Backport: pass on properties of Terraform typed application to Configuration (#2872)

Pass on properties like writeConnectionSecretRef, Region and providerRef
to Configuration.

Backport #2847

Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>

Makefile

@@ -155,7 +155,7 @@ e2e-setup:
 	helm upgrade --install --create-namespace --namespace vela-system --set image.pullPolicy=IfNotPresent --set image.repository=vela-core-test --set applicationRevisionLimit=5 --set dependCheckWait=10s --set image.tag=$(GIT_COMMIT) --wait kubevela ./charts/vela-core
 	helm upgrade --install --create-namespace --namespace oam-runtime-system --set image.pullPolicy=IfNotPresent --set image.repository=vela-core-test --set dependCheckWait=10s --set image.tag=$(GIT_COMMIT) --wait oam-runtime ./charts/oam-runtime
 	bin/vela addon enable fluxcd
-	bin/vela addon enable terraform
+	bin/vela addon enable terraform-alibaba ALICLOUD_ACCESS_KEY=xxx ALICLOUD_SECRET_KEY=yyy ALICLOUD_REGION=cn-beijing
 	ginkgo version
 	ginkgo -v -r e2e/setup
 
@@ -204,10 +204,12 @@ e2e-cleanup:
 	rm -rf ~/.vela
 
 image-cleanup:
+ifneq (, $(shell which docker))
 # Delete Docker image
 ifneq ($(shell docker images -q $(VELA_CORE_TEST_IMAGE)),)
 	docker rmi -f $(VELA_CORE_TEST_IMAGE)
 endif
+endif
 
 end-e2e-core:
 	sh ./hack/e2e/end_e2e_core.sh
@@ -257,7 +259,7 @@ core-uninstall: manifests
 	kubectl delete -f charts/vela-core/crds/
 
 # Generate manifests e.g. CRD, RBAC etc.
-manifests: installcue kustomize
+manifests: installcue kustomize addon
 	go generate $(foreach t,pkg apis,./$(t)/...)
 	# TODO(yangsoon): kustomize will merge all CRD into a whole file, it may not work if we want patch more than one CRD in this way
 	$(KUSTOMIZE) build config/crd -o config/crd/base/core.oam.dev_applications.yaml
@@ -265,7 +267,6 @@ manifests: installcue kustomize
 	go run ./hack/crd/dispatch/dispatch.go config/crd/base charts/vela-core/crds charts/oam-runtime/crds runtime/ charts/vela-minimal/crds
 	rm -f config/crd/base/*
 	./vela-templates/gen_definitions.sh
-	go run ./vela-templates/gen_addons.go
 
 GOLANGCILINT_VERSION ?= v1.38.0
 HOSTOS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
@@ -349,3 +350,7 @@ check-license-header:
 
 def-install:
 	./hack/utils/installdefinition.sh
+
+# generate addons to auto-gen and charts
+addon:
+	go run ./vela-templates/gen_addons.go

apis/core.oam.dev/common/types.go

@@ -19,13 +19,11 @@ package common
 import (
 	"encoding/json"
 
+	"github.com/oam-dev/terraform-controller/api/v1beta1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
-	types "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
-
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
-
 	"github.com/oam-dev/kubevela/apis/standard.oam.dev/v1alpha1"
 )
 
@@ -117,8 +115,7 @@ type Terraform struct {
 	// Path is the sub-directory of remote git repository. It's valid when remote is set
 	Path string `json:"path,omitempty"`
 
-	// ProviderReference specifies the reference to Provider
-	ProviderReference *types.Reference `json:"providerRef,omitempty"`
+	v1beta1.BaseConfigurationSpec `json:",inline"`
 }
 
 // A WorkloadTypeDescriptor refer to a Workload Type

apis/core.oam.dev/common/zz_generated.deepcopy.go

@@ -21,7 +21,6 @@ limitations under the License.
 package common
 
 import (
-	crossplane_runtime "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
@@ -559,11 +558,7 @@ func (in *SubStepsStatus) DeepCopy() *SubStepsStatus {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Terraform) DeepCopyInto(out *Terraform) {
 	*out = *in
-	if in.ProviderReference != nil {
-		in, out := &in.ProviderReference, &out.ProviderReference
-		*out = new(crossplane_runtime.Reference)
-		**out = **in
-	}
+	in.BaseConfigurationSpec.DeepCopyInto(&out.BaseConfigurationSpec)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Terraform.

charts/oam-runtime/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/oam-runtime/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/oam-runtime/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/oam-runtime/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/oam-runtime/templates/oam-runtime-controller.yaml

@@ -126,7 +126,7 @@ spec:
             {{ end }}
             - "--system-definition-namespace={{ .Values.systemDefinitionNamespace }}"
             - "--oam-spec-ver={{ .Values.OAMSpecVer }}"
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/oam-runtime/templates/test/test-application.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Pod
 metadata:
-  name: "{{ include "oam-runtime.fullname" . }}-test-connection"
+  name: {{ include "oam-runtime.fullname" . }}-test-connection
   labels:
   {{- include "oam-runtime.labels" . | nindent 4 }}
   annotations:
@@ -9,7 +9,7 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: busybox
+      image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
       command: ['wget']
       args: ['{{ include "oam-runtime.fullname" . }}:{{ .Values.healthCheck.port }}']
   restartPolicy: Never

charts/oam-runtime/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: "all"
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -98,4 +100,9 @@ concurrentReconciles: 4
 dependCheckWait: 30s
 
 # OAMSpecVer is the oam spec version controller want to setup
-OAMSpecVer: "v0.2"
+OAMSpecVer: "v0.2"
+
+test:
+  app:
+    repository: oamdev/busybox
+    tag: v1

charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

charts/vela-core/crds/core.oam.dev_componentdefinitions.yaml

@@ -179,6 +179,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -192,11 +197,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -206,6 +215,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -467,6 +492,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -480,11 +510,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -494,6 +528,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

charts/vela-core/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-core/templates/addons/terraform-alibaba.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
+        addons.oam.dev/name: terraform-alibaba
+      name: terraform-alibaba
+      namespace: vela-system
+    spec:
+      components:
+      - name: alibaba-account-creds-[[ index .Args "providerName" ]]
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: alibaba-account-creds-[[ index .Args "providerName" ]]
+            namespace: vela-system
+          stringData:
+            credentials: |
+              accessKeyID: [[ index .Args "ALICLOUD_ACCESS_KEY" ]]
+              accessKeySecret: [[ index .Args "ALICLOUD_SECRET_KEY" ]]
+              securityToken: [[ index .Args "ALICLOUD_SECURITY_TOKEN" ]]
+          type: Opaque
+        type: raw
+      - name: alibaba-[[ index .Args "providerName" ]]
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: '[[ index .Args "providerName" ]]'
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: alibaba-account-creds-[[ index .Args "providerName" ]]
+                namespace: vela-system
+              source: Secret
+            provider: alibaba
+            region: '[[ index .Args "ALICLOUD_REGION" ]]'
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
+    addons.oam.dev/name: terraform-alibaba
+  labels:
+    addons.oam.dev/type: terraform-alibaba
+  name: terraform-alibaba
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform-aws.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for AWS
+        addons.oam.dev/name: terraform-aws
+      name: terraform-aws
+      namespace: vela-system
+    spec:
+      components:
+      - name: aws-account-creds
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: aws-account-creds
+            namespace: vela-system
+          stringData:
+            credentials: |
+              awsAccessKeyID: [[ index .Args "AWS_ACCESS_KEY_ID" ]]
+              awsSecretAccessKey: [[ index .Args "AWS_SECRET_ACCESS_KEY" ]]
+              awsSessionToken: [[ index .Args "AWS_SESSION_TOKEN" ]]
+          type: Opaque
+        type: raw
+      - name: aws
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: aws
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: aws-account-creds
+                namespace: vela-system
+              source: Secret
+            provider: aws
+            region: '[[ index .Args "AWS_DEFAULT_REGION" ]]'
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for AWS
+    addons.oam.dev/name: terraform-aws
+  labels:
+    addons.oam.dev/type: terraform-aws
+  name: terraform-aws
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform-azure.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+data:
+  application: |
+    apiVersion: core.oam.dev/v1beta1
+    kind: Application
+    metadata:
+      annotations:
+        addons.oam.dev/description: Kubernetes Terraform Controller for Azure
+        addons.oam.dev/name: terraform-azure
+      name: terraform-azure
+      namespace: vela-system
+    spec:
+      components:
+      - name: azure-account-creds
+        properties:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: azure-account-creds
+            namespace: vela-system
+          stringData:
+            credentials: |
+              armClientID: [[ index .Args "ARM_CLIENT_ID" ]]
+              armClientSecret: [[ index .Args "ARM_CLIENT_SECRET" ]]
+              armSubscriptionID: [[ index .Args "ARM_SUBSCRIPTION_ID" ]]
+              armTenantID: [[ index .Args "ARM_TENANT_ID" ]]
+          type: Opaque
+        type: raw
+      - name: azure
+        properties:
+          apiVersion: terraform.core.oam.dev/v1beta1
+          kind: Provider
+          metadata:
+            name: azure
+            namespace: default
+          spec:
+            credentials:
+              secretRef:
+                key: credentials
+                name: azure-account-creds
+                namespace: vela-system
+              source: Secret
+            provider: azure
+        type: raw
+      workflow:
+        steps:
+        - name: ""
+          properties:
+            name: terraform
+            namespace: vela-system
+          type: depends-on-app
+        - name: ""
+          type: apply-application
+    status:
+      rollout:
+        batchRollingState: ""
+        currentBatch: 0
+        lastTargetAppRevision: ""
+        rollingState: ""
+        upgradedReadyReplicas: 0
+        upgradedReplicas: 0
+kind: ConfigMap
+metadata:
+  annotations:
+    addons.oam.dev/description: Kubernetes Terraform Controller for Azure
+    addons.oam.dev/name: terraform-azure
+  labels:
+    addons.oam.dev/type: terraform-azure
+  name: terraform-azure
+  namespace: {{.Values.systemDefinitionNamespace}}

