--- page_title: "yba_universe Resource - YugabyteDB Anywhere" description: |- Universe Resource. --- # yba_universe (Resource) Universe Resource. ## Example Usage ```terraform data "yba_provider_key" "cloud_key" { provider_id = yba_aws_provider.aws.id } data "yba_release_version" "release_version" { depends_on = [yba_aws_provider.aws] } resource "yba_universe" "universe_name" { clusters { cluster_type = "PRIMARY" user_intent { universe_name = "" provider = yba_aws_provider.aws.id region_list = yba_aws_provider.aws.regions[*].uuid num_nodes = 3 replication_factor = 3 instance_type = "" device_info { num_volumes = 1 volume_size = 375 storage_type = "" } use_time_sync = true enable_ysql = true yb_software_version = data.yba_release_version.release_version.id access_key_code = data.yba_provider_key.cloud_key.id } } communication_ports {} } # Universe with dedicated master nodes: masters run on separate nodes from TServers. # This variant pins a distinct instance_type and device_info for the master nodes. resource "yba_universe" "dedicated_masters" { clusters { cluster_type = "PRIMARY" user_intent { universe_name = "" provider = yba_aws_provider.aws.id region_list = yba_aws_provider.aws.regions[*].uuid num_nodes = 3 replication_factor = 3 instance_type = "" device_info { num_volumes = 1 volume_size = 375 storage_type = "" } dedicated_masters { instance_type = "" device_info { num_volumes = 1 volume_size = 100 storage_type = "" } } use_time_sync = true enable_ysql = true yb_software_version = data.yba_release_version.release_version.id access_key_code = data.yba_provider_key.cloud_key.id } } communication_ports {} } # Same as above but omits instance_type / device_info inside dedicated_masters, # so masters inherit the TServer instance type and device info. resource "yba_universe" "dedicated_masters_inherit" { clusters { cluster_type = "PRIMARY" user_intent { universe_name = "" provider = yba_aws_provider.aws.id region_list = yba_aws_provider.aws.regions[*].uuid num_nodes = 3 replication_factor = 3 instance_type = "" device_info { num_volumes = 1 volume_size = 375 storage_type = "" } dedicated_masters {} use_time_sync = true enable_ysql = true yb_software_version = data.yba_release_version.release_version.id access_key_code = data.yba_provider_key.cloud_key.id } } communication_ports {} } ``` The details for configuration are available in the [YugabyteDB Anywhere Create YugabyteDB universe deployments](https://docs.yugabyte.com/stable/yugabyte-platform/create-deployments/) and [YugabyteDB Anywhere Manage YugabyteDB universe deployments](https://docs.yugabyte.com/stable/yugabyte-platform/manage-deployments/). ~> **Disclaimer:** Please note that adding read replica clusters after universe creation currently not supported. ~> **Warning:** Read replica (ASYNC cluster) support is not fully documented in this provider. Configuration options for ASYNC clusters may be incomplete or subject to change. Use read replicas with caution and refer to the YugabyteDB Anywhere UI or API documentation for the full set of supported options. The full set of in-place edit operations -- triggers, behavior, and ordering rules -- is documented in the [Universe Edit Actions](../guides/universe-edit-actions.md) guide. ~> **Note:** `clusters[*].user_intent.access_key_code` is listed in the Optional schema group, but it is required when the cluster targets a cloud provider (`aws`, `gcp`, `azu`). It is only optional for on-prem providers whose nodes have the YBA node agent installed. The provider rejects a plan that omits it for a cloud provider at plan time. ## Schema ### Required - `clusters` (Block List, Min: 1) (see [below for nested schema](#nestedblock--clusters)) ### Optional - `arch` (String) The architecture of the universe nodes. Allowed values are x86_64 and aarch64. - `client_root_ca` (String) The UUID of the clientRootCA to be used to generate client certificates and facilitate TLS communication between server and client. When set to a different value than root_ca, separate certificates are used for node-to-node and client-to-node TLS. May be set without root_ca (e.g. when node-to-node encryption is disabled but client-to-node encryption is enabled); in that case YBA auto-generates a root CA for node-to-node if