search

PaloAltoNetworks / terraform-provider-panos

Terraform Panos provider
https://www.terraform.io/docs/providers/panos/
Mozilla Public License 2.0
87 stars 70 forks source link

panos_panorama_tunnel_interface crashes #326

Open kbreit opened 2 years ago

kbreit commented 2 years ago

Describe the bug

When running panos_panorama_tunnel_interface I am receiving a crash. This crash only happens if I do a terraform plan. If I do a terraform plan -target=panos_panorama_tunnel_interface.gcp_tunnel it works fine. It also errors out when I include only the provider creation and remove all resources.

│ Error: Plugin did not respond
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ReadResource call. The plugin logs
│ may contain more details.
╵
╷
│ Error: Plugin did not respond
│
│   with panos_panorama_tunnel_interface.gcp_tunnel,
│   on gcp_vpn.tf line 5, in resource "panos_panorama_tunnel_interface" "gcp_tunnel":
│    5: resource "panos_panorama_tunnel_interface" "gcp_tunnel" {
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ReadResource call. The plugin logs
│ may contain more details.
╵

Stack trace from the terraform-provider-panos_v1.10.0 plugin:

panic: interface conversion: interface {} is *pango.Panorama, not *pango.Firewall

goroutine 68 [running]:
github.com/terraform-providers/terraform-provider-panos/panos.readTunnelInterface(0xc000c1e690, 0x212e7a0, 0xc00000a1e0, 0xc000c1e690, 0x0)
    github.com/terraform-providers/terraform-provider-panos/panos/resource_tunnel_interface.go:104 +0x8f9
github.com/hashicorp/terraform-plugin-sdk/helper/schema.(*Resource).RefreshWithoutUpgrade(0xc0006870e0, 0xc00032d090, 0x212e7a0, 0xc00000a1e0, 0xc00000e4b8, 0x0, 0x0)
    github.com/hashicorp/terraform-plugin-sdk@v1.17.2/helper/schema/resource.go:470 +0x12e
github.com/hashicorp/terraform-plugin-sdk/internal/helper/plugin.(*GRPCProviderServer).ReadResource(0xc0000cad38, 0x23711d0, 0xc000151410, 0xc000380ae0, 0xc0000cad38, 0xc000647ba0, 0x106ca87)
    github.com/hashicorp/terraform-plugin-sdk@v1.17.2/internal/helper/plugin/grpc_provider.go:535 +0x3dd
github.com/hashicorp/terraform-plugin-sdk/internal/tfplugin5._Provider_ReadResource_Handler(0x20e9340, 0xc0000cad38, 0x23711d0, 0xc000151410, 0xc000380a80, 0x0, 0x23711d0, 0xc000151410, 0xc000906300, 0xb3)
    github.com/hashicorp/terraform-plugin-sdk@v1.17.2/internal/tfplugin5/tfplugin5.pb.go:3269 +0x214
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000a701c0, 0x237a8f8, 0xc000001980, 0xc000c42000, 0xc000726540, 0x2a99c10, 0x0, 0x0, 0x0)
    google.golang.org/grpc@v1.32.0/server.go:1194 +0x52b
google.golang.org/grpc.(*Server).handleStream(0xc000a701c0, 0x237a8f8, 0xc000001980, 0xc000c42000, 0x0)
    google.golang.org/grpc@v1.32.0/server.go:1517 +0xd0c
google.golang.org/grpc.(*Server).serveStreams.func1.2(0xc0005ec280, 0xc000a701c0, 0x237a8f8, 0xc000001980, 0xc000c42000)
    google.golang.org/grpc@v1.32.0/server.go:859 +0xab
created by google.golang.org/grpc.(*Server).serveStreams.func1
    google.golang.org/grpc@v1.32.0/server.go:857 +0x1fd

Error: The terraform-provider-panos_v1.10.0 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Expected behavior

It should create a tunnel interface in the proper Panorama template.

Current behavior

See above for crash.

Steps to reproduce

provider "panos" {
  hostname = "panorama-domain.example.com"
}

resource "panos_panorama_tunnel_interface" "gcp_tunnel" {
  template = "PAN-template"
  name = "tunnel.8"
  comment = "Tunnel for GCP demo"

  lifecycle {
      create_before_destroy = true
  }
}

Your Environment

jamesholland-uk commented 2 years ago

Hi @kbreit, I can reproduce this error if I target a NGFW, but if I target Panorama it works fine. panos_panorama_tunnel_interface is designed for Panorama specifically. Are you targeting a NGFW or Panorama?

kbreit commented 2 years ago

@jamesholland-uk - I am definitely targeting Panorama. However, I wonder if the provider is caching some old values and internally pointing to a firewall. Looking into this a bit more. Do you happen to know how I can see the targets in state?

jamesholland-uk commented 2 years ago

@kbreit Your Terraform state is found in the file terraform.tfstate in your working directory if you're executing Terraform from a workstation. It's human readable. If, per the comment string, this is a demo environment, it could be worth testing this in a fresh working directory I guess.

