Make changes to image variable ignored after cluster is built

aws/infrastructure.tf

@@ -156,6 +156,12 @@ resource "aws_instance" "mgmt" {
     Name = format("mgmt%d", count.index + 1)
   }
 
+  lifecycle {
+    ignore_changes = [
+      ami
+    ]
+  }
+
   depends_on = [aws_internet_gateway.gw]
 }
 
@@ -244,6 +250,12 @@ resource "aws_instance" "login" {
     aws_security_group.allow_out_any.id,
   ]
 
+  lifecycle {
+    ignore_changes = [
+      ami
+    ]
+  }
+
   tags = {
     Name = format("login%d", count.index + 1)
   }
@@ -279,6 +291,12 @@ resource "aws_instance" "node" {
     aws_security_group.allow_out_any.id,
   ]
 
+  lifecycle {
+    ignore_changes = [
+      ami
+    ]
+  }
+
   tags = {
     Name = "node${count.index + 1}"
   }

azure/infrastructure.tf

@@ -168,6 +168,12 @@ resource "azurerm_virtual_machine" "login" {
   os_profile_linux_config {
     disable_password_authentication = true
   }
+
+  lifecycle {
+    ignore_changes = [
+      storage_image_reference
+    ]
+  }
 }
 
 resource "azurerm_virtual_machine" "mgmt" {
@@ -202,6 +208,12 @@ resource "azurerm_virtual_machine" "mgmt" {
   os_profile_linux_config {
     disable_password_authentication = true
   }
+
+  lifecycle {
+    ignore_changes = [
+      storage_image_reference
+    ]
+  }
 }
 
 resource "azurerm_managed_disk" "home" {
@@ -290,6 +302,12 @@ resource "azurerm_virtual_machine" "nodevm" {
   os_profile_linux_config {
     disable_password_authentication = true
   }
+
+  lifecycle {
+    ignore_changes = [
+      storage_image_reference
+    ]
+  }
 }
 
 locals {

docs/README.md

@@ -189,7 +189,8 @@ should be mainly done through Puppet scripting. Image customization is mostly
 envisioned as a way to accelerate the provisioning process by applying the
 security patches and OS updates in advance.
 
-**Post Build Modification Effect**: rebuild of all instances at next `terraform apply`.
+**Post Build Modification Effect**: None - if this variable is modified, existing
+instances will ignore the change and future instances will use the new value.
 
 #### 4.4.1 AWS
 

gcp/infrastructure.tf

@@ -95,7 +95,10 @@ resource "google_compute_instance" "mgmt" {
   metadata_startup_script = file("${path.module}/install_cloudinit.sh")
 
   lifecycle {
-    ignore_changes = [attached_disk]
+    ignore_changes = [
+      attached_disk,
+      boot_disk.initialize_params.image
+    ]
   }
 }
 
@@ -157,6 +160,12 @@ resource "google_compute_instance" "login" {
   }
 
   metadata_startup_script = file("${path.module}/install_cloudinit.sh")
+
+  lifecycle {
+    ignore_changes = [
+      boot_disk.initialize_params.image
+    ]
+  }
 }
 
 resource "google_compute_instance" "node" {
@@ -193,6 +202,12 @@ resource "google_compute_instance" "node" {
   }
 
   metadata_startup_script = file("${path.module}/install_cloudinit.sh")
+
+  lifecycle {
+    ignore_changes = [
+      boot_disk.initialize_params.image
+    ]
+  }
 }
 
 resource "google_compute_firewall" "allow_all_internal" {

openstack/infrastructure.tf

@@ -120,6 +120,13 @@ resource "openstack_compute_instance_v2" "mgmt" {
       volume_size           = block_device.value.volume_size
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      image_id,
+      block_device[0].uuid
+    ]
+  }
 }
 
 resource "openstack_compute_volume_attach_v2" "va_home" {
@@ -182,6 +189,13 @@ resource "openstack_compute_instance_v2" "login" {
       volume_size           = block_device.value.volume_size
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      image_id,
+      block_device[0].uuid
+    ]
+  }
 }
 
 resource "openstack_networking_port_v2" "port_node" {
@@ -226,6 +240,13 @@ resource "openstack_compute_instance_v2" "node" {
       volume_size           = block_device.value.volume_size
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      image_id,
+      block_device[0].uuid
+    ]
+  }
 }
 
 locals {