ibm_container_cluster doesn't wait for ALBs on create

[dleehr]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

Terraform v1.0.0
on darwin_amd64
+ provider registry.terraform.io/ibm-cloud/ibm v1.26.0

Affected Resource(s)

• ibm_container_cluster
• ibm_container_alb

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "ibm_container_cluster" "ecp_dev_us_south" {
  datacenter                = "dal10"
  default_pool_size         = 1
  disk_encryption           = "true"
  hardware                  = "shared"
  kube_version              = "1.21"
  machine_type              = "b3c.4x16"
  name                      = "ecp-dev-us-south"
  private_service_endpoint  = "true"
  private_vlan_id           = ibm_network_vlan.private_vlan_dev_dal10.id
  resource_group_id         = data.ibm_resource_group.ant_edge_compute.id
}
# Enable the private ALB
# This fails if the cluster has not created the ALB yet - the list will be empty
resource "ibm_container_alb" "ecp_dev_us_south_alb" {
  alb_id            = element(ibm_container_cluster.ecp_dev_us_south.albs, 0).id
  enable            = true
}

Debug Output

Panic Output

Expected Behavior

The list of albs from ibm_container_cluster should return the list of cluster ALBs so that ibm_container_alb can enable it by id.

Actual Behavior

The ibm_container_cluster resource's albs property is returned as an empty list. When creating the cluster, I cannot enable the ALB until this property is populated. ibm_container_alb needs the ID. If I wait 10-15 minutes and run terraform apply a second time, terraform is able to fetch the ALB ID from the cluster's albs and use it to enable through ibm_container_alb

╷
│ Error: Error in function call
│ 
│   on iks.tf line 57, in resource "ibm_container_alb" "ecp_dev_us_south_alb":
│   57:   alb_id = element(ibm_container_cluster.ecp_dev_us_south.albs, 0).id
│     ├────────────────
│     │ ibm_container_cluster.ecp_dev_us_south.albs is empty list of object
│ 
│ Call to function "element" failed: cannot use element function with an empty list.
╵

Steps to Reproduce

1. terraform apply

Important Factoids

Using private vlans for the cluster and workers.

References

• ibm_container_worker_pool_zone_attachment should wait for ALBs to finish in a new zone #1372, fix: ibm_container_worker_pool_zone_attachment should wait for ALBs #1373 References adding this behavior to ibm_container_worker_pool_zone_attachment and suggests that ibm_container_cluster waits for ALBs, but it doesn't seem to in my case.

[dleehr]

I'm leaving wait_till empty. It defaults to IngressReady, but this wait only happens if publicSubnetAdded is true:

terraform-provider-ibm/ibm/resource_ibm_container_cluster.go

Lines 1198 to 1204 in 8533f3b

	if publicSubnetAdded && d.Get("wait_till").(string) == ingressReady {
	_, err = WaitForSubnetAvailable(d, meta, targetEnv)
	if err != nil {
	return fmt.Errorf(
	"Error waiting for initializing ingress hostname and secret: %s", err)
	}
	}

But since I'm not using a public subnet, I suspect publicSubnetAdded is always false, and in this case, the logic will not actually wait for IngressReady

[hkantare]

@dleehr Yes you are right...the code was developed to wait for clusters with public subnet..We need to investigate and test can we even wait for private subnets cluster