* Add ability to parse backend blocks present in a test file's run blocks, validate configuration (#36541)
* Add ability to parse backend blocks from a run block
* Add validation to avoid multiple backend blocks across run blocks that use the same internal state file. Update tests.
* Add validation to avoid multiple backend blocks within a single run block. Update tests.
* Remove use of quotes in diagnostic messages
* Add validation to avoid backend blocks being used in plan run blocks. Update tests.
* Correct local backend blocks in new test fixtures
* Add test to show that different test files can use same backend block for same state key.
* Add validation to enforce state-storage backend types are used
* Remove TODO comment
We only need to consider one file at a time when checking if a state_key already has a backend associated with it; parallelism in `terraform test` is scoped down to individual files.
* Add validation to assert that the backend block must be in the first apply command for an internal state
* Consolidate backend block validation inside a single if statement
* Add initial version of validation that ensures a backend isn't re-used within a file
* Explicitly set the state_key at the point of parsing the config
TODO: What should be done with method (moduletest.Run).GetStateKey?
* Update test fixture now that reusing backend configs has been made invalid
* Add automated test showing validation of reused configuration blocks
* Skip test due to flakiness, minor change to test config naming
* Update test so it tolerates non-deterministic order run blocks are evaluated in
* Remove unnecessary value assignment to r.StateKey
* Replace use of GetStateKey() with accessing the state key that's now set during test config parsing
* Fix bug so that run blocks using child modules get the correct state key set at parsing time
* Update acceptance test to also cover scenario where root and child module state keys are in use
* Update test name
* Add newline to regex
* Ensure consistent place where repeat backend error is raised from
* Write leftover test state(s) to file (#36614)
* Add additional validation that the backend used in a run is a supported type (#36648)
* Prevent test run when leftover state data is present (#36685)
* `test`: Set the initial state for a state files from a backend, allow the run that defines a backend to write state to the backend (#36646)
* Allow use of backend block to set initial state for a state key
* Note about alternative place to keep 'backend factories'
* Allow the run block defining the backend to write state to it
* Fix rebase
* Change to accessing backend init functions via ContextOpts
* Add tests demonstrating how runs containing backend blocks use and update persisted state
* Fix test fixture
* Address test failure due to trouble opening the state file
This problem doesn't happen on MacOS, so I assume is due to the Linux environment of GitHub runners.
* Fix issue with paths properly
I hope
* Fix defect in test assertion
* Pivot back to approach introduced in 4afc3d7
* Let failing tests write to persistent state, add test case covering that.
I split the acceptance tests into happy/unhappy paths for this, which required some of the helper functions' declarations to be raised up to package-level.
* Change how we update internal state files, so that information about the associated backend is never lost
* Fix UpdateStateFile
* Ensure that the states map set by TestStateTransformer associates a backend with the correct run.
* Misc spelling fixes in comments and a log
* Replace state get/set functions with existing helpers (#36747)
* Replace state get/set functions with existing helpers
* Compare to string representation of state
* Compare to string representation of state
* Terraform Test: Allow skipping cleanup of entire test file or individual run blocks (#36729)
* Add validation to enforce skip_cleanup=false cannot be used with backend blocks (#36857)
* Integrate use of backend blocks in tests with skip_cleanup feature (#36848)
* Fix nil pointer error, update test to not be table-driven
* Make using a backend block implicitly set skip_cleanup to true
* Stop state artefacts being created when a backend is in use and no cleanup errors have occurred
* Return diagnostics so calling code knows if cleanup experienced issues or not
* Update tests to show that when cleanup fails a state artefact is created
* Add comment about why diag not returned
* Bug fix - actually pull in the state from the state manager!
* Split and simplify (?) tests to show the backend block can create and/or reuse prior state
* Update test to use new fixtures, assert about state artefact. Fix nil pointer
* Update test fixture in use, add guardrail for flakiness of forced error during cleanup
* Refactor so resource ID set in only one place
* Add documentation for using a `backend` block during `test` (#36832)
* Add backend as a documented block in a run block
* Add documentation about backend blocks in run blocks.
