Incus Terraform Provider

When defining the config map for an incus_project, note that certain keys are automatically managed by Incus. If you do not explicitly define these keys, they will be omitted from the Terraform state and treated as computed values:

• features.images
• features.profiles
• features.storage.volumes
• features.storage.buckets

The config map in incus_storage_pool may contain keys automatically generated by Incus. If you do not explicitly define these keys, they will be treated as computed values in the Terraform state.

Common computed keys by driver:

• dir: source
• zfs: size, source, zfs.pool_name
• lvm: size, source, lvm.vg_name, lvm.thinpool_name
• lvmcluster: size, lvm.vg_name
• linstor: source, linstor.resource_group.name, linstor.resource_group.place_count, linstor.resource_group.storage_pool, linstor.volume.prefix, drbd.auto_add_quorum_tiebreaker, drbd.on_no_quorum
• truenas: source, truenas.dataset
• General: volatile.* keys.

The incus_network_address_set resource allows you to define a list of IPv4 or IPv6 addresses (with or without CIDR suffixes). These sets can be referenced in the source or destination fields of Incus ACLs to simplify rule management.

resource "incus_network_address_set" "this" {
    name        = "Network Address Set"
    description = "Network Address Set description"
    addresses   = ["10.0.0.2", "10.0.0.3"]
}

To create a network in a cluster, you must first define the network on each individual node in the cluster using the target argument. Once the node-level resources are defined, you create the actual cluster-wide network resource, ensuring it depends_on the node-specific resources.

resource "incus_network" "my_network_node1" {
  name   = "my_network"
  target = "node1"
}

resource "incus_network" "my_network_node2" {
  name   = "my_network"
  target = "node2"
}

resource "incus_network" "my_network" {
  depends_on = [
    "incus_network.my_network_node1",
    "incus_network.my_network_node2",
  ]

  name = "my_network"

  config = {
    "ipv4.address" = "10.150.19.1/24"
    "ipv4.nat"     = "true"
    "ipv6.address" = "fd42:474b:622d:259d::1/64"
    "ipv6.nat"     = "true"
  }
}

The wait_for block allows you to pause Terraform execution until the instance reaches a specific state. This is useful for ensuring services or networks are ready before proceeding.

Supported type values:

• agent: Waits for the Incus agent (required for VMs).
• cloud-init: Waits for cloud-init to complete.
• delay: Waits for a specified delay (e.g., 30s).
• ipv4: Waits for an IPv4 address on a specific nic (e.g., eth0).
• ipv6: Waits for an IPv6 address on a specific nic (e.g., eth0).
• ready: Waits for the instance to be ready.

Examples

Wait for Incus agent (VMs):

wait_for {
  type = "agent"
}

Wait for cloud-init:

wait_for {
  type = "cloud-init"
}

Wait for IPv4/IPv6 on eth0:

wait_for {
  type = "ipv4"
  nic  = "eth0"
}

wait_for {
  type = "ipv6"
  nic  = "eth0"
}

The tool uses Go templates to define both the target file paths and the content of the generated files. There are two types of templates:

1. Regular templates: Executed once for every entity (resource) defined in the configuration. These have access to the entityArgs for the current entity.
2. Global templates: Executed exactly once for the entire generation process. These receive a map containing all entities, where the key is the entity name and the value is its corresponding entityArgs.

The incus_cluster data source provides information about an Incus cluster. It can be used to discover cluster members and determine if the current Incus setup is running in a clustered configuration. If the setup is not clustered, the members attribute will be null.

data "incus_cluster" "this" {
  # No arguments are required.
}

To import an existing Incus network forward into your Terraform state, use the following ID syntax:

[<remote>:][<project>/]<network-name>/<listen-address>

• <remote> (Optional): Remote name.
• <project> (Optional): Project name.
• <network-name> (Required): Network name.
• <listen-address> (Required): IP Listen Address.

# Using terraform import command
terraform import incus_network_forward.forward1 proj/my-network/10.150.19.10

# Using an import block (Terraform v1.5.0+)
resource "incus_network_forward" "forward1" {
  network_name   = "my-network"
  listen_address = "10.150.19.10"
  project        = "proj"
}

import {
  to = incus_network_forward.forward1
  id = "proj/my-network/10.150.19.10"
}

To import an existing Incus network ACL into Terraform, use the following ID syntax: [<remote>:][<project>/]<name>

• <remote>: Optional remote name.
• <project>: Optional project name.
• <name>: Required network name.

Using terraform import

terraform import incus_network_acl.acl1 proj/acl1

Using the import block (Terraform v1.5.0+)

resource "incus_network_acl" "acl1" {
  name    = "acl1"
  project = "proj"
}

import {
  to = incus_network_acl.acl1
  id = "proj/acl1"
}