needed and uses the provided value for client-to-node. When not set, root_ca is reused for client-to-node TLS. - `communication_ports` (Block List, Max: 1) Communication ports. See the universe edit actions guide for which ports can be changed after creation and which trigger a full move when edited. (see [below for nested schema](#nestedblock--communication_ports)) - `db_version_upgrade_options` (Block List, Max: 1) Options controlling the DB version upgrade path (UpgradeDBVersion). By default finalize = false pauses the upgrade in PreFinalize state for a monitoring phase; flip to true and re-apply to commit, or set rollback = true to revert to the previous DB version. (see [below for nested schema](#nestedblock--db_version_upgrade_options)) - `delete_options` (Block List, Max: 1) (see [below for nested schema](#nestedblock--delete_options)) - `full_move` (Block List, Max: 1) Block controlling whether and how full-move-triggering edits are permitted. A full move provisions new nodes with the new configuration, migrates data from the old nodes, and decommissions the old nodes; it requires temporary 2x node capacity during migration and takes significantly longer than in-place operations. (see [below for nested schema](#nestedblock--full_move)) - `node_restart_settings` (Block List, Max: 1) Controls how node restarts are performed during upgrade operations (DB version, GFlags, Systemd, Finalize, Rollback). When omitted, YugabyteDB Anywhere platform defaults apply: Rolling strategy with 180000 ms (3 minutes) sleep after each master and TServer restart. (see [below for nested schema](#nestedblock--node_restart_settings)) - `root_ca` (String) The UUID of the rootCA used for node-to-node TLS encryption. When not set, YBA creates and assigns a root CA automatically. - `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts)) ### Read-Only - `db_version_upgrade_state` (String) Current DB version upgrade state reported by YugabyteDB Anywhere. Possible values: Ready, Upgrading, UpgradeFailed, PreFinalize, Finalizing, FinalizeFailed, RollingBack, RollbackFailed. - `id` (String) The ID of this resource. - `node_details_set` (List of Object) (see [below for nested schema](#nestedatt--node_details_set)) ### Nested Schema for `clusters` Required: - `cluster_type` (String) The type of cluster, primary or read replica (async). Allowed values are PRIMARY or ASYNC. - `user_intent` (Block List, Min: 1, Max: 1) Configuration values used in universe creation. Only these values can be updated. (see [below for nested schema](#nestedblock--clusters--user_intent)) Optional: - `cloud_list` (Block List) Explicit per-zone placement for the universe. When omitted, YBA distributes nodes across zones automatically. (see [below for nested schema](#nestedblock--clusters--cloud_list)) Read-Only: - `uuid` (String) Cluster UUID. ### Nested Schema for `clusters.user_intent` Required: - `device_info` (Block List, Min: 1, Max: 1) Configuration values associated with the machines used for this universe. (see [below for nested schema](#nestedblock--clusters--user_intent--device_info)) - `instance_type` (String) Instance type of universe nodes. - `num_nodes` (Number) Desired total number of nodes for this universe. When cloud_list is also set, this value is ignored by YBA: the actual node count is determined by the sum of cloud_list[*].region_list[*].az_list[*].num_nodes (userAZSelected=true). Set this to match that sum to avoid plan drift on subsequent applies. - `provider` (String) Provider UUID. - `region_list` (List of String) List of regions for node placement. - `replication_factor` (Number) Replication factor for this universe. - `universe_name` (String) Universe name. - `yb_software_version` (String) YBDB version of the universe. Changing this field triggers a DB version upgrade (UpgradeDBVersion). By default the upgrade pauses at PreFinalize state for a monitoring phase; set db_version_upgrade_options.finalize = true to commit automatically after the upgrade task completes. See db_version_upgrade_options for full rollback/finalize controls. Optional: - `access_key_code` (String) Access Key code of provider. Required for cloud providers (aws, gcp, azu). Not required for on-prem providers whose nodes have the YBA node agent