Terraform provider for the DuploCloud AI Helpdesk platform.
- Terraform >= 1.0
- Go >= 1.25 (to build from source)
make install # build + install to ~/.terraform.d/plugins/
make test # unit tests
make testacc # acceptance tests (requires TF_ACC=1)
make doc # regenerate docsterraform {
required_providers {
duploai = {
source = "registry.terraform.io/duplocloud/duploai"
version = "~> 0.0"
}
}
}
provider "duploai" {
duplo_host = "https://<helpdesk-host>"
duplo_token = var.duplo_token
}| Variable | Description |
|---|---|
DUPLO_HOST |
DuploCloud AI Helpdesk base URL |
DUPLO_TOKEN |
API bearer token |
| Resource | Description |
|---|---|
duploai_admin_ai_agent |
Manages a DuploCloud AI Helpdesk AI Agent — an external AI service or model the help desk can invoke to perform automated tasks. Agents are assigned to personas, which determine where they are available |
duploai_admin_command_policy |
Manages a DuploCloud AI Helpdesk command policy — reusable allow/block regular-expression lists that govern which agent-proposed commands are auto-approved or denied (deny-wins). A policy has no effect on its own; it takes effect once bound to a scope (System, Workspace, or Project) by a command policy mapping |
duploai_admin_command_policy_mapping |
Manages a DuploCloud AI Helpdesk command policy mapping — binds a command policy to a scope (System, Workspace, or Project), putting the policy's allow/block command rules into effect for tickets in that scope. Only one active mapping may exist per System scope, and per Workspace/Project target |
duploai_admin_permission_set |
Manages a DuploCloud AI Helpdesk permission set — a named grant of workspace-scoped access (scopes and agents) that can be assigned to users via permission set groups |
duploai_admin_persona |
Manages a DuploCloud AI Helpdesk persona — a named assistant profile (prompt and assigned skills) that determines how an AI agent behaves and which skills it can use |
duploai_admin_provider |
Manages a DuploCloud AI Helpdesk Provider — a registered cloud, Kubernetes, source-control, or observability provider (with its authentication credentials) that scopes and agents use |
duploai_admin_quota_definition |
Manages a DuploCloud AI Helpdesk quota definition — a spend/token limit (with a buffer) applied over a daily or monthly period, which quota mappings then bind to platform or workspace scopes |
duploai_admin_quota_mapping |
Manages a DuploCloud AI Helpdesk quota mapping — binds a quota definition to a scope (platform-wide or specific workspaces) and a dimension (workspace, user, or ticket) |
duploai_admin_scope |
Manages a DuploCloud AI scope: a credentialed view over a provider's resources, filtered by AWS, Kubernetes, and Git rules |
duploai_admin_skill |
Manages a DuploCloud AI Helpdesk skill — a reusable capability (Markdown docs, a package, or a private Git repo) that is assigned to personas |
duploai_admin_user |
Manages a DuploCloud AI user account, including identity, roles, and metadata |
duploai_admin_workspace |
Manages a DuploCloud AI Helpdesk workspace — the top-level container that groups personas, scopes, a quota, and configuration for a team or tenant |
duploai_admin_workspace_scope_mapping |
Attaches an infrastructure scope to a DuploCloud AI workspace. Use this to manage the link on its own — for example when the workspace is managed elsewhere, or by a different team — instead of listing the scope in the workspace's scope_ids. Manage a given scope with one or the other, never both |
duploai_app_service |
Manages a DuploCloud AI Helpdesk app service (Kubernetes Deployment) |
duploai_aws_efs |
Manages a DuploCloud AI Helpdesk AWS EFS file system — an elastic, managed NFS file system provisioned within an environment and resource group |
duploai_aws_lambda |
Manages a DuploCloud AI Helpdesk AWS Lambda function — a serverless compute resource that runs code in response to events within an environment and resource group |