charts/vela-core/templates/addons/terraform.yaml

@@ -11,20 +11,35 @@ data:
       namespace: vela-system
     spec:
       components:
-      - name: ns-terraform-system
-        properties:
-          apiVersion: v1
-          kind: Namespace
-          metadata:
-            name: terraform-system
-        type: raw
       - name: terraform-controller
         properties:
           chart: terraform-controller
           repoType: helm
           url: https://charts.kubevela.net/addons
-          version: 0.2.6
+          version: 0.2.10
         type: helm
+      - name: alibaba-redis
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                Redis
+            labels:
+              type: terraform
+            name: alibaba-redis
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules/alibaba/redis
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: alibaba-ack
         properties:
           apiVersion: core.oam.dev/v1beta1
@@ -48,6 +63,29 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: alibaba-ask
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                Serverless Kubernetes (ASK)
+            labels:
+              type: terraform
+            name: alibaba-ask
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/cs/serverless-kubernetes
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: alibaba-eip
         properties:
           apiVersion: core.oam.dev/v1alpha2
@@ -76,6 +114,8 @@ data:
           kind: ComponentDefinition
           metadata:
             annotations:
+              cloud-resource/console-url: https://oss.console.aliyun.com/bucket/oss-{ALICLOUD_REGION}/{BUCKET_NAME}/overview
+              cloud-resource/identifier: BUCKET_NAME
               definition.oam.dev/description: Terraform configuration for Alibaba Cloud
                 OSS object
             labels:
@@ -103,6 +143,9 @@ data:
           kind: ComponentDefinition
           metadata:
             annotations:
+              cloud-resource/console-url: https://rdsnext.console.aliyun.com/detail/{DB_ID}/basicInfo?&region={ALICLOUD_REGION}
+              cloud-resource/identifier: DB_ID
+              cloud-resource/sensitive-outputs: DB_PASSWORD
               definition.oam.dev/description: Terraform configuration for Alibaba Cloud
                 RDS object
             labels:
@@ -126,6 +169,10 @@ data:
                     security_ips = ["0.0.0.0/0",]
                   }
 
+                  output "DB_ID" {
+                    value = module.rds.db_instance_id
+                  }
+
                   output "DB_NAME" {
                     value = module.rds.this_db_instance_name
                   }
@@ -173,6 +220,98 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: alibaba-sls-project
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                SLS Project
+            labels:
+              type: terraform
+            name: alibaba-sls-project
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/sls/project
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-sls-store
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                SLS Store
+            labels:
+              type: terraform
+            name: alibaba-sls-store
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/sls/store
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-vpc
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                VPC
+            labels:
+              type: terraform
+            name: alibaba-vpc
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/vpc
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
+      - name: alibaba-vswitch
+        properties:
+          apiVersion: core.oam.dev/v1beta1
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+                VSwitch
+            labels:
+              type: terraform
+            name: alibaba-vswitch
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: https://github.com/kubevela-contrib/terraform-modules.git
+                path: alibaba/vswitch
+                type: remote
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       - name: aws-s3
         properties:
           apiVersion: core.oam.dev/v1alpha2
@@ -329,19 +468,119 @@ data:
                 apiVersion: terraform.core.oam.dev/v1beta1
                 kind: Configuration
         type: raw
+      - name: azure-storage-account
+        properties:
+          apiVersion: core.oam.dev/v1alpha2
+          kind: ComponentDefinition
+          metadata:
+            annotations:
+              definition.oam.dev/description: Terraform configuration for Azure Blob Storage
+                Account
+              provider: azure
+            labels:
+              type: terraform
+            name: azure-storage-account
+            namespace: vela-system
+          spec:
+            schematic:
+              terraform:
+                configuration: |
+                  # Configure the Microsoft Azure Provider
+                  provider "azurerm" {
+                    features {}
+                  }
+
+                  resource "azurerm_resource_group" "rsg" {
+                    count    = var.create_rsg ? 1 : 0
+                    name     = var.resource_group_name
+                    location = var.location
+                  }
+
+                  resource "azurerm_storage_account" "sa" {
+                    name                      = var.name
+                    resource_group_name       = var.create_rsg ? azurerm_resource_group.rsg[0].name : var.resource_group_name
+                    location                  = var.location
+                    account_tier              = "Standard"
+                    account_replication_type  = "GRS"
+                    enable_https_traffic_only = true
+
+                    dynamic "static_website" {
+                      for_each = var.static_website
+                      content {
+                        index_document     = static_website.value["index_document"]
+                        error_404_document = static_website.value["error_404_document"]
+                      }
+                    }
+
+                    tags = var.tags
+                  }
+
+                  variable "create_rsg" {
+                    description = "Conditional if resource group should be created. Defaults to 'true'."
+                    type        = bool
+                    default     = true
+                  }
+
+                  variable "resource_group_name" {
+                    description = "Name of resource group. Defaults to 'rsg'."
+                    type        = string
+                    default     = "rsg"
+                  }
+
+                  variable "name" {
+                    description = "Name of storage account. Defaults to 'storageaccount'."
+                    type        = string
+                    default     = "storageaccount"
+                  }
+
+                  variable "location" {
+                    description = "Location of storage account. Defaults to 'West Europe'."
+                    type        = string
+                    default     = "West Europe"
+                  }
+
+                  variable "tags" {
+                    description = "Tags for storage account. Defaults to '{}'."
+                    type        = map(string)
+                    default     = {}
+                  }
+
+                  variable "static_website" {
+                    description = "Static website configuration. Defaults to disabled."
+                    type        = list(map(string))
+                    default     = [{
+                      index_document = null
+                      error_404_document = null
+                    }]
+                  }
+
+                  output "BLOB_CONNECTION_STRING" {
+                    description = "Blob storage connection string"
+                    sensitive   = true
+                    value       = azurerm_storage_account.sa.primary_connection_string
+                  }
+
+                  output "BLOB_WEB_ENDPOINT" {
+                    description = "Blob storage static web endpoint"
+                    value       = azurerm_storage_account.sa.primary_web_endpoint
+                  }
+                providerRef:
+                  name: azure
+                  namespace: default
+            workload:
+              definition:
+                apiVersion: terraform.core.oam.dev/v1beta1
+                kind: Configuration
+        type: raw
       workflow:
         steps:
-        - name: checking-depends-on
+        - name: ""
           properties:
             name: fluxcd
             namespace: vela-system
           type: depends-on-app
-        - name: apply-ns
-          properties:
-            component: ns-terraform-system
-          type: apply-component
-        - name: apply-resources
-          type: apply-remaining
+        - name: ""
+          type: apply-application
     status:
       rollout:
         batchRollingState: ""

charts/vela-core/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/vela-core/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/vela-core/templates/cluster-gateway.yaml

@@ -35,7 +35,7 @@ spec:
             {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
             - "--cert-dir={{ .Values.multicluster.clusterGateway.secureTLS.certPath }}"
             {{ end }}
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           resources:
           {{- toYaml .Values.multicluster.clusterGateway.resources | nindent 12 }}
@@ -132,7 +132,7 @@ spec:
     spec:
       containers:
       - name: create
-        image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+        image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
         imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
         args:
           - create
@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
       - name: patch
-        image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+        image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
         imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
         command:
           - /patch

charts/vela-core/templates/kubevela-apiserver.yaml

@@ -30,7 +30,7 @@ spec:
           args:
             - "apiserver"
             - "--port={{ .Values.apiServer.port }}"
-          image: {{ .Values.apiserverImage.repository }}:{{ .Values.apiserverImage.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.apiserverImage.repository }}:{{ .Values.apiserverImage.tag }}
           imagePullPolicy: {{ quote .Values.apiserverImage.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-core/templates/kubevela-controller.yaml

@@ -130,7 +130,7 @@ spec:
             {{ if .Values.multicluster.enabled }}
             - "--enable-cluster-gateway"
             {{ end }}
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-core/templates/test/test-application.yaml