Also, is there anything else in gcp_vpn.tf? Or other Terraform code in the working directory involved etc? I ask because:

When I target a NGFW with your code snippet, I get: interface {} is *pango.Firewall, not *pango.Panorama and the trace first line hass github.com/terraform-providers/terraform-provider-panos/panos.readPanoramaTunnelInterface which makes sense as I am using Panorama resource type panos_panorama_tunnel_interface for a NGFW.

Your pasted error text shows interface {} is *pango.Panorama, not *pango.Firewall and the trace first line contains github.com/terraform-providers/terraform-provider-panos/panos.readTunnelInterface. This is the wrong way around, there is use of the NGFW tunnel interface under the hood, and it is not happy at targeting a Panorama...

kbreit commented 2 years ago

@jamesholland-uk I don't have anything else panos related in the directory and right now the only thing I have enabled is the panos provider. However, if I enable this code snippet...

resource "panos_panorama_tunnel_interface" "gcp_tunnel" {
  template = "PAN-template"
  name = "tunnel.8"
  comment = "Tunnel for GCP, Transform 2022 demo"

  lifecycle {
      create_before_destroy = true
  }
}

I get...

Stack trace from the terraform-provider-panos_v1.10.0 plugin:

panic: interface conversion: interface {} is *pango.Panorama, not *pango.Firewall

goroutine 16 [running]:
github.com/terraform-providers/terraform-provider-panos/panos.readTunnelInterface(0xc000b24700, 0x212e7a0, 0xc00000a1e0, 0xc000b24700, 0x0)

As you said, it's inverted of what you're seeing. I am specifying the Panorama based resource but it's thinking it's panos. Regarding tstate, we're storing state in Azure so it's not local. But a terraform state show panos_panorama_tunnel_interface.gcp_tunnel isn't showing anything too exciting. It does include the template parameter.

jamesholland-uk commented 2 years ago

You could append this to your .tf file, to make sure it i definitely Panorama?!? No strange DNS resolving you to a NGFW?

data "panos_system_info" "device_info" { }

output "model" {
    value = data.panos_system_info.device_info.info.model
}

You should see something like:

Changes to Outputs:
  + model = "Panorama"

vs a NGFW model like this for VM-Series:

Changes to Outputs:
  + model = "PA-VM"
kbreit commented 2 years ago

Did that but it's still crashing...

│ Error: Plugin did not respond
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ReadResource call. The plugin logs may contain more details.
╵
╷
│ Error: Plugin did not respond
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ReadResource call. The plugin logs may contain more details.
╵
╷
│ Error: Plugin did not respond
│
│ The plugin encountered an error, and failed to respond to the plugin.(*GRPCProvider).ReadResource call. The plugin logs may contain more details.
╵

Stack trace from the terraform-provider-panos_v1.10.0 plugin:

panic: interface conversion: interface {} is *pango.Panorama, not *pango.Firewall

goroutine 67 [running]:
github.com/terraform-providers/terraform-provider-panos/panos.readTunnelInterface(0xc000142850, 0x212e7a0, 0xc00000a1e0, 0xc000142850, 0x0)
jamesholland-uk commented 2 years ago

It doesn't make sense somewhere. The error related to readTunnelInterface is coming from (code) from panos_tunnel_interface, but your code is using panos_panorama_tunnel_interface?

Discussing more with others, maybe try reinitialising the plugin, and if that doesn't help, try TF_LOG=trace terraform apply and paste the results so we can get more insight.

kbreit commented 2 years ago

I resolved this today. There were both panos and panos_panorama resources in state. So when it tried to scan the panos ones it got caught up with Panorama.

Is it feasible to catch this exception in code and provide a more friendly error?

jamesholland-uk commented 2 years ago

Glad it is sorted :-) The smoking gun was always interface conversion: interface {} is *pango.Panorama, not *pango.Firewall

If different error messages is an enhancement you would like to request, I'd ask that you open a separate GitHub Issue for it, and we can tag it as an enhancement and track it there. Many thanks