fix: Stop data sources from generating kubeconfig tokens on every plan - #2287
Merged
Conversation
#2269) * fix: Stop data sources from generating kubeconfig tokens on every plan Cluster data sources called the Rancher generateKubeconfig API on every plan and apply, creating a new API token each time. Over time this leads to accumulation of large numbers of orphaned tokens. * fix: Default generate_kube_config to true to avoid breaking change Kubeconfig generation on cluster data sources now defaults to enabled, preserving existing behavior. A deprecation warning is logged when generation is active, noting that the default will change to false in a future version. (cherry picked from commit 0d37ae2)
github-actions
Bot
added
internal/pr-backport
JonCrowther
approved these changes
Jun 4, 2026
pmatseykanets
approved these changes
Jun 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request cherry-picks the changes from #2269 into release/v15
Addresses #2272 for #2271
WARNING!: to avoid having to resolve merge conflicts this PR is generated with 'git cherry-pick -X theirs'.
Please make sure to carefully inspect this PR so that you don't accidentally revert anything!
Copied from main PR:
Addresses #1229
Description
Cluster data sources called the Rancher generateKubeconfig API on every plan and apply, creating a new API token each time. Over time this leads to accumulation of large numbers of orphaned tokens.
Data sources now skip kubeconfig generation by default, which is a breaking change. Users who need the kubeconfig output can opt in by setting generate_kube_config = true on the data source.
The alternative is to make it opt-out in which case the side-effect remains the default behavior.
Testing
This is a breaking change.
kube_configon cluster data sources (rancher2_cluster,rancher2_cluster_v2) is now empty by default.Previously, every plan/apply generated a new API token. Users who need
kube_configfrom a data source must setgenerate_kube_config = true.