@@ -10,7 +10,7 @@ spec:
     - name: helm-test-express-server
       type: webservice
       properties:
-        image: crccheck/hello-world
+        image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
         port: 8000
       traits:
         - type: ingress
@@ -30,7 +30,7 @@ spec:
   serviceAccountName: kubevela-vela-core
   containers:
     - name: {{ .Release.Name }}-application-test
-      image: alpine/k8s:1.18.2
+      image: {{ .Values.imageRegistry }}{{ .Values.test.k8s.repository }}:{{ .Values.test.k8s.tag }}
       imagePullPolicy: IfNotPresent
       command:
         - /bin/bash

charts/vela-core/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: ""
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -130,4 +132,12 @@ multicluster:
         memory: 200Mi
     secureTLS:
       enabled: true
-      certPath: /etc/k8s-cluster-gateway-certs
+      certPath: /etc/k8s-cluster-gateway-certs
+
+test:
+  app:
+    repository: oamdev/hello-world
+    tag: v1
+  k8s:
+    repository: oamdev/alpine-k8s
+    tag: 1.18.2

charts/vela-minimal/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

charts/vela-minimal/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

charts/vela-minimal/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

charts/vela-minimal/templates/admission-webhooks/job-patch/job-createSecret.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create

charts/vela-minimal/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - patch

charts/vela-minimal/templates/cluster-gateway.yaml

@@ -35,7 +35,7 @@ spec:
             {{ if .Values.multicluster.clusterGateway.secureTLS.enabled }}
             - "--cert-dir={{ .Values.multicluster.clusterGateway.secureTLS.certPath }}"
             {{ end }}
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           resources:
           {{- toYaml .Values.multicluster.clusterGateway.resources | nindent 12 }}
@@ -132,7 +132,7 @@ spec:
     spec:
       containers:
         - name: create
-          image: {{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.admissionWebhooks.patch.image.repository }}:{{ .Values.admissionWebhooks.patch.image.tag }}
           imagePullPolicy: {{ .Values.admissionWebhooks.patch.image.pullPolicy }}
           args:
             - create
@@ -175,7 +175,7 @@ spec:
     spec:
       containers:
         - name: patch
-          image: {{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.multicluster.clusterGateway.image.repository }}:{{ .Values.multicluster.clusterGateway.image.tag }}
           imagePullPolicy: {{ .Values.multicluster.clusterGateway.image.pullPolicy }}
           command:
             - /patch

charts/vela-minimal/templates/kubevela-apiserver.yaml

@@ -30,7 +30,7 @@ spec:
           args:
             - "apiserver"
             - "--bind-addr=0.0.0.0:{{ .Values.apiServer.port }}"
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-minimal/templates/kubevela-controller.yaml

@@ -132,7 +132,7 @@ spec:
             {{ if .Values.multicluster.enabled }}
             - "--enable-cluster-gateway"
             {{ end }}
-          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          image: {{ .Values.imageRegistry }}{{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ quote .Values.image.pullPolicy }}
           resources:
           {{- toYaml .Values.resources | nindent 12 }}

charts/vela-minimal/templates/test/test-application.yaml

@@ -10,53 +10,5 @@ spec:
     - name: helm-test-express-server
       type: webservice
       properties:
-        image: crccheck/hello-world
+        image: {{ .Values.imageRegistry }}{{ .Values.test.app.repository }}:{{ .Values.test.app.tag }}
         port: 8000
-      # traits:
-      #   - type: ingress
-      #     properties:
-      #       domain: testsvc.example.com
-      #       http:
-      #         "/": 8000
-# ---
-# apiVersion: v1
-# kind: Pod
-# metadata:
-#   name: "{{ .Release.Name }}-application-test"
-#   annotations:
-#     "helm.sh/hook": test
-#     helm.sh/hook-delete-policy: hook-succeeded
-# spec:
-#   serviceAccountName: kubevela-vela-core
-#   containers:
-#     - name: {{ .Release.Name }}-application-test
-#       image: alpine/k8s:1.18.2
-#       imagePullPolicy: IfNotPresent
-#       command:
-#         - /bin/bash
-#         - -ec
-#         - |
-
-#           set -e
-
-#           echo "Waiting application is ready..."
-
-#           echo "waiting for application being Ready"
-#           kubectl -n vela-system wait --for=condition=Ready applications.core.oam.dev helm-test-vela-app --timeout=3m
-#           echo "application is Ready"
-
-#           # wait for deploy being created
-#           echo "waiting for deployment being available"
-#           kubectl -n vela-system wait --for=condition=available deployments helm-test-express-server --timeout 3m
-#           echo "deployment being available"
-
-#           # wait for ingress being created
-#           while ! [ `kubectl -n vela-system get ing helm-test-express-server | grep -v NAME | wc -l` = 1 ]; do
-#             echo "waiting for ingress being created"
-#             sleep 1
-#           done
-
-
-
-#           echo "Application and its components are created"
-#   restartPolicy: Never

charts/vela-minimal/values.yaml

@@ -7,6 +7,8 @@ replicaCount: 1
 applyOnceOnly: "off"
 
 disableCaps: "manualscalertrait,containerizedwokrload,envbinding"
+
+imageRegistry: ""
 image:
   repository: oamdev/vela-core
   tag: latest
@@ -125,4 +127,9 @@ multicluster:
         memory: 200Mi
     secureTLS:
       enabled: true
-      certPath: /etc/k8s-cluster-gateway-certs
+      certPath: /etc/k8s-cluster-gateway-certs
+
+test:
+  app:
+    repository: oamdev/hello-world
+    tag: v1

docs/examples/terraform/cloud-resource-provision-and-consume/application-ask.yaml

@@ -0,0 +1,13 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-ask-sample
+spec:
+  components:
+    - name: sample-ask
+      type: alibaba-ask
+      properties:
+        name: kubevela
+
+        writeConnectionSecretToRef:
+          name: ask-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-rds.yaml

@@ -0,0 +1,14 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-rds-sample
+spec:
+  components:
+    - name: sample-db
+      type: alibaba-rds
+      properties:
+        instance_name: sample-db
+        account_name: oamtest
+        password: U34rfwefwefffaked
+        writeConnectionSecretToRef:
+          name: db-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-sls-project.yaml

@@ -0,0 +1,14 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-sls-project-sample
+spec:
+  components:
+    - name: sample-sls-project
+      type: alibaba-sls-project
+      properties:
+        name: kubevela-1112
+        description: "Managed by KubeVela"
+
+        writeConnectionSecretToRef:
+          name: sls-project-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-sls-store.yaml

@@ -0,0 +1,16 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-sls-store-sample
+spec:
+  components:
+    - name: sample-sls-store
+      type: alibaba-sls-store
+      properties:
+        store_name: kubevela-1111
+        store_retention_period: 30
+        store_shard_count: 2
+        store_max_split_shard_count: 2
+
+        writeConnectionSecretToRef:
+          name: sls-store-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-vpc.yaml

@@ -0,0 +1,13 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-vpc-sample
+spec:
+  components:
+    - name: sample-vpc
+      type: alibaba-vpc
+      properties:
+        vpc_cidr: "172.16.0.0/12"
+
+        writeConnectionSecretToRef:
+          name: vpc-conn

docs/examples/terraform/cloud-resource-provision-and-consume/application-vswitch.yaml

@@ -0,0 +1,15 @@
+apiVersion: core.oam.dev/v1beta1
+kind: Application
+metadata:
+  name: app-vpc-sample
+spec:
+  components:
+    - name: sample-vswitch
+      type: alibaba-vswitch
+      properties:
+        vpc_cidr: "172.16.0.0/12"
+        vswitch_cidr: "172.16.0.0/18"
+        zone_id: cn-beijing-a
+
+        writeConnectionSecretToRef:
+          name: vswitch-conn

go.mod

@@ -36,7 +36,7 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.1
 	github.com/oam-dev/cluster-gateway v1.1.6
 	github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28
-	github.com/oam-dev/terraform-controller v0.2.6
+	github.com/oam-dev/terraform-controller v0.2.12
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/onsi/ginkgo v1.16.4
 	github.com/onsi/gomega v1.16.0

go.sum

@@ -181,6 +181,7 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk5
 github.com/alessio/shellescape v1.2.2 h1:8LnL+ncxhWT2TR00dfJRT25JWWrhkMZXneHVWnetDZg=
 github.com/alessio/shellescape v1.2.2/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
 github.com/alexkohler/prealloc v1.0.0/go.mod h1:VetnK3dIgFBBKmg0YnD9F9x6Icjd+9cvfHR56wJVlKE=
+github.com/aliyun/alibaba-cloud-sdk-go v1.61.1318/go.mod h1:9CMdKNL3ynIGPpfTcdwTvIm8SGuAZYYC4jFVSSvE1YQ=
 github.com/aliyun/aliyun-oss-go-sdk v2.0.4+incompatible/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.0/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
@@ -673,6 +674,7 @@ github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
@@ -964,6 +966,7 @@ github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFF
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v0.0.0-20180701071628-ab8a2e0c74be/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -1214,8 +1217,8 @@ github.com/oam-dev/stern v1.13.1 h1:Gt7xMBmQjRueHVFjRo5CHDTVhiYrssjlmvPwRiZtq7c=
 github.com/oam-dev/stern v1.13.1/go.mod h1:0pLjZt0amXE/ErF16Rdrgd98H2owN8Hmn3/7CX5+AeA=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28 h1:tD8HiFKnt0jnwdTWjeqUnfnUYLD/+Nsmj8ZGIxqDWiU=
 github.com/oam-dev/terraform-config-inspect v0.0.0-20210418082552-fc72d929aa28/go.mod h1:Mu8i0/DdplvnjwRbAYPsc8+LRR27n/mp8VWdkN10GzE=
-github.com/oam-dev/terraform-controller v0.2.6 h1:aoEj4sfxDMBdTkM5uKYmjVFOgjhYeYBm0xzdRb4+Xu0=
-github.com/oam-dev/terraform-controller v0.2.6/go.mod h1:xFSCd3Nwuh6P1HEpx5jDnLzN35T9hoH53zdojDYE6LI=
+github.com/oam-dev/terraform-controller v0.2.12 h1:WIcpV4JWVOiN52DOjwiOTvy4+snSWzX2ltFAnXP1QqE=
+github.com/oam-dev/terraform-controller v0.2.12/go.mod h1:DbdquoYxiWoZnYpRsHH/HKdR1REYdwRQycYJuC1CUdQ=
 github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=

