runr_runtime_patches (Data Source)

A project's runtime patch state (runtime patches): the patch its deployment runs, the newest one, the pin and the newest patches of its runtime version. A report to read, e.g. for checks or outputs.

Applying, pinning and unpinning a patch stay actions (runr projects patch apply|pin|unpin): a pin names one of the five newest patches of a feed that keeps moving, and RunR itself lifts or sets pins when a critical or zero-day deadline passes, so a pin declared in Terraform would fight RunR.

Example Usage#

data "runr_runtime_patches" "api" {
  project_id = runr_project.api.id
}

# Fail the plan while the project runs behind a critical patch past its deadline.
check "runtime_patch" {
  assert {
    condition     = data.runr_runtime_patches.api.state != "overdue"
    error_message = "orders-api runs behind ${data.runr_runtime_patches.api.latest.tag}: run `runr projects patch apply orders-api`."
  }
}

Schema#

Required#

• project_id (String) Project id.

Read-Only#

• auto_migrate (Boolean) RunR moves projects onto critical / zero-day patches at their deadline.
• current (Attributes) The patch the live deployment runs. (see below for nested schema)
• deadline_at (String) Earliest critical / zero-day deadline of those patches.
• deployed (Boolean) The project has a live deployment.
• keep (Number) How many of the newest patches a project can be pinned to.
• latest (Attributes) The newest patch of the project's runtime version. (see below for nested schema)
• level (String) Most urgent level of the patches the project runs behind.
• patches (Attributes List) The newest patches of the project's runtime version, newest first. (see below for nested schema)
• pending (List of String) Ids of the newer patches the project does not run yet.
• pin (Attributes) The patch the project is pinned to; null without a pin. (see below for nested schema)
• state (String) up_to_date, patch_available, pinned or overdue (a critical / zero-day deadline passed); null when no patch concerns the project (a container project, a runtime version without patches).

Nested Schema for current#

Read-Only:

• digest (String) Image digest.
• id (String) Patch id (null for a digest deployed before patches were known).
• level (String) routine, security, critical or zero-day.
• published_at (String) When the patch was published.
• tag (String) Patch tag, e.g. exec-php:8.3.36-r1.

Nested Schema for latest#

Read-Only:

• digest (String) Image digest.
• id (String) Patch id (null for a digest deployed before patches were known).
• level (String) routine, security, critical or zero-day.
• published_at (String) When the patch was published.
• tag (String) Patch tag, e.g. exec-php:8.3.36-r1.

Nested Schema for patches#

Read-Only:

• cves (List of String) CVEs it fixes.
• deadline_at (String) Deadline of a critical / zero-day patch.
• digest (String) Image digest.
• id (String) Patch id.
• image (String) Image.
• level (String) routine, security, critical or zero-day.
• published_at (String) When it was published.
• reason (String) Why it came.
• tag (String) Patch tag.
• url (String) Release notes.

Nested Schema for pin#

Read-Only:

• available (Boolean) Still one of the newest patches (else the next deploy uses the newest).
• by (String) Who pinned it (runr for the pin of a rolled-back automatic migration).
• digest (String) Image digest.
• id (String) Patch id.
• tag (String) Patch tag.