Register the durable extension resource

Assemble the reviewed extension lifecycle helpers behind a Terraform Plugin Framework resource, require local archive inputs only for create or replacement, and publish generated schema documentation. This makes the durable extension surface usable while keeping runtime operations out of Terraform.

Author: IlyaasK

docs/resources/extension.md

@@ -0,0 +1,29 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "kernel_extension Resource - Kernel"
+subcategory: ""
+description: |-
+  Kernel uploaded extension durable configuration.
+---
+
+# kernel_extension (Resource)
+
+Kernel uploaded extension durable configuration.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.
+
+- `name` (String) Optional extension name. Must be unique within the project. Adding or changing a configured name replaces the extension; omitting it preserves the remote name because the API cannot clear a name.
+- `project_id` (String) Project this extension belongs to. Defaults to the provider `project_id` when unset; when neither is set, the API key's project binding determines the project. Adding or changing it replaces the extension.
+- `source_path` (String, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Local path to the extension ZIP. Required when creating or replacing the extension and never stored in Terraform plan or state artifacts. Requires Terraform 1.11 or later.
+- `source_sha256` (String) Lowercase hexadecimal SHA-256 checksum of the exact extension ZIP bytes. Configure with `filesha256(source_path)`. Adding or changing it replaces the extension.
+
+### Read-Only
+
+- `id` (String) Unique extension identifier.

internal/provider/provider.go

@@ -7,12 +7,13 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/provider"
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
-	"github.com/kernel/terraform-provider-kernel/internal/datasources/extension"
+	extensiondatasource "github.com/kernel/terraform-provider-kernel/internal/datasources/extension"
 	"github.com/kernel/terraform-provider-kernel/internal/datasources/profile"
 	projectdatasource "github.com/kernel/terraform-provider-kernel/internal/datasources/project"
 	"github.com/kernel/terraform-provider-kernel/internal/datasources/proxy"
 	"github.com/kernel/terraform-provider-kernel/internal/kernelclient"
 	"github.com/kernel/terraform-provider-kernel/internal/resources/browserpool"
+	extensionresource "github.com/kernel/terraform-provider-kernel/internal/resources/extension"
 	projectresource "github.com/kernel/terraform-provider-kernel/internal/resources/project"
 )
 
@@ -82,6 +83,7 @@ func (p *kernelProvider) Configure(ctx context.Context, req provider.ConfigureRe
 func (p *kernelProvider) Resources(ctx context.Context) []func() resource.Resource {
 	return []func() resource.Resource{
 		browserpool.NewResource,
+		extensionresource.NewResource,
 		projectresource.NewResource,
 	}
 }
@@ -91,6 +93,6 @@ func (p *kernelProvider) DataSources(ctx context.Context) []func() datasource.Da
 		projectdatasource.NewDataSource,
 		profile.NewDataSource,
 		proxy.NewDataSource,
-		extension.NewDataSource,
+		extensiondatasource.NewDataSource,
 	}
 }

internal/provider/provider_test.go

@@ -34,8 +34,8 @@ func TestProviderRegistersResources(t *testing.T) {
 	p := provider.New("test")()
 
 	resources := p.Resources(context.Background())
-	if len(resources) != 2 {
-		t.Fatalf("Resources length = %d, want 2", len(resources))
+	if len(resources) != 3 {
+		t.Fatalf("Resources length = %d, want 3", len(resources))
 	}
 
 	got := make(map[string]bool, len(resources))
@@ -49,7 +49,7 @@ func TestProviderRegistersResources(t *testing.T) {
 		got[resp.TypeName] = true
 	}
 
-	for _, want := range []string{"kernel_browser_pool", "kernel_project"} {
+	for _, want := range []string{"kernel_browser_pool", "kernel_extension", "kernel_project"} {
 		if !got[want] {
 			t.Fatalf("missing resource %s; got %v", want, got)
 		}