duploai_aws_secret |
Manages a DuploCloud AI Helpdesk AWS Secrets Manager secret |
duploai_azure_key_vault |
Manages an Azure Key Vault — a managed store for secrets, keys and certificates, provisioned within an environment and resource group. Platform-provisioned vaults always use Azure RBAC: the resource group's managed identity is granted Key Vault Administrator at resource-group scope, so workloads bound to that group can read secrets with no per-vault permission setup |
duploai_azure_key_vault_secret |
Manages a secret inside an Azure Key Vault. Key Vault secrets are append-only: writing a name that already exists adds a new version rather than overwriting the old one, so any change here produces a new version and a new version value. The secret's value is write-only — the API never returns it, only its metadata |
duploai_azure_managed_redis |
Manages an Azure Managed Redis (Redis Enterprise) instance, provisioned within an environment and resource group. |
Azure models this as two ARM resources and the platform creates both: a Microsoft.Cache/redisEnterprise cluster (SKU, TLS, high availability, public network access) and a single Microsoft.Cache/redisEnterprise/databases child named default (clustering policy, eviction policy, modules, persistence, geo-replication, access-key auth). The attributes below are flattened across both. The database child is created only after the cluster finishes provisioning, so database_id and the access-key operations are unavailable for a period after the resource first reports Complete — set wait_for_database if you need to depend on them |
| duploai_azure_node_pool | Manages a node pool (AKS agent pool) on an Azure Kubernetes Service cluster, provisioned within an environment and resource group.
The pool is created on the AKS cluster linked to the resource group, so that resource group must already have a cluster attached and the cluster must have finished provisioning — the API rejects the create otherwise. Every pool is created as a User pool backed by a virtual machine scale set; the cluster's own system pool is not managed here.
The platform stores the pool's configuration and sends the whole of it to Azure on every change, so Terraform sends every field back on update, not just the ones that changed. Nothing in this resource surfaces live Azure state such as the current node count or Kubernetes version: the API deliberately withholds the raw cloud snapshot from its responses, so only arm_resource_id and the platform's own status are available. The record's version counter and last-updated timestamp are not exposed either — the API refreshes its cloud snapshot on every read and saves the record as it does, so both change on every GET and would report drift on every plan while meaning nothing |
| duploai_azure_postgres_flexible_server | Manages an Azure Database for PostgreSQL Flexible Server — a managed PostgreSQL instance provisioned within an environment and resource group, with configurable compute, storage, backup, high availability, authentication, and networking |
| duploai_azure_private_endpoint | Manages an Azure Private Endpoint, giving a PaaS resource a private IP address inside a subnet so it can be reached without traversing the public internet.
The platform does two things per endpoint: it creates the Microsoft.Network/privateEndpoints resource, then attaches a Private DNS zone group so the target's public hostname resolves to the private IP from inside the network. The zone is chosen from sub_resource_name — blob gives privatelink.blob.core.windows.net, vault gives privatelink.vaultcore.azure.net, and so on. The resource only reports Complete once both steps have succeeded, so a Complete endpoint always has working private DNS. Verified live 2026-08-05 against a storage account's blob service.
