Add deployment data source

Expose direct project-scoped deployment metadata without logs, event streams, source fields absent from the tagged SDK, or environment values.

Author: IlyaasK

.github/workflows/acceptance.yml

@@ -46,6 +46,10 @@ jobs:
             package: ./internal/datasources/app
             project_id_required: true
             app_fixture_required: true
+          - name: Deployment data source
+            package: ./internal/datasources/deployment
+            project_id_required: true
+            app_fixture_required: true
     # Keep the job timeout above the go test timeout so Go can report the test
     # timeout before the runner stops the job. Either hard timeout can bypass
     # t.Cleanup, so release operators still inspect for leaked test resources.

CHANGELOG.md

@@ -8,15 +8,15 @@ First public v1 release candidate:
 
 - Provider configuration for `api_key`, `base_url`, and `project_id`.
 - Durable `kernel_project`, `kernel_browser_pool`, and `kernel_extension` resources.
-- Lookup-only `kernel_app`, `kernel_browser_pool`, `kernel_project`, `kernel_profile`, `kernel_proxy`, and `kernel_extension` data sources.
+- Lookup-only `kernel_app`, `kernel_browser_pool`, `kernel_deployment`, `kernel_project`, `kernel_profile`, `kernel_proxy`, and `kernel_extension` data sources.
 - Stable import for every registered resource, including project-qualified browser-pool and extension forms.
 - Unit tests, generated Terraform docs, Terraform examples, CI checks, and an opt-in live acceptance matrix.
 
 Intentionally deferred from the first public v1 because their durable API, SDK, or sensitive-state contracts are incomplete:
 
 - Runtime browser/session operations such as acquire, release, flush, app invocation, screenshots, logs, live view, and force recovery.
 - API key, profile, proxy, and deployment resources.
-- API key and deployment data sources.
+- API key data source.
 - `force_destroy` browser-pool deletion.
 - Terraform Plugin Framework code generation.
 

README.md

@@ -22,6 +22,7 @@ Data sources:
 
 - `kernel_app`
 - `kernel_browser_pool`
+- `kernel_deployment`
 - `kernel_project`
 - `kernel_profile`
 - `kernel_proxy`

docs/acceptance.md

@@ -49,6 +49,7 @@ Actions secrets and must not be printed.
 | `kernel_profile` data source | Test present | A uniquely created durable profile is read by canonical ID and exact name through explicit and provider-default project scope; metadata, no-drift planning, and post-cleanup coded `not_found` are verified. | None. |
 | `kernel_proxy` data source | Test present | A uniquely created managed datacenter proxy is read by canonical ID and exact name through explicit and provider-default project scope; durable type/protocol metadata, no-drift planning, and post-cleanup coded `not_found` are verified without fixture credentials. | None. |
 | `kernel_app` data source | Test present | A release-owned running app version is read by exact name/version through explicit and provider-default project scope; canonical deployment metadata and no-drift planning are verified without invocation. Unit coverage verifies action-name and environment-key flattening without environment values. | Keep `KERNEL_ACC_APP_NAME` and `KERNEL_ACC_APP_VERSION` pointed at exactly one running app version in the acceptance project. |
+| `kernel_deployment` data source | Test present | The deployment backing the release-owned app fixture is read by canonical ID through explicit and provider-default project scope; direct GET metadata and no-drift planning are verified without logs or event streams. Unit coverage verifies that only environment variable names enter state. | Keep the release-owned app fixture running so its deployment ID remains readable. |
 | `kernel_api_key` data source | Deferred; unregistered | No provider surface yet. | Wait for a tagged SDK with exact-name filtering, then add masked ID/name lookup acceptance. |
 | Profile, proxy, deployment, and API-key resources | Deferred; unregistered | No provider surfaces yet. | Enter the matrix only after their documented API/SDK/state blockers are resolved and implementation lands. |
 
@@ -57,7 +58,7 @@ against the release commit. The release record below supplies that evidence.
 