internal/resources/extension/framework_resource_test.go

@@ -0,0 +1,82 @@
+package extension
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/kernel/terraform-provider-kernel/internal/kernelclient"
+)
+
+var _ extensionClient = kernelclient.Clients{}
+
+func TestExtensionResourceMetadataAndSchema(t *testing.T) {
+	t.Parallel()
+
+	r := NewResource()
+	var metadata resource.MetadataResponse
+	r.Metadata(context.Background(), resource.MetadataRequest{ProviderTypeName: "kernel"}, &metadata)
+	if metadata.TypeName != "kernel_extension" {
+		t.Fatalf("type name = %q, want kernel_extension", metadata.TypeName)
+	}
+
+	var schema resource.SchemaResponse
+	r.Schema(context.Background(), resource.SchemaRequest{}, &schema)
+	for _, name := range []string{"id", "name", "project_id", "source_path", "source_sha256"} {
+		if _, ok := schema.Schema.Attributes[name]; !ok {
+			t.Fatalf("extension schema missing %s attribute", name)
+		}
+	}
+}
+
+func TestExtensionResourceConfigure(t *testing.T) {
+	t.Parallel()
+
+	t.Run("durable client", func(t *testing.T) {
+		t.Parallel()
+		r := &extensionResource{}
+		var resp resource.ConfigureResponse
+		r.Configure(context.Background(), resource.ConfigureRequest{ProviderData: kernelclient.Clients{}}, &resp)
+		if resp.Diagnostics.HasError() {
+			t.Fatalf("unexpected diagnostics: %v", resp.Diagnostics)
+		}
+		if r.client == nil {
+			t.Fatal("extension client was not configured")
+		}
+	})
+
+	t.Run("unexpected provider data", func(t *testing.T) {
+		t.Parallel()
+		r := &extensionResource{}
+		var resp resource.ConfigureResponse
+		r.Configure(context.Background(), resource.ConfigureRequest{ProviderData: "not a client"}, &resp)
+		if len(resp.Diagnostics) != 1 || resp.Diagnostics[0].Summary() != "Unexpected Kernel Client Type" {
+			t.Fatalf("diagnostics = %v, want Unexpected Kernel Client Type", resp.Diagnostics)
+		}
+	})
+
+	t.Run("nil provider data", func(t *testing.T) {
+		t.Parallel()
+		r := &extensionResource{}
+		var resp resource.ConfigureResponse
+		r.Configure(context.Background(), resource.ConfigureRequest{}, &resp)
+		if resp.Diagnostics.HasError() {
+			t.Fatalf("unexpected diagnostics: %v", resp.Diagnostics)
+		}
+		if r.client != nil {
+			t.Fatal("nil provider data configured a client")
+		}
+	})
+}
+
+func TestExtensionResourceRejectsUpdate(t *testing.T) {
+	t.Parallel()
+
+	r := &extensionResource{}
+	var resp resource.UpdateResponse
+	r.Update(context.Background(), resource.UpdateRequest{}, &resp)
+
+	if len(resp.Diagnostics) != 1 || resp.Diagnostics[0].Summary() != "Unexpected Kernel Extension Update" {
+		t.Fatalf("diagnostics = %v, want Unexpected Kernel Extension Update", resp.Diagnostics)
+	}
+}

internal/resources/extension/modify_plan.go

@@ -0,0 +1,61 @@
+package extension
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func modifyExtensionPlan(ctx context.Context, req resource.ModifyPlanRequest, resp *resource.ModifyPlanResponse) {
+	if req.Plan.Raw.IsNull() {
+		return
+	}
+
+	var config extensionModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &config)...)
+	var plan extensionModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	requiresArchive := req.State.Raw.IsNull()
+	if !requiresArchive {
+		var state extensionModel
+		resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+		requiresArchive = extensionReplacementPlanned(state, plan)
+	}
+	if !requiresArchive {
+		return
+	}
+
+	if config.SourcePath.IsNull() {
+		resp.Diagnostics.AddAttributeError(
+			path.Root("source_path"),
+			"Missing Extension Source Path",
+			"source_path must be configured when creating or replacing a Kernel extension.",
+		)
+	}
+	if config.SourceSHA256.IsNull() {
+		resp.Diagnostics.AddAttributeError(
+			path.Root("source_sha256"),
+			"Missing Extension Source Checksum",
+			"source_sha256 must be configured when creating or replacing a Kernel extension. Use filesha256(source_path) to track the exact archive bytes.",
+		)
+	}
+}
+
+func extensionReplacementPlanned(state, plan extensionModel) bool {
+	return extensionStringChanged(state.Name, plan.Name) ||
+		extensionStringChanged(state.ProjectID, plan.ProjectID) ||
+		extensionStringChanged(state.SourceSHA256, plan.SourceSHA256)
+}
+
+func extensionStringChanged(state, plan types.String) bool {
+	return !state.Equal(plan)
+}