Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Resizing a volume in terraform without enable_online_resize?

authera

Is there a way to terraform apply and recreate the storage volume rather than setting enable_online_resize or running a terraform destroy first?

openstack_blockstorage_volume_v3.repo: Modifying... [id=87049fb6-1520-41e3-bcde-44f837dd5d1f]
╷
│ Error: Error extending openstack_blockstorage_volume_v3 87049fb6-1520-41e3-bcde-44f837dd5d1f,
│                                       volume is attached to the instance and
│                                       resizing online is disabled,
│                                       see enable_online_resize option
│ 
│   with openstack_blockstorage_volume_v3.repo,
│   on main.tf line 60, in resource "openstack_blockstorage_volume_v3" "repo":
│   60: resource "openstack_blockstorage_volume_v3" "repo" {

I realize I'll lose the data on the volume?

briley last edited by
You can use https://www.terraform.io/cli/state/taint like this,
```
terraform apply --replace=openstack_blockstorage_volume_v3.repo
```
Reply Quote 0
1 Reply Last reply

terraform 232

2
Posts

0
Views

Suggested Topics

E

Are manual changes to an aws IAM policy detected by Terraform plan?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform • • emran

2

0
Votes

2
Posts

1
Views

C

Yes, Terraform will detect drift in IAM policies. Here is my starting point, a policy that allows full S3 and SQS access to specific resources. data "aws_iam_policy_document" "task" { statement { effect = "Allow" actions = ["sqs:*"] resources = [ aws_sqs_queue.my-queue.arn ] } statement { effect = "Allow" actions = ["s3:*"] resources = [ "${aws_s3_bucket.my_bucket.arn}", "${aws_s3_bucket.my_bucket.arn}/*", ] } } resource "aws_iam_policy" "task_role" { name = "my-task-policy" policy = data.aws_iam_policy_document.task.json } I then manually added ec2:DescribeInstances to this policy via the AWS management console. To test whether it was detected or not, I ran terraform apply -target aws_iam_policy.task_role An execution plan has been generated and is shown below. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # aws_iam_policy.task_role will be updated in-place ~ resource "aws_iam_policy" "task_role" { arn = "arn:aws:iam::111111111111:policy/my-task-policy" id = "arn:aws:iam::111111111111:policy/my-task-policy" name = "my-task-policy" path = "/" ~ policy = jsonencode( ~ { ~ Statement = [ ... REDACTED... - { - Action = "ec2:DescribeInstances" - Effect = "Allow" - Resource = "*" - Sid = "VisualEditor0" }, ] Version = "2012-10-17" } ) } Plan: 0 to add, 1 to change, 0 to destroy. So Terraform correctly detected the drift.
C

How to make Terraform Modules wait for resources to be created in place of using computed values
Continuous Integration and Delivery (CI, CD) • terraform terraform module • • Cleofas

2

0
Votes

2
Posts

1
Views

A

The most popular answer is out of date with Terraform in version 0.12.24. depends_on is a protected variable, and cannot be used in a module. In addition there are a few syntax differences. I've updated the example below. # ROOT level main.tf # ------------------------------------------------------------------- # Create NAT Gateway - Associates EIP as well # ------------------------------------------------------------------- module "vpc_nat_gateway" { source = "./vpc_nat_gateway" vpc_id = module.vpc.id public_subnet_ids = module.vpc_subnets.public_subnet_ids private_cidr = var.private_cidr common_tags = local.common_tags } # ------------------------------------------------------------------- # Create Private Routes # ------------------------------------------------------------------- module "vpc_private_route" { source = "./vpc_private_route" vpc_id. = module.vpc.id nat_gateway_id = module.vpc_nat_gateway.nat_gateway_id common_tags = local.common_tags # Depends is a custom variable, depends_on is a reserved keyword. depends = [module.vpc_nat_gateway.nat_gateway_id] } # vpc_private_route module - main.tf variable "depends" { default = [] } resource "null_resource" "depends_on" { triggers = { depends_on = "${join("", var.depends)}" } } data "aws_nat_gateway" "az1" { vpc_id = var.vpc_id depends_on = [ null_resource.depends_on ] } data "aws_nat_gateway" "az2" { vpc_id = var.vpc_id depends_on = [ null_resource.depends_on ] }
Y

Can't write to Docker volume
Continuous Integration and Delivery (CI, CD) • docker • • yajahira

