> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-provisioner-mirror-no-fallback.md). # PLUGIN\_PROVISIONER\_MIRROR\_NO\_FALLBACK Configure PLUGIN\_PROVISIONER\_MIRROR\_NO\_FALLBACK to control whether the IaCM plugin falls back to vendor download endpoints when the Harness Artifact Registry mirror is unavailable. {% hint style="success" %} This feature is in Limited GA and requires enablement. [View all early access features.](/release-notes/features.md) {% @harness-feature-flag-access/request-feature-flag-access module="infrastructure-as-code-management" pagePath="infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-provisioner-mirror-no-fallback" featureFlags="%5B%7B%22name%22%3A%22Provisioner%20binary%20mirror%22%2C%22key%22%3A%22IACM\_ENABLE\_PROVISIONER\_MIRROR%22%2C%22status%22%3A%22LIMITED\_GA%22%2C%22description%22%3A%22When%20enabled%2C%20the%20IaCM%20plugin%20downloads%20Terraform%20and%20OpenTofu%20binaries%20from%20Harness%20Artifact%20Registry%20first%2C%20falling%20back%20to%20the%20vendor%20site%20if%20the%20mirror%20is%20unavailable.%22%7D%5D" %} {% endhint %} The provisioner binary mirror allows the IaCM plugin download Terraform and OpenTofu binaries from Harness Artifact Registry (HAR) instead of vendor download endpoints, preventing pipeline failures caused by GitHub API or `get.opentofu.org` rate limits in high-concurrency environments. Applies to Terraform and OpenTofu; Terragrunt binaries are not mirrored. Harness enables the mirror per account by setting `PLUGIN_PROVISIONER_MIRROR_BASE`, you do not need to configure that variable. After Harness enables the feature flag, the plugin handles download routing automatically. Use `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK` to control whether a mirror miss fails the pipeline or falls back to the vendor site. *** ## How it works When the mirror is enabled for your account, the IaCM plugin: 1. Attempts to download the requested provisioner binary from HAR. 2. Verifies the binary checksum against a `SHA256SUMS` file served from HAR. HAR hosts both a Harness-format and a vendor-format checksum file; the plugin tries the Harness-format file first and falls back to the vendor-format copy. No outbound request to the vendor site is made during checksum verification. 3. Falls back to the vendor site if HAR does not have the requested version or the download fails. By default, the plugin falls back to the vendor site when a version is not available in HAR or the mirror download fails. Go to [Disable vendor fallback](#disable-vendor-fallback) if you need to prevent that fallback. {% hint style="info" %} If you configure `PLUGIN_BINARY_DIR` and the directory contains a matching provisioner binary, that binary takes precedence over the mirror. The plugin does not download the binary from HAR. {% endhint %} *** ## Before you begin Confirm the following before requesting mirror enablement: * **Plugin version:** `iacm-terraform-plugin/v0.287.0` or later. If your account has a pinned plugin image version set via the `execution-config` API, update the pin to `v0.287.0` or later first. * **Enablement:** Harness must enable the provisioner binary mirror for your account. Contact [Harness Support](https://support.harness.io) and include your account ID. Go to **Account Settings > Account Details > General** to find your account ID. Harness confirms when the feature flag is active. After enablement, the plugin automatically routes provisioner downloads through HAR on the next pipeline run without any pipeline or workspace changes required. *** ## Disable vendor fallback To treat a mirror miss as a hard failure instead of falling back to the vendor site, set `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK=true` on your workspace. Use this when you need to guarantee that all provisioner binaries come from HAR, for example in an environment where vendor sites are unreachable. You need the **IaCM Workspace Edit** role or higher to add environment variables to a workspace. Go to [IaCM plugins](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins.md) for role details. To set the variable: 1. Navigate to your workspace and select the **Connectors and Variables** tab. 2. In the **Environment Variables** section, select **+ Add Variable**. 3. Set **Key** to `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK` and **Value** to `true`. 4. Select **Save Changes**. {% hint style="warning" %} When `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK` is set and the mirror is unavailable or the requested version is not in HAR, the pipeline fails at the **Installing provisioner** step. Do not set this variable if you need vendor fallback. {% endhint %} *** ## Verify the mirror After Harness enables the mirror, run a pipeline and check the **Installing provisioner** step logs. A successful mirror download includes a message similar to: ``` Installed terraform 1.9.0 from provisioner mirror ``` If the requested version is not in HAR and fallback is active, the log includes a message similar to: ``` Provisioner mirror miss for terraform 1.9.0 (); falling back to vendor installer ``` *** ## Troubleshooting
The Installing provisioner step still hits a rate limit after the mirror is enabled Verify the following: * The provisioner binary mirror feature flag is confirmed active for your account by Harness Support. * The plugin version is `iacm-terraform-plugin/v0.287.0` or later. If your account uses a pinned image version, confirm the pin has been updated. * The **Installing provisioner** logs show `Installed … from provisioner mirror`, not `using vendor installer`. After confirming all three conditions, re-run the pipeline.
The pipeline fails with a checksum mismatch error Verify the following: * The provisioner version declared on your workspace is available in HAR. * The network path from the runner to HAR is not intercepting or modifying the download. If the issue persists, contact [Harness Support](https://support.harness.io) with the pipeline execution ID and the full error from the **Installing provisioner** step.
The pipeline fails with "provisioner mirror disabled and PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK is set" `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK` is set to `true` on your workspace, but the mirror is not active for your account. Either request mirror enablement from Harness Support or remove the `PLUGIN_PROVISIONER_MIRROR_NO_FALLBACK` variable from your workspace.
*** ## Next steps * Go to [IaCM plugins](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins.md) for the full list of plugin environment variables. * Go to [PLUGIN\_BINARY\_DIR](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-binary-dir.md) to use a provisioner binary from a custom image instead of downloading one at runtime. {% @harness-feedback/feedback %}