elastic / terraform-provider-ec

https://registry.terraform.io/providers/elastic/ec/latest/docs
Apache License 2.0
176 stars 88 forks source link

Terraform provider corrupts trust settings on update #842

Open nick-benoit opened 2 months ago

nick-benoit commented 2 months ago

Readiness Checklist

Expected Behavior

Trust settings should not be altered unless specified in the terraform file.

Current Behavior

Elasticsearch trust settings are changed by the provider in the following unexpected ways:

An example of Elasticsearch cluster data before TF update:

 "trust": {
    "accounts": [
      {
        "account_id": "554443047",
        "name": "Default trust",
        "trust_all": true
      }
    ],
    "external": [],
    "direct": [
      {
        "uid": "9a2d84bb-0619-4e2c-8da1-1151e34ab890",
        ...
        "type": "generic",
        "name": "Test"
      }
    ]
  },

And after TF Update

  "trust": {
    "accounts": [
      {
        "trust_all": true,
        "account_id": "554443047",
        "name": "" # This was removed 
      }
    ],
    "external": [],
    "direct": [] # This was also removed
  },

 Terraform definition

terraform {
  required_version = ">= 0.12.29"

  required_providers {
    ec = {
      source  = "elastic/ec"
      version = "0.10.0"
    }
  }
}

provider "ec" {
  # ECE installation endpoint
  endpoint = "https://public-api.qa.cld.elstc.co"

  # If the ECE installation has a self-signed certificate
  # setting "insecure" to true is required.
  #insecure = false

  # APIKey is the recommended authentication mechanism. When
  # Targeting the Elasticsearch Service, APIKeys are the only
  # valid authentication mechanism.
  apikey = "..."
}

data "ec_stack" "latest" {
  version_regex = "latest"
  region        = "aws-eu-west-1"
}

# Create an Elastic Cloud deployment
resource "ec_deployment" "example_minimal" {
  # Optional name.
  name = "my_example_deployment"

  # Mandatory fields
  region                 = "aws-eu-west-1"
  version                = "8.14.3" #data.ec_stack.latest.version
  deployment_template_id = "aws-io-optimized-v2"

  # Use the deployment template defaults
  elasticsearch = {
    hot = {
      autoscaling = {}
    }

    ml = {
       autoscaling = {
          autoscale = true
       }
    }

  }

  kibana = {
    topology = {}
  }
}

Steps to Reproduce

  1. Create a cluster via TF
  2. Add direct trust settings via adminconsole
  3. Change cluster name via Terraform
  4. Use advanced edit to view Elasticsearch cluster settings and verify cluster trust has been changed (direct trusts removed, and account trust names removed)
gigerdo commented 1 month ago

With 0.12.0 the provider will not update trust settings unless they have changed. However the reported problems when updating trust settings have not yet been fixed.