pingcli-plugin-terraformer

README

Ping CLI Terraformer Plugin

Export PingOne resources to Terraform configuration with automatic dependency resolution and import block generation.

Features

• Complete DaVinci Export: Export DaVinci flows, variables, connector instances, applications, and flow policies
• Multiple Output Formats: Supports Terraform HCL (.tf) or Terraform JSON (.tf.json) output
• Automatic Dependency Resolution: Generates Terraform references between resources
• Import Block Generation: Terraform import blocks to manage existing resources (Terraform 1.5+)
• Module Structure: Generates reusable Terraform modules with proper variable scaffolding
• Dual Mode Operation: Works as standalone CLI or Ping CLI plugin
• Two-Environment Authentication: Isolate credentials from exported resources

Guides

• Manage an Existing Environment
• Migrate from Legacy DaVinci Provider

Installation

Pre-built Binaries (Recommended)

Download from GitHub Releases.

Homebrew (macOS/Linux)

brew install pingidentity/homebrew-pingcli/pingcli-terraformer

Linux Package Managers

# Debian/Ubuntu
sudo dpkg -i pingcli-terraformer_*.deb

# RHEL/CentOS/Fedora
sudo rpm -i pingcli-terraformer_*.rpm

# Alpine
sudo apk add pingcli-terraformer_*.apk

Docker

docker run --rm \
  -e PINGCLI_PINGONE_ENVIRONMENT_ID="..." \
  -e PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_ID="..." \
  -e PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_SECRET="..." \
  -v $(pwd)/output:/output \
  ghcr.io/pingidentity/pingcli-plugin-terraformer:latest \
  export --services pingone-davinci --out /output

From Source

git clone https://github.com/pingidentity/pingcli-plugin-terraformer.git
cd pingcli-plugin-terraformer
make build

Prerequisites

• PingOne environment with DaVinci
• PingOne worker application with DaVinci API Read access
• Terraform 1.5+ (for import blocks)

Configuration

Environment Variables

Variable	Description
PINGCLI_PINGONE_ENVIRONMENT_ID	Worker environment ID (authentication)
PINGCLI_PINGONE_EXPORT_ENVIRONMENT_ID	Target environment to export (optional, defaults to worker env)
PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_ID	OAuth2 client ID
PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_SECRET	OAuth2 client secret
PINGCLI_PINGONE_REGION_CODE	Region code: NA, EU, AP, CA, AU

Two-Environment Model

Export resources from a different environment than where the worker app is configured:

pingcli-terraformer export \
  --pingone-worker-environment-id <auth-env-uuid> \
  --pingone-export-environment-id <target-env-uuid> \
  --pingone-worker-client-id <client-id> \
  --pingone-worker-client-secret <secret> \
  --pingone-region-code NA \
  --out ./output

Usage

Basic Export (HCL)

pingcli-terraformer export \
  --services pingone-davinci \
  --pingone-worker-environment-id <uuid> \
  --pingone-worker-client-id <client-id> \
  --pingone-worker-client-secret <secret> \
  --pingone-region-code NA \
  --out ./output

Export as Terraform JSON

pingcli-terraformer export \
  --services pingone-davinci \
  --output-format tfjson \
  --out ./output

Using Environment Variables

export PINGCLI_PINGONE_ENVIRONMENT_ID="..."
export PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_ID="..."
export PINGCLI_PINGONE_CLIENT_CREDENTIALS_CLIENT_SECRET="..."
export PINGCLI_PINGONE_REGION_CODE="NA"

pingcli-terraformer export --services pingone-davinci --out ./output

Command Reference

Export Command

Flag	Default	Description
--services	pingone-davinci	Services to export (comma-separated)
--pingone-worker-environment-id	-	Worker environment ID
--pingone-export-environment-id	Worker env	Target environment ID
--pingone-worker-client-id	-	OAuth2 client ID
--pingone-worker-client-secret	-	OAuth2 client secret
--pingone-region-code	NA	Region: NA, EU, AP, CA, AU
--out / -o	stdout	Output directory path
--output-format	hcl	Output format: hcl or tfjson
--module-name	ping-export	Module name prefix
--module-dir	ping-export-module	Child module directory name
--include-values	false	Populate variable values from API
--include-imports	false	Generate import blocks in root module
--skip-imports	false	Skip generating import blocks
--skip-dependencies	false	Use hardcoded UUIDs instead of references

Output Formats

Format	Flag Value	File Extension	Description
HCL	hcl	.tf	Standard Terraform HCL syntax (default)
Terraform JSON	tfjson	.tf.json	Terraform JSON configuration syntax

Supported Resources

Resource	Terraform Type
DaVinci Flow	pingone_davinci_flow
DaVinci Variable	pingone_davinci_variable
DaVinci Connector Instance	pingone_davinci_connector_instance
DaVinci Application	pingone_davinci_application
DaVinci Flow Policy	pingone_davinci_application_flow_policy

Contributing

See CONTRIBUTING.md for development guides, architecture documentation, and how to add new resources.

License

Apache License 2.0 - see LICENSE.

Documentation

Overview

Package main provides a CLI plugin for converting PingOne DaVinci flows (in JSON format) to HCL (HashiCorp Configuration Language) that is compatible with the PingOne Terraform Provider's DaVinci resources.

This binary can operate in two modes: 1. Plugin mode: Launched by pingcli as a gRPC plugin 2. Standalone mode: Run directly from command line with flags