2

0
Votes

2
Posts

1
Views

T

Solution that worked for me in the past: create a new image out of the existing one and let entrypoint script of that new image to modify permissions of your volume_mountpoint. So in the case of your image (php:7.4-apache) you create entrypoint.sh file, something like chown www-data:www-data -R /path/to/volume_mountpoint apache2-foreground And then your Dockerfile should be something like FROM php:7.4-apache COPY entrypoint.sh /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"] This way it should correct the permissions when container starts. Note, that I haven't tested the above, might require some tweaks - but hopefully it shows the idea. P.s. Maybe somebody has a better way of doing this - I would be very interested myself.
E

Terraform resource imports
Software Programming • terraform modules • • esther

2

0
Votes

2
Posts

0
Views

In this case, the error is that the symbol shielding is forgotten.The decision tells the panels: https://stackoverflow.com/a/62649280/5971473
[Multiple projects, one Azure subscription], Terraform - feasibility of distributed configuration
Continuous Integration and Delivery (CI, CD) • azure terraform terraform module • • morde

2

0
Votes

2
Posts

0
Views

K

You may want to use https://www.terraform.io/cloud this will allow you to publish your modules from the project repos to a registry and you can then consume these modules from another repo containing the terraform that you use for the IaC deployments you then need to work out what the pipeline triggers for this repo will be. Terraform cloud will also give you remote storage of the tfstate files and you will need a state per environment that you deploy. Azure DevOps and GitHub (and probably all other CI/CD providers) let you define environments and associate variables with them so you can use these to define which state file and resource group to target along with any other environment specific values you may need to use.
G

Include verbose output in terraform/terragrunt
Continuous Integration and Delivery (CI, CD) • terraform terraform module terraform workspace • • guilherme

2

0
Votes

2
Posts

1
Views

You might be able to do something with the local-exec Provisioner to push the information out to an external script or file which you could monitor separately during the run. The issue you might encounter is the run order, HCL isn't processed top to bottom like a "traditional" programming language, it works out a dependency tree for the resources it is creating, so might not run the local-exec when you'd expect them to be run.
R

Terraform: apply only one tf file
Continuous Integration and Delivery (CI, CD) • terraform • • Rossere

2

0
Votes

2
Posts

1
Views

Z

Not really. The standard way to work around this though is to use eg: terraform apply -target=aws_security_group.my_sg but that's only going to apply one security group at a time, so will get tedious if you have a lot of them. You can, however, target multiple resources in one command: terraform apply -target=aws_security_group.my_sg -target=aws_security_group.my_2nd_sg However, there are potentially a couple of workarounds: The -target parameter respects dependencies. This means if you were to eg. -target=aws_instance.my_server and that instance had, say, five security groups attached to it via interpolation, changes to those security groups should be included in the plan (I haven't thoroughly tested this, but I believe this is how it works). That is a bit messy though, as you probably don't want to touch an instance. A safer alternative might be using something like a null_resource to provide a target for the security groups, but again I haven't tried this (there might be another 'safe' resource you could rely on, though?). Create a module. You can target a module just like you can target a plain resource: terraform apply -target=module.my_security_groups Inside this module, you could define all of your security groups - just like you would have outside of the module. As well as being able to target it directly, this also makes it easier for you to re-use the same set of security groups for other infrastructure, if you ever need to.
E

Which Users Should I Create With Terraform And Which With Ansible?
Continuous Integration and Delivery (CI, CD) • linux ansible terraform • • emerson

2

0
Votes

2
Posts

1
Views

A

I'd say to do it as you last explained it: using the admin user created by tf with ansible, and then create any other user using ansible. The downside is from the security pov, does ansible needs an admin user ? If yes then keep the tf created user, if not then i'd suggest creating a new non-admin user for ansible. As ansible is a ssh based config mgmt tool, you should think about using a strong pki. Using the std tf admin user may results in a unique admin created on your every ubuntu vm, with the very same ssh key and this is not a very good practice (although it is a widely spread practice from my personal experience), this is where a real and strong pki may help you. Anyway, tf needs to create an (admin) user so keep it that way, then switch to you config mgmt to handle any other required users.
K

How can I deploy a Kubernetes cluster onto OpenStack with Terraform?
Continuous Integration and Delivery (CI, CD) • kubernetes openstack • • kalena

