Fix bug with CSEK where the key stored in state might be associated with the wrong disk #327
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ith the wrong disk
|
Changed test to include one unencrypted disk so the order matters, and updated code so the order doesn't change. |
|
With your change, When applying this config: resource "google_compute_disk" "foobar2" {
name = "foobar2"
size = 10
type = "pd-ssd"
zone = "us-central1-a"
disk_encryption_key_raw = "dGhpcmQ2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="
}
resource "google_compute_disk" "foobar3" {
name = "foobar3"
size = 10
type = "pd-ssd"
zone = "us-central1-a"
disk_encryption_key_raw = "dGhpcmQ2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="
}
resource "google_compute_disk" "foobar4" {
name = "foobar4"
size = 10
type = "pd-ssd"
zone = "us-central1-a"
}
resource "google_compute_instance" "foobar" {
name = "foobar"
machine_type = "n1-standard-1"
zone = "us-central1-a"
boot_disk {
initialize_params{
image = "debian-8-jessie-v20160803"
}
disk_encryption_key_raw = "Ym9vdDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="
}
attached_disk {
source = "${google_compute_disk.foobar2.self_link}"
disk_encryption_key_raw = "dGhpcmQ2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="
}
attached_disk {
source = "${google_compute_disk.foobar4.self_link}"
}
attached_disk {
source = "${google_compute_disk.foobar3.self_link}"
disk_encryption_key_raw = "dGhpcmQ2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI="
}
network_interface {
network = "default"
}
metadata {
foo = "bar"
}
}I get a diff after the first apply succeeds: If I apply again, I get the following error |
|
Good catch, thanks! Made a fix (which conveniently simplifies the solution a whole bunch) |
rosbo
reviewed
Aug 16, 2017
| @@ -1003,16 +1006,15 @@ func resourceComputeInstanceRead(d *schema.ResourceData, meta interface{}) error | |||
| return fmt.Errorf("Expected %d disks, API returned %d", expectedDisks, len(instance.Disks)) | |||
There was a problem hiding this comment.
This might be outside the scope of this PR but if we add or remove a disk outside of Terraform, then this line fails preventing the user from updating the instance.
Is this a behavior we want to fix?
There was a problem hiding this comment.
Not right now- because we're relying so much on what's written in state, we can't really support that case without a fair amount of effort. It'll probably be easier once disks is gone for good, so it'll probably be worth a shot then.
There was a problem hiding this comment.
I think even with a fair amount of effort, we might not be able to support that case. :/ I think we may just have to accept it for a couple more weeks as a price for getting to a saner model of disks.
rosbo
approved these changes
Aug 16, 2017
|
@paddycarver are you all good with this change (once I resolve conflicts)? |
|
All right I'm assuming no answer means yes. Merging now. |
negz
pushed a commit
to negz/terraform-provider-google
that referenced
this pull request
Oct 17, 2017
…ith the wrong disk (hashicorp#327) * Fix bug with CSEK where the key stored in state might be associated with the wrong disk * preserve original order of attached disks * use the disk index to figure out the raw key
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks! |
ghost
locked and limited conversation to collaborators
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instances don't necessarily return disks in the order they were sent, so we can't just set the encryption key in state based on the index. This matches the correct key to the correct disk information.
This change could potentially break existing configs by changing the order disks are in or adding keys that were not in state before. However, these configs were technically wrong before.