legacy/charts/vela-core-legacy/crds/core.oam.dev_applicationrevisions.yaml

@@ -1232,6 +1232,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1245,11 +1251,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1259,6 +1270,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1639,6 +1667,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1652,11 +1686,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1666,6 +1705,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -1944,6 +2000,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -1957,11 +2019,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -1971,6 +2038,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3372,6 +3456,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3385,11 +3475,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3399,6 +3494,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -3672,6 +3784,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -3685,11 +3803,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -3699,6 +3822,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4061,6 +4201,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4074,11 +4220,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4088,6 +4239,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4329,6 +4497,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4342,11 +4516,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4356,6 +4535,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object
@@ -4617,6 +4813,12 @@ spec:
                                 configuration:
                                   description: Configuration is Terraform Configuration
                                   type: string
+                                deleteResource:
+                                  default: true
+                                  description: DeleteResource will determine whether
+                                    provisioned cloud resources will be deleted when
+                                    CR is deleted
+                                  type: boolean
                                 path:
                                   description: Path is the sub-directory of remote
                                     git repository. It's valid when remote is set
@@ -4630,11 +4832,16 @@ spec:
                                       type: string
                                     namespace:
                                       default: default
-                                      description: Namespace of the secret.
+                                      description: Namespace of the referenced object.
                                       type: string
                                   required:
                                   - name
                                   type: object
+                                region:
+                                  description: Region is cloud provider's region.
+                                    It will override the region in the region field
+                                    of ProviderReference
+                                  type: string
                                 type:
                                   default: hcl
                                   description: Type specifies which Terraform configuration
@@ -4644,6 +4851,23 @@ spec:
                                   - json
                                   - remote
                                   type: string
+                                writeConnectionSecretToRef:
+                                  description: WriteConnectionSecretToReference specifies
+                                    the namespace and name of a Secret to which any
+                                    connection details for this managed resource should
+                                    be written. Connection details frequently include
+                                    the endpoint, username, and password required
+                                    to connect to the managed resource.
+                                  properties:
+                                    name:
+                                      description: Name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: Namespace of the secret.
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
                               required:
                               - configuration
                               type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_componentdefinitions.yaml

@@ -179,6 +179,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -192,11 +197,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -206,6 +215,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -467,6 +492,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -480,11 +510,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -494,6 +528,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_definitionrevisions.yaml

@@ -222,6 +222,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -235,11 +241,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -249,6 +260,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -510,6 +538,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -523,11 +557,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -537,6 +576,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -791,6 +847,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -804,11 +866,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -818,6 +885,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object
@@ -1053,6 +1137,12 @@ spec:
                               configuration:
                                 description: Configuration is Terraform Configuration
                                 type: string
+                              deleteResource:
+                                default: true
+                                description: DeleteResource will determine whether
+                                  provisioned cloud resources will be deleted when
+                                  CR is deleted
+                                type: boolean
                               path:
                                 description: Path is the sub-directory of remote git
                                   repository. It's valid when remote is set
@@ -1066,11 +1156,16 @@ spec:
                                     type: string
                                   namespace:
                                     default: default
-                                    description: Namespace of the secret.
+                                    description: Namespace of the referenced object.
                                     type: string
                                 required:
                                 - name
                                 type: object
+                              region:
+                                description: Region is cloud provider's region. It
+                                  will override the region in the region field of
+                                  ProviderReference
+                                type: string
                               type:
                                 default: hcl
                                 description: Type specifies which Terraform configuration
@@ -1080,6 +1175,23 @@ spec:
                                 - json
                                 - remote
                                 type: string
+                              writeConnectionSecretToRef:
+                                description: WriteConnectionSecretToReference specifies
+                                  the namespace and name of a Secret to which any
+                                  connection details for this managed resource should
+                                  be written. Connection details frequently include
+                                  the endpoint, username, and password required to
+                                  connect to the managed resource.
+                                properties:
+                                  name:
+                                    description: Name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: Namespace of the secret.
+                                    type: string
+                                required:
+                                - name
+                                type: object
                             required:
                             - configuration
                             type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_policydefinitions.yaml

@@ -151,6 +151,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -164,11 +169,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -178,6 +187,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_traitdefinitions.yaml

@@ -188,6 +188,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -201,11 +206,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -215,6 +224,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -472,6 +497,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -485,11 +515,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -499,6 +533,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_workflowstepdefinitions.yaml

@@ -148,6 +148,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -161,11 +166,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -175,6 +184,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

legacy/charts/vela-core-legacy/crds/core.oam.dev_workloaddefinitions.yaml

@@ -193,6 +193,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -206,11 +211,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -220,6 +229,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object
@@ -458,6 +483,11 @@ spec:
                       configuration:
                         description: Configuration is Terraform Configuration
                         type: string
+                      deleteResource:
+                        default: true
+                        description: DeleteResource will determine whether provisioned
+                          cloud resources will be deleted when CR is deleted
+                        type: boolean
                       path:
                         description: Path is the sub-directory of remote git repository.
                           It's valid when remote is set
@@ -471,11 +501,15 @@ spec:
                             type: string
                           namespace:
                             default: default
-                            description: Namespace of the secret.
+                            description: Namespace of the referenced object.
                             type: string
                         required:
                         - name
                         type: object
+                      region:
+                        description: Region is cloud provider's region. It will override
+                          the region in the region field of ProviderReference
+                        type: string
                       type:
                         default: hcl
                         description: Type specifies which Terraform configuration
@@ -485,6 +519,22 @@ spec:
                         - json
                         - remote
                         type: string
+                      writeConnectionSecretToRef:
+                        description: WriteConnectionSecretToReference specifies the
+                          namespace and name of a Secret to which any connection details
+                          for this managed resource should be written. Connection
+                          details frequently include the endpoint, username, and password
+                          required to connect to the managed resource.
+                        properties:
+                          name:
+                            description: Name of the secret.
+                            type: string
+                          namespace:
+                            description: Namespace of the secret.
+                            type: string
+                        required:
+                        - name
+                        type: object
                     required:
                     - configuration
                     type: object

pkg/appfile/appfile.go

@@ -50,14 +50,20 @@ import (
 
 // constant error information
 const (
-	errInvalidValueType                                = "require %q type parameter value"
-	errTerraformConfigurationIsNotSet                  = "terraform configuration is not set"
-	errFailToConvertTerraformComponentProperties       = "failed to convert Terraform component properties"
-	errTerraformNameOfWriteConnectionSecretToRefNotSet = "the name of writeConnectionSecretToRef of terraform component is not set"
+	errInvalidValueType                          = "require %q type parameter value"
+	errTerraformConfigurationIsNotSet            = "terraform configuration is not set"
+	errFailToConvertTerraformComponentProperties = "failed to convert Terraform component properties"
+	errConvertTerraformBaseConfigurationSpec     = "failed to convert properties to Terraform Configuration spec"
 )
 
-// WriteConnectionSecretToRefKey is used to create a secret for cloud resource connection
-const WriteConnectionSecretToRefKey = "writeConnectionSecretToRef"
+const (
+	// WriteConnectionSecretToRefKey is used to create a secret for cloud resource connection
+	WriteConnectionSecretToRefKey = "writeConnectionSecretToRef"
+	// RegionKey is the region of a Cloud Provider
+	RegionKey = "region"
+	// ProviderRefKey is the reference of a Provider
+	ProviderRefKey = "providerRef"
+)
 
 // Workload is component
 type Workload struct {
@@ -658,8 +664,14 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 	}
 
 	configuration := terraformapi.Configuration{
-		TypeMeta:   metav1.TypeMeta{APIVersion: "terraform.core.oam.dev/v1beta1", Kind: "Configuration"},
-		ObjectMeta: metav1.ObjectMeta{Name: wl.Name, Namespace: ns},
+		TypeMeta: metav1.TypeMeta{APIVersion: "terraform.core.oam.dev/v1beta1", Kind: "Configuration"},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      wl.Name,
+			Namespace: ns,
+		},
+	}
+	if wl.FullTemplate.ComponentDefinition != nil {
+		configuration.ObjectMeta.Annotations = wl.FullTemplate.ComponentDefinition.Annotations
 	}
 
 	switch wl.FullTemplate.Terraform.Type {
@@ -672,19 +684,24 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 		configuration.Spec.Path = wl.FullTemplate.Terraform.Path
 	}
 
-	if wl.FullTemplate.Terraform.ProviderReference != nil {
-		configuration.Spec.ProviderReference = wl.FullTemplate.Terraform.ProviderReference
-	}
-
 	// 1. parse writeConnectionSecretToRef
-	if err := json.Unmarshal(params, &configuration.Spec); err != nil {
+	if err := json.Unmarshal(params, &configuration); err != nil {
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
 
