OpenTofu Provider for UDS (Unified Defense Stack)

Manage UDS resources with OpenTofu. Currently, the provider supports deploying and managing UDS packages.

Warning

This provider is an alpha release. Its interfaces and behavior may change between releases, including breaking changes.

Installation

Provider releases are available from the OpenTofu Registry and Terraform Registry.

Usage

terraform {
  required_providers {
    uds = {
      source  = "defenseunicorns/uds"
      version = "~> 0.5.1" # x-release-please-version
    }
  }
}

resource "uds_package" "init" {
  source = "oci://ghcr.io/zarf-dev/packages/init:v0.83.0"

  # init is keyless-signed. This example skips verification for brevity.
  signature_verification = {
    verify = false
  }
}

resource "uds_package" "dos_games" {
  depends_on = [uds_package.init]
  source     = "oci://ghcr.io/zarf-dev/packages/dos-games:1.3.0"
  namespace  = "demo"

  # dos-games is key-signed. This example skips verification for brevity.
  signature_verification = {
    verify = false
  }
}

tofu init
tofu plan
tofu apply

Logging

Provider and Zarf output is emitted through OpenTofu's provider log stream rather than written directly to stdout. The following settings control that provider/OpenTofu log stream only:

• Set TF_LOG=INFO for lifecycle messages and non-muted Zarf command output.
• Set TF_LOG=DEBUG for detailed Zarf diagnostics.
• Set TF_LOG_PROVIDER=INFO or TF_LOG_PROVIDER=DEBUG to filter provider logs.
• Set TF_LOG_PATH=/absolute/path to persist logs.

Failed non-muted Zarf output is included in the normal Terraform diagnostic regardless of these log settings. Successful Zarf command output remains log-only, while muted command output remains suppressed. Raw successful Zarf command output is still subject to the logging system's filtering and persistence settings.

Documentation

• Provider configuration
• uds_package resource
• Signed package examples

Development

See CONTRIBUTING.md.

License

See LICENSE.