Terraform Enterprise 2.1.x

The following tables show Terraform Enterprise releases, deployment methods, and prerequisites.

* Denotes a required release. All online upgrades will automatically install this version, but airgap customers must upgrade to this version before proceeding to later releases.

** The release package contains this version of the Terraform CLI, but you can install older and newer versions of the Terraform CLI as needed via the Admin UI or API.

Minimum system requirements

The requirements for deploying Terraform Enterprise depend on the version you want to deploy, as well as the environment you plan to operate the software in, such as operating system, runtime, and storage systems. Check the software product compatibility report page for details.

2.1.0

Last required release: v202406-1 (776)

Flexible Deployment Options terraform-enterprise container digest: amd64/linux sha256:1a2b18a325aa6a5b02239e331211feab459431b3fc8db8e645038983e351094c, arm64/linux sha256:73f7bf42eb64478fa864ae07dcbf133c9bd48a5e51a9f748a54241ddbfbf213b

Breaking Changes

1. Terraform Enterprise now disables public self-registration by default. This change does not apply to instances configured with SAML authentication. Previously, public self-registration was enabled by default. Instances that relied on default open registration will have unauthenticated sign-ups blocked after upgrade until a site administrator explicitly enables the setting. To preserve open-registration behavior, set enable-public-registration to true using the Admin Settings API, or enable Enable public registration in Admin > Settings.
2. Terraform Enterprise now packages version control operations in an agent job instead of the standalone slug-ingress service. Your agents must be able to reach your VCS servers. On Kubernetes, allow egress to your VCS servers from the agents namespace. Refer to Configure network access for more information. Ingress jobs run alongside your other agent workloads and do not count against an organization's run concurrency. They use the same image, CPU, and memory settings as run agents, and create additional agent containers on Docker and Podman, agent jobs on Nomad, and agent pods in your agents namespace on Kubernetes. Refer to Increase run capacity on Kubernetes to size the agents namespace. To keep the Terraform Enterprise 2.0 behavior while you update your network rules, set TFE_VCS_INGRESS_SLUG_INGRESS_FALLBACK to true and restart Terraform Enterprise.

Deprecations

1. Terraform Enterprise is transitioning to Red Hat Universal Base Image (UBI) as its base operating system. If you have built a custom Terraform Enterprise image on top of the current base image, you must rebuild your image and update any OS-specific customizations for compatibility. IBM does not support building custom Terraform Enterprise images. Instead, you should run the official unmodified image. If you have specific requirements that necessitate a custom image, contact your IBM account representative.

2. The idp-cert and old-idp-cert attributes in the admin/saml-settings endpoint, and the admin/saml-settings/actions/revoke-old-certificate action, are deprecated and will be removed in a future release. This is part of the transition to multiple SAML IdP certificates. Use the SAML IdP Certificates API instead.

3. Built-in Fluent Bit log forwarding is deprecated and will no longer be supported starting in October 2027. We recommend configuring external log forwarding using your platform's native container logging drivers or host-level observability agents.

4. VCS ingress fallback to the slug-ingress service is deprecated and will no longer be supported starting in October 2027. We recommend allowing your agents to reach your VCS servers so that Terraform Enterprise can perform VCS ingress in agent jobs.

5. Relying on implicit auto-detection of Azure Workload Identity for object storage is deprecated. You should explicitly set TFE_OBJECT_STORAGE_AZURE_USE_WORKLOAD_IDENTITY to true or false instead of depending on auto-detection based on the AZURE_FEDERATED_TOKEN_FILE environment variable. Refer to Deploy to Kubernetes for details.

Highlights

1. Terraform Policy: Terraform Enterprise now supports Terraform policy, a declarative, HCL-based policy-as-code framework integrated directly with Terraform and provider schemas. Terraform policy enables you to author, test, and enforce governance policies across workspaces and Stacks natively within your Terraform workflow.

2. Tag-based policy set scoping: Terraform Enterprise now supports scoping a policy set to workspaces with matching tags, in addition to scoping by project or workspace, increasing the flexibility of targeting. Policy sets scoped to tags use a tag match logic of And, which requires all selected tags to be present on a workspace, or Or, which requires at least one selected tag to be present on a workspace. Refer to Manage policy sets for more information.

3. Project-level run tasks: Terraform Enterprise now supports project-level run tasks, enabling organizations to apply security, compliance, and operational guardrails consistently across groups of workspaces while reducing manual overhead. Refer to Terraform run tasks for more information.

4. Migrate workspaces to Stacks: You can now use the terraform stacks migrate command group to migrate existing workspaces into Terraform Stacks. The migration workflow automatically scaffolds Stack configuration, translates workspace state files into deployment-level Stack state, and imports resources into Stacks.