Everything about an endpoint is immutable: Azure has no in-place update for one, and the API rejects the attempt outright. Any change here — including tags — replaces the endpoint |
| duploai_cluster_attributes | Manages DuploCloud AI Helpdesk cluster attributes — add-ons and components installed onto an existing EKS cluster (autoscaler, ALB controller, EFS, external-dns, and more) |
| duploai_cluster_baseline | Manages a DuploCloud AI Helpdesk Kubernetes cluster baseline (control plane, networking, and optional system node group), provisionable across any supported cloud. The target cloud is selected via the cloud attribute — AWS (EKS), Azure (AKS), GCP (GKE), or bare Kubernetes (K8S_ONLY) — and defaults to AWS |
| duploai_ecr | Manages a DuploCloud AI Helpdesk AWS ECR (Elastic Container Registry) repository, provisioned within an environment and resource group |
| duploai_elasticache | Manages a DuploCloud AI Helpdesk AWS ElastiCache cluster (Redis, Valkey, or Memcached) |
| duploai_environment | Manages a DuploCloud AI environment within a workspace |
| duploai_helm_release | Manages a DuploCloud AI Helpdesk Kubernetes Helm release (Flux HelmRelease) |
| duploai_helm_repository | Manages a DuploCloud AI Helpdesk Kubernetes Helm repository (Flux HelmRepository) |
| duploai_k8s_config_map | Manages a DuploCloud AI Helpdesk Kubernetes ConfigMap |
| duploai_k8s_cron_job | Manages a DuploCloud AI Helpdesk Kubernetes CronJob — a scheduled workload that runs jobs on a recurring cron schedule within an environment or resource group |
| duploai_k8s_ingress | Manages a DuploCloud AI Helpdesk Kubernetes Ingress — an HTTP/HTTPS routing rule set that exposes services within an environment or resource group |
| duploai_k8s_job | Manages a DuploCloud AI Helpdesk Kubernetes Job — a batch workload that runs one or more containers to completion within an environment or resource group |
| duploai_k8s_namespace | Manages a DuploCloud AI Helpdesk Kubernetes Namespace |
| duploai_k8s_pvc | Manages a DuploCloud AI Helpdesk Kubernetes PersistentVolumeClaim (PVC) |
| duploai_k8s_resource_quota | Manages a DuploCloud AI Helpdesk Kubernetes ResourceQuota. A ResourceQuota enforces per-namespace compute and object limits |
| duploai_k8s_secret | Manages a DuploCloud AI Helpdesk Kubernetes Secret |
| duploai_k8s_storage_class | Manages a DuploCloud AI Helpdesk Kubernetes StorageClass. A StorageClass is a cluster-scoped object that describes how a volume is dynamically provisioned; PersistentVolumeClaims reference it by name |
| duploai_mcp_server | Manages a DuploCloud AI Helpdesk MCP (Model Context Protocol) server registration — a tool/data provider that AI agents can connect to over HTTP, SSE, or a raw configuration |
| duploai_msk_kafka | Manages a DuploCloud AI Helpdesk AWS MSK (Managed Streaming for Apache Kafka) provisioned cluster, in which you size the brokers, provisioned within an environment and resource group |
| duploai_msk_kafka_serverless | Manages a DuploCloud AI Helpdesk AWS MSK (Managed Streaming for Apache Kafka) serverless cluster, in which AWS manages broker capacity automatically. Networking (private subnets and security group) and IAM client authentication are configured server-side |
| duploai_native_host | Manages a DuploCloud native host — an AWS EC2 instance provisioned inside a workspace environment |
| duploai_network_baseline | Manages a DuploCloud AI Helpdesk network baseline. On AWS this provisions a VPC, subnets, and NAT gateways; on Azure it provisions a virtual network, subnets, and NAT gateways via the nested azure block. The target cloud is selected with cloud |
| duploai_node_group | Manages a DuploCloud AI Helpdesk AWS EKS managed node group |
| duploai_oci_repository | Manages a DuploCloud AI Helpdesk Kubernetes OCI repository (Flux OCIRepository) |
| duploai_plan | Manages a DuploCloud AI Helpdesk plan (a region landing zone that collects reusable cloud references: a primary hosted zone, certificates, and AMIs). A plan has no provisioning lifecycle of its own — it is created synchronously and its references are edited directly or by the agent |
| duploai_rds_cluster | Manages a DuploCloud AI Helpdesk AWS RDS (Aurora) cluster |
| duploai_rds_instance | Manages a DuploCloud AI Helpdesk standalone AWS RDS instance |
| duploai_resource_group | Manages a DuploCloud AI Helpdesk resource group (shared security groups, IAM role, KMS key) |
| duploai_s3_bucket | Manages a DuploCloud AI Helpdesk AWS S3 bucket |
| duploai_sns | Manages a DuploCloud AI Helpdesk AWS SNS (Simple Notification Service) topic, provisioned within an environment and resource group |
| duploai_sqs | Manages a DuploCloud AI Helpdesk AWS SQS (Simple Queue Service) queue, provisioned within an environment and resource group |