* Make the relationship between backends and state keys more clear, other improvements
* More test documentation (#36838)
* Terraform Test: cleanup command (#36847)
* Allow cleanup of states that depend on prior runs outputs (#36902)
* terraform test: refactor graph edge calculation
* create fake run block nodes during cleanup operation
* tidy up TODOs
* fix tests
* remove old changes
* Update internal/moduletest/graph/node_state_cleanup.go
Co-authored-by: Samsondeen <40821565+dsa0x@users.noreply.github.com>
* Improve diagnostics around skip_cleanup conflicts (#37385)
* Improve diagnostics around skip_cleanup conflicts
* remove unused dynamic node
* terraform test: refactor manifest file for simplicity (#37412)
* test: refactor apply and plan functions so no run block is needed
* terraform test: write and load state manifest files
* Terraform Test: Allow skipping cleanup of entire test file or individual run blocks (#36729)
* terraform test: add support for skip_cleanup attr
* terraform test: add cleanup command
* terraform test: add backend blocks
* pause
* fix tests
* remove commented code
* terraform test: make controlling destroy functionality experimental (#37419)
* address comments
* Update internal/moduletest/graph/node_state_cleanup.go
Co-authored-by: Samsondeen <40821565+dsa0x@users.noreply.github.com>
---------
Co-authored-by: Samsondeen <40821565+dsa0x@users.noreply.github.com>
* add experimental changelog entries
---------
Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>
Co-authored-by: Samsondeen <40821565+dsa0x@users.noreply.github.com>
Co-authored-by: Samsondeen Dare <samsondeen.dare@hashicorp.com>
At one point, these tests were explicitly passing an empty cli config filepath so that terraform would ignore any existing cli config file (only relevant if you are running these tests locally), but the behavior changed over time such that it was no longer working for these tests (now if the env var file path is empty, we fall back to the default). The actual behavior is reasonably correct (I've depended on passing in blank config file paths before, so I don't love it, but I don't see a need to break this either) so I've added a small method that drops a blank file in place to fix the behavior and avoid file not found errors.
* Fix S3 backend test affected by making the Workspaces method return errors via diagnostics
* Address diagnostics comparison issues in test by ensuring expected diagnostics are defined in the context of the config they're triggered by
* Fix failing test case `TestBackendConfig_EC2MetadataEndpoint/envvar_invalid_mode` by making `diagnosticBase` struct comparable
* Add compile-time checks that diagnostic types fulfil interfaces
* Stop diagnosticBase implementing ComparableDiagnostic, re-add S3-specific comparer code to s3 package
* Update tests to use the S3-specific comparer again
* Fix test case missed in refactoring
* Update the backend.Backend interface to use diagnostics as return value from StateMgr method
* Fix calls to `Fatalf`
* Add a helper for mocking a provider with a state store
* Update tests to use the new helper
* Update other test fixtures for consistency
The related tests pass before and after this change
* Update testing helper to return the underlying type, not the interface
The Resource struct didn't really match the data structure. Refactor
this to make it easier to break up the config generation calls so we can
pass in final config from the provider.
* Stop `state_store` being parsed when experiments aren't enabled
* Update tests that show the feature is experimentally gated
* Refactor to use unparsed hcl.Block for diagnostics when experiments aren't enabled
* terraform test: fix regression when running with no tests (#37475)
* added changelog entry
* move changelog entry from v1.14 to v1.13
* Return moduletest.Error instead of suite.Status if test operation is cancelled
* Add "terraform test" test with no tests
Yes, that's right. It's OK if you need to read it again.
* properly parse actions during configuration loading
* parse action expression during ActionPlanTransformer transform
* fix: properly parse action expressions (not traversals)
Previously, we were storing action and linkedResource expressions as Traversals during config loading. This PR replaces those fields with hcl.Expression, moves some validation around to account for the fact we don't have fully evaluated traversals yet (some checks have been removed entirely and will be replaced in a follow up PR, I wanted to get this right first), and finally moves the actual evaluation into the terraform graph build phase.