-	if configuration.Spec.WriteConnectionSecretToReference != nil {
-		if configuration.Spec.WriteConnectionSecretToReference.Name == "" {
-			return nil, errors.New(errTerraformNameOfWriteConnectionSecretToRefNotSet)
-		}
+	var spec terraformapi.BaseConfigurationSpec
+	if err := json.Unmarshal(params, &spec); err != nil {
+		return nil, errors.Wrap(err, errConvertTerraformBaseConfigurationSpec)
+	}
+	if spec.ProviderReference != nil && !reflect.DeepEqual(configuration.Spec.ProviderReference, spec.ProviderReference) {
+		configuration.Spec.ProviderReference = spec.ProviderReference
+	}
+	if spec.Region != "" && configuration.Spec.Region != spec.Region {
+		configuration.Spec.Region = spec.Region
+	}
+	if spec.WriteConnectionSecretToReference != nil && spec.WriteConnectionSecretToReference.Name != "" &&
+		!reflect.DeepEqual(configuration.Spec.WriteConnectionSecretToReference, spec.WriteConnectionSecretToReference) {
+		configuration.Spec.WriteConnectionSecretToReference = spec.WriteConnectionSecretToReference
 		// set namespace for writeConnectionSecretToRef, developer needn't manually set it
 		if configuration.Spec.WriteConnectionSecretToReference.Namespace == "" {
 			configuration.Spec.WriteConnectionSecretToReference.Namespace = ns
@@ -702,11 +719,14 @@ func generateTerraformConfigurationWorkload(wl *Workload, ns string) (*unstructu
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
 	delete(variableMap, WriteConnectionSecretToRefKey)
+	delete(variableMap, RegionKey)
+	delete(variableMap, ProviderRefKey)
 
 	data, err := json.Marshal(variableMap)
 	if err != nil {
 		return nil, errors.Wrap(err, errFailToConvertTerraformComponentProperties)
 	}
+
 	configuration.Spec.Variable = &runtime.RawExtension{Raw: data}
 	raw := util.Object2RawExtension(&configuration)
 	return util.RawExtension2Unstructured(raw)

pkg/appfile/appfile_test.go

@@ -608,12 +608,12 @@ variable "password" {
 			},
 
 			Spec: terraformapi.ConfigurationSpec{
-				HCL:                              configuration,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: &terraformtypes.SecretReference{Name: "db", Namespace: "default"},
+				HCL:      configuration,
+				Variable: raw,
 			},
 			Status: terraformapi.ConfigurationStatus{},
 		}
+		workload.Spec.WriteConnectionSecretToReference = &terraformtypes.SecretReference{Name: "db", Namespace: "default"}
 
 		expectCompManifest := &oamtypes.ComponentManifest{
 			Name: compName,
@@ -920,13 +920,6 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 		args args
 		want want
 	}{
-		"json workload with invalid secret": {
-			args: args{
-				json:   "abc",
-				params: map[string]interface{}{"acl": "private", "writeConnectionSecretToRef": map[string]interface{}{"name": "", "namespace": ""}},
-			},
-			want: want{err: errors.New(errTerraformNameOfWriteConnectionSecretToRefNotSet)}},
-
 		"json workload with secret": {
 			args: args{
 
@@ -998,10 +991,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				HCL:                              tc.args.hcl,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				HCL:      tc.args.hcl,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.json != "" {
 			template = &Template{
@@ -1011,10 +1004,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				JSON:                             tc.args.json,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				JSON:     tc.args.json,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.remote != "" {
 			template = &Template{
@@ -1024,10 +1017,10 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 				},
 			}
 			configSpec = terraformapi.ConfigurationSpec{
-				Remote:                           tc.args.remote,
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				Remote:   tc.args.remote,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.hcl == "" && tc.args.json == "" && tc.args.remote == "" {
 			template = &Template{
@@ -1035,9 +1028,9 @@ func TestGenerateTerraformConfigurationWorkload(t *testing.T) {
 			}
 
 			configSpec = terraformapi.ConfigurationSpec{
-				Variable:                         raw,
-				WriteConnectionSecretToReference: tc.args.writeConnectionSecretToRef,
+				Variable: raw,
 			}
+			configSpec.WriteConnectionSecretToReference = tc.args.writeConnectionSecretToRef
 		}
 		if tc.args.providerRef != nil {
 			template.Terraform.ProviderReference = tc.args.providerRef

pkg/appfile/parser.go

@@ -78,6 +78,9 @@ func (p *Parser) GenerateAppFile(ctx context.Context, app *v1beta1.Application)
 	appName := app.Name
 
 	appfile := p.newAppfile(appName, ns, app)
+	if app.Status.LatestRevision != nil {
+		appfile.AppRevisionName = app.Status.LatestRevision.Name
+	}
 
 	var wds []*Workload
 	for _, comp := range app.Spec.Components {

pkg/controller/core.oam.dev/v1alpha2/application/apply.go

@@ -184,8 +184,10 @@ func (h *AppHandler) collectHealthStatus(wl *appfile.Workload, appRev *v1beta1.A
 		}
 		if configuration.Status.Apply.State != terraformtypes.Available {
 			status.Healthy = false
+			isHealth = false
 		} else {
 			status.Healthy = true
+			isHealth = true
 		}
 		status.Message = configuration.Status.Apply.Message
 	} else {

pkg/controller/standard.oam.dev/v1alpha1/rollout/handler.go

@@ -221,13 +221,24 @@ func (h *handler) setWorkloadBaseInfo() {
 		h.sourceWorkload.SetNamespace(h.rollout.Namespace)
 	}
 
+	var appRev string
+	if len(h.rollout.GetLabels()) > 0 {
+		appRev = h.rollout.GetLabels()[oam.LabelAppRevision]
+	}
+
 	h.targetWorkload.SetName(h.compName)
-	util.AddLabels(h.targetWorkload, map[string]string{oam.LabelAppComponentRevision: h.targetRevName})
+	util.AddLabels(h.targetWorkload, map[string]string{
+		oam.LabelAppComponentRevision: h.targetRevName,
+		oam.LabelAppRevision:          appRev,
+	})
 	util.AddAnnotations(h.targetWorkload, map[string]string{oam.AnnotationSkipGC: "true"})
 
 	if h.sourceWorkload != nil {
 		h.sourceWorkload.SetName(h.compName)
-		util.AddLabels(h.sourceWorkload, map[string]string{oam.LabelAppComponentRevision: h.sourceRevName})
+		util.AddLabels(h.sourceWorkload, map[string]string{
+			oam.LabelAppComponentRevision: h.sourceRevName,
+			oam.LabelAppRevision:          appRev,
+		})
 	}
 }
 

pkg/controller/standard.oam.dev/v1alpha1/rollout/handler_suit_test.go

@@ -60,6 +60,7 @@ var _ = Describe("Test rollout related handler func", func() {
 		srcWorkload.SetAPIVersion("apps/v1")
 		srcWorkload.SetKind("Deployment")
 		compName := "comp-test"
+		appRevName := "app-revision-v2"
 		h := handler{
 			reconciler: &reconciler{
 				Client: k8sClient,
@@ -67,6 +68,9 @@ var _ = Describe("Test rollout related handler func", func() {
 			rollout: &v1alpha1.Rollout{
 				ObjectMeta: metav1.ObjectMeta{
 					Namespace: namespace,
+					Labels: map[string]string{
+						oam.LabelAppRevision: appRevName,
+					},
 				}},
 			targetWorkload: tarWorkload,
 			sourceWorkload: srcWorkload,
@@ -82,10 +86,10 @@ var _ = Describe("Test rollout related handler func", func() {
 		Expect(h.targetWorkload.GetNamespace()).Should(BeEquivalentTo(namespace))
 		Expect(h.sourceWorkload.GetNamespace()).Should(BeEquivalentTo(namespace))
 		tarLabel := h.targetWorkload.GetLabels()
-		Expect(len(tarLabel)).Should(BeEquivalentTo(2))
+		Expect(tarLabel[oam.LabelAppRevision]).Should(BeEquivalentTo(appRevName))
 		Expect(tarLabel[oam.LabelAppComponentRevision]).Should(BeEquivalentTo("comp-test-v2"))
 		srcLabel := h.sourceWorkload.GetLabels()
-		Expect(len(srcLabel)).Should(BeEquivalentTo(2))
+		Expect(srcLabel[oam.LabelAppRevision]).Should(BeEquivalentTo(appRevName))
 		Expect(srcLabel[oam.LabelAppComponentRevision]).Should(BeEquivalentTo("comp-test-v1"))
 
 		Expect(h.assembleWorkload(ctx)).Should(BeNil())

references/cli/addon.go

@@ -24,26 +24,26 @@ import (
 	"text/template"
 	"time"
 
-	yaml2 "k8s.io/apimachinery/pkg/util/yaml"
-
-	"github.com/oam-dev/kubevela/pkg/oam/util"
-
-	common2 "github.com/oam-dev/kubevela/apis/core.oam.dev/common"
-
 	"github.com/Masterminds/sprig"
 	"github.com/gosuri/uitable"
+	terraformv1beta1 "github.com/oam-dev/terraform-controller/api/v1beta1"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	v1 "k8s.io/api/core/v1"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	types2 "k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
+	yaml2 "k8s.io/apimachinery/pkg/util/yaml"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	common2 "github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
 	"github.com/oam-dev/kubevela/apis/types"
 	"github.com/oam-dev/kubevela/pkg/oam"
+	"github.com/oam-dev/kubevela/pkg/oam/util"
 	"github.com/oam-dev/kubevela/pkg/utils/apply"
 	"github.com/oam-dev/kubevela/pkg/utils/common"
 	cmdutil "github.com/oam-dev/kubevela/pkg/utils/util"
@@ -55,6 +55,11 @@ const (
 
 	// DependsOnWorkFlowStepName is workflow step name which is used to check dependsOn app
 	DependsOnWorkFlowStepName = "depends-on-app"
+
+	// AddonTerraformProviderNamespace is the namespace of addon terraform provider
+	AddonTerraformProviderNamespace = "default"
+	// AddonTerraformProviderNameArgument is the argument name of addon terraform provider
+	AddonTerraformProviderNameArgument = "providerName"
 )
 
 var statusUninstalled = "uninstalled"
@@ -96,7 +101,7 @@ func NewAddonCommand(c common.Args, ioStreams cmdutil.IOStreams) *cobra.Command
 	}
 	cmd.AddCommand(
 		NewAddonListCommand(),
-		NewAddonEnableCommand(ioStreams),
+		NewAddonEnableCommand(c, ioStreams),
 		NewAddonDisableCommand(ioStreams),
 	)
 	return cmd
@@ -120,13 +125,19 @@ func NewAddonListCommand() *cobra.Command {
 }
 
