formae.SecretValue so their values are hashed at rest end-to-end (previously stored in cleartext on the read/actual-state path). Covers GCP::Compute::BackendService and GCP::Compute::RegionBackendService oauth2ClientSecret, GCP::Container::Cluster master-auth password, and GCP::SQL::Database rootPassword. Requires a formae agent on the matching release; minFormaeVersion is bumped to 0.88.0.GCP::CloudRun::Service exposes template.vpcAccess, letting a service
route egress through a Serverless VPC connector or direct VPC network
(connector, networkInterfaces, egress).GCP::CloudRun::Service create no longer hangs: the operation is now
polled to completion, and selfLink is normalized so a create-then-read
cycle no longer reports spurious drift.GCP::IAM::ServiceAccount delete is now async, completing only once the
account has left the list, so a delete immediately followed by a
synchronization or discovery run no longer resurrects it.GCP::Compute::InstanceGroup now manages VM membership via an instances
field (instance self-links or Instance resolvables), reconciled with
addInstances / removeInstances; namedPorts are now mutable via
setNamedPorts. This lets a GCE VM back an external HTTPS load balancer.GCP::Compute::SslCertificate.privateKey accepts a wrapped value
(formae.value(read(...).text).opaque), keeping the PEM private key out of
rendered plans and stored state.GCP::Compute::SslCertificate SELF_MANAGED certificates now send
certificate / privateKey nested under selfManaged, as the API requires.
Creation previously failed with "Self-managed certificate details must be
specified if type = SELF_MANAGED".GCP::IAM::ServiceAccount creation now accounts for IAM eventual consistency:
the create completes only once the account is listable, so a synchronization
or discovery run immediately after create no longer drops it from inventory.GCP::Compute::InstanceGroup read no longer surfaces provider-populated
network / subnetwork as spurious drift.GCP::PubSub::Topic, GCP::PubSub::Subscription, and
GCP::PubSub::Schema.GCP::SecretManager::Secret (automatic, Google-managed
replication by default).GCP::DNS::ManagedZone for public and private DNS zones.GCP::IAM::ServiceAccount for service accounts and GCP::IAM::Role
for custom project roles.GCP::Compute::Route for static VPC routes and
GCP::Compute::SecurityPolicy for Cloud Armor policies.GCP::BigQuery::Dataset and GCP::BigQuery::Table now support updates.
Previously create/delete only; mutable fields such as description, labels,
and (for tables) schema can now be changed in place.GCP::IAM::ProjectIamMember for managing a single member-role binding on a
project, without touching the rest of the project's IAM policy.id,
name, selfLink), so references to these resources resolve correctly.GCP::Compute::RouterNat for managing Cloud NAT configurations on a Cloud
Router.GCP::GKEHub::Feature and GCP::GKEHub::Membership,
can now be managed through formae. Use Membership to register GKE (or
external) clusters into a fleet and Feature to enable fleet-wide features on
those clusters.formae extract now works correctly for BigQuery Table resources. Previously,
extracting a managed table to PKL would fail with an internal error,
preventing round-trip workflows (deploy, extract, redeploy).GCP::CloudRun::Job and GCP::CloudRun::Service) with
full conformance tests.location to the GCP target configuration, giving explicit control over the
target location for regional resources.Disk.sourceImage nullable type. The field was incorrectly required, causing
validation failures when creating disks without a source image.