I added a permissive parsing of the ActionExpression during ActionPlanTransformer.transformSingle (to get the config action) and store the action expression inside the nodeActionTriggerPlanExpand.lifecycleActionTrigger so it can be fully evaluated (with access to the resource's repetition data, which is necessary if the action in the resource's lifecycle block uses count.index or for_each.key) during nodeActionTriggerPlanExpand.DynamicExpand
* Update Backend interface to use diagnostics for `DeleteWorkspace` and `Workspaces` methods
* Update testing helpers in backend package
* Update pluggable package to match interface changes
* Update builtin terraform provider package to match interface changes
* Update code in Meta-related files in command package; update error check logic
* Update workspace commands; update error check logic
* Update Local backend package to match interface changes
* Update Cloud backend to match interface changes
* Update Remote backend to match interface changes
* Update cos remote-state backend to match interface changes
* Update inmem remote-state backend to match interface changes
* Update pg remote-state backend to match interface changes
* Update http remote-state backend to match interface changes
* Update consul remote-state backend to match interface changes
* Update oss remote-state backend to match interface changes
* Update kubernetes remote-state backend to match interface changes
* Update gcs remote-state backend to match interface changes
* Update s3 remote-state backend to match interface changes
* Update oci remote-state backend to match interface changes
* Update azure remote-state backend to match interface changes
* Allow warnings from Workspaces and DeleteWorkspace methods to be logged or returned to calling code
* Fix defect in inmem backend test
* Change how warnings from workspace-related methods are output to view/ui
* Add forked version of `run` logic that's only used if experiments are enabled
* Reorder actions in experimental init - load in full config before configuring the backend.
* Add getProvidersFromConfig method, initially as an exact copy of getProviders
* Make getProvidersFromConfig not use state to get providers
* Add `appendLockedDependencies` method to `Meta` to allow multi-phase saving to the dep locks file
* Update experimental init to use new getProvidersFromConfig method
* Add new getProvidersFromState method that only accepts state information as input for getting providers. Use in experimental init and append values to existing deps lock file
* Update messages sent to view about provider download phases
* Change init to save updates to the deps lock file only once
* Make Terraform output report that a lock file _will_ be made after providers are determined from config
* Remove use of `ProviderDownloadOutcome`s
* Move repeated code into separate method
* Change provider download approach: determine if locks changed at point of attempting to update the lockfile, keep record of incomplete providers inside init command struct
* Refactor `mergeLockedDependencies` and update test
* Add comments to provider download methods
* Fix issue where incorrect message ouput to view when downloading providers
* Update `mergeLockedDependencies` method to be more generic
* Update `getProvidersFromState` method to receive in-progress config locks and merge those with any locks on file. This allows re-use of providers downloaded by `getProvidersFromConfig` in the same init command
* Fix config for `TestInit_stateStoreBlockIsExperimental`
* Improve testing of mergeLockedDependencies; state locks are always missing version constraints
* Add tests for 2 phase provider download
* Add test case to cover use of the `-upgrade` flag
* Change the message shown when a provider is reused during the second provider download step.
When downloading providers described only in the state then the provider may already be downloaded from a previous init (i.e. is recorded in the deps lock file) or downloaded during step 1 of provider download. The message here needs to cover both potential scenarios.
* Update mergeLockedDependencies comment
* fix: completely remove use of upgrade flag in getProvidersFromState
* Fix: avoid nil pointer errors by returning an empty collection of locks when there is no state
* Fix: use state store data only in diagnostic
* Change how we make PSS experimental - avoid relying on a package level variable that causes tests to interact.
* Remove full-stop in view message, update tests
* Update span names to be unique
* Re-add lost early returns
* Remove unused view messages
* Add comments to new view messages
* Pull `init` `Run` method into new method in a separate file, in preparation for adding experimental fork.
* Add license header
* Allow init args to be accessed before calling separate init run logic
* Add -enable-pss flag to the init command, to be used for accessing experimental init logic
* Fix- put call to `run` in else block!
* Make flag name more explicit
* Add an environment variable alternative to the CLI flag
* Make the panic text more user-friendly
* go fmt
* Allow backend or state_store config to be passed via BackendOpts from calling code
* Update messages sent to view: make message specific to state storage mechanism in use
* Add nil pointer check
* Fix typos
* Pivot to `Len` method approach of nil check
* Pivot to the point of pirouetting
* Store the FQN of the provider used in PSS in representations of the parsed config.
This can only be done once modules have been parsed and the required providers data is available. There are multiple places where config is parsed, into either Config or Module structs, so this needs to be implemented in multiple places.
* Update affected tests, improve error diagnostic
* Begin enabling method to return a backend.Backend made using state_store config.
State store config can now be received via BackendOpts and there is rough validation of whether the config makes sense (does the provider offer a store with the given name?).
* Update code's logic to include possibility of a state store being in use
At this point there are no cases that actually handle the state store scenarios though!
