Respect PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION in the dynamic provider loader - #3564
Open
DwaineSaunderson wants to merge 1 commit into
Open
Conversation
…ovider loader On a plugin cache miss, the dynamic provider loader downloaded the requested Terraform provider from the registry, which performs terraform-svchost discovery (a genuine outbound HTTP call). This happened even when the user set PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION, since that variable previously only gated Pulumi's own plugin-binary acquisition in the engine. Honor the variable in getProviderServer: on a cache miss with acquisition disabled, fail fast with an actionable error instead of contacting the registry. This matches user expectations in air-gapped and hermetic environments. The variable is already inherited by provider plugins, which the engine launches with os.Environ(), so no additional forwarding is required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
When the dynamic bridge loads a named Terraform provider and the requested
version is not present in the local plugin cache,
getProviderServerdownloadsit from the registry. That download performs
terraform-svchostdiscovery,which is a genuine outbound HTTP call.
This happened even when the user set
PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION,because that variable previously only gated Pulumi's own plugin-binary
acquisition in the engine — it never reached the dynamic bridge's Terraform
provider download path. In air-gapped or hermetic environments this is
surprising: setting the variable is expected to prevent automatic network
acquisition entirely.
Change
Honor
PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITIONingetProviderServer. On acache miss with acquisition disabled, fail fast with an actionable error instead
of contacting the registry.
The variable is already inherited by provider plugins — the engine launches them
with
os.Environ()(sdk/go/common/resource/plugin/plugin.go) — so noadditional forwarding is required; the guard reads it inside the plugin process
where the download occurs.
Behavior is unchanged when the variable is unset, and cached providers continue
to load regardless of the variable.
Testing
TestGetProviderServerDisablesAutomaticAcquisitionforces acache miss with the variable set and asserts an error is returned; the test
provides no network access, so a regression would surface as a registry-reach
attempt.
gofmt -s,go build ./dynamic/...,golangci-lint run ./dynamic/internal/shim/run/...(0 issues), and the dynamic unit tests all pass.