 ## Current Commands
 
-Run the nine existing packages independently for fast failure isolation:
+Run the ten existing packages independently for fast failure isolation:
 
 ```sh
 go test -count=1 -timeout=30m -v ./internal/resources/project -run TestAcc
@@ -68,6 +69,7 @@ go test -count=1 -timeout=30m -v ./internal/datasources/extension -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/profile -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/proxy -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/app -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/datasources/deployment -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/browserpool -run TestAcc
 ```
 

docs/architecture.md

@@ -84,11 +84,12 @@ tagged SDK exposes source provenance, the API supports deterministic durable
 readback, and the write-only environment/token plus metadata-only import design
 is accepted. Its current status may be exposed only as computed inspection
 metadata: it cannot be configured, drive a diff, or be populated from an event
-stream. The `kernel_deployment` data source is limited to fields returned by a
-durable deployment GET; app name, version, and actions remain the responsibility
-of the exact-lookup `kernel_app` data source until deployment reads expose them
-directly. The resource omits `force` until the API implements and tests the
-documented overwrite behavior. `kernel_app` remains lookup-only.
+stream. The registered `kernel_deployment` data source is limited to fields the
+tagged SDK returns from a durable deployment GET; source provenance remains
+omitted until it reaches a tagged SDK. App name, version, and actions remain the
+responsibility of the exact-lookup `kernel_app` data source until deployment
+reads expose them directly. The resource omits `force` until the API implements
+and tests the documented overwrite behavior. `kernel_app` remains lookup-only.
 
 Terraform schema and model code generation remains deferred. The current tool produced valid output but did not reduce code or review complexity, and broad OpenAPI-driven generation would further weaken the durable allowlist.
 

docs/data-sources/deployment.md

@@ -0,0 +1,34 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "kernel_deployment Data Source - Kernel"
+subcategory: ""
+description: |-
+  Lookup a Kernel deployment by canonical ID without reading logs or event streams.
+---
+
+# kernel_deployment (Data Source)
+
+Lookup a Kernel deployment by canonical ID without reading logs or event streams.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `id` (String) Canonical deployment ID.
+
+### Optional
+
+- `project_id` (String) Project to look the deployment up in. Defaults to the provider `project_id`; when neither is set, the API key's project binding determines the project.
+
+### Read-Only
+
+- `created_at` (String) Deployment creation timestamp.
+- `entrypoint_rel_path` (String) Relative path to the deployed application entrypoint, if recorded.
+- `env_var_keys` (Set of String) Environment variable names configured for the deployment. Values are never exposed.
+- `region` (String) Deployment region.
+- `status` (String) Current deployment status for inspection only.
+- `status_reason` (String) Current status reason, if provided by Kernel.
+- `updated_at` (String) Deployment update timestamp, if available.

examples/README.md

@@ -18,6 +18,6 @@ Use local development overrides while the provider is unreleased. See the root [
 - [basic-browser-pool](basic-browser-pool) creates a minimal durable browser pool.
 - [design-preview-browser-pool](design-preview-browser-pool) shows a browser pool shaped for repeated design-preview checks without modeling the browser sessions themselves.
 - [extension](extension) uploads an immutable extension archive and tracks exact content changes with `filesha256`.
-- [lookups](lookups) shows read-only app, browser-pool, project, profile, proxy, and extension data sources.
+- [lookups](lookups) shows read-only app, browser-pool, deployment, project, profile, proxy, and extension data sources.
 - [project](project) creates a durable Kernel project with an explicit unique name.
 - [project-scoped-browser-pool](project-scoped-browser-pool) places a browser pool in an explicit project, overriding the provider-level `project_id` default.

examples/lookups/main.tf

@@ -73,6 +73,11 @@ data "kernel_app" "selected" {
   project_id = data.kernel_project.selected.id
 }
 
+data "kernel_deployment" "selected" {
+  id         = data.kernel_app.selected.deployment_id
+  project_id = data.kernel_project.selected.id
+}
+
 output "kernel_ids" {
   value = {
     project_id      = data.kernel_project.selected.id
@@ -81,6 +86,6 @@ output "kernel_ids" {
     proxy_id        = data.kernel_proxy.selected.id
     extension_id    = data.kernel_extension.selected.id
     app_id          = data.kernel_app.selected.id
-    deployment_id   = data.kernel_app.selected.deployment_id
+    deployment_id   = data.kernel_deployment.selected.id
   }
 }