* Add empty cases for handle all broad init scenarios involving PSS
* Update default case's error to report state store variables
* Improve how we resolve the builtin terraform provider's address
* Add test that hits the code path for adding a state store to a new (or implied local) project
* Add test for use of `-reconfigure` flag; show that it hits the code path for adding a state store for the first time
* Add test that hits the code path for removing use of a state store, migrating to (implied) local backend
* Add test that hits the code path for changing a state store's configuration
* Update existing test names to be backend-specific
* Add tests that hits the code path for migrating between PSS and backends
* Consolidate PSS-related tests at end of the file
* Fix log text
* Add test showing that using variables is disallowed with state_store and nested provider blocks
* Update test name
* Fix test cases
* Add TODOs so we remember to remove experiments from tests
* Update state store-related tests to use t.Cleanup
* Remove use of `testChdir`
* Add actions to the plans and change
* jsonplan - ignoring LinkedResources for now, those are not in the MVP
* pausing here: we'll work on the plan rendering later
* Replace use of `testChdir` with `t.Chdir`
* Update tests to use temporary directories with copied content, instead of using directories in the repo directly.
* Remove stacks copy of testChdir function
This has been replaced with t.Chdir from the standard library
* Replace remaining simple usage of testChdir
* Update guidance for using `tempWorkingDir`
* Replace use of testChdir in a function reused in a single test
* Update comments to no longer recommend using testChdir
* Remove testChdir function!
* Add the ability to make a hash of state store config
* Add test demonstrating that the provider block doesn't impact the hash of a state_store block
* Make sure test asserts what would happen if the schema DID include the provider block
* Update the Hash method to return diagnostics, ignore nested provider blocks, and validate incoming schema and config
* Update tests to use more representative config, fix code under test as a result
* Update Hash method to return hashes for both the state_store and provider blocks
* Add test cases to cover how required fields are tolerated when making the hash
This is because ENVs may supply those values.
* Fix inaccurate comments
* Add test to show that hashes are consistent and exclude the provider block
* Update backend state file to contain hash of provider block's config
* Fix test to expect a hash for the provider config block.
* Fix bug in DeepCopy method, update test to have better error messages when diffs are detected
* Update test to explicitly check hash values
* Try make test intention clearer
* Improve user feedback when state store schema contains the protected word "provider"
* Update tests
* Update test to test the Hash method in a more true-to-life way
Copy of 04a1201878cd1f6f117c43c43c1ee9d0fc17cec1 by Radek Simko
* Update test to use new approach
* Fix `TestInit_stateStoreBlockIsExperimental` test failure
* Update comments to distinguish between operations and state-storage backends more clearly
* Rename `BackendOpts` field `Config` to more specific `BackendConfig`
* Add test coverage for Meta's determineInitReason method, fix error in diagnostic when migrating away from HCP Terraform
* Add godoc comment to determineInitReason method
* WIP
* Reuse plan command for query CLI
* Basic CLI output
* Only fail a list request on error
* poc: store query results in separate field
* WIP: odd mixture between JSONs
* Fix list references
* Separate JSON rendering
The structured JSON now only logs a status on which list query is
currently running. The new jsonlist package can marshal the query fields
of a plan.
* Remove matcher
* Store results in an extra struct
* Structured list result logging
* Move list result output into hooks
* Add help text and additional flag
* Disable query runs with the cloud backend for now
* Review feedback
* Implement `ForPlan` method on `StateStoreConfigState`, add `Planner` interface
* Rename `ForPlan` method to `Plan`
* Allow plan files to contain information about state stores
* Add code needed for representing a state store in the Plan struct, which is used when handling plan files
* Add ability to read/write either a backend or state store's data in a plan file. Add some test coverage.
* Update plan's `ProviderAddrs` method to include the provider used for PSS, if present
* Split interfaces
* Apply feedback from code review
* Refactor `SetVersion` to use appropriate constructor
* Split `ProviderAddrs` method test into two
* Fix method call after rename
* Fix test
* Remove change to `(p *Plan) ProviderAddrs()`
We may re-add this when we implement PSS for use during apply commands with plan files
* Remove changes to test, now that the plan doesn't report the provider used for PSS anymore.
* Add test showing that users cannot delete the default workspace
Note: in the test this validation is being returned from the local backend's `DeleteWorkspace` method, not the command itself.
* Make the `workspace delete` command return early if the user is trying to delete the default workspace. Update test.