| duploai_storage_account | Manages a DuploCloud AI Helpdesk Azure Storage Account, provisioned within an environment and resource group |
| Data Source | Description |
|---|---|
duploai_admin_ai_agent |
Manages a DuploCloud AI Helpdesk AI Agent — an external AI service or model the help desk can invoke to perform automated tasks. Agents are assigned to personas, which determine where they are available |
duploai_admin_command_policy |
Manages a DuploCloud AI Helpdesk command policy — reusable allow/block regular-expression lists that govern which agent-proposed commands are auto-approved or denied (deny-wins). A policy has no effect on its own; it takes effect once bound to a scope (System, Workspace, or Project) by a command policy mapping |
duploai_admin_command_policy_mapping |
Manages a DuploCloud AI Helpdesk command policy mapping — binds a command policy to a scope (System, Workspace, or Project), putting the policy's allow/block command rules into effect for tickets in that scope. Only one active mapping may exist per System scope, and per Workspace/Project target |
duploai_admin_permission_set |
Manages a DuploCloud AI Helpdesk permission set — a named grant of workspace-scoped access (scopes and agents) that can be assigned to users via permission set groups |
duploai_admin_persona |
Manages a DuploCloud AI Helpdesk persona — a named assistant profile (prompt and assigned skills) that determines how an AI agent behaves and which skills it can use |
duploai_admin_provider |
Manages a DuploCloud AI Helpdesk Provider — a registered cloud, Kubernetes, source-control, or observability provider (with its authentication credentials) that scopes and agents use |
duploai_admin_quota_definition |
Manages a DuploCloud AI Helpdesk quota definition — a spend/token limit (with a buffer) applied over a daily or monthly period, which quota mappings then bind to platform or workspace scopes |
duploai_admin_quota_mapping |
Manages a DuploCloud AI Helpdesk quota mapping — binds a quota definition to a scope (platform-wide or specific workspaces) and a dimension (workspace, user, or ticket) |
duploai_admin_scope |
Manages a DuploCloud AI scope: a credentialed view over a provider's resources, filtered by AWS, Kubernetes, and Git rules |
duploai_admin_skill |
Manages a DuploCloud AI Helpdesk skill — a reusable capability (Markdown docs, a package, or a private Git repo) that is assigned to personas |
duploai_admin_user |
Manages a DuploCloud AI user account, including identity, roles, and metadata |
duploai_admin_workspace |
Manages a DuploCloud AI Helpdesk workspace — the top-level container that groups personas, scopes, a quota, and configuration for a team or tenant |
duploai_app_service |
Manages a DuploCloud AI Helpdesk app service (Kubernetes Deployment) |
duploai_aws_efs |
Manages a DuploCloud AI Helpdesk AWS EFS file system — an elastic, managed NFS file system provisioned within an environment and resource group |
duploai_aws_lambda |
Manages a DuploCloud AI Helpdesk AWS Lambda function — a serverless compute resource that runs code in response to events within an environment and resource group |
duploai_aws_secret |
Manages a DuploCloud AI Helpdesk AWS Secrets Manager secret |
duploai_azure_key_vault |
Manages an Azure Key Vault — a managed store for secrets, keys and certificates, provisioned within an environment and resource group. Platform-provisioned vaults always use Azure RBAC: the resource group's managed identity is granted Key Vault Administrator at resource-group scope, so workloads bound to that group can read secrets with no per-vault permission setup |
duploai_azure_key_vault_secret |
Manages a secret inside an Azure Key Vault. Key Vault secrets are append-only: writing a name that already exists adds a new version rather than overwriting the old one, so any change here produces a new version and a new version value. The secret's value is write-only — the API never returns it, only its metadata |
duploai_azure_managed_redis |
Manages an Azure Managed Redis (Redis Enterprise) instance, provisioned within an environment and resource group. |
Azure models this as two ARM resources and the platform creates both: a Microsoft.Cache/redisEnterprise cluster (SKU, TLS, high availability, public network access) and a single Microsoft.Cache/redisEnterprise/databases child named default (clustering policy, eviction policy, modules, persistence, geo-replication, access-key auth). The attributes below are flattened across both. The database child is created only after the cluster finishes provisioning, so database_id and the access-key operations are unavailable for a period after the resource first reports Complete — set wait_for_database if you need to depend on them |
| duploai_azure_node_pool | Manages a node pool (AKS agent pool) on an Azure Kubernetes Service cluster, provisioned within an environment and resource group.
