EngineerBetter / control-tower

Deploy and operate Concourse CI in a single command
https://www.engineerbetter.com
Apache License 2.0
121 stars 39 forks source link

Secrets for `aws_access_key_id` and `aws_secret_access_key` not saved to credhub when updating to 0.20.4 #279

Open beccar97 opened 1 year ago

beccar97 commented 1 year ago

I recently updated our control-tower installation from version 0.19.5 to 0.20.4 using the self-update job. I then tried to use the self-update job to upgrade to 0.22.1 and the task failed due to the error

failed to interpolate task config: undefined vars: aws_access_key_id, aws_secret_access_key

Looking at the terraform output of the upgrade to 0.20.4 and in our AWS account I can see that when updating to 0.20.4 the self-update user was correctly created, and an access key was created, but the details of this key were not saved anywhere. In order to resolve the issue I had to manually create another access key for the user from the AWS console and save secrets concourse/main/control-tower-self-update/aws_access_key_id and concourse/main/control-tower-self-update/aws_secret_access_key to credhub.

While I was able to resolve the issue and continue updating our installation, the release notes implied that this would happen automatically as part of the update, and I was not expecting to have to do this manually