* Clean up redundant parts of test
* Add tests defining what are valid workspace names
* Update workspace name validation to mark an empty string as not valid
* Add change file
* Add command-level test showing the "" workspace cannot be created or selected
* Update invalid name error text to include empty string as invalid.
* Split code for backend state file vs backend state
* Rename BackendState to BackendConfigState
* Spelling error
* Add `StateStorageConfigState` struct as new implementation of new `ConfigState[T any]` interface.
* Split tests for backend state file vs backend config state structs
* Rename StateStorageConfigState to StateStoreConfigState
* Clarify test name, add comments
* Add tests for StateStoreConfigState methods
* Add test showing state_store in JSON is parsed correctly
* Add detection of malformed backend state files that contain both backend and state_store fields
* Add validation that stops a backend state file being written if it will contain state for both backend and state_store blocks
* Rename `state_storage` to `state_store`
* Rename `state_storage` to `state_store` in filenames
* Move`ConfigState` to its own file
* Fix test name, remove whitespace
* Update `StateStoreConfigState` comment using review suggestion
* Update error message to no longer allude to the environment TF is being run in
* Update the state_store state to use `version.Version` and an adapted version of `tfaddr.Provider` for marshalling version and source data
* Update test helper so it doesn't accidentally supply validation in tests
* Add protection against saving an empty backend state file
* Remove direct testing of (s *Source) MarshalText() and UnmarshalText() methods
* Add Validate method to StateStoreConfigState, use in backend state encoding logic
* Refactor to use new features in registry dependency
* Enable parsing of blocks in individual files
Co-authored-by: Radek Simko <radeksimko@users.noreply.github.com>
* Enable handling of state stores when parsing a module from its constituent files.
This includes: validations of duplicates and clashes, supporting override files.
Co-authored-by: Radek Simko <radeksimko@users.noreply.github.com>
* Add tests for validation that detects conflicts between state_store blocks and others
* Add tests for state_store override behavior
* Add tests for validation that detects when conflicting state-related blocks are used, either in the same file or across separate files
* Update error message summaries to explicitly say blocks conflict
* Add small changes to assertions in state_store override tests
* Update state_store block parsing to expect scoped provider block
* Update tests following syntax change
* Make config parsing experimental
* Remove testModuleFromDirWithExperiment, as testModuleFromDirWithExperiments exists!
* Update code comment
---------
Co-authored-by: Radek Simko <radeksimko@users.noreply.github.com>
Co-authored-by: Radek Simko <radek.simko@gmail.com>
* terraform test: add variable definitions to test files
Currently, `terraform test` attempts to work out the type of any external variables by delaying evaluation until each run block executes so it can use the definitions within the run blocks's module. This means that the values of variables can technically change between run blocks which isn't ideal.
This commit is the first in a chain which will move the evaluation of variables into the terraform test graph. We need to give the users the option of specifying the type for external variables within the file as these variables are now going to be assessed outside of the context of a run block. To do this, we introduce the optional variable blocks that are added by this commit.
* update comment
* include help entry for -replace
* add to website docs as well
* Update internal/command/apply.go
Co-authored-by: Daniel Banck <dbanck@users.noreply.github.com>
* Update website/docs/cli/commands/apply.mdx
Co-authored-by: Daniel Banck <dbanck@users.noreply.github.com>
---------
Co-authored-by: Daniel Banck <dbanck@users.noreply.github.com>
* Fix defects where `done` is called before the command's `Run` method is invoked
We're attempting to reading output from a command that hasn't been executed yet!
* Another one
* configschema: Add identity attribute to import block
* Mark import target ID as legacy
* Add test with import identity
* Use ID or identity when importing via configuration
* Add plan import tests
* Review Feedback
* Make sure to copy identity for ResourceInstanceObjects
* Add helper for converting cty.Objects to string
* Replace getProvider calls
* Improve unknown object check
* Update URLs from www.terraform.io to developer.hashicorp.com
* More updates to URLs linking to documentation in documentation and user-facing warnings/errors
* More updates to URLs linking to documentation, in docs, code, test fixtures
* Replace www.terraform.io/community with link to Community Forum
* Apply suggestions from code review
Co-authored-by: Rose M Koron <32436232+rkoron007@users.noreply.github.com>
---------
Co-authored-by: Rose M Koron <32436232+rkoron007@users.noreply.github.com>
* Fix copy-pasta
* Update some comments clarifying backend-related interfaces and "enhanced" versus "operations"
* Fix more comments that refer to types and interfaces that have moved into the backendrun package
* jsonstate: Marshal identity values
* jsonstate: Test identity marshalling
* Add identity to prepareStateV4
* Check identity schema version when marshaling state
* Marshal identity for deposed resources
* Marshal identity version if `0`
* Check for missing resource identity schema
* Feat: Enhance elapsed time display in UI hook with minutes and seconds format
* changelog: improve elapsed time display in UI Hook (#36368)
* update test output to use zero-padded elapsed time format
* Add testing helpers for comparing diagnostics with different levels of stringency
* Refactor some existing tests to use the new helpers
* Replace use of diag comparison test helpers in terraform package
* Add header
* Add return statement back in ephemeral test
* Update internal/terraform/context_plan2_test.go
* Add `DiagnosticComparer` to standardize how diagnostics are compared for equality. This uses code originally in the s3 backend.
