v4.0.0

What's New

This release adds RBAC and organization administration to the provider: service accounts, users, invites, and role bindings, along with singular and plural data sources for each. All admin resources use the provider's admin credentials (client_id / client_secret, or PINECONE_CLIENT_ID / PINECONE_CLIENT_SECRET).

Service Accounts

Create and manage organization service accounts. The OAuth client_secret is returned only at creation or rotation — it cannot be read back later, so it stays empty in state for an imported service account. Change rotate_trigger to any new value to issue and store a new secret.

resource "pinecone_service_account" "ci" {
  name           = "ci-deployer"
  rotate_trigger = "2026-01-01"
}

output "ci_client_secret" {
  value     = pinecone_service_account.ci.client_secret
  sensitive = true
}

Note: client_secret is stored in plaintext in Terraform state. sensitive redacts it from CLI output but does not encrypt state — secure your state backend.

Role Bindings

Grant a role to a principal (user, service_account, or api_key) at organization or project scope. Bindings are immutable — changing any attribute forces replacement. resource_id is required for project scope and must be omitted for organization scope.

resource "pinecone_role_binding" "ci_org_member" {
  principal_id   = pinecone_service_account.ci.id
  principal_type = "service_account"
  resource_type  = "organization"
  role           = "OrgMember"
}

resource "pinecone_role_binding" "ci_project_editor" {
  principal_id   = pinecone_service_account.ci.id
  principal_type = "service_account"
  resource_type  = "project"
  resource_id    = pinecone_project.example.id
  role           = "ProjectEditor"
}

Invites

Send and revoke organization invitations. role_bindings sets the invitee's initial roles and must include one organization-scoped membership role; the server moves those bindings to the user principal once the invite is accepted, so the roles carry over. Deleting a pending invite revokes it; deleting an accepted (processed) one is a no-op.

resource "pinecone_invite" "contractor" {
  email = "contractor@example.com"

  role_bindings = [
    {
      resource_type = "organization"
      role          = "OrgMember"
    },
    {
      resource_type = "project"
      role          = "ProjectEditor"
      resource_id   = pinecone_project.example.id
    }
  ]
}

Note: the invite endpoint does not return the roles it granted, so role_bindings is not drift-detected and cannot be imported. Read an invite's bindings with the pinecone_role_bindings data source using principal_type = "invite". After acceptance, manage the user's roles with pinecone_role_binding and principal_type = "user".

Users

Users can't be created through Terraform — they join by accepting an invite — so pinecone_user manages an existing member via import. Destroying the resource removes the user from the organization. Roles are managed with pinecone_role_binding.

resource "pinecone_user" "teammate" {
  id = "495a1437-79de-4121-9326-c0d3aa6090f8"
}

terraform import pinecone_user.teammate 495a1437-79de-4121-9326-c0d3aa6090f8

New Data Sources

pinecone_service_account(s), pinecone_user(s), pinecone_invite(s), and pinecone_role_binding(s). The plural forms support filtering: users by email, and role bindings by principal or by resource scope.

data "pinecone_user" "teammate" {
  email = "teammate@example.com"
}

data "pinecone_role_bindings" "teammate_roles" {
  principal_type = "user"
  principal_id   = data.pinecone_user.teammate.id
}

output "teammate_roles" {
  value = [for b in data.pinecone_role_bindings.teammate_roles.role_bindings : b.role]
}

Other Changes

• Bumped to go-pinecone v6.0.0 (#89)
• Fixed max_pods not being applied on project create; hardened index, collection, and project delete paths with transient-error retries and a single shared delete timeout (#86)
• Dependency updates (#80, #88)

Changelog

• d6d6965 Bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#88)
• 0ea3445 Implement RBAC and new Admin operations (#90)
• c3f740b Bump go-pinecone -> v6.0.0 (#89)
• e2d1659 Bump dependencies (consolidated Dependabot PRs #73–#79, #81–#85) (#80)
• ba73607 Fix max_pods on project create; harden delete paths and speed up acceptance tests (#86)