 // NewAddonEnableCommand create addon enable command
-func NewAddonEnableCommand(ioStream cmdutil.IOStreams) *cobra.Command {
+func NewAddonEnableCommand(c common.Args, ioStream cmdutil.IOStreams) *cobra.Command {
+	ctx := context.Background()
 	return &cobra.Command{
 		Use:     "enable",
 		Short:   "enable an addon",
 		Long:    "enable an addon in cluster",
 		Example: "vela addon enable <addon-name>",
 		RunE: func(cmd *cobra.Command, args []string) error {
+			k8sClient, err := c.GetClient()
+			if err != nil {
+				return err
+			}
+
 			if len(args) < 1 {
 				return fmt.Errorf("must specify addon name")
 			}
@@ -135,7 +146,7 @@ func NewAddonEnableCommand(ioStream cmdutil.IOStreams) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			err = enableAddon(name, addonArgs)
+			err = enableAddon(ctx, k8sClient, name, addonArgs)
 			if err != nil {
 				return err
 			}
@@ -192,23 +203,31 @@ func listAddons() error {
 	table := uitable.New()
 	table.AddRow("NAME", "DESCRIPTION", "STATUS")
 	for _, addon := range addons {
+		// Addon terraform should be invisible to end-users. It will be installed by other addons like `terraform-alibaba`
+		if addon.name == "terraform" {
+			continue
+		}
 		table.AddRow(addon.name, addon.description, addon.getStatus())
 	}
 	fmt.Println(table.String())
 	return nil
 }
 
-func enableAddon(name string, args map[string]string) error {
+func enableAddon(ctx context.Context, k8sClient client.Client, name string, args map[string]string) error {
 	repo, err := NewAddonRepo()
 	if err != nil {
 		return err
 	}
+
 	addon, err := repo.getAddon(name)
 	if err != nil {
 		return err
 	}
+	if strings.HasPrefix(name, "terraform-") {
+		args, _ = getTerraformProviderArgumentValue(name, args)
+	}
 	addon.setArgs(args)
-	err = addon.enable()
+	err = addon.enable(ctx, k8sClient, name, args)
 	return err
 }
 
@@ -358,14 +377,25 @@ func (a *Addon) renderApplication() (*v1beta1.Application, error) {
 	return a.application, nil
 }
 
-func (a *Addon) enable() error {
+func (a *Addon) enable(ctx context.Context, k8sClient client.Client, name string, args map[string]string) error {
 	applicator := apply.NewAPIApplicator(clt)
-	ctx := context.Background()
 	obj, err := a.renderApplication()
 	if err != nil {
 		return err
 	}
-	err = a.installDependsOn()
+
+	if strings.HasPrefix(name, "terraform-") {
+		providerName, existed, err := checkWhetherTerraformProviderExist(ctx, k8sClient, name, args)
+		if err != nil && !apimeta.IsNoMatchError(err) {
+			return err
+		}
+		if existed {
+			return errors.Errorf("terraform provider %s with name %s already exists", name, providerName)
+		}
+		obj.Name = fmt.Sprintf("%s-%s", obj.Name, providerName)
+	}
+
+	err = a.installDependsOn(ctx, k8sClient, args)
 	if err != nil {
 		return errors.Wrap(err, "Error occurs when install dependent addon")
 	}
@@ -427,7 +457,7 @@ func (a *Addon) setArgs(args map[string]string) {
 	a.Args = args
 }
 
-func (a *Addon) installDependsOn() error {
+func (a *Addon) installDependsOn(ctx context.Context, k8sClient client.Client, args map[string]string) error {
 	if a.application.Spec.Workflow == nil || a.application.Spec.Workflow.Steps == nil {
 		return nil
 	}
@@ -448,7 +478,7 @@ func (a *Addon) installDependsOn() error {
 				return err
 			}
 			if addon.getStatus() != statusInstalled {
-				err = addon.enable()
+				err = addon.enable(ctx, k8sClient, dependsOnAddonName, args)
 				if err != nil {
 					return err
 				}
@@ -462,3 +492,51 @@ func (a *Addon) installDependsOn() error {
 func TransAddonName(name string) string {
 	return strings.ReplaceAll(name, "/", "-")
 }
+
+func getTerraformProviderNames(ctx context.Context, k8sClient client.Client) ([]string, error) {
+	var names []string
+	providerList := &terraformv1beta1.ProviderList{}
+	err := k8sClient.List(ctx, providerList, client.InNamespace(AddonTerraformProviderNamespace))
+	if err != nil {
+		if apimeta.IsNoMatchError(err) || kerrors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	for _, provider := range providerList.Items {
+		names = append(names, provider.Name)
+	}
+	return names, nil
+}
+
+// Get the value of argument AddonTerraformProviderNameArgument
+func getTerraformProviderArgumentValue(addonName string, args map[string]string) (map[string]string, string) {
+	providerName, ok := args[AddonTerraformProviderNameArgument]
+	if !ok {
+		switch addonName {
+		case "terraform-alibaba":
+			providerName = "default"
+		case "terraform-aws":
+			providerName = "aws"
+		case "terraform-azure":
+			providerName = "azure"
+		}
+		args[AddonTerraformProviderNameArgument] = providerName
+	}
+	return args, providerName
+}
+
+func checkWhetherTerraformProviderExist(ctx context.Context, k8sClient client.Client, addonName string, args map[string]string) (string, bool, error) {
+	_, providerName := getTerraformProviderArgumentValue(addonName, args)
+
+	providerNames, err := getTerraformProviderNames(ctx, k8sClient)
+	if err != nil {
+		return "", false, err
+	}
+	for _, name := range providerNames {
+		if providerName == name {
+			return providerName, true, nil
+		}
+	}
+	return providerName, false, nil
+}

test/e2e-addon-test/addon_test.go

@@ -25,6 +25,7 @@ import (
 	"strconv"
 	"time"
 
+	terraformv1beta1 "github.com/oam-dev/terraform-controller/api/v1beta1"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
@@ -87,7 +88,7 @@ var _ = Describe("Addon tests", func() {
 
 	It("Addons Terraform is successfully enables and Terraform application works", func() {
 		By("Install Addon Terraform")
-		output, err := exec.Command("bash", "-c", "/tmp/vela addon enable terraform").Output()
+		output, err := exec.Command("bash", "-c", "/tmp/vela addon enable terraform-alibaba providerName=alibaba-e2e ALICLOUD_ACCESS_KEY=xxx ALICLOUD_SECRET_KEY=yyy ALICLOUD_REGION=cn-beijing").Output()
 		var ee *exec.ExitError
 		if errors.As(err, &ee) {
 			fmt.Println("exit code error:", string(ee.Stderr))
@@ -95,6 +96,12 @@ var _ = Describe("Addon tests", func() {
 		Expect(err).Should(BeNil())
 		Expect(string(output)).Should(ContainSubstring("Successfully enable addon:"))
 
+		By("Checking Provider")
+		Eventually(func() error {
+			var provider terraformv1beta1.Provider
+			return k8sClient.Get(ctx, client.ObjectKey{Name: "alibaba-e2e", Namespace: "default"}, &provider)
+		}, time.Second*120, time.Millisecond*500).Should(BeNil())
+
 		By("Apply an application with Terraform Component")
 		var terraformApp v1beta1.Application
 		Expect(common.ReadYamlToObject("testdata/app/app_terraform_oss.yaml", &terraformApp)).Should(BeNil())

test/e2e-addon-test/suite_test.go

@@ -21,11 +21,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/oam-dev/kubevela/apis/standard.oam.dev/v1alpha1"
-
+	terraformv1beta1 "github.com/oam-dev/terraform-controller/api/v1beta1"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
-
 	crdv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -36,6 +34,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	core "github.com/oam-dev/kubevela/apis/core.oam.dev"
+	"github.com/oam-dev/kubevela/apis/standard.oam.dev/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -62,6 +61,8 @@ var _ = BeforeSuite(func(done Done) {
 	Expect(err).Should(BeNil())
 	err = v1alpha1.AddToScheme(scheme)
 	Expect(err).Should(BeNil())
+	err = terraformv1beta1.AddToScheme(scheme)
+	Expect(err).Should(BeNil())
 	By("Setting up kubernetes client")
 	k8sClient, err = client.New(config.GetConfigOrDie(), client.Options{Scheme: scheme})
 	if err != nil {

vela-templates/addons/auto-gen/terraform-alibaba.yaml

@@ -3,17 +3,17 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
-    addons.oam.dev/name: terraform/provider-alibaba
-  name: terraform-provider-alibaba
+    addons.oam.dev/name: terraform-alibaba
+  name: terraform-alibaba
   namespace: vela-system
 spec:
   components:
-  - name: alibaba-account-creds
+  - name: alibaba-account-creds-[[ index .Args "providerName" ]]
     properties:
       apiVersion: v1
       kind: Secret
       metadata:
-        name: alibaba-account-creds
+        name: alibaba-account-creds-[[ index .Args "providerName" ]]
         namespace: vela-system
       stringData:
         credentials: |
@@ -22,23 +22,32 @@ spec:
           securityToken: [[ index .Args "ALICLOUD_SECURITY_TOKEN" ]]
       type: Opaque
     type: raw
-  - name: default
+  - name: alibaba-[[ index .Args "providerName" ]]
     properties:
       apiVersion: terraform.core.oam.dev/v1beta1
       kind: Provider
       metadata:
-        name: default
+        name: '[[ index .Args "providerName" ]]'
         namespace: default
       spec:
         credentials:
           secretRef:
             key: credentials
-            name: alibaba-account-creds
+            name: alibaba-account-creds-[[ index .Args "providerName" ]]
             namespace: vela-system
           source: Secret
         provider: alibaba
         region: '[[ index .Args "ALICLOUD_REGION" ]]'
     type: raw
+  workflow:
+    steps:
+    - name: ""
+      properties:
+        name: terraform
+        namespace: vela-system
+      type: depends-on-app
+    - name: ""
+      type: apply-application
 status:
   rollout:
     batchRollingState: ""