installed. - `assign_public_ip` (Boolean) Assign Public IP to universe nodes. True by default. - `assign_static_ip` (Boolean) Flag indicating whether a static IP should be assigned. - `aws_arn_string` (String) IP ARN String. - `dedicated_masters` (Block List, Max: 1) When present, master processes run on dedicated nodes separate from TServer processes. Omitting this block runs masters co-located with TServers. Only valid on the PRIMARY cluster; setting it on a Read Replica (ASYNC) cluster is an error. Once set, dedicated mode cannot be toggled off after universe creation. Inheritance and ownership rules: - An empty block (dedicated_masters {}) runs masters on dedicated nodes using the same instance_type and device_info as the TServer nodes. All master configuration tracks user_intent automatically. - Once instance_type or device_info is explicitly set inside this block, those fields become the sole source of truth for master configuration. Subsequent changes to the TServer fields in user_intent do NOT propagate to the master block automatically; the operator is responsible for keeping them in sync. (see [below for nested schema](#nestedblock--clusters--user_intent--dedicated_masters)) - `enable_client_to_node_encrypt` (Boolean) Enable Encryption in Transit - Client to Node encryption. True by default. - `enable_ipv6` (Boolean) Enable IPv6. - `enable_node_to_node_encrypt` (Boolean) Enable Encryption in Transit - Node to Node encryption. True by default. - `enable_ycql` (Boolean) Enable YCQL. True by default. - `enable_ycql_auth` (Boolean) Enable YCQL authentication. - `enable_yedis` (Boolean) Enable YEDIS. False by default. - `enable_ysql` (Boolean) Enable YSQL. True by default. - `enable_ysql_auth` (Boolean) Enable YSQL authentication. - `image_bundle_uuid` (String) Image Bundle UUID. When omitted for cloud providers (aws, gcp, azu), YBA resolves the provider's default image bundle for the configured arch. - `instance_tags` (Map of String) Instance Tags. - `master_gflags` (Map of String, Deprecated) Set of Master GFlags. Deprecated since YugabyteDB Anywhere 2.18.6.0. Please use 'specific_gflags.per_process.master_gflags' instead. Values set here are promoted into specific_gflags on apply and mirrored back on Read. - `preferred_region` (String) Preferred Region for node placement. - `specific_gflags` (Block List, Max: 1) Cluster-level GFlags configuration. When set, this block takes precedence over the flat master_gflags / tserver_gflags maps. Use it to apply GFlag groups, inherit GFlags from the Primary cluster (read replicas only), or override GFlags per AZ. All inner fields are Optional+Computed: omitting one in HCL preserves the existing value. To clear a setting, declare it explicitly empty (e.g. `tserver_gflags = {}`, `gflag_groups = []`). See the [Removing GFlags or groups](../guides/universe-edit-actions#removing-gflags-or-groups) section of the universe edit actions guide. (see [below for nested schema](#nestedblock--clusters--user_intent--specific_gflags)) - `tserver_gflags` (Map of String, Deprecated) Set of TServer GFlags. Deprecated since YugabyteDB Anywhere 2.18.6.0. Please use 'specific_gflags.per_process.tserver_gflags' instead. Values set here are promoted into specific_gflags on apply and mirrored back on Read. - `use_host_name` (Boolean) Enable to use host name instead of IP addresses to communicate. - `use_systemd` (Boolean) Enable Systemd in universe nodes. True by default. - `use_time_sync` (Boolean) Enable time sync. True by default. - `ycql_password` (String, Sensitive) YCQL auth password. Required when enable_ycql_auth is true. Stored in Terraform state - use an encrypted backend for security. - `ysql_password` (String, Sensitive) YSQL auth password. Required when enable_ysql_auth is true. Stored in Terraform state - use an encrypted backend for security. Read-Only: - `provider_type` (String) Cloud provider type. Derived from the referenced provider UUID via the provider API. ### Nested Schema for `clusters.user_intent.device_info` Required: - `num_volumes` (Number) Number of volumes per node. - `volume_size` (Number) Volume size in GB. Optional: - `disk_iops` (Number) Disk IOPS. - `mount_points` (String) Disk mount points. Required for on-prem cluster nodes. Not