The pool is created on the AKS cluster linked to the resource group, so that resource group must already have a cluster attached and the cluster must have finished provisioning — the API rejects the create otherwise. Every pool is created as a User pool backed by a virtual machine scale set; the cluster's own system pool is not managed here.
The platform stores the pool's configuration and sends the whole of it to Azure on every change, so Terraform sends every field back on update, not just the ones that changed. Nothing in this resource surfaces live Azure state such as the current node count or Kubernetes version: the API deliberately withholds the raw cloud snapshot from its responses, so only arm_resource_id and the platform's own status are available. The record's version counter and last-updated timestamp are not exposed either — the API refreshes its cloud snapshot on every read and saves the record as it does, so both change on every GET and would report drift on every plan while meaning nothing |
| duploai_azure_postgres_flexible_server | Manages an Azure Database for PostgreSQL Flexible Server — a managed PostgreSQL instance provisioned within an environment and resource group, with configurable compute, storage, backup, high availability, authentication, and networking |
| duploai_azure_private_endpoint | Manages an Azure Private Endpoint, giving a PaaS resource a private IP address inside a subnet so it can be reached without traversing the public internet.
The platform does two things per endpoint: it creates the Microsoft.Network/privateEndpoints resource, then attaches a Private DNS zone group so the target's public hostname resolves to the private IP from inside the network. The zone is chosen from sub_resource_name — blob gives privatelink.blob.core.windows.net, vault gives privatelink.vaultcore.azure.net, and so on. The resource only reports Complete once both steps have succeeded, so a Complete endpoint always has working private DNS. Verified live 2026-08-05 against a storage account's blob service.
Everything about an endpoint is immutable: Azure has no in-place update for one, and the API rejects the attempt outright. Any change here — including tags — replaces the endpoint |
| duploai_cluster_attributes | Manages DuploCloud AI Helpdesk cluster attributes — add-ons and components installed onto an existing EKS cluster (autoscaler, ALB controller, EFS, external-dns, and more) |
| duploai_cluster_baseline | Manages a DuploCloud AI Helpdesk Kubernetes cluster baseline (control plane, networking, and optional system node group), provisionable across any supported cloud. The target cloud is selected via the cloud attribute — AWS (EKS), Azure (AKS), GCP (GKE), or bare Kubernetes (K8S_ONLY) — and defaults to AWS |
| duploai_ecr | Manages a DuploCloud AI Helpdesk AWS ECR (Elastic Container Registry) repository, provisioned within an environment and resource group |
| duploai_elasticache | Manages a DuploCloud AI Helpdesk AWS ElastiCache cluster (Redis, Valkey, or Memcached) |
| duploai_environment | Manages a DuploCloud AI environment within a workspace |
| duploai_helm_release | Manages a DuploCloud AI Helpdesk Kubernetes Helm release (Flux HelmRelease) |
| duploai_helm_repository | Manages a DuploCloud AI Helpdesk Kubernetes Helm repository (Flux HelmRepository) |
| duploai_k8s_config_map | Manages a DuploCloud AI Helpdesk Kubernetes ConfigMap |
| duploai_k8s_cron_job | Manages a DuploCloud AI Helpdesk Kubernetes CronJob — a scheduled workload that runs jobs on a recurring cron schedule within an environment or resource group |