vela-templates/addons/auto-gen/terraform-aws.yaml

@@ -3,8 +3,8 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for AWS
-    addons.oam.dev/name: terraform/provider-aws
-  name: terraform-provider-aws
+    addons.oam.dev/name: terraform-aws
+  name: terraform-aws
   namespace: vela-system
 spec:
   components:
@@ -39,6 +39,15 @@ spec:
         provider: aws
         region: '[[ index .Args "AWS_DEFAULT_REGION" ]]'
     type: raw
+  workflow:
+    steps:
+    - name: ""
+      properties:
+        name: terraform
+        namespace: vela-system
+      type: depends-on-app
+    - name: ""
+      type: apply-application
 status:
   rollout:
     batchRollingState: ""

vela-templates/addons/auto-gen/terraform-azure.yaml

@@ -3,8 +3,8 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for Azure
-    addons.oam.dev/name: terraform/provider-azure
-  name: terraform-provider-azure
+    addons.oam.dev/name: terraform-azure
+  name: terraform-azure
   namespace: vela-system
 spec:
   components:
@@ -39,6 +39,15 @@ spec:
           source: Secret
         provider: azure
     type: raw
+  workflow:
+    steps:
+    - name: ""
+      properties:
+        name: terraform
+        namespace: vela-system
+      type: depends-on-app
+    - name: ""
+      type: apply-application
 status:
   rollout:
     batchRollingState: ""

vela-templates/addons/auto-gen/terraform.yaml

@@ -8,20 +8,35 @@ metadata:
   namespace: vela-system
 spec:
   components:
-  - name: ns-terraform-system
-    properties:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: terraform-system
-    type: raw
   - name: terraform-controller
     properties:
       chart: terraform-controller
       repoType: helm
       url: https://charts.kubevela.net/addons
-      version: 0.2.6
+      version: 0.2.10
     type: helm
+  - name: alibaba-redis
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            Redis
+        labels:
+          type: terraform
+        name: alibaba-redis
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules/alibaba/redis
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
   - name: alibaba-ack
     properties:
       apiVersion: core.oam.dev/v1beta1
@@ -45,6 +60,29 @@ spec:
             apiVersion: terraform.core.oam.dev/v1beta1
             kind: Configuration
     type: raw
+  - name: alibaba-ask
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            Serverless Kubernetes (ASK)
+        labels:
+          type: terraform
+        name: alibaba-ask
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules.git
+            path: alibaba/cs/serverless-kubernetes
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
   - name: alibaba-eip
     properties:
       apiVersion: core.oam.dev/v1alpha2
@@ -73,6 +111,8 @@ spec:
       kind: ComponentDefinition
       metadata:
         annotations:
+          cloud-resource/console-url: https://oss.console.aliyun.com/bucket/oss-{ALICLOUD_REGION}/{BUCKET_NAME}/overview
+          cloud-resource/identifier: BUCKET_NAME
           definition.oam.dev/description: Terraform configuration for Alibaba Cloud
             OSS object
         labels:
@@ -100,6 +140,9 @@ spec:
       kind: ComponentDefinition
       metadata:
         annotations:
+          cloud-resource/console-url: https://rdsnext.console.aliyun.com/detail/{DB_ID}/basicInfo?&region={ALICLOUD_REGION}
+          cloud-resource/identifier: DB_ID
+          cloud-resource/sensitive-outputs: DB_PASSWORD
           definition.oam.dev/description: Terraform configuration for Alibaba Cloud
             RDS object
         labels:
@@ -123,6 +166,10 @@ spec:
                 security_ips = ["0.0.0.0/0",]
               }
 
+              output "DB_ID" {
+                value = module.rds.db_instance_id
+              }
+
               output "DB_NAME" {
                 value = module.rds.this_db_instance_name
               }
@@ -170,6 +217,98 @@ spec:
             apiVersion: terraform.core.oam.dev/v1beta1
             kind: Configuration
     type: raw
+  - name: alibaba-sls-project
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            SLS Project
+        labels:
+          type: terraform
+        name: alibaba-sls-project
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules.git
+            path: alibaba/sls/project
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
+  - name: alibaba-sls-store
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            SLS Store
+        labels:
+          type: terraform
+        name: alibaba-sls-store
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules.git
+            path: alibaba/sls/store
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
+  - name: alibaba-vpc
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            VPC
+        labels:
+          type: terraform
+        name: alibaba-vpc
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules.git
+            path: alibaba/vpc
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
+  - name: alibaba-vswitch
+    properties:
+      apiVersion: core.oam.dev/v1beta1
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Alibaba Cloud
+            VSwitch
+        labels:
+          type: terraform
+        name: alibaba-vswitch
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: https://github.com/kubevela-contrib/terraform-modules.git
+            path: alibaba/vswitch
+            type: remote
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
   - name: aws-s3
     properties:
       apiVersion: core.oam.dev/v1alpha2
@@ -326,19 +465,119 @@ spec:
             apiVersion: terraform.core.oam.dev/v1beta1
             kind: Configuration
     type: raw
+  - name: azure-storage-account
+    properties:
+      apiVersion: core.oam.dev/v1alpha2
+      kind: ComponentDefinition
+      metadata:
+        annotations:
+          definition.oam.dev/description: Terraform configuration for Azure Blob Storage
+            Account
+          provider: azure
+        labels:
+          type: terraform
+        name: azure-storage-account
+        namespace: vela-system
+      spec:
+        schematic:
+          terraform:
+            configuration: |
+              # Configure the Microsoft Azure Provider
+              provider "azurerm" {
+                features {}
+              }
+
+              resource "azurerm_resource_group" "rsg" {
+                count    = var.create_rsg ? 1 : 0
+                name     = var.resource_group_name
+                location = var.location
+              }
+
+              resource "azurerm_storage_account" "sa" {
+                name                      = var.name
+                resource_group_name       = var.create_rsg ? azurerm_resource_group.rsg[0].name : var.resource_group_name
+                location                  = var.location
+                account_tier              = "Standard"
+                account_replication_type  = "GRS"
+                enable_https_traffic_only = true
+
+                dynamic "static_website" {
+                  for_each = var.static_website
+                  content {
+                    index_document     = static_website.value["index_document"]
+                    error_404_document = static_website.value["error_404_document"]
+                  }
+                }
+
+                tags = var.tags
+              }
+
+              variable "create_rsg" {
+                description = "Conditional if resource group should be created. Defaults to 'true'."
+                type        = bool
+                default     = true
+              }
+
+              variable "resource_group_name" {
+                description = "Name of resource group. Defaults to 'rsg'."
+                type        = string
+                default     = "rsg"
+              }
+
+              variable "name" {
+                description = "Name of storage account. Defaults to 'storageaccount'."
+                type        = string
+                default     = "storageaccount"
+              }
+
+              variable "location" {
+                description = "Location of storage account. Defaults to 'West Europe'."
+                type        = string
+                default     = "West Europe"
+              }
+
+              variable "tags" {
+                description = "Tags for storage account. Defaults to '{}'."
+                type        = map(string)
+                default     = {}
+              }
+
+              variable "static_website" {
+                description = "Static website configuration. Defaults to disabled."
+                type        = list(map(string))
+                default     = [{
+                  index_document = null
+                  error_404_document = null
+                }]
+              }
+
+              output "BLOB_CONNECTION_STRING" {
+                description = "Blob storage connection string"
+                sensitive   = true
+                value       = azurerm_storage_account.sa.primary_connection_string
+              }
+
+              output "BLOB_WEB_ENDPOINT" {
+                description = "Blob storage static web endpoint"
+                value       = azurerm_storage_account.sa.primary_web_endpoint
+              }
+            providerRef:
+              name: azure
+              namespace: default
+        workload:
+          definition:
+            apiVersion: terraform.core.oam.dev/v1beta1
+            kind: Configuration
+    type: raw
   workflow:
     steps:
-    - name: checking-depends-on
+    - name: ""
       properties:
         name: fluxcd
         namespace: vela-system
       type: depends-on-app
-    - name: apply-ns
-      properties:
-        component: ns-terraform-system
-      type: apply-component
-    - name: apply-resources
-      type: apply-remaining
+    - name: ""
+      type: apply-application
 status:
   rollout:
     batchRollingState: ""

vela-templates/addons/terraform-alibaba/readme.md

@@ -0,0 +1,3 @@
+# terraform-alibaba
+
+This addon contains terraform provider for Alibaba Cloud.