2

0
Votes

2
Posts

0
Views

D

Most likely the best path forward is to provision the VMs using Terraform, and the rest with Ansible. OpenStack can be set up a number of ways, but I believe the only hook in the terraform provider that would allow you to execute code on the node would be via cloud-init user data (bash script). What I would do is provision nodes with terraform and have it provide outputs, have python generate Ansible hosts and vars from those outputs, and then run Ansible. What flavor of k8s are you looking at? k0s, k3s, microk8s, etc?
Terraform aws_ecr_repository resource always attempts to destroy
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ecs • • Bogopo

2

0
Votes

2
Posts

1
Views

N

In your terraform {...} section you need a backend directive to store your state somewhere: https://www.terraform.io/docs/state/remote.html (OP later explain that the code above is just a module imported from a main file). S3 backends might be the easiest to use and probably to most commonly used backends to store remote state across different executions of Terraform: terraform { backend "s3" { bucket = "mybucket" key = "path/to/my/key" region = "us-east-1" } } Please note that Terraform init will not import existing resources into a state (there's Terraform import for that). It will therefore try to create new ones and you will get a conflict on the name. The Terraform documentation gives some pointers on how to use Terraform in automation and that includes using remote state. It is possible to prevent the creation of the ECR through a data block as you hinted (with count = ...), but doing so would feel like a hack to me. Once you have your remote backend configured, you can double check that everything works as expected by using the terraform state command in your pipeline. I would suggest using the show subcommand on a resource you expect to be there in order to validate that the state indeed contains the resource: terraform init -input=false terraform state show module.name-of-your-module.aws_ecr_repository.frontend_ecr_repo_creation
What can Terraform be used to configure for hosting a web application?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ec2 • • carriann

2

0
Votes

2
Posts

0
Views

R

I think it is better if you containerize your flask application. So: Containerize your flask application. Create and configure an EC2 server to deploy your application container on it. Containerize your flask application. I'm not gonna walk you through this but basically you should create a Dockerfile and create an image based on that. then push it to any repo you like (e.g. https://hub.docker.com/ ). Create and configure an EC2 server to deploy your application container on it. Here is an example that will create and config an EC2 server, install Docker on it and then run an container from your image (in this example: Nginx) provider "aws" { region = "eu-central-1" } variable vpc_cidr_block {} variable subnet_1_cidr_block {} variable avail_zone {} variable env_prefix {} variable instance_type {} variable ssh_key {} variable my_ip {} data "aws_ami" "amazon-linux-image" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["amzn2-ami-hvm-*-x86_64-gp2"] } filter { name = "virtualization-type" values = ["hvm"] } } output "ami_id" { value = data.aws_ami.amazon-linux-image.id } resource "aws_vpc" "myapp-vpc" { cidr_block = var.vpc_cidr_block tags = { Name = "${var.env_prefix}-vpc" } } resource "aws_subnet" "myapp-subnet-1" { vpc_id = aws_vpc.myapp-vpc.id cidr_block = var.subnet_1_cidr_block availability_zone = var.avail_zone tags = { Name = "${var.env_prefix}-subnet-1" } } resource "aws_security_group" "myapp-sg" { name = "myapp-sg" vpc_id = aws_vpc.myapp-vpc.id ingress { from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = [var.my_ip] } ingress { from_port = 8080 to_port = 8080 protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] prefix_list_ids = [] } tags = { Name = "${var.env_prefix}-sg" } } resource "aws_internet_gateway" "myapp-igw" { vpc_id = aws_vpc.myapp-vpc.id tags = { Name = "${var.env_prefix}-internet-gateway" } } resource "aws_route_table" "myapp-route-table" { vpc_id = aws_vpc.myapp-vpc.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.myapp-igw.id } default route, mapping VPC CIDR block to "local", created implicitly and cannot be specified. tags = { Name = "${var.env_prefix}-route-table" } } Associate subnet with Route Table resource "aws_route_table_association" "a-rtb-subnet" { subnet_id = aws_subnet.myapp-subnet-1.id route_table_id = aws_route_table.myapp-route-table.id } resource "aws_key_pair" "ssh-key" { key_name = "myapp-key" public_key = file(var.ssh_key) } output "server-ip" { value = aws_instance.myapp-server.public_ip } resource "aws_instance" "myapp-server" { ami = data.aws_ami.amazon-linux-image.id instance_type = var.instance_type key_name = "myapp-key" associate_public_ip_address = true subnet_id = aws_subnet.myapp-subnet-1.id vpc_security_group_ids = [aws_security_group.myapp-sg.id] availability_zone = var.avail_zone tags = { Name = "${var.env_prefix}-server" } user_data = <<EOF #!/bin/bash apt-get update && apt-get install -y docker-ce systemctl start docker usermod -aG docker ec2-user docker run -p 8080:8080 nginx EOF } Sources: https://registry.terraform.io/modules/terraform-aws-modules/ec2-instance/aws/latest https://gitlab.com/nanuchi/terraform-learn/-/tree/feature/deploy-to-ec2
R

