provider

noetl provider — infra plan / drift / orphans / adopt

The Terraform-style CLI over the kind: provider tool (noetl/ai-meta#189). Reads the provider resources a playbook declares and drives the same noetl-tools provider tool the worker runs — in local mode, no NoETL server required to run the tool. Shipped in noetl-cli 4.17.0 (needs noetl-tools ≥ 3.25.0).

noetl provider plan     --playbook infra.yaml
noetl provider drift    --playbook infra.yaml --stack prod --auth-token $TOK
noetl provider orphans  --playbook infra.yaml --stack prod --server http://localhost:8082
noetl provider adopt    --playbook infra.yaml --step ensure_project --auth-token $TOK
noetl provider adopt    --playbook infra.yaml --step ensure_project --auth-token $TOK --apply --confirm <digest>

The verbs

Verb	What it does	Cloud effect	Auth
plan	The request each declared resource would issue (the would_call).	none (dry-run)	none
drift	Last-known-desired (the EHDB fold) vs live actual (GET), field by field.	none (read)	--auth-token (for the live GET)
orphans	Resources owned per EHDB that the playbook no longer declares, scoped to --stack; plus cross-stack conflicts.	none	none (reads the fold only)
adopt	Confirm-gated take-ownership of the live actual as the new desired, for one resource.	none (read/GET only)	--auth-token

plan/drift/orphans operate over all kind: provider steps in the playbook; adopt targets one (--step, or the sole provider step).

How it works (it reimplements nothing)

• the per-resource tool config is built by the executor's own to_tools_config from the playbook's Tool::Provider step;
• plan = a dry-run, drift = the tool's reconcile: report, adopt = the tool's reconcile: adopt — the gates (explicit auth: for real calls, dry-run defaults, digest-bound confirm, stale-digest refusal) are the tool's;
• URN derivation is delegated to the tool (a dry-run emits provider_fact.urn);
• last-known-desired comes from provider_state::extract_facts_from_tier_records over the raw EHDB eventlog tier.

State source (last-known-desired)

drift / orphans / adopt need last-known-desired. Two sources:

• --server <url> — fetches GET /api/ehdb/tiers/eventlog and folds the raw eventlog-tier records (unwrapping the payload string and finding the nested provider_fact).
• --facts-file <path> — an offline JSON file of tier records / event bodies / bare provider_facts. For pure-local runs with no server.

With neither, the model is empty (everything reports untracked / is an import for adopt).

Ownership scoping (--stack)

Ownership facts carry a stack label. --stack scopes drift + orphan detection to one stack (overriding each step's own stack:; default <unscoped> = one global stack). orphans also reports cross-stack conflicts — a URN two stacks both own — so you can split ownership before they fight over it.

Adopt — the confirm gate

# 1. dry-run: review the field diff + capture the plan_digest
noetl provider adopt --playbook infra.yaml --step ensure_project --auth-token $TOK --facts-file facts.json --json

# 2. apply: echo the reviewed digest
noetl provider adopt --playbook infra.yaml --step ensure_project --auth-token $TOK --facts-file facts.json --apply --confirm <plan_digest>

A blind apply (no --confirm) is refused; a stale digest (the resource drifted again since you reviewed it) is refused — nothing is written. Adopt makes no cloud mutation: it only rewrites last-known-desired.

Offline testing (--endpoint)

--endpoint <base-url> reroutes the provider GETs to a mock / emulator, so the whole flow runs offline with no live cloud call.

Related

• noetl/tools wiki — Provider Tool (the tool this drives; the reconcile policy, destroy gate, and provider_state fold)
• noetl-executor workspace crate (tools_bridge)
• Umbrella: noetl/ai-meta#189