Open woranhun opened 1 week ago
Another example:
apiVersion: ec2.aws.upbound.io/v1beta1
kind: NetworkACLRule
metadata:
annotations:
crossplane.io/composition-resource-name: rule-nacl-permit-all-ingress-10.254.1.0/24-all-0-65535-nacl-acl-0fe2a88c9076d3be6-vrf-sigext-vpc-main-rg-network-k2rbw-5f4bbf59d5
crossplane.io/external-create-failed: "2024-09-06T15:25:47Z"
crossplane.io/external-create-pending: "2024-09-06T15:25:47Z"
crossplane.io/external-create-succeeded: "2024-09-06T14:55:51Z"
creationTimestamp: "2024-09-06T14:55:20Z"
finalizers:
- finalizer.managedresource.crossplane.io
generateName: rg-network-k2rbw-
generation: 1
labels:
accountId: "xxxxxxxx"
crossplane.io/claim-name: rg-network
crossplane.io/claim-namespace: claims-66db15b61bc75e2143e08048
crossplane.io/composite: rg-network-k2rbw
name: rg-network-k2rbw-f2shz
the external-name is missing so the provider doesn't know that it created the resource already.
2024-09-06T14:55:20Z DEBUG provider-aws Calling the inner handler for Create event. {"gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "name": "rg-network-k2rbw-f2shz", "queueLength": 0}
2024-09-06T14:55:20Z DEBUG provider-aws Reconciling {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}}
2024-09-06T14:55:20Z DEBUG provider-aws Connecting to the service provider {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:20Z DEBUG provider-aws Instance state not found in cache, reconstructing... {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:20Z DEBUG provider-aws Observing the external resource {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:20Z DEBUG provider-aws Diff detected {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "instanceDiff": "*terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{\"cidr_block\":*terraform.ResourceAttrDiff{Old:\"\", New:\"10.254.1.0/24\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"egress\":*terraform.ResourceAttrDiff{Old:\"\", New:\"false\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"from_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"0\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"network_acl_id\":*terraform.ResourceAttrDiff{Old:\"\", New:\"acl-0fe2a88c9076d3be6\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"protocol\":*terraform.ResourceAttrDiff{Old:\"\", New:\"-1\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"rule_action\":*terraform.ResourceAttrDiff{Old:\"\", New:\"allow\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"rule_number\":*terraform.ResourceAttrDiff{Old:\"\", New:\"100\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"to_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"65535\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}}, Destroy:false, DestroyDeposed:false, DestroyTainted:false, RawConfig:cty.NilVal, RawState:cty.NilVal, RawPlan:cty.NilVal, Meta:map[string]interface {}(nil)}"}
2024-09-06T14:55:20Z DEBUG provider-aws Async create starting... {"trackerUID": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "resourceName": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "tfID": ""}
2024-09-06T14:55:20Z DEBUG provider-aws Creating the external resource {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:20Z DEBUG provider-aws Successfully requested creation of external resource {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}, "uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "version": "1590732", "external-name": "", "external-name": ""}
2024-09-06T14:55:20Z DEBUG provider-aws Calling the inner handler for Update event. {"gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "name": "rg-network-k2rbw-f2shz", "queueLength": 0}
2024-09-06T14:55:20Z DEBUG provider-aws Reconciling {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}}
2024-09-06T14:55:21Z DEBUG provider-aws Connecting to the service provider {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:21Z DEBUG provider-aws Instance state not found in cache, reconstructing... {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:21Z DEBUG provider-aws ongoing async operation {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "opType": "create"}
2024-09-06T14:55:21Z DEBUG provider-aws External resource is up to date {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}, "uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "version": "1590781", "external-name": "", "requeue-after": "2024-09-06T15:00:19Z"}