allowed for any other provider type. - `storage_type` (String) Storage type of volume. AWS: IO1, IO2, GP2, GP3. GCP: Scratch, Persistent, Hyperdisk_Balanced, Hyperdisk_Extreme. Azure: StandardSSD_LRS, Premium_LRS, PremiumV2_LRS, UltraSSD_LRS. Not applicable for on-prem providers. - `throughput` (Number) Disk throughput in MB/s. Required for storage types that support throughput provisioning: GP3, UltraSSD_LRS, PremiumV2_LRS, Hyperdisk_Balanced. ### Nested Schema for `clusters.user_intent.dedicated_masters` Optional: - `device_info` (Block List, Max: 1) Disk and volume configuration for dedicated master nodes. When this block is absent, all disk settings fall back to user_intent.device_info and continue to track it automatically. When this block is present, each field is inherited from user_intent.device_info on the first apply when left unset, but subsequent changes to user_intent.device_info fields do NOT propagate automatically -- the operator must update them here explicitly. To return to full automatic tracking, remove this device_info block entirely. (see [below for nested schema](#nestedblock--clusters--user_intent--dedicated_masters--device_info)) - `instance_type` (String) Instance type for dedicated master nodes. When omitted (empty string), falls back to user_intent.instance_type and continues to track it on every apply. Once set to a non-empty value this field is owned by this block; changes to user_intent.instance_type no longer affect the master instance type. ### Nested Schema for `clusters.user_intent.dedicated_masters.device_info` Optional: - `disk_iops` (Number) Disk IOPS for master nodes. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.disk_iops changes. - `mount_points` (String) Disk mount points for master nodes. Required for on-prem cluster master nodes. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.mount_points changes. - `num_volumes` (Number) Number of volumes per master node. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.num_volumes changes. - `storage_type` (String) Storage type for master node volumes. AWS: IO1, IO2, GP2, GP3. GCP: Scratch, Persistent, Hyperdisk_Balanced, Hyperdisk_Extreme. Azure: StandardSSD_LRS, Premium_LRS, PremiumV2_LRS, UltraSSD_LRS. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.storage_type changes. - `throughput` (Number) Disk throughput in MB/s for master nodes. Required for storage types that support throughput provisioning: GP3, UltraSSD_LRS, PremiumV2_LRS, Hyperdisk_Balanced. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.throughput changes. - `volume_size` (Number) Volume size in GB for master nodes. Inherited from user_intent.device_info on the first apply when unset. Once this device_info block is present in config, this field is no longer updated automatically when user_intent.device_info.volume_size changes. ### Nested Schema for `clusters.user_intent.specific_gflags` Optional: - `gflag_groups` (List of String) GFlag group names to apply to the universe. Universe-wide: YBA overwrites the Read Replica's groups with the Primary's on every apply, so the value declared on the ASYNC cluster must match the PRIMARY (or be omitted). Case-insensitive in config; YBA stores the upper-case form. Allowed values: ENHANCED_POSTGRES_COMPATIBILITY. - `inherit_from_primary` (Boolean) Read Replica (ASYNC) only: inherit all GFlags from the Primary cluster. Invalid on the PRIMARY cluster. - `per_az` (Block List) Per-availability-zone GFlag overrides. Each entry overrides flags for the specified AZ UUID. (see [below for nested schema](#nestedblock--clusters--user_intent--specific_gflags--per_az)) - `per_process` (Block List, Max: 1) Per-process GFlags applied to every AZ in this cluster. (see [below for nested schema](#nestedblock--clusters--user_intent--specific_gflags--per_process)) ### Nested Schema for `clusters.user_intent.specific_gflags.per_az` Required: - `az_uuid` (String) Availability zone UUID for these overrides. Optional: - `master_gflags` (Map of String) Master GFlags for nodes in this AZ. - `tserver_gflags` (Map of String) TServer GFlags for nodes in this AZ. ### Nested Schema for `clusters.user_intent.specific_gflags.per_process` Optional: - `master_gflags` (Map of String) Master process GFlags for this