Teams

The devzero_team resource starts a new DevZero team from the provider's team, such as a partner's team starting one for each of its customers. The provider's team_id is the starting team, and it must be a DevZero partner team. Pass the new team's id to team_id on devzero_cluster to register the customer's clusters in it.

For the whole flow, including the console and a customer that already has a DevZero team, see Partner Teams.

Example

variable "partner_team_id" {
  type = string
}

variable "partner_service_account_token" {
  type      = string
  sensitive = true
}

provider "devzero" {
  team_id = var.partner_team_id
  token   = var.partner_service_account_token
}

resource "devzero_team" "acme" {
  name                = "Acme"
  member_emails       = ["alice@partner.example"]
  admin_invite_emails = ["admin@acme.example"]
}

resource "devzero_cluster" "acme_prod" {
  name    = "acme-prod"
  team_id = devzero_team.acme.id
}

Arguments

All three are used only when the team is started. A later change to any of them is refused at plan. After the start, the team's Admins rename it and manage its people in the DevZero console, and a rename there shows no drift in Terraform.

A refused start, such as one with no Admin in member_emails, fails the apply and writes nothing to state.

Attributes

The apply warns when invites_not_sent is not empty. Applying again does not send them. An Admin of the new team re-sends them under Settings > Organization Settings > User and Role Management with Resend invite, or sends the link from Copy invite link.

The service account token

The service account joins each team it starts as a Developer. There it can register, rename and delete clusters and reset their tokens. It is never an Admin outside its own team, so it cannot invite people to the new team or rename it. That is why member_emails must name a person who is an Admin of the provider's team: every new team needs a person as Admin from the start.

A service account with the Viewer role cannot start teams.

Destroying it is a leave

Destroying a devzero_team is the token owner's leave of the team:

• With a service account token, the service account leaves. The team and its people stay.
• With a person's token, that person leaves. If they are the team's last member, the leave deletes the team. DevZero may refuse a person's leave, for example when they are the last member of a team that has had clusters connected, or the only Admin while others stay.

Destroying a devzero_cluster deletes the cluster in DevZero, so destroying a whole configuration deletes the customer's clusters. To stop managing a customer without deleting anything, replace its devzero_cluster resources with removed blocks that set lifecycle { destroy = false }, and delete the devzero_team block, whose destroy only takes the service account out of the team. To keep the service account in the team as well, give the devzero_team a removed block too. The provider's messages name Terraform 1.9.3 or later for removed blocks.

removed {
  from = devzero_cluster.acme_prod
  lifecycle {
    destroy = false
  }
}

The people named in member_emails stay in the team until they leave or its Admins remove them.

Renaming the resource address

Renaming a devzero_team address, or moving it into a module, needs a moved block from the old address. Without one, Terraform starts a second team, sends its invites again, and destroys the old address, which takes the token owner out of the customer's team. The plan is refused only when an existing devzero_cluster takes its team_id from that resource.

moved {
  from = devzero_team.acme
  to   = devzero_team.acme_corp
}

A team that cannot be read

If the team is deleted, or the token's owner is removed from it, the refresh fails and Terraform keeps the team in state rather than starting a new one. Retry first. If it still fails, remove the devzero_team and the devzero_cluster resources in its team from configuration as well as from state, with terraform state rm or removed blocks. Removed from state but kept in configuration, they start a new team and register the clusters in it on the next apply.

Import

terraform import devzero_team.acme <team_id>

The provider's own team cannot be imported. After an import, the next apply records the configured name, member_emails and admin_invite_emails in state and sends nothing to DevZero.