feat: add deployment-level option to disable Terraform module caching - #29187
Merged
Conversation
CODER_PROVISIONER_DISABLE_MODULE_CACHE withholds cached Terraform modules from every workspace build, so admins no longer have to toggle each template. The deployment setting wins: templates cannot opt back in, and the per-template toggle becomes read-only while it is set. Modules stay cached at template import so dynamic parameter rendering keeps resolving module-defined parameters. Templates report the deployment state as module_cache_disabled_by_deployment so the settings UI can explain why the toggle is locked.
Contributor
Docs previewCheck off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here. |
Emyrk
commented
Sep 11, 2026
Comment on lines
+74
to
+81
| // provisioning for this template. It is read-only while | ||
| // ModuleCacheDisabledByDeployment is true. | ||
| DisableModuleCache bool `json:"disable_module_cache"` | ||
|
|
||
| // ModuleCacheDisabledByDeployment reports that the deployment disables the | ||
| // Terraform module cache for every template. Templates cannot opt back in, | ||
| // so the effective state is disabled regardless of DisableModuleCache. | ||
| ModuleCacheDisabledByDeployment bool `json:"module_cache_disabled_by_deployment"` |
Member
Author
There was a problem hiding this comment.
2 separate bools so the end user knows the state
Member
Author
|
Manually checked |
Emyrk
marked this pull request as ready for review
September 11, 2026 22:10
BobbyHo
approved these changes
Sep 11, 2026
BobbyHo
left a comment
Contributor
There was a problem hiding this comment.
I reviewed the Go files, and the changes LGTM. I’m not very familiar with the TypeScript files, but based on the screenshots in the PR description, they look correct as well.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #22834.
Adds
CODER_PROVISIONER_DISABLE_MODULE_CACHEso an admin can disable Terraform module caching for every template at once instead of toggling ~100 templates by hand.module_cache_disabled_by_deployment, and template settings shows why the checkbox is locked.Agent context
Decisions taken with @Emyrk before implementing:
deployment || template, no per-template override, so no migration and no nullable column. The rule lives in one place,codersdk.ModuleCacheDisabled.dynamicparameters/render.gooverlayscached_module_filesat.terraform/modulesto render module-defined parameters. Skipping the cache there would reproduce theModule not loaded. Did you run terraform init?failure reported by a customer, so the deployment setting only affects whatAcquireJobhands the provisioner.disable_module_cacheis discarded while the deployment setting is on, rather than persisted. Persisting it would silently keep templates opted out after the deployment setting is removed.disable_module_cachekeeps its meaning (this template's stored value) and the new read-onlymodule_cache_disabled_by_deploymentreports the deployment state. Reading the effective value from/deployment/configwas rejected because template admins may lack deployment-config read permission.CODER_PROVISIONER_DISABLE_MODULE_CACHEover the issue'sCODER_DISABLE_TERRAFORM_MODULE_CACHE, to match the provisioning option group.Note:
InsertTemplateParamshas nodisable_module_cachebinding, so new templates always storefalse. With deployment precedence they still behave as opted out, so the create path needed no change.Out of scope and tracked elsewhere: the
coderd_templateTerraform provider attribute (separate repo) and backporting the per-template toggle torelease/2.30.Coder Agents on behalf of @Emyrk.