cluster. Invalid on a Read Replica (ASYNC) cluster -- ASYNC clusters have no master processes. - `tserver_gflags` (Map of String) TServer process GFlags for this cluster. ### Nested Schema for `clusters.cloud_list` Required: - `provider` (String) YBA provider UUID. Use the same value as user_intent.provider. Optional: - `region_list` (Block List) Regions participating in placement for this cloud provider. (see [below for nested schema](#nestedblock--clusters--cloud_list--region_list)) Read-Only: - `code` (String) Cloud provider code (e.g. aws, gcp, azu, onprem). Derived from the provider UUID. ### Nested Schema for `clusters.cloud_list.region_list` Required: - `code` (String) Region code identifying the target region (e.g. us-east-1, us-central1). Optional: - `az_list` (Block List) Availability zones participating in placement for this region. Note: this is a positional list. When removing a zone, the plan may show adjacent zones appearing to change (code, num_nodes, etc.) due to index shifting. The provider resolves zones by code before sending the API request, so the actual operation is always correct regardless of how the plan is displayed. (see [below for nested schema](#nestedblock--clusters--cloud_list--region_list--az_list)) Read-Only: - `name` (String) Region display name as returned by YBA. - `uuid` (String) Region UUID. ### Nested Schema for `clusters.cloud_list.region_list.az_list` Required: - `code` (String) Availability zone code (e.g. us-east-1a, us-central1-a). Optional: - `is_affinitized` (Boolean) Whether this zone is preferred (affinitized) for read traffic. When true, YBA routes read requests to nodes in this zone first. - `leader_preference` (Number) Master leader placement priority for this zone. Zero means no preference. A lower non-zero value indicates higher priority (e.g. 1 is preferred over 2). Multiple zones may share the same value. When any zone has a non-zero value, all unique non-zero priority values across zones must form a contiguous sequence with no gaps (e.g. 1,2,3 is valid; 1,3 is not). YBA enforces this and rejects requests with gaps. Must be non-negative. This setting is most effective with replication_factor >= 3, where the YBA load balancer can move leaders between zones without data migration. For replication_factor = 1 (single master) the setting is effectively a no-op: there are no follower replicas in other zones to promote, so leader placement cannot be changed without physically migrating tablet data. - `num_nodes` (Number) Number of nodes to place in this zone. When cloud_list is set, these per-AZ counts are the authoritative source of truth: YBA derives the total node count from their sum and user_intent.num_nodes is ignored. YBA removes any AZ whose node count reaches 0 from the placement; do not set this to 0 unless the intent is to remove the zone. - `replication_factor` (Number) Number of replicas placed in this zone. The sum of per-AZ values across the cluster must equal user_intent.replication_factor, with one explicit exception: a 2-AZ cluster at RF=3 may use [1,1] (sum=2). replication_factor=0 is permitted only when the number of zones exceeds user_intent.replication_factor. Distributions YBA considers invalid for the topology are silently rewritten - neither the YBA API nor the YBA UI surfaces a warning - leaving no effective change and causing the apply to abort. Omit this field on every az_list entry to let YBA compute the default distribution. Read-Only: - `secondary_subnet` (String) Secondary subnet ID for this zone, inherited from the provider. - `subnet` (String) Primary subnet ID for this zone, inherited from the provider. - `uuid` (String) Availability zone UUID. ### Nested Schema for `communication_ports` Optional: - `master_http_port` (Number) Master HTTP port. - `master_rpc_port` (Number) Master RPC port. - `node_exporter_port` (Number) Node exporter port. - `redis_server_http_port` (Number) Redis (YEDIS) server HTTP port. Cannot be changed after universe creation. - `redis_server_rpc_port` (Number) Redis (YEDIS) server RPC port. Cannot be changed after universe creation. - `tserver_http_port` (Number) TServer HTTP port. - `tserver_rpc_port` (Number) TServer RPC port. - `yb_controller_rpc_port` (Number) YB Controller RPC