| duploai_k8s_ingress | Manages a DuploCloud AI Helpdesk Kubernetes Ingress — an HTTP/HTTPS routing rule set that exposes services within an environment or resource group |
| duploai_k8s_job | Manages a DuploCloud AI Helpdesk Kubernetes Job — a batch workload that runs one or more containers to completion within an environment or resource group |
| duploai_k8s_namespace | Manages a DuploCloud AI Helpdesk Kubernetes Namespace |
| duploai_k8s_pvc | Manages a DuploCloud AI Helpdesk Kubernetes PersistentVolumeClaim (PVC) |
| duploai_k8s_resource_quota | Manages a DuploCloud AI Helpdesk Kubernetes ResourceQuota. A ResourceQuota enforces per-namespace compute and object limits |
| duploai_k8s_secret | Manages a DuploCloud AI Helpdesk Kubernetes Secret |
| duploai_k8s_storage_class | Manages a DuploCloud AI Helpdesk Kubernetes StorageClass. A StorageClass is a cluster-scoped object that describes how a volume is dynamically provisioned; PersistentVolumeClaims reference it by name |
| duploai_mcp_server | Manages a DuploCloud AI Helpdesk MCP (Model Context Protocol) server registration — a tool/data provider that AI agents can connect to over HTTP, SSE, or a raw configuration |
| duploai_msk_kafka | Manages a DuploCloud AI Helpdesk AWS MSK (Managed Streaming for Apache Kafka) provisioned cluster, in which you size the brokers, provisioned within an environment and resource group |
| duploai_msk_kafka_serverless | Manages a DuploCloud AI Helpdesk AWS MSK (Managed Streaming for Apache Kafka) serverless cluster, in which AWS manages broker capacity automatically. Networking (private subnets and security group) and IAM client authentication are configured server-side |
| duploai_native_host | Manages a DuploCloud native host — an AWS EC2 instance provisioned inside a workspace environment |
| duploai_network_baseline | Manages a DuploCloud AI Helpdesk network baseline. On AWS this provisions a VPC, subnets, and NAT gateways; on Azure it provisions a virtual network, subnets, and NAT gateways via the nested azure block. The target cloud is selected with cloud |
| duploai_node_group | Manages a DuploCloud AI Helpdesk AWS EKS managed node group |
| duploai_oci_repository | Manages a DuploCloud AI Helpdesk Kubernetes OCI repository (Flux OCIRepository) |
| duploai_plan | Manages a DuploCloud AI Helpdesk plan (a region landing zone that collects reusable cloud references: a primary hosted zone, certificates, and AMIs). A plan has no provisioning lifecycle of its own — it is created synchronously and its references are edited directly or by the agent |
| duploai_rds_cluster | Manages a DuploCloud AI Helpdesk AWS RDS (Aurora) cluster |
| duploai_rds_instance | Manages a DuploCloud AI Helpdesk standalone AWS RDS instance |
| duploai_resource_group | Manages a DuploCloud AI Helpdesk resource group (shared security groups, IAM role, KMS key) |
| duploai_s3_bucket | Manages a DuploCloud AI Helpdesk AWS S3 bucket |
| duploai_sns | Manages a DuploCloud AI Helpdesk AWS SNS (Simple Notification Service) topic, provisioned within an environment and resource group |
| duploai_sqs | Manages a DuploCloud AI Helpdesk AWS SQS (Simple Queue Service) queue, provisioned within an environment and resource group |
| duploai_storage_account | Manages a DuploCloud AI Helpdesk Azure Storage Account, provisioned within an environment and resource group |
See RELEASE.md (gitignored — local only) for the full release procedure.