Document deprecated-read exceptions where no write-only sink exists
Date: 2026-07-03 Status: Accepted Decision: hl-zzmt Deciders: sean
Context
Section titled “Context”Four sink groups have no legal non-deprecated path because their downstream providers lack write-only support: Keycloak realm SMTP password and GitHub IdP client secret (keycloak provider), Cloudflare Access IdP client secret and Workers secret_text bindings (cloudflare provider, which shipped write-only on the Access field in 5.6.0 and reverted it). Forcing a substitute (e.g. the generic OIDC IdP resource for GitHub) would break functionality — GitHub is OAuth2, not OIDC.
Decision
Section titled “Decision”Four data sources stay on the deprecated read, each annotated in-code with the specific upstream provider gap. Upstream feature-request issues are filed (sanitized of internal specifics, operator-reviewed before filing); no upstream PRs for now.
Rationale
Section titled “Rationale”- Correctness over cosmetic warning removal — no substitute preserves behavior
- Explicit, auditable in-code trail of exactly where and why secrets remain in Terraform state
Alternatives Considered
Section titled “Alternatives Considered”- Documented exceptions + upstream issues (chosen): unblocks the rest of the migration now; revisit when providers ship _wo
- Force-fit substitutes (rejected): generic OIDC resource cannot replace the GitHub social IdP; no Workers secret resource exists in cloudflare v5
- Swap exception reads to vault_generic_secret (rejected): same dodge rejected repo-wide (see companion ADR)
Consequences
Section titled “Consequences”- Positive: migration completes without blocking on third-party provider roadmaps
- Negative: four sites keep secrets flowing into state indefinitely (all marked Sensitive)
- Neutral: two upstream issues tracked for re-evaluation when write-only support lands