port. Cannot be changed after universe creation. - `yql_server_http_port` (Number) YCQL server HTTP port. Cannot be changed after universe creation. - `yql_server_rpc_port` (Number) YCQL server RPC port. Cannot be changed after universe creation. - `ysql_server_http_port` (Number) YSQL server HTTP port. Cannot be changed after universe creation. - `ysql_server_rpc_port` (Number) YSQL server RPC port. Cannot be changed after universe creation. ### Nested Schema for `db_version_upgrade_options` Optional: - `finalize` (Boolean) Whether to finalize the DB version upgrade. When false (default), the upgrade pauses at PreFinalize state for a monitoring phase; set to true and re-apply to commit when ready. When true, FinalizeUpgrade is called automatically after the upgrade task completes. - `rollback` (Boolean) Set to true to roll back a pending DB version upgrade when db_version_upgrade_state is PreFinalize. Mutually exclusive with finalize = true. After rollback the universe returns to Ready state running the previous DB version. The provider automatically resets this field to false in state after a successful rollback. ### Nested Schema for `delete_options` Optional: - `delete_backups` (Boolean) Flag indicating whether the backups should be deleted with the universe. False by default. - `delete_certs` (Boolean) Flag indicating whether the certificates should be deleted with the universe. False by default. - `force_delete` (Boolean) Force delete universe with errors. False by default. ### Nested Schema for `full_move` Optional: - `allow` (Boolean) Explicit acknowledgment required to perform operations that trigger a FULL MOVE on the Primary or Read Replica Cluster: volume_size decrease (any instance type); num_volumes change with same instance type; storage_type change (any instance type). False by default; set to true when the full-move implications have been reviewed and accepted. Plan-time validation rejects full-move-triggering edits when allow = false, and apply-time pre-flight aborts when YBA returns FULL_MOVE as the only valid update option. - `force` (Boolean) When true, perform a FULL MOVE even when YBA reports that smart resize (in-place rolling update) is also available for the planned edit. Intended for specific one-off operations where the operator wants the stronger guarantees of a full rebuild (fresh nodes, no lingering state) over the speed and lower cost of smart resize. Requires allow = true; setting force = true with allow = false is rejected at plan time. Has no effect when YBA does not return FULL_MOVE as an option for the planned edit. Recommended usage: revert to force = false after the targeted operation completes. Leaving force = true in configuration routes every subsequent eligible edit through FULL MOVE, which requires 2x node capacity during migration and takes significantly longer than smart resize. ### Nested Schema for `node_restart_settings` Optional: - `sleep_after_master_restart_millis` (Number) Milliseconds to sleep after each master node restart. Must be 0 or a positive integer. Defaults to 180000 (3 minutes), matching the YugabyteDB Anywhere platform default. - `sleep_after_tserver_restart_millis` (Number) Milliseconds to sleep after each TServer node restart. Must be 0 or a positive integer. Defaults to 180000 (3 minutes), matching the YugabyteDB Anywhere platform default. - `upgrade_option` (String) Node restart strategy applied to all upgrade operations. Allowed values: Rolling, Non-Rolling, Non-Restart. Defaults to Rolling (YugabyteDB Anywhere platform default). TLS toggle always uses Non-Rolling; ResizeNode and VMImageUpgrade always use Rolling, regardless of this setting. ### Nested Schema for `timeouts` Optional: - `create` (String) - `delete` (String) - `update` (String) ### Nested Schema for `node_details_set` Read-Only: - `az_uuid` (String) - `cloud_info` (List of Object) (see [below for nested