Dedicated/Separate Git Repo as Terraform Remote Backend
Continuous Integration and Delivery (CI, CD) • git terraform • • Raziyah00

2

0
Votes

2
Posts

1
Views

Using git for terraform remote state management is an interesting, but non-standard implementation. Storing binary / large files in git, integrating a locking system and a few other concerns come to mind. Using s3, Buckets or other storage options provide the multiple statefile management (versions in buckets, folders in buckets or terraform folder structure / workspaces) and other functionality you mentioned. If you would like to pursue using git for remote state management, check out the community project terraform-backend-git. There is also a good discussion around it in the terraform issues section: https://github.com/hashicorp/terraform/issues/16616. If you attempt to use the tool from the community, it would be great to hear about your experience. Good luck!
O

How to get code onto aws ec2 instance using terraform and gitlabs
Continuous Integration and Delivery (CI, CD) • amazon web services gitlab terraform amazon ec2 • • Oba22

2

0
Votes

2
Posts

1
Views

S

Setup a Jenkins server. Please do code checkout using Jenkins. Jenkins supports parameterized build. you can pass selected parameter from Jenkins UI to linux bash. Then use linux's cli command to fire terraform.Terraform supports several workspace. You can use same code for dev, test and prod. terraform workspace new dev Use this command to create new workspace. After that , we can use this workspace name to your code. Below is the content of local.tf locals { env = terraform.workspace } Like below use the same code for multiple env. resource "aws_autoscaling_group" "asg" { name = "${local.env}-${local.project}-demo-asg" } Moreover to save your state file securely , you can use s3 as backend. terraform { backend "s3" { bucket = "tfstate-demo" key = "keyfiles" region = "ap-southeast-1" dynamodb_table = "tfstate-demo" } } To separate backend and frontend service, use best practice of AWS. Create a public ALB for frontend and then move traffic to backend services via private ALB. You can use Ansible as a configuration manager to build your server then create a AMI of that using packer. Later on, use the same AMI in ASG.
G

network_security_group_id not expected in azurerm_network_interface
Continuous Integration and Delivery (CI, CD) • azure terraform azure devops • • gionna

2

0
Votes

2
Posts

0
Views

E

Found the answer, this has changed at some point. What's needed is a network_security_group_association which relates to a subnet_id and a network_security_group_id (the one that was in the network_security_group before) resource "azurerm_subnet" "subnet-internal-1" { name = "${var.prefix}-internal-1" resource_group_name = azurerm_resource_group.geofriends.name virtual_network_name = azurerm_virtual_network.vn.name address_prefixes = ["10.0.0.0/24"] } resource "azurerm_network_security_group" "allow-ssh" { name = "${var.prefix}-allow-ssh" location = var.location resource_group_name = azurerm_resource_group.geofriends.name security_rule { name = "SSH" priority = 1001 direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = var.ssh-source-address destination_port_range = var.ssh-destination-address source_address_prefix = var.ssh-source-address destination_address_prefix = var.ssh-destination-address } } resource "azurerm_subnet_network_security_group_association" "sec-group-association" { subnet_id = azurerm_subnet.subnet-internal-1.id network_security_group_id = azurerm_network_security_group.allow-ssh.id } Now the subnet subnet-internal-1 contains the allow ssh security_group
A

How do I upgrade or pin a Terraform Provider?
Continuous Integration and Delivery (CI, CD) • terraform versioning • • authera

2

0
Votes

2
Posts

0
Views

Upgrading to the newest version You can upgrade the provider with terraform init -upgrade So long as you don't have the version specified anywhere in a required_providers block. Pinning with a required_providers block You can pin or specify any https://www.terraform.io/language/expressions/version-constraints with a required_providers block, like this. terraform { required_providers { aws = { source = "registry.terraform.io/hashicorp/aws" version = "4.14.0" } } } provider "aws" { region = "us-east-1" } Terraform pre 0.13 Prior to Terraform version 0.13, you could specify your version in the provider block, provider "aws" { version = "4.14.0" region = "us-east-1" } Find the official docs at, https://learn.hashicorp.com/tutorials/terraform/provider-versioning#upgrade-the-aws-provider-version https://www.terraform.io/language/providers/requirements

Resizing a volume in terraform without enable_online_resize?

