Terraform and OpenTofu

The Frazer provider, frazer-ai/frazer, manages Frazer resources from Terraform and OpenTofu. It is published in both registries and generated from the same API contracts as the CLI and the MCP server, so every declarative resource has a provider resource. What sets it apart: terraform plan asks Frazer to plan each change, so you see quota impact, policy violations and estimated cost before you apply. See Integrations for everything Frazer connects to.

How it works

• Generated. Each declarative resource of the API is a provider resource, and each one has a data source, plus a plural data source per collection that takes an AIP-160 filter. The provider’s schema is the schema of frazer apply -f YAML, so you can move between the two.
• Names are frazer_<service>_<type>, for example frazer_kubernetes_cluster, frazer_kubernetes_node_pool, frazer_network_address or frazer_dns_managed_zone. When the service ID is the plural of its main type, the type is not repeated: frazer_secret.
• One configuration, both tools. The provider uses plugin protocol 6 and only the features both tools support, so the same configuration runs with terraform and tofu. Its acceptance tests run against Frazer every night with both.

Key behaviors:

• Long-running changes are polled until done; set limits with a timeouts block.
• Etags guard every update and delete: if someone changed the resource since your last refresh, the apply fails instead of overwriting their change.
• Request IDs: each create carries one UUID, kept in state, so a retried apply never creates a resource twice.
• Soft delete and deletion_protection behave as in the API: deleting a resource keeps it restorable until its purge time, and deletion_protection refuses the delete.
• Custom actions are fields. An action such as attaching an address is a field of the resource, so a plan can converge on it.
• No false drift. Fields Frazer sets, such as a cluster’s current version, never show as drift.
• IAM comes as resources for single bindings and an authoritative resource for a whole policy; they do not fight over the same policy.

Install the provider

1. Add the provider to your configuration:

   versions.tf

   terraform {
     required_providers {
       frazer = {
         source = "frazer-ai/frazer"
       }
     }
   }
   
   provider "frazer" {}

2. Initialize the working directory. With OpenTofu, run tofu init instead:

   terraform init

Provider versions follow semantic versioning, and the major version follows the API’s major version. Ephemeral resources need Terraform 1.10 or later, or OpenTofu 1.11 or later.

Authenticate

The provider takes the first credential it finds, in this order:

1. FRAZER_TOKEN: a personal access token in the environment.
2. Your CLI sign-in: run frazer login once, then plan and apply from the same machine.
3. Workload identity federation from GitHub Actions or GitLab: the CI job’s own OIDC token becomes a 15-minute Frazer token, and a condition on its claims (repository, branch) decides which jobs may. Nothing secret is stored in CI. See Identity and access.

Tip

In CI, prefer workload identity federation to a token: there is nothing to rotate and nothing to leak.

Example: a DNS zone and a record

dns.tf

resource "frazer_dns_managed_zone" "apps" {
  project  = "acme-production"
  name     = "apps"
  dns_name = "apps.acme.example."
  dnssec { state = "ON" }
}

resource "frazer_dns_record_set" "www" {
  managed_zone = frazer_dns_managed_zone.apps.id
  name         = "www"
  type         = "A"
  ttl_seconds  = 300
  rrdatas      = ["203.0.113.10"]
}

terraform plan
terraform apply

terraform plan shows the record changes, the zone’s lint findings and the quota impact. The arguments of every resource are on its product’s page; see DNS and certificates for zones and records.

Plans: Terraform’s and Frazer’s

terraform plan compares your configuration with state. For every resource it would change, the provider also asks Frazer for a plan of that change (the API’s validate_only), so the plan shows:

• Quota impact: a warning when a counter would be at 80 % or more of its limit. A change over a limit fails at plan time with QUOTA_EXCEEDED, not halfway through an apply.
• Organization policy violations: what the change would break.
• Estimated cost of the change.

For IAM changes, Frazer’s plan also says whether access grows, shrinks or stays the same (MORE_PERMISSIVE, LESS_PERMISSIVE, EQUIVALENT or INCOMPARABLE), so a CI job can fail a pull request that would grant new access.