schema](#nestedobjatt--node_details_set--cloud_info)) - `crons_active` (Boolean) - `dedicated_to` (String) - `disks_are_mounted_by_uuid` (Boolean) - `is_master` (Boolean) - `is_redis_server` (Boolean) - `is_tserver` (Boolean) - `is_yql_server` (Boolean) - `is_ysql_server` (Boolean) - `last_volume_update_time` (String) - `machine_image` (String) - `master_http_port` (Number) - `master_rpc_port` (Number) - `master_state` (String) - `node_exporter_port` (Number) - `node_idx` (Number) - `node_name` (String) - `node_uuid` (String) - `otel_collector_metrics_port` (Number) - `placement_uuid` (String) - `redis_server_http_port` (Number) - `redis_server_rpc_port` (Number) - `ssh_port_override` (Number) - `ssh_user_override` (String) - `state` (String) - `tserver_http_port` (Number) - `tserver_rpc_port` (Number) - `yb_controller_http_port` (Number) - `yb_controller_rpc_port` (Number) - `yb_prebuilt_ami` (Boolean) - `yql_server_http_port` (Number) - `yql_server_rpc_port` (Number) - `ysql_server_http_port` (Number) - `ysql_server_rpc_port` (Number) ### Nested Schema for `node_details_set.cloud_info` Read-Only: - `assign_public_ip` (Boolean) - `az` (String) - `cloud` (String) - `instance_type` (String) - `lun_indexes` (List of Number) - `mount_roots` (String) - `private_dns` (String) - `private_ip` (String) - `public_dns` (String) - `public_ip` (String) - `region` (String) - `root_volume` (String) - `secondary_private_ip` (String) - `secondary_subnet_id` (String) - `subnet_id` (String) - `use_time_sync` (Boolean) ## Operation timeouts The `timeouts` block accepts `create`, `update`, and `delete` durations and uses these defaults when omitted: | Operation | Default | |---|---| | `create` | `60m` | | `update` | `60m` | | `delete` | `30m` | Large universes (many nodes, large volumes, or full-move edits) can exceed these defaults. Raise them per-resource when needed: ```terraform resource "yba_universe" "example" { timeouts { create = "120m" update = "120m" delete = "45m" } # ... other fields ... } ``` Hitting a timeout aborts the Terraform-side wait but does not cancel the YBA task. Re-running `terraform apply` after the YBA task finishes will reconcile state. ## Known Issues ### Fields sourced from data sources show as "(known after apply)" during provider edits Several `clusters.user_intent` fields are commonly sourced from data sources that carry a direct value dependency on the provider resource: | Field | Typical source | |---|---| | `access_key_code` | `data.yba_provider_key` | | `region_list` | `data.yba_provider_regions..regions_uuid` | When the provider resource is modified in the same apply (e.g. adding a region), Terraform marks these outputs as deferred and shows the universe fields as changing to `(known after apply)`: ``` ~ user_intent { ~ access_key_code = "my-access-key" -> (known after apply) ~ region_list = [...] -> (known after apply) } ``` **This diff is cosmetic.** The underlying universe configuration is unchanged; all values are resolved correctly before the universe operation runs. Applying will not modify the universe itself. The values will return to their prior display on the next plan once the provider edit has been applied. ## Import Universes can be imported using `universe uuid`: ```sh terraform import yba_universe.universe_name ``` ### Sensitive fields are not imported `terraform import` reads universe state from the YugabyteDB Anywhere API, which does not return plaintext secrets. For the following `clusters.user_intent` fields, the API returns the literal string `REDACTED`, and that sentinel is what lands in your state file after import: - `ysql_password` - `ycql_password` On the next plan Terraform sees a diff from `REDACTED` to the value in your configuration, and the universe update guard rejects the apply (you cannot change passwords after universe creation). Choose one of the following to resolve this: 1. **Ignore the field in your configuration** (recommended when the password is managed outside Terraform): ```hcl resource "yba_universe" "universe_name" { # ... lifecycle { ignore_changes = [ clusters[0].user_intent[0].ysql_password, clusters[0].user_intent[0].ycql_password, ] } } ``` State will continue to hold `REDACTED` for these fields; this is expected and does not affect universe operation. 2. **Patch the state with the real secret value** so Terraform sees it as unchanged. This requires the current password and direct state edits (`terraform state pull` / `terraform state push`, or `terraform state rm` plus re-import after manual seeding); only use it when you intend to keep managing the password through Terraform.