5. No code search: Terraform Enterprise lets you search your existing infrastructure for unmanaged resources and import them into your workspace from the user interface without writing HCL, making it easier to bring existing infrastructure under Terraform management.

6. Registry artifact tagging: You can now tag private registry modules, providers, and Stack component configurations with project tags. You can also tag individual artifact versions with environment tags, resulting in easier organization and discovery of the appropriate registry artifacts.

7. Restore deleted workspaces and Stacks: Site administrators and organization owners can now restore recently deleted workspaces and Stacks from a recoverable trash state, reducing recovery effort and risk from accidental deletion.

8. Global banner and link customization: Site administrators can now configure custom site-wide notification banners and override default platform help links. You can publish informational, warning, or critical banners with optional scheduling windows and audience targeting, as well as replace built-in documentation, tutorial, and support links with internal URLs.

9. Data retention policies by artifact type: Terraform Enterprise now lets you configure data retention policies separately for configuration versions, state versions, and run data and logs, including plans, applies, and assessments. You can also retain a specific number of the most recent versions for each resource and artifact type.

10. Node drain status: Terraform Enterprise introduces a node drain status API that lets you check whether a node is safe to terminate before removing it from a deployment. Use these endpoints to avoid interrupting active Terraform runs during node maintenance or scaling operations. Refer to Node Drain Status API for more information.

11. Modify node configuration without restart: You can now modify specific configuration values on a running Terraform Enterprise node without restarting it. Refer to Modify node configuration for more information.

12. Workload identity for Kubernetes: Terraform Enterprise now provides documented workload identity support for EKS, GKE, and Azure AKS. Workload identities eliminate the need for static credentials, such as access keys, service account JSON files, and storage account keys when authenticating to object storage, database, and Redis services. Refer to Deploy to Kubernetes for details.

13. AKS object storage workload identity setting: The new TFE_OBJECT_STORAGE_AZURE_USE_WORKLOAD_IDENTITY environment variable for AKS lets you either enable workload identity for object storage or use a storage account key for object storage, even when workload identity is active on the pod for other services such as PostgreSQL and Redis. Refer to Deploy to Kubernetes for details.

Features

1. Integration with IBM Cloudability: Terraform Enterprise now supports the Cloudability native task integration, which is in public beta. The Cloudability native task enables cost estimation, FinOps policy evaluation, and optimization recommendations as part of your infrastructure automation workflow, without requiring users to leave Terraform. This integration requires an HCP Terraform agent version 1.31.1 or later. Your instance must also be able to reach Cloudability endpoints for your region.

2. Multiple SAML IdP certificates: Terraform Enterprise previously trusted exactly one active SAML IdP certificate, plus one temporary certificate during a rotation window. Terraform Enterprise now stores IdP certificates as a collection and verifies each SAML response against every trusted certificate, so an identity provider that signs with different certificates per region no longer breaks logins during a failover. Refer to Manage IdP certificates for more information.

3. Admin console access modes: Terraform Enterprise introduces the TFE_ADMIN_CONSOLE_ACCESS_MODE environment variable, which provides flexible options for accessing the admin console through a dedicated port or standard HTTPS path. Refer to Access the admin console for additional information.

4. Pod-level workload identity: Terraform Enterprise deployments on Kubernetes now support pod-level workload identity federation for Azure, AWS, and GCP. This allows Terraform Enterprise pods to authenticate to external PostgreSQL, Redis, and storage services without passwords or node-level managed identities, improving security isolation in multi-tenant cluster environments.

5. Support for Redis 8 and Valkey 9.0: Terraform Enterprise now supports Redis 8 and Valkey 9.0 for the required external cache. Valkey is a drop-in replacement for Redis and uses the same connection settings.

6. Support for IBM Cloud: You can now deploy Terraform Enterprise to IBM Cloud. This gives you additional flexibility when hosting Terraform Enterprise in your cloud environment. You can also use the Terraform Enterprise on IBM Cloud deployable architecture to automate deployment with supporting IBM Cloud services.

Improvements

1. Token expiration notification: Terraform Enterprise sends notification emails at 30 days and seven days before a user, team, audit, or organization token expires. The expiration window is intended to give you sufficient time to rotate or renew tokens before they expire.

2. The Team Tokens page now supports improved filtering by token expiration status and bulk deletion, making it easier to find and manage multiple tokens.

3. Revoke user tokens: Site administrators can now view and revoke API tokens for any user in the organization directly from the admin UI or by calling the API, improving token governance and security compliance in environments where non-expiring user tokens pose a policy risk.