Frazer holds no direct change by a person or a pipeline unless a rule says so, so the pull request review stays your approval for infrastructure as code. A change that a rule does hold answers APPROVAL_REQUIRED; see Errors.

Import existing resources

Import a resource by its full resource name, with an import block:

import.tf

import {
  to = frazer_dns_managed_zone.apps
  id = "//dns.frazer.ai/projects/acme-production/managedZones/apps"
}

To bring many resources under code at once, frazer export --format=hcl writes HCL for existing resources from the same generator as the provider.

Secrets stay out of state

The provider never needs a secret in your state or plan files:

• Write-only attributes. Secret versions, connection credentials and webhook secrets take their value in value_wo. Frazer stores it, Terraform never records it, and you change value_wo_version to send a new value.
• Ephemeral resources produce short-lived values that exist only during a run. The products that offer them list them on their pages:

Ephemeral resource for	Gives you
Cluster credentials	A short-lived token for a cluster, to configure the kubernetes and helm providers
Access tokens	A short-lived Frazer access token
Secret versions	A secret’s value, for another provider that needs it

Provider functions

Function	Does
provider::frazer::resource_name()	Builds a resource name from its parts
provider::frazer::parse_resource_name()	Splits a resource name into its parts
provider::frazer::location_of()	Returns the location in a resource name

Resources

Every product’s resources and data sources, from that product’s page. Each heading links to the product’s guide with the arguments and examples.

Servers and pools

Resource	What it manages
frazer_servers_server_pool	A server pool in a host project, with its share settings.

Kubernetes

Resource	What it manages
frazer_kubernetes_cluster	A Kubernetes cluster in a project, with its release channel, maintenance policy and upgrade settings.
frazer_kubernetes_node_pool	A node pool of a cluster, placed on a server pool of the project or one shared with it.
frazer_maintenance_policy	A project's maintenance window, exclusions, order and notices, attached to clusters and node pools.
frazer_cluster_credentials	Ephemeral. A short-lived kubeconfig token for the kubernetes and helm providers.

In-memory store

Resource	What it manages
frazer_keyvalue_instance	An In-memory store instance in a project.

Secrets

Resource	What it manages
frazer_secret	A secret's metadata, folder, aliases and rotation; never its value.
frazer_secret_version	A secret version with a write-only value; as an ephemeral resource it reads a value without storing it in state.

VPC and firewall

Resource	What it manages
frazer_network_subnet	A subnet of a network at one site, with its stack type and external IPv6 range.
frazer_network_address	A reserved internal or external address.

Load balancers

Resource	What it manages
frazer_network_load_balancer	A load balancer with its frontends, address families, backends, health check and security policy.
frazer_network_security_policy	A Frazer Shield security policy and its rules.

DNS and certificates

Resource	What it manages
frazer_dns_managed_zone	A public or private zone, with its DNSSEC settings.
frazer_dns_record_set	A record set in a zone.
frazer_dns_verified_domain	A domain your organization has proved it owns.
frazer_dns_server_policy	Resolver options for networks, such as inbound forwarding.
frazer_dns_response_policy	A response policy bound to networks.
frazer_dns_response_policy_rule	A rule of a response policy.
frazer_dns_tsig_key	A TSIG key for zone transfers; the secret is write-only.
frazer_network_health_check	A health check used by DNS routing policies and load balancers.

Identity and access

Resource	What it manages
frazer_iam_service_account	A service account in a project.

Billing and budgets

Resource	What it manages
frazer_billing_budget	A budget with thresholds and an optional cap on a billing account.
frazer_quota_preference	A requested limit for a quota on a project or an organization.

Integrations

Resource	What it manages
frazer_integrations_connection	A connection to an outside service; credentials are write-only attributes.
frazer_integrations_connection_grant	Who may use a connection, for which capabilities and resources.

Webhooks and events

Resource	What it manages
frazer_integrations_webhook_endpoint	A webhook endpoint; its signing secret is a write-only attribute.

Related

• API: the resources, names and plans behind the provider
• CLI: frazer export and frazer apply -f
• Identity and access: tokens and workload identity federation
• Environments and GitOps: what runs inside your clusters, from Git
• Errors: every reason with its fix