfg3.Name = "different-provisioner-key"
+
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:               true,
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: cfg1.String(t),
+			},
+			{
+				Config: cfg2.String(t),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("coderd_provisioner_key.test", plancheck.ResourceActionReplace),
+					},
+				},
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue("coderd_provisioner_key.test", tfjsonpath.New("tags").AtMapKey("wibble"), knownvalue.StringExact("wobble")),
+				},
+			},
+			{
+				Config: cfg3.String(t),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("coderd_provisioner_key.test", plancheck.ResourceActionReplace),
+					},
+				},
+			},
+		},
+	})
+}
+
+type testAccProvisionerKeyResourceConfig struct {
+	URL   string
+	Token string
+
+	OrganizationID uuid.UUID
+	Name           string
+	Tags           map[string]string
+}
+
+func (c testAccProvisionerKeyResourceConfig) String(t *testing.T) string {
+	t.Helper()
+
+	tpl := `
+provider coderd {
+	url   = "{{.URL}}"
+	token = "{{.Token}}"
+}
+
+resource "coderd_provisioner_key" "test" {
+	organization_id = "{{.OrganizationID}}"
+	name            = "{{.Name}}"
+
+	tags = {
+		{{- range $key, $value := .Tags}}
+		{{$key}} = "{{$value}}"
+		{{- end}}
+	}
+}
+`
+
+	buf := strings.Builder{}
+	tmpl, err := template.New("provisionerKeyResource").Parse(tpl)
+	require.NoError(t, err)
+
+	err = tmpl.Execute(&buf, c)
+	require.NoError(t, err)
+	return buf.String()
+}

internal/provider/template_resource_test.go

@@ -424,7 +424,7 @@ func TestAccTemplateResourceEnterprise(t *testing.T) {
 		t.Skip("Acceptance tests are disabled.")
 	}
 	ctx := context.Background()
-	client := integration.StartCoder(ctx, t, "template_acc", true)
+	client := integration.StartCoder(ctx, t, "template_resource_acc", true)
 	firstUser, err := client.User(ctx, codersdk.Me)
 	require.NoError(t, err)
 
@@ -565,7 +565,7 @@ func TestAccTemplateResourceAGPL(t *testing.T) {
 		t.Skip("Acceptance tests are disabled.")
 	}
 	ctx := context.Background()
-	client := integration.StartCoder(ctx, t, "template_acc", false)
+	client := integration.StartCoder(ctx, t, "template_resource_agpl_acc", false)
 	firstUser, err := client.User(ctx, codersdk.Me)
 	require.NoError(t, err)
 
@@ -689,7 +689,7 @@ resource "coderd_template" "sample" {
 }`
 
 	ctx := context.Background()
-	client := integration.StartCoder(ctx, t, "template_acc", false)
+	client := integration.StartCoder(ctx, t, "template_resource_variables_acc", false)
 
 	cfg = fmt.Sprintf(cfg, client.URL.String(), client.SessionToken())