Co-authored-by: Graham Davison <gdavison@hashicorp.com>
* Refactor `test` related code to use new comparer
* Refactor `s3` related code to use new comparer
* Replace use of reflect and go-spew with new diagnostics comparison approach
* Fix whitespace
* Make `tfdiags.DiagnosticComparer` a var
* Fix DiagnosticComparer test
---------
Co-authored-by: Graham Davison <gdavison@hashicorp.com>
* Add details to `<failure>` element describing which assertion failed
* Remove unused diagnostic string
* Set `message` attribute of `<failure>` element to failed assertion's error message
* Make `<failure>` contain diagnostic's message, refactor how `message` attribute is set
* Ensure that system-err is only added when needed
* Update test fixtures
* Make diags usage clearer, ensure all test failure diags in "failure" element
* Refactor how "skipped" element value is set
* Fix failing test Test_TestJUnitXMLFile_Save
* Add ability for TestJUnitXMLFile to access data about whether the test runner was Stopped
* Add details to XML describing why a Run was skipped
* Fix wording
* Code consistency changes
* Move all JUnit-related code down to where it's used
Away from the Views section of the code where it was relevant before
* Move JUnit-related error and warning diags to above where cancellable contexts are created
* Fix wording of user feedback
* Fix test to match updated skipped message text
* Fix test
* feat: add state_alias for test run blocks
* fix: move `state_alias` to run block + rename to `state_key`
* docs: add state_key changelog entry
* docs: add state_key in run block documentation
* Revert "docs: add state_key in run block documentation"
This reverts commit ccccf62a76.
* Revert "docs: add state_key changelog entry"
This reverts commit 86e2ad8dc3.
* Promote JUnit reports for `terraform test` out of experimental status
* Make JUnit output explicitly for local execution only
* Refactor how local test runner is passed JUnit data
* Add change file
* Add test for incompatible flags
* Refactor JUnit XML output to use new concept of an Artifact
* Move JUnit-related code into new `artifact` package
* Refactor Artifact's Save method to return diagnostics, update comments
Previously TestJUnitXMLFile implemented the View interface, which cannot return errors. Now it's not a View any more we can simplify things.
* Make junitXMLTestReport output deterministic by iterating over a slice instead of a map, add test
* Provide sources to junitXMLTestReport, allowing complete error messages in the XML
We need to ensure that artifact.NewTestJUnitXMLFile is called once the config Loader is available as a non-nil pointer
* Whitespace
* Add some test coverage for JUnit XML output for `terraform test`
* Refactor how file is saved, add tests
* Move XML structs definitions outside of `junitXMLTestReport`
* Fix nil pointer bug
* Add missing file headers
* Refactor comparison of byte slices
* Rename package to `junit`, rename structs to match
* Add a test showing JUnit output when a test is skipped by the user
* Record metadata about the start timestamp for a Run/test case
* Add RFC3339 format timestamp attributes to `<testcase>` elements in JUnit XML output
* Ensure timestamps are saved as and rendered as UTC timestamps
The CLI attempts to prevent the user from inputting non-ephemeral
variables during apply which don't match the stored plan values. Since
the user can't avoid variables parsed from auto-loaded files, we have to
ignore those values.
Non-string input variables taken from the environment initially need to
be parsed and stored as string, since there is no type associated type
information. Make sure these are correctly handled when validated during
apply.
Plan allows undeclared config variables with only warnings, and that
behavior need to be carried forward to apply now that ephemeral
variables can be passed in at apply time.
