hashicorp / terraform-provider-nomad

Terraform Nomad provider
https://registry.terraform.io/providers/hashicorp/nomad/latest
Mozilla Public License 2.0
144 stars 101 forks source link

False drift with nomad variables containing newlines #476

Open optiz0r opened 1 month ago

optiz0r commented 1 month ago

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

Terraform Version

Terraform v1.5.1
on linux_amd64
+ provider registry.terraform.io/hashicorp/nomad v2.3.0

Only tested on 1.5.1 but very likely to be the same on newer versions, due to relevant logic being in nomad core and this provider only.

Nomad Version

Nomad v1.8.3+ent
BuildDate 2024-08-13T07:52:39Z
Revision 82fa712be0e7c1e07d6d630e0583c188347411ee

Provider Configuration

data "vault_nomad_access_token" "nomad_token" {
  backend = "nomad"
  role    = "admin"
}

provider "nomad" {
  secret_id = local.is_remote_run ? data.vault_nomad_access_token.nomad_token.secret_id : null
  region    = "london"
}

Environment Variables

NOMAD_ADDR=https://...:4646

Affected Resource(s)

Please list the resources as a list, for example:

Terraform Configuration Files

resource "nomad_job" "foo" {
  jobspec = file("${path.module}/foo.nomad.hcl")
  hcl2 {
    vars    = {
      example = <<-EOT
        This is an example multi
        line variable
        EOT
    }
  }
}

Debug Output

Omitted, includes sensitive data

Expected Behavior

If the example variable has not changed, no drift should be detected and no change to be made.

Actual Behavior

Since Nomad 1.8.2, Nomad re-encodes the newlines in variables received in JobSubmission so that the internal variables file is well formed, and the job once stopped through the UI can be started again.

This provider retrieves the modified variable definitions from the Nomad API, and then compares it to the unmodified content of the example variable in the terraform code. Since they no longer match, this is reported as a drift, and the nomad_job resource is refreshed.

This doesn't appear actually cause nomad to interrupt the running job, but does cause false reporting of changes.

Steps to Reproduce

  1. terraform apply
  2. terraform apply

Important Factoids

It's unclear if this is a fault in nomad core itself (i.e. the values returned by the read API should be unmodified to match what terraform would have already submitted), or if a fault in the provider (i.e. it should be pre-encoding the newlines before submission, or handling the diff ignoring changes in newline encoding).

References