terraform-google-modules / terraform-google-project-factory

Creates an opinionated Google Cloud project by using Shared VPC, IAM, and Google Cloud APIs
https://registry.terraform.io/modules/terraform-google-modules/project-factory/google
Apache License 2.0
835 stars 538 forks source link

Tainting a project should never be allowed #818

Closed mattbnz closed 1 year ago

mattbnz commented 1 year ago

TL;DR

When the module encounters unexpected errors creating a project the resource is marked as tainted which causes terraform to attempt to recreate it via a delete/create cycle. This is a trap and will always result in the user ending up in a dead-end situation, as deleting a project leaves it in a pending state for 30 days prevent it's recreation.

Expected behavior

The module should never mark the project as tainted, or allow the project to be marked as tainted; as the taint behaviour is never the correct resolution for a project in an unknown state.

Observed behavior

1) On the first instance of terraform apply an unexpected API error was received and terraform exited halfway through the project creation step. 2) Re-running terraform apply (on the expectation the API error was transient, and re-running apply would idempotently apply my declarative configuration to resolve any state discrepancies) resulted in a plan that deleted the project, and then failed to recreate it as the name was already taken.

Terraform Configuration

resource "google_project" "my_project" {
 name = "My Project"
 project_id = "your-project-id"
 org_id = "1234567"
}

(But to reproduce with this configuration you also need to induce an error part way through project creation)

Terraform Version

$ terraform version
Terraform v1.4.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v4.66.0
+ provider registry.terraform.io/hashicorp/google-beta v4.66.0
+ provider registry.terraform.io/hashicorp/null v3.2.1
+ provider registry.terraform.io/hashicorp/random v3.5.1
+ provider registry.terraform.io/hashicorp/time v0.9.1

Your version of Terraform is out of date! The latest version
is 1.4.6. You can update by downloading from https://www.terraform.io/downloads.html

Additional information

No response

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

mattbnz commented 1 year ago

It's not stale, it's still valid and necessary to address, just ignored and sadly I don't appear to have the ability to remove labels :(

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days