4. You can now use dynamic provider credentials with Tencent Cloud by configuring Terraform Enterprise as an OIDC relying party, eliminating the need for static credentials in workspace configurations.

5. Site Auditor role through identity provider: Terraform Enterprise now provisions the read-only Site Auditor role automatically through your identity provider. Configure a SAML attribute or role, or map a SCIM group, to grant and revoke cross-organization Site Auditor access without manual admin action. When SCIM is enabled, Terraform Enterprise skips SAML auditor provisioning. The role is Terraform Enterprise only and cannot be granted to service accounts. Refer to site auditor provisioning in the SAML SSO and SCIM documentation for details.

6. The Quick Filter buttons on the Workspaces page now adapt and display properly across all screen sizes. Previously, a layout bug affected their responsive behavior on certain screen resolutions.

7. You can now view full project names when filtering workspaces. The workspace filter has been redesigned into an inline bar that wraps long names onto multiple lines, preventing truncation.

8. You can now use the dedicated Actions page to discover, review, and invoke day-two operational workflows and remediation actions directly from the user interface. You can also monitor active and historical action runs to audit ad hoc operations and troubleshoot operational issues across your environment.

9. Disable gravatar.com: Site administrators can now disable outbound requests to gravatar.com by configuring Terraform Enterprise to display a default avatar icon instead, improving privacy and compatibility with restricted network environments.

10. Agent-based VCS ingress: Terraform Enterprise now uses agent-based VCS ingress, which packages version control data in an agent job rather than through the standalone slug-ingress service. Ingress jobs run on demand alongside your other agent workloads and do not count against an organization's run concurrency. Configuration versions, policy set versions, and registry module versions continue to ingress as before, with no change to the Terraform Enterprise UI or API. Terraform Enterprise still ships and runs the slug-ingress service as a fallback, so upgrading requires no configuration change. On Kubernetes, agent-based VCS ingress creates additional agent pods in your agents namespace.

11. Redis mTLS connections now support password authentication. You can enable certificate-based mutual TLS and Redis ACL credentials at the same time.

12. The Azure object storage configuration now supports block size and concurrency parameters, which brings it closer to parity with the AWS object storage configuration.

Bug Fixes

1. Variable sets no longer lose project associations when edited on organizations with more than ~30 attached projects. Previously, an internal HTTP 429 response during the paginated project-fetch could cause some projects to be silently detached before the save completed, leaving affected workspaces without access to the variable set until they were manually reattached.

2. The Automatic speculative plans option on a workspace's version control settings page is now correctly disabled when the VCS trigger type is set to tag-based. Previously, the option remained selectable even though speculative plans do not trigger on pull requests for tag-based workspaces, leading users to believe the feature was active when it was not.

3. Terraform Stacks now correctly resolve store.varset.<alias>.stable.<key> to the variable set named in that alias's store block. Previously, when two variable sets referenced by the same Stack contained a Terraform variable with the same key name, both deployments received the value from the same variable set instead of their respective configured sets.

4. The Edit Sharing button on the Manage Shared Registries page now works correctly on instances with a large number of organizations. Previously, clicking the button caused the browser to enter an infinite loop of requests to the /api/v2/admin/organizations endpoint, leaving the page unresponsive.

5. Site administrators can now view run details directly from the Admin > Runs page without impersonating another user. Previously, Terraform Enterprise 2.0 required administrators who were also organization owners to impersonate a different organization owner before run details would load. Administrators who were the sole owner of an organization were completely blocked from viewing those runs from the admin interface.

6. The GET /api/v2/organizations/:organization_name/tasks endpoint now returns each run task exactly once across all pages. Previously, a pagination bug caused some tasks to appear on multiple pages, resulting in duplicate entries in the UI and in any tooling that iterated all pages of results.

7. Structured run output now correctly shows the ID of the deposed resource instance to be destroyed. Previously, the plan UI displayed the ID of the current live resource instead of the deposed instance targeted for deletion. The previous output may have caused operators to incorrectly believe that an active resource was about to be removed, prompting them to block legitimate plan approvals. The console output was unaffected.

Security

1. Security vulnerabilities have been addressed and resolved in this update to enhance overall system protection.
2. Terraform Enterprise now rejects certificates issued by eight compromised eMudhra Limited intermediate certificate authorities, addressing CVE-2026-111943. The Go runtime and the container image's system CA certificates have been updated. As a result, connections to hosts that chain to the removed emSign Root TLS CA – G3 or Comodo AAA Certificate Services roots will now fail verification. For details, refer to the Ubuntu security blog.