service unavailable while azurerm_api_management_api updates api definition

[mrickly]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.4

AzureRM Provider Version

3.65.0

Affected Resource(s)/Data Source(s)

azurerm_api_management_api

Terraform Configuration Files

terraform {
  required_version = ">= 1.0.11"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 2.87.0"
    }
    null = {
      source  = "hashicorp/null"
      version = ">= 3.1.0"
    }
  }
}

locals {
  # openapi_value = var.openapi_value != "" ? var.openapi_value : (var.openapi_file != "" ? file(var.openapi_file) : null)
  openapi_content = var.openapi_file == null ? var.openapi_content : file(var.openapi_file)
}

resource "azurerm_api_management_api" "api" {

  api_management_name   = var.apim_name
  description           = var.description
  display_name          = var.api_name
  name                  = var.version_name == null ? var.api_name : "${var.api_name}-${var.version_name}"
  path                  = var.path
  protocols             = ["https"]
  resource_group_name   = var.apim_rg
  revision              = "1"
  service_url           = var.webservice_url
  subscription_required = var.subscription_required
  version_set_id        = var.version_set_id
  version               = var.version_name

  # Convert import to dynamic import block to be able to exclude depending on configured json import.
  # see https://discuss.hashicorp.com/t/pattern-to-handle-optional-dynamic-blocks/2384
  dynamic "import" {
    for_each = local.openapi_content[*]
    content {
      content_format = var.content_format
      content_value  = import.value # TODO file or url depending on content-format
    }
  }

  # oauth link only if present, not for sandbox
  dynamic "oauth2_authorization" {
    for_each = var.authorization_server_name[*]
    content {
      authorization_server_name = var.authorization_server_name
    }
  }
}

Debug Output/Panic Output

module.api_provider_registration.module.api.azurerm_api_management_api.api: Modifying... [id=/subscriptions/e5e059e9-92ef-4e3c-a352-00554175fc0f/resourceGroups/caz-preprod-rg/providers/Microsoft.ApiManagement/service/caz-preprod-apim/apis/glu-test-minimalist-service]

module.api_provider_registration.module.api.azurerm_api_management_api.api: Still modifying... [id=/subscriptions/e5e059e9-92ef-4e3c-a352-...-apim/apis/glu-test-minimalist-service, 10s elapsed]
module.services.kubernetes_deployment_v1.deployment: Still modifying... [id=glu-test-minimalist-service/glu-test-minimalist-service, 10s elapsed]

module.api_provider_registration.module.api.azurerm_api_management_api.api: Still modifying... [id=/subscriptions/e5e059e9-92ef-4e3c-a352-...-apim/apis/glu-test-minimalist-service, 20s elapsed]
module.services.kubernetes_deployment_v1.deployment: Still modifying... [id=glu-test-minimalist-service/glu-test-minimalist-service, 20s elapsed]
module.api_provider_registration.module.api.azurerm_api_management_api.api: Still modifying... [id=/subscriptions/e5e059e9-92ef-4e3c-a352-...-apim/apis/glu-test-minimalist-service, 30s elapsed]

module.api_provider_registration.module.api.azurerm_api_management_api.api: Modifications complete after 31s [id=/subscriptions/e5e059e9-92ef-4e3c-a352-005[541](https://gitlab.com/diemobiliar/it/glu/test/glu-test-minimalist-service/-/jobs/4876787810#L541)75fc0f/resourceGroups/caz-preprod-rg/providers/Microsoft.ApiManagement/service/caz-preprod-apim/apis/glu-test-minimalist-service]

Expected Behaviour

The terraform apply should complete within seconds. No service interruption should be observed.

Actual Behaviour

As can be seen from the log extract (only relevant part, this is a deployment with other things happening), the execution takes 31 seconds. During this time, the service cannot be reached. Note that this happens only if the api definition (openapi description) is modified. Hence it is not related to the availability of backend pods.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[sinbai]

@mrickly thanks for opening this issue. Could you explain that "the service cannot be reached" what exactly are the symptoms? Also, is it possible to provide a complete tf configuration (including variable values) and repro steps to help reproduce/troubleshoot?

[mrickly]

Hello @sinbai , thank you for reaching out!

"the service cannot be reached" means for instance that we get a 500 response every time we try to call one of the api endpoints from the developer portal. After 30 seconds, the unavailability goes away (200 response again). It cannot be reached by another service deployed on our AKS cluster either.

What I could offer right now is to provide a commented extract (only 280 lines in total) from the TRACE level log of the provider, which shows exactly what happens. I believe that it would be the most useful to you. Basically, it shows that the module updates the api without specifying the serviceUrl, which is then set to the default http://0.0.0.0:8080 by Azure and makes the service unreachable. After 30 seconds, a second update request is made, this time specifying the correct serviceUrl and the service becomes available again.

[mrickly]

terraform_provider_trace_log_analysis.txt

[sinbai]

@mrickly thanks for the detailed explanation. The PR has been submitted to fix this issue. Could you please track it for more updates?

[mrickly]

@sinbai : Thank you very much for acknowledging the issue and providing a fix so rapidly! I am subscribed to both this issue and your pull request.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.