TeaPublicationTarget

A remote TEA server the tenant is willing to mirror published objects to, registered once so it can be reviewed, rather than named by URL in each access policy. Mirroring is a copy the receiving server then governs. This server does not mirror yet: the target is registered and kept, plan warns that nothing is copied to it, and the publisher API still refuses publishTo. The server derives the target’s TEI domain from rootUrl, and a tenant registers each domain once. Removing the document deregisters the target and discards its credential; copies already sent stay where they are.

apiVersion	vulnetix.com/v1
kind	TeaPublicationTarget
Group	TEA
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists TeaPublicationTarget in its kinds. See Management tokens.
Secret fields	spec.credential: read on the client from valueFrom, sent once, never exported or shown in a plan
Terraform resource	vulnetix_tea_publication_target, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/TeaPublicationTarget.schema.json
Newest schema	latest/TeaPublicationTarget.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema TeaPublicationTarget

Minimal

Only the fields the kind requires. From examples/TeaPublicationTarget/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaPublicationTarget.schema.json
apiVersion: vulnetix.com/v1
kind: TeaPublicationTarget
metadata:
  name: globex-tea
spec:
  rootUrl: https://tea.globex.example.com/tea/v1

HCL (resource vulnetix_tea_publication_target)

# Only the arguments the kind requires. From config-schemas examples/TeaPublicationTarget/minimal.yaml.

resource "vulnetix_tea_publication_target" "globex_tea" {
  name     = "globex-tea"
  root_url = "https://tea.globex.example.com/tea/v1"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaPublicationTarget.schema.json
apiVersion: vulnetix.com/v1
kind: TeaPublicationTarget
metadata:
  name: globex-tea
spec:
  rootUrl: https://tea.globex.example.com/tea/v1
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/TeaPublicationTarget/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaPublicationTarget.schema.json
apiVersion: vulnetix.com/v1
kind: TeaPublicationTarget
metadata:
  name: globex-tea
  labels:
    owner: platform
spec:
  rootUrl: https://tea.globex.example.com/tea/v1
  description: Globex's TEA server, for the payments contract.
  credential: { env: GLOBEX_TEA_TOKEN }
  suspended: true

HCL (resource vulnetix_tea_publication_target)

# Every argument the kind supports. From config-schemas examples/TeaPublicationTarget/advanced.yaml.

variable "globex_tea_credential" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "vulnetix_tea_publication_target" "globex_tea" {
  name                  = "globex-tea"
  credential_wo         = var.globex_tea_credential
  credential_wo_version = 1
  description           = "Globex's TEA server, for the payments contract."
  root_url              = "https://tea.globex.example.com/tea/v1"
  suspended             = true
  labels = {
    owner = "platform"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
export GLOBEX_TEA_TOKEN=...   # read on this machine by valueFrom, never written to the document
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaPublicationTarget.schema.json
apiVersion: vulnetix.com/v1
kind: TeaPublicationTarget
metadata:
  name: globex-tea
  labels:
    owner: platform
spec:
  rootUrl: https://tea.globex.example.com/tea/v1
  description: Globex's TEA server, for the payments contract.
  credential: { env: GLOBEX_TEA_TOKEN }
  suspended: true
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Secret	Description
apiVersion	string	yes		exactly vulnetix.com/v1		The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly TeaPublicationTarget		Always TeaPublicationTarget.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$		The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid		The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$		Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)		Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.rootUrl	string	yes		pattern ^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?(/[^\s?#]*[^\s?#/])?$; length 0 to 2048		The remote server’s TEA root, the rootUrl its own discovery document advertises, without a trailing slash. Must be https, because a mirror carries a credential.
spec.description	string	no		length 1 to 256		What this target is, for whoever reviews the list later.
spec.credential	object	no		1 to 1 keys; no other keys	yes	Where the client reads the bearer credential this server presents to the target. It is encrypted with the tenant’s KMS key, never exported or shown in a plan, and supplying the same value again is no change. Left out, the target is registered without a credential, or keeps the one it has.
spec.credential.env	string	no		pattern ^[A-Za-z_][A-Za-z0-9_]*$		Name of an environment variable.
spec.credential.file	string	no		length 1 to any		Path to a file holding the value. Trailing newlines are trimmed.
spec.suspended	boolean	no	false			Keep the target registered but send it nothing.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

The bearer credential is a valueFrom secret, encrypted under a key bound to the organization and the target.

Terraform and OpenTofu

The resource is vulnetix_tea_publication_target in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_tea_publication_target.

Import an object that already exists by its name:

# Import an existing TeaPublicationTarget by its name (metadata.name).
terraform import vulnetix_tea_publication_target.globex_tea globex-tea

A secret is two arguments, never stored in the plan or the state: credential_wo (write-only) and credential_wo_version. Change the version number to send a new value. See Secrets.

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.