search

terraform-google-modules / terraform-example-foundation

Shows how the CFT modules can be composed to build a secure cloud foundation
https://cloud.google.com/architecture/security-foundations
Apache License 2.0
1.18k stars 701 forks source link

Update code base to a current Terraform version #1265

Open agold-rh opened 1 month ago

agold-rh commented 1 month ago

TL;DR

The documents (README) for this code base indicates that Terraform version 1.3.10 should be used to for execution. Current Terraform is 1.8.4 as of this writing, and 1.3.10 is a version no longer supported by Hashicorp. I'm listing this as a bug, because creating new code for an unsupported tf version that's reached EOL is problematic.

Expected behavior

I expect most currently supported Terraform versions to execute correctly. Screenshot 2024-06-04 at 15 18 57

Observed behavior

Screenshot 2024-06-04 at 15 17 45

Terraform Configuration

None

Terraform Version

None

Additional information

A requirement to use an obsolete version of TF for correct execution is a red flag for any cautious, security conscious software engineer. Since this repo was created to conveniently provide a security conscious landing zone, a TF update seems desirable.

fmichaelobrien commented 1 month ago

FYI for cloud build users

An upgrade past 1.3.10 in the DockerFile used in cloud build will benefit from the upgrade - for now we downgrade to 1.3 to avoid a statefile corruption between 0-bootstrap and 1-org https://github.com/terraform-google-modules/terraform-example-foundation/issues/1151 workaround https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/issues/374

bdashrad commented 3 weeks ago

I've been running my own clone of this on terraform 1.8 on github after modifying the deploy scripts.

eeaton commented 2 weeks ago

We've partially updated the version to 1.5.7 (last version before hashicorp changed the license). However, I acknowledge that this doesn't entirely address this issue, because versions 1.6 and earlier are out of support.

I'm seeking legal confirmation internally whether we can use versions after 1.6 with the BSL license changes from Hashicorp. In the meantime we've added text emphasizing that users of the blueprint can upgrade terraform to the latest version so long as they ensure that the TF version used in manual steps and in build pipeline are the same.