[BUG] Unable to modify quota of Subaccount Entitlement

dacamposol commented 2 weeks ago

Is there an existing issue for this?

[X] I have searched the existing issues

What version of the Terraform provider are you using?

1.8.0

What version of the Terraform CLI are you using?

1.9.8

What type of issue are you facing

bug report

Describe the bug

Received the following error when trying to scale down a service entitlement in a given subaccount:

module.production-core-infra.btp_subaccount_entitlement.aicore: Still modifying... [id=<REDACTED>, 30s elapsed]
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.production-core-infra.btp_subaccount_entitlement.aicore, provider "provider[\"registry.terraform.io/sap/btp\"].agent-production" produced an unexpected new value: .amount: was
│ cty.NumberIntVal(1), but now cty.NumberIntVal(2).
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

Expected Behavior

Being able to scale down the quota of a service entitlement, if I consider that is not needed.

Steps To Reproduce

Verify the entitlement quota for the service that we want to scale down:

❯ btp --format json list accounts/entitlement | jq ' .quotas[] | select(.service=="aicore")'
{
  "service": "aicore",
  "plan": "sap-internal",
  "uniqueIdentifier": "NA",
  "quota": 2,
  "unlimited": false,
  "provisioningMethod": "SERVICE_BROKER",
  "serviceCategory": "ELASTIC_SERVICE",
  "resources": []
}

Verify that the actual quota is the one in the Terraform state:

❯ terraform state show module.production-core-infra.btp_subaccount_entitlement.aicore
# module.production-core-infra.btp_subaccount_entitlement.aicore:
resource "btp_subaccount_entitlement" "aicore" {
    amount        = 2
    category      = "ELASTIC_SERVICE"
    created_date  = "2024-09-27T09:36:44Z"
    id            = "<REDACTED>"
    last_modified = "2024-11-04T15:28:07Z"
    plan_id       = "<REDACTED>"
    plan_name     = "<REDACTED>"
    service_name  = "aicore"
    state         = "OK"
    subaccount_id = "<REDACTED>"
}

Reduce the quota in the Terraform script:

resource "btp_subaccount_entitlement" "aicore" {
  subaccount_id = btp_subaccount.infrastructure.id
  service_name  = "aicore"
  plan_name     = "sap-internal"
  amount        = 1
}

Apply changes and received the following error:

module.production-core-infra.btp_subaccount_entitlement.aicore: Still modifying... [id=<REDACTED>, 30s elapsed]
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.production-core-infra.btp_subaccount_entitlement.aicore, provider "provider[\"registry.terraform.io/sap/btp\"].agent-production" produced an unexpected new value: .amount: was
│ cty.NumberIntVal(1), but now cty.NumberIntVal(2).
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

User's Role Collections

Global Account Administrator
Subaccount Administrator

Add screenshots to help explain your problem

No response

Additional context

No response

dacamposol commented 2 weeks ago

Okay, further research shows that the problem is that some services (as in this case aicore) have what is called a non-numeric quota; and the quota of the service is shared across the whole Global Account without being able to establish anything at subaccount level:

A fixed quota for this plan is provided to your global account; however, this amount is available to every subaccount or managed directory to which you assign the plan. There is no manual distribution of this quota.

To make this plan available for use in a subaccount, you must assign this plan to the subaccount, without specifying an actual amount (also known as "non-numeric assignment").

Maybe could we do something so there isn't such a weird error on the Terraform side?

lechnerc77 commented 2 weeks ago

@dacamposol how did you create the entitlement for the AI Core service? If it is an ELASTIC_SERVICE which has no quota and must be assigned differently than the services with a quota, which the provider steer via getting a quota or not. If the entitlement was done via Terraform with a quota, the AICORE service is implementing the service broker in a wrong way as this should result in an error if a quota is supplied 😕

Long story short: the situation you are running into could/should not happen, the error would be happening in the initial assignment of the entitlement already.

dacamposol commented 2 weeks ago

@dacamposol how did you create the entitlement for the AI Core service? If it is an ELASTIC_SERVICE which has no quota and must be assigned differently than the services with a quota, which the provider steer via getting a quota or not. If the entitlement was done via Terraform with a quota, the AICORE service is implementing the service broker in a wrong way as this should result in an error if a quota is supplied 😕

Long story short: the situation you are running into could/should not happen, the error would be happening in the initial assignment of the entitlement already.

I indeed imported my already existing infrastructure to Terraform, so that's why I didn't received that error beforehand. In order to import my resources, I used the same data that was provided by the BTP CLI.

When I imported this resource to my state, I had the block defined with a quota of 2, which was the original result from querying the CLI. It didn't complain and it never failed to apply the IaC up until I tried to scale it down. Probably since this value never changed, I didn't realise the incompatibility.

lechnerc77 commented 2 weeks ago

I analyzed the setup:

As this is an elastic service, the behavior per se is correct, as this service has no numeric quota.
The amount of the quota that is returned by the platform seems to be a generic mechanism using the value that was set in the BTP control center (available SAP-internally only) when setting up the global account.

To resolve the situation, please execute a re-import via the following steps:

remove the state for the entitlement via terraform state rm <address of the resource>
adjust the Terraform configuration, namely remove the quota attribute

create an import block like:

import {
  to = <address of the resource>
  id = "<ID of your subaccount>,aicore,sap-internal"
}

Execute the import via terraform plan/terraform apply

SAP / terraform-provider-btp