Open l2fprod opened 4 years ago
l2fprod
commented
4 years ago It seems that one option I have is to not use the "security_groups" attribute but only the attachment. This way it seems terraform does not look at the security groups during apply and thus does not try to change anything. But doing so I have to be careful to not touch the VPC default security group and just leave it with its almost empty rules.
BShrivastav
commented
1 year ago Hello @l2fprod ,
Could you please acknowledge if you are able to utilise the security group target to achieve the same, as the resource is deprecated also it will be removed as part of future release.
l2fprod
commented
1 year ago I replaced with ibm_is_security_group_target but there is still a bug if you apply this twice.
The reason is because of the nested security_groups in is_instance. If you attach groups outside of the instance in addition to using security_groups inside the instance, the code is not able to reconcile everything.
variable "ibmcloud_api_key" {}
variable "region" { default = "us-south" }
variable "basename" { default = "testbed" }
terraform {
required_providers {
ibm = {
source = "IBM-Cloud/ibm"
}
}
required_version = ">= 1.1.8"
}
provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
region = var.region
}
data "ibm_is_image" "ds_image" {
name = "ibm-centos-7-6-minimal-amd64-2"
}
variable "ssh_keyname" {}
data "ibm_is_ssh_key" "ds_key" {
name = var.ssh_keyname
}
variable resource_group_name {}
data "ibm_resource_group" "group" {
name = var.resource_group_name
}
resource "ibm_is_vpc" "vpc" {
name = "${var.basename}-vpc"
resource_group = data.ibm_resource_group.group.id
}
resource "ibm_is_public_gateway" "cloud" {
vpc = ibm_is_vpc.vpc.id
name = "${var.basename}-pubgw"
zone = "${var.region}-1"
}
resource "ibm_is_vpc_address_prefix" "vpc_address_prefix" {
name = "${var.basename}-prefix"
zone = "${var.region}-1"
vpc = ibm_is_vpc.vpc.id
cidr = "192.168.0.0/16"
}
resource "ibm_is_subnet" "subnet" {
name = "${var.basename}-subnet"
vpc = ibm_is_vpc.vpc.id
zone = "${var.region}-1"
resource_group = data.ibm_resource_group.group.id
ipv4_cidr_block = ibm_is_vpc_address_prefix.vpc_address_prefix.cidr
}
resource "ibm_is_instance" "instance" {
name = "${var.basename}-instance"
vpc = ibm_is_vpc.vpc.id
zone = "${var.region}-1"
profile = "cx2-2x4"
image = data.ibm_is_image.ds_image.id
keys = [data.ibm_is_ssh_key.ds_key.id]
resource_group = data.ibm_resource_group.group.id
primary_network_interface {
subnet = ibm_is_subnet.subnet.id
security_groups = [
ibm_is_security_group.instance-group.id
]
}
}
resource "ibm_is_security_group" "instance-group" {
name = "${var.basename}-instance-group"
vpc = ibm_is_vpc.vpc.id
resource_group = data.ibm_resource_group.group.id
}
resource "ibm_is_security_group" "another-group" {
name = "${var.basename}-another-group"
vpc = ibm_is_vpc.vpc.id
resource_group = data.ibm_resource_group.group.id
}
resource "ibm_is_security_group_target" "attach-instance" {
security_group = ibm_is_security_group.another-group.id
target = ibm_is_instance.instance.primary_network_interface.0.id
}@l2fprod , thanks for more detail. Your observation is correct and logically right. As addition of security group as part of instance resource inline:
resource "ibm_is_instance" "example2" {
name = "example-instance-2"
image = ibm_is_image.example.id
profile = "cx2-2x4"
primary_network_interface {
subnet = ibm_is_subnet.example.id
security_groups = [ibm_is_security_group.example.id]
}
dedicated_host_group = ibm_is_dedicated_host_group.example.id
vpc = ibm_is_vpc.example.id
zone = "us-south-1"
keys = [ibm_is_ssh_key.example.id]
depends_on = [ibm_is_security_group_rule.example3]
//User can configure timeouts
timeouts {
create = "15m"
update = "15m"
delete = "15m"
}
}or by using security group target
resource "ibm_is_security_group_target" "attach-instance" {
security_group = ibm_is_security_group.another-group.id
target = ibm_is_instance.instance.primary_network_interface.0.id
}would create redundancy for the terraform, We recommend to use one of the both to achieve security group attachments. We will also try to enhance the documentation for the same.
As defined here for nics:
Applying the following tf twice results in new changes detected.
I have this simple tf creating a VPC, one instance and two security groups:
On first
terraform applyeverything works as expected:Without changing anything, I run apply again, and I expect no changes to be applied but...
Notice that Terraform detects that the security groups configuration for the instance needs to be changed.
This is because I specified one security group in the instance definition and then I used the security group network attachment so terraform is confused and tries to remove this other security group added by another mean.
Now if I do apply and then another apply, it will prompt again to re-add the group... an infinite loop of apply.
What is the proper way to handle this?