vela-templates/addons/terraform-alibaba/template.yaml

@@ -3,17 +3,24 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for Alibaba Cloud
-    addons.oam.dev/name: terraform/provider-alibaba
-  name: terraform-provider-alibaba
+    addons.oam.dev/name: terraform-alibaba
+  name: terraform-alibaba
   namespace: vela-system
 spec:
+  workflow:
+    steps:
+      - type: depends-on-app
+        properties:
+          name: terraform
+          namespace: vela-system
+      - type: apply-application
   components:
-    - name: alibaba-account-creds
+    - name: alibaba-account-creds-[[ index .Args "providerName" ]]
       properties:
         apiVersion: v1
         kind: Secret
         metadata:
-          name: alibaba-account-creds
+          name: alibaba-account-creds-[[ index .Args "providerName" ]]
           namespace: vela-system
         type: Opaque
         stringData:
@@ -22,13 +29,13 @@ spec:
             accessKeySecret: [[ index .Args "ALICLOUD_SECRET_KEY" ]]
             securityToken: [[ index .Args "ALICLOUD_SECURITY_TOKEN" ]]
       type: raw
-    - name: default
+    - name: alibaba-[[ index .Args "providerName" ]]
       type: raw
       properties:
         apiVersion: terraform.core.oam.dev/v1beta1
         kind: Provider
         metadata:
-          name: default
+          name: '[[ index .Args "providerName" ]]'
           namespace: default
         spec:
           provider: alibaba
@@ -37,7 +44,7 @@ spec:
             source: Secret
             secretRef:
               namespace: vela-system
-              name: alibaba-account-creds
+              name: alibaba-account-creds-[[ index .Args "providerName" ]]
               key: credentials
 {{ range .ResourceFiles }}
     - name: {{ .Name }}

vela-templates/addons/terraform-aws/readme.md

@@ -0,0 +1,3 @@
+# terraform-aws
+
+This addon contains terraform provider for AWS.

vela-templates/addons/terraform-aws/template.yaml

@@ -3,10 +3,17 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for AWS
-    addons.oam.dev/name: terraform/provider-aws
-  name: terraform-provider-aws
+    addons.oam.dev/name: terraform-aws
+  name: terraform-aws
   namespace: vela-system
 spec:
+  workflow:
+    steps:
+      - type: depends-on-app
+        properties:
+          name: terraform
+          namespace: vela-system
+      - type: apply-application
   components:
     - name: aws-account-creds
       properties:

vela-templates/addons/terraform-azure/readme.md

@@ -0,0 +1,3 @@
+# terraform-azure
+
+This addon contains terraform provider for Azure.

vela-templates/addons/terraform-azure/template.yaml

@@ -3,10 +3,17 @@ kind: Application
 metadata:
   annotations:
     addons.oam.dev/description: Kubernetes Terraform Controller for Azure
-    addons.oam.dev/name: terraform/provider-azure
-  name: terraform-provider-azure
+    addons.oam.dev/name: terraform-azure
+  name: terraform-azure
   namespace: vela-system
 spec:
+  workflow:
+    steps:
+      - type: depends-on-app
+        properties:
+          name: terraform
+          namespace: vela-system
+      - type: apply-application
   components:
     - name: azure-account-creds
       properties:

vela-templates/addons/terraform/definitions/terrafom-alibaba-redis.yaml

@@ -0,0 +1,18 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-redis
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud Redis
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules/alibaba/redis
+      type: remote

vela-templates/addons/terraform/definitions/terraform-alibaba-ask.yaml

@@ -0,0 +1,19 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-ask
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud Serverless Kubernetes (ASK)
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules.git
+      type: remote
+      path: alibaba/cs/serverless-kubernetes

vela-templates/addons/terraform/definitions/terraform-alibaba-oss.yaml

@@ -5,6 +5,11 @@ metadata:
   namespace: vela-system
   annotations:
     definition.oam.dev/description: Terraform configuration for Alibaba Cloud OSS object
+    # identifier of this cloud resource
+    cloud-resource/identifier: BUCKET_NAME
+    # the console url of this cloud resource
+    cloud-resource/console-url: "https://oss.console.aliyun.com/bucket/oss-{ALICLOUD_REGION}/{BUCKET_NAME}/overview"
+    # the outputs which are sensitive. Separate them by a comma if there are more than one
   labels:
     type: terraform
 spec:

vela-templates/addons/terraform/definitions/terraform-alibaba-rds.yaml

@@ -5,6 +5,12 @@ metadata:
   namespace: vela-system
   annotations:
     definition.oam.dev/description: Terraform configuration for Alibaba Cloud RDS object
+    # identifier of this cloud resource
+    cloud-resource/identifier: DB_ID
+    # the console url of this cloud resource
+    cloud-resource/console-url: "https://rdsnext.console.aliyun.com/detail/{DB_ID}/basicInfo?&region={ALICLOUD_REGION}"
+    # the outputs which are sensitive. Separate them by a comma if there are more than one
+    cloud-resource/sensitive-outputs: "DB_PASSWORD"
   labels:
     type: terraform
 spec:
@@ -28,6 +34,10 @@ spec:
           security_ips = ["0.0.0.0/0",]
         }
 
+        output "DB_ID" {
+          value = module.rds.db_instance_id
+        }
+
         output "DB_NAME" {
           value = module.rds.this_db_instance_name
         }

vela-templates/addons/terraform/definitions/terraform-alibaba-sls-project.yaml

@@ -0,0 +1,19 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-sls-project
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud SLS Project
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules.git
+      type: remote
+      path: alibaba/sls/project

vela-templates/addons/terraform/definitions/terraform-alibaba-sls-store.yaml

@@ -0,0 +1,19 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-sls-store
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud SLS Store
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules.git
+      type: remote
+      path: alibaba/sls/store

vela-templates/addons/terraform/definitions/terraform-alibaba-vpc.yaml

@@ -0,0 +1,19 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-vpc
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud VPC
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules.git
+      type: remote
+      path: alibaba/vpc

vela-templates/addons/terraform/definitions/terraform-alibaba-vswitch.yaml

@@ -0,0 +1,19 @@
+apiVersion: core.oam.dev/v1beta1
+kind: ComponentDefinition
+metadata:
+  name: alibaba-vswitch
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Alibaba Cloud VSwitch
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      configuration: https://github.com/kubevela-contrib/terraform-modules.git
+      type: remote
+      path: alibaba/vswitch

vela-templates/addons/terraform/definitions/terraform-azure-storage-account.yaml

@@ -0,0 +1,100 @@
+apiVersion: core.oam.dev/v1alpha2
+kind: ComponentDefinition
+metadata:
+  name: azure-storage-account
+  namespace: vela-system
+  annotations:
+    definition.oam.dev/description: Terraform configuration for Azure Blob Storage Account
+    provider: azure
+  labels:
+    type: terraform
+spec:
+  workload:
+    definition:
+      apiVersion: terraform.core.oam.dev/v1beta1
+      kind: Configuration
+  schematic:
+    terraform:
+      providerRef:
+        name: azure
+        namespace: default
+      configuration: |
+        # Configure the Microsoft Azure Provider
+        provider "azurerm" {
+          features {}
+        }
+
+        resource "azurerm_resource_group" "rsg" {
+          count    = var.create_rsg ? 1 : 0
+          name     = var.resource_group_name
+          location = var.location
+        }
+
+        resource "azurerm_storage_account" "sa" {
+          name                      = var.name
+          resource_group_name       = var.create_rsg ? azurerm_resource_group.rsg[0].name : var.resource_group_name
+          location                  = var.location
+          account_tier              = "Standard"
+          account_replication_type  = "GRS"
+          enable_https_traffic_only = true
+
+          dynamic "static_website" {
+            for_each = var.static_website
+            content {
+              index_document     = static_website.value["index_document"]
+              error_404_document = static_website.value["error_404_document"]
+            }
+          }
+
+          tags = var.tags
+        }
+
+        variable "create_rsg" {
+          description = "Conditional if resource group should be created. Defaults to 'true'."
+          type        = bool
+          default     = true
+        }
+
+        variable "resource_group_name" {
+          description = "Name of resource group. Defaults to 'rsg'."
+          type        = string
+          default     = "rsg"
+        }
+
+        variable "name" {
+          description = "Name of storage account. Defaults to 'storageaccount'."
+          type        = string
+          default     = "storageaccount"
+        }
+
+        variable "location" {
+          description = "Location of storage account. Defaults to 'West Europe'."
+          type        = string
+          default     = "West Europe"
+        }
+
+        variable "tags" {
+          description = "Tags for storage account. Defaults to '{}'."
+          type        = map(string)
+          default     = {}
+        }
+
+        variable "static_website" {
+          description = "Static website configuration. Defaults to disabled."
+          type        = list(map(string))
+          default     = [{
+            index_document = null
+            error_404_document = null
+          }]
+        }
+
+        output "BLOB_CONNECTION_STRING" {
+          description = "Blob storage connection string"
+          sensitive   = true
+          value       = azurerm_storage_account.sa.primary_connection_string
+        }
+
+        output "BLOB_WEB_ENDPOINT" {
+          description = "Blob storage static web endpoint"
+          value       = azurerm_storage_account.sa.primary_web_endpoint
+        }

vela-templates/addons/terraform/template.yaml

@@ -8,32 +8,19 @@ metadata:
 spec:
   workflow:
     steps:
-      - name: checking-depends-on
-        type: depends-on-app
+      - type: depends-on-app
         properties:
           name: fluxcd
           namespace: vela-system
-      - name: apply-ns
-        type: apply-component
-        properties:
-          component: ns-terraform-system
-      - name: apply-resources
-        type: apply-remaining
+      - type: apply-application
   components:
-    - name: ns-terraform-system
-      type: raw
-      properties:
-        apiVersion: v1
-        kind: Namespace
-        metadata:
-          name: terraform-system
     - name: terraform-controller
       type: helm
       properties:
         repoType: helm
         url: https://charts.kubevela.net/addons
         chart: terraform-controller
-        version: 0.2.6
+        version: 0.2.10
 {{ range .ResourceFiles }}
     - name: {{ .Name }}
       type: raw