2024-09-06T14:55:21Z DEBUG provider-aws Reconciling {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}}
2024-09-06T14:55:21Z DEBUG provider-aws Connecting to the service provider {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:21Z DEBUG provider-aws Async create ended. {"trackerUID": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "resourceName": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "error": null, "tfID": "nacl-989123708"}
2024-09-06T14:55:21Z DEBUG provider-aws Instance state not found in cache, reconstructing... {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:21Z DEBUG provider-aws Observing the external resource {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule"}
2024-09-06T14:55:21Z DEBUG provider-aws Diff detected {"uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "name": "rg-network-k2rbw-f2shz", "gvk": "ec2.aws.upbound.io/v1beta1, Kind=NetworkACLRule", "instanceDiff": "*terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{\"cidr_block\":*terraform.ResourceAttrDiff{Old:\"\", New:\"10.254.1.0/24\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"egress\":*terraform.ResourceAttrDiff{Old:\"\", New:\"false\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"from_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"0\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"network_acl_id\":*terraform.ResourceAttrDiff{Old:\"\", New:\"acl-0fe2a88c9076d3be6\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"protocol\":*terraform.ResourceAttrDiff{Old:\"\", New:\"-1\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"rule_action\":*terraform.ResourceAttrDiff{Old:\"\", New:\"allow\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"rule_number\":*terraform.ResourceAttrDiff{Old:\"\", New:\"100\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}, \"to_port\":*terraform.ResourceAttrDiff{Old:\"\", New:\"65535\", NewComputed:false, NewRemoved:false, NewExtra:interface {}(nil), RequiresNew:true, Sensitive:false, Type:0x0}}, Destroy:false, DestroyDeposed:false, DestroyTainted:false, RawConfig:cty.NilVal, RawState:cty.NilVal, RawPlan:cty.NilVal, Meta:map[string]interface {}(nil)}"}
2024-09-06T14:55:21Z DEBUG provider-aws Waiting for external resource existence to be confirmed {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}, "uid": "c7b6217a-3e63-4494-89ef-f76d7f6f0cf5", "version": "1590781", "external-name": ""}
2024-09-06T14:55:21Z DEBUG provider-aws Reconciling {"controller": "managed/ec2.aws.upbound.io/v1beta1, kind=networkaclrule", "request": {"name":"rg-network-k2rbw-f2shz"}}
@ulucinar this seems to be a timing issue where the external-name annotation is never added to the resource, or the update fails and the name gets lost is the process.
Can you think of anything that we could try to collect more information, or are there known upjet issues in this area that need to be addressed? Thanks!
Related issues and code:
https://github.com/crossplane-contrib/provider-upjet-aws/issues/1346#issuecomment-2220336366
Is there an existing issue for this?
Affected Resource(s)
ec2.aws.upbound.io/v1beta1 - Subnet ec2.aws.upbound.io/v1beta1 - SubnetCidrReservation ec2.aws.upbound.io/v1beta1 - SecurityGroupRule ec2.aws.upbound.io/v1beta1 - NetworkACLRule
Resource MRs required to reproduce the bug
Steps to Reproduce
We were not able to deterministically reproduce this issue. This issue happens randomly when creating multiple resources of the above.
What happened?
Sometimes when we create a MR via Crossplane the
tfID
returned from AWS after a successful resource creation is not saved to the"crossplane.io/external-name"
annotation. During the next reconciliation a Diff is again detected with the same content as previously. Therefore, Crossplane sends another request to AWS but it fails because the resource already exists on AWS side.See
subnet-create-fail.log
for further details. We observed the same behavior with the creation of Subnet, SubnetCidrReservation, SecurityGroupRule, NetworkACLRule.We also provided a working example
subnet-create-ok.log
. As you can see the same MR manifest sometimes provides a failed result.Relevant logs:
Relevant Error Output Snippet
Crossplane Version
v1.16.0
Provider Version
v1.11.0; v1.13.0
Kubernetes Version
v1.29.7-eks-a18cd3a
Kubernetes Distribution
EKS
Additional Info
FYI: @janosdubovszky @bobh66