Suggested Topics

Are manual changes to an aws IAM policy detected by Terraform plan? Continuous Integration and Delivery (CI, CD) • amazon web services terraform • • emran

How to make Terraform Modules wait for resources to be created in place of using computed values Continuous Integration and Delivery (CI, CD) • terraform terraform module • • Cleofas

Can't write to Docker volume Continuous Integration and Delivery (CI, CD) • docker • • yajahira

Terraform resource imports Software Programming • terraform modules • • esther

[Multiple projects, one Azure subscription], Terraform - feasibility of distributed configuration Continuous Integration and Delivery (CI, CD) • azure terraform terraform module • • morde

Include verbose output in terraform/terragrunt Continuous Integration and Delivery (CI, CD) • terraform terraform module terraform workspace • • guilherme

Terraform: apply only one tf file Continuous Integration and Delivery (CI, CD) • terraform • • Rossere

Which Users Should I Create With Terraform And Which With Ansible? Continuous Integration and Delivery (CI, CD) • linux ansible terraform • • emerson

How can I deploy a Kubernetes cluster onto OpenStack with Terraform? Continuous Integration and Delivery (CI, CD) • kubernetes openstack • • kalena

Terraform aws_ecr_repository resource always attempts to destroy Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ecs • • Bogopo

What can Terraform be used to configure for hosting a web application? Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ec2 • • carriann

Dedicated/Separate Git Repo as Terraform Remote Backend Continuous Integration and Delivery (CI, CD) • git terraform • • Raziyah00

How to get code onto aws ec2 instance using terraform and gitlabs Continuous Integration and Delivery (CI, CD) • amazon web services gitlab terraform amazon ec2 • • Oba22

network_security_group_id not expected in azurerm_network_interface Continuous Integration and Delivery (CI, CD) • azure terraform azure devops • • gionna

How do I upgrade or pin a Terraform Provider? Continuous Integration and Delivery (CI, CD) • terraform versioning • • authera

Are manual changes to an aws IAM policy detected by Terraform plan?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform • • emran

How to make Terraform Modules wait for resources to be created in place of using computed values
Continuous Integration and Delivery (CI, CD) • terraform terraform module • • Cleofas

Can't write to Docker volume
Continuous Integration and Delivery (CI, CD) • docker • • yajahira

Terraform resource imports
Software Programming • terraform modules • • esther

[Multiple projects, one Azure subscription], Terraform - feasibility of distributed configuration
Continuous Integration and Delivery (CI, CD) • azure terraform terraform module • • morde

Include verbose output in terraform/terragrunt
Continuous Integration and Delivery (CI, CD) • terraform terraform module terraform workspace • • guilherme

Terraform: apply only one tf file
Continuous Integration and Delivery (CI, CD) • terraform • • Rossere

Which Users Should I Create With Terraform And Which With Ansible?
Continuous Integration and Delivery (CI, CD) • linux ansible terraform • • emerson

How can I deploy a Kubernetes cluster onto OpenStack with Terraform?
Continuous Integration and Delivery (CI, CD) • kubernetes openstack • • kalena

Terraform aws_ecr_repository resource always attempts to destroy
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ecs • • Bogopo

What can Terraform be used to configure for hosting a web application?
Continuous Integration and Delivery (CI, CD) • amazon web services terraform amazon ec2 • • carriann

Dedicated/Separate Git Repo as Terraform Remote Backend
Continuous Integration and Delivery (CI, CD) • git terraform • • Raziyah00

How to get code onto aws ec2 instance using terraform and gitlabs
Continuous Integration and Delivery (CI, CD) • amazon web services gitlab terraform amazon ec2 • • Oba22

network_security_group_id not expected in azurerm_network_interface
Continuous Integration and Delivery (CI, CD) • azure terraform azure devops • • gionna

How do I upgrade or pin a Terraform Provider?
Continuous Integration and Delivery (CI, CD) • terraform versioning • • authera