Issue with resource creation using vmware vsphere plugin version 1.16.1

[manishingole-coder]

Hi there,

Terraform Version

v0.12.20

vSphere Provider Version

1.16.1

Affected Resource(s)

vsphere_virtual_machine

Terraform Configuration Files

data "vsphere_datacenter" "dc" {
name = var.dcname
}

data "vsphere_datastore" "datastore" {
name = var.name
datacenter_id = data.vsphere_datacenter.dc.id
}

data "vsphere_compute_cluster" "cluster" {
name = "Services"
datacenter_id = data.vsphere_datacenter.dc.id
}

data "vsphere_network" "network" {
name = "VM Network"
datacenter_id = data.vsphere_datacenter.dc.id
}

data "vsphere_virtual_machine" "template" {
name = var.template_name
datacenter_id = data.vsphere_datacenter.dc.id
}

resource "vsphere_virtual_machine" "EDB_SR_SETUP" {
name = count.index == 0 ? "${var.dbengine}-master" : "${var.dbengine}-slave${count.index}"
count = 3
resource_pool_id = data.vsphere_compute_cluster.cluster.resource_pool_id
datastore_id = data.vsphere_datastore.datastore.id
wait_for_guest_ip_timeout = -1
num_cpus = local.CPUCORE
memory = local.RAM
guest_id = "centos7_64Guest"

network_interface {
network_id = data.vsphere_network.network.id
adapter_type = data.vsphere_virtual_machine.template.network_interface_types[0]
}

disk {
label = "disk0"
size = data.vsphere_virtual_machine.template.disks.0.size
eagerly_scrub = data.vsphere_virtual_machine.template.disks.0.eagerly_scrub
thin_provisioned = data.vsphere_virtual_machine.template.disks.0.thin_provisioned
}
clone {
template_uuid = data.vsphere_virtual_machine.template.id
}

provisioner "local-exec" {
command = "echo '${self.default_ip_address} ansible_user=${var.ssh_user} ansible_ssh_pass=${var.ssh_password}' >> ${path.module}/utilities/scripts/hosts"
}

provisioner "local-exec" {
command = "sleep 60"
}

provisioner "remote-exec" {
inline = [
"yum info python"
]

connection {
host = self.default_ip_address
type = "ssh"
user = var.ssh_user
password = var.ssh_password
port = "22"
agent = false
}

}

provisioner "local-exec" {
command = "ansible-playbook -i ${path.module}/utilities/scripts/hosts '${path.module}/utilities/scripts/install${var.dbengine}.yml' --extra-vars='USER=${var.EDB_yumrepo_username} PASS=${var.EDB_yumrepo_password} PGDBUSER=${local.DBUSERPG} EPASDBUSER=${local.DBUSEREPAS}' --limit ${self.default_ip_address}"
}

lifecycle {
create_before_destroy = true
}

}

locals {
DBUSERPG="${var.db_user == "" || var.dbengine == regexall("${var.dbengine}", "pg10 pg11 pg12") ? "postgres" : var.db_user}"
DBUSEREPAS="${var.db_user == "" || var.dbengine == regexall("${var.dbengine}", "eaps10 epas11 epas12") ? "enterprisedb" : var.db_user}"
DBPASS="${var.db_password == "" ? "postgres" : var.db_password}"
CPUCORE="${var.cpucore == "" ? "2" : var.cpucore}"
RAM="${var.ramsize == "" ? "1024" : var.ramsize}"

}

#####################################

Configuration of streaming replication start here

###########################################

resource "null_resource" "configuremaster" {
triggers = {
private_ip = "${join(",", vsphere_virtual_machine.EDB_SR_SETUP.*.default_ip_address)}"
}

depends_on = [vsphere_virtual_machine.EDB_SR_SETUP[0]]

provisioner "local-exec" {
command = "ansible-playbook -i ${path.module}/utilities/scripts/hosts '${path.module}/utilities/scripts/configuremaster.yml' --extra-vars='ip1=${vsphere_virtual_machine.EDB_SR_SETUP[1].default_ip_address} ip2=${vsphere_virtual_machine.EDB_SR_SETUP[2].default_ip_address} ip3=${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address} REPLICATION_USER_PASSWORD=${var.replication_password} DB_ENGINE=${var.dbengine} PGDBUSER=${local.DBUSERPG} EPASDBUSER=${local.DBUSEREPAS} REPLICATION_TYPE=${var.replication_type} DBPASSWORD=${local.DBPASS}' --limit ${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address}"

}

}

resource "null_resource" "configureslave1" {
triggers = {
private_ip = "${join(",", vsphere_virtual_machine.EDB_SR_SETUP.*.default_ip_address)}"
}

depends_on = [null_resource.configuremaster]

provisioner "local-exec" {
command = "ansible-playbook -i ${path.module}/utilities/scripts/hosts '${path.module}/utilities/scripts/configureslave.yml' --extra-vars='ip1=${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address} ip2=${vsphere_virtual_machine.EDB_SR_SETUP[2].default_ip_address} REPLICATION_USER_PASSWORD=${var.replication_password} DB_ENGINE=${var.dbengine} REPLICATION_TYPE=${var.replication_type} SELFIP1=${vsphere_virtual_machine.EDB_SR_SETUP[1].default_ip_address} SELFIP2=${vsphere_virtual_machine.EDB_SR_SETUP[2].default_ip_address} MASTER=${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address}' --limit ${vsphere_virtual_machine.EDB_SR_SETUP[1].default_ip_address},${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address}"

}

}

resource "null_resource" "configureslave2" {
triggers = {
private_ip = "${join(",", vsphere_virtual_machine.EDB_SR_SETUP.*.default_ip_address)}"
}

depends_on = [null_resource.configuremaster]

provisioner "local-exec" {
command = "ansible-playbook -i ${path.module}/utilities/scripts/hosts '${path.module}/utilities/scripts/configureslave.yml' --extra-vars='ip1=${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address} ip2=${vsphere_virtual_machine.EDB_SR_SETUP[1].default_ip_address} REPLICATION_USER_PASSWORD=${var.replication_password} DB_ENGINE=${var.dbengine} REPLICATION_TYPE=${var.replication_type} SELFIP1=${vsphere_virtual_machine.EDB_SR_SETUP[1].default_ip_address} SELFIP2=${vsphere_virtual_machine.EDB_SR_SETUP[2].default_ip_address} MASTER=${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address}' --limit ${vsphere_virtual_machine.EDB_SR_SETUP[2].default_ip_address},${vsphere_virtual_machine.EDB_SR_SETUP[0].default_ip_address}"

}

}

resource "null_resource" "removehostfile" {

provisioner "local-exec" {
command = "rm -rf ${path.module}/utilities/scripts/hosts"
}

depends_on = [
null_resource.configureslave2,
null_resource.configureslave1,
null_resource.configuremaster,
vsphere_virtual_machine.EDB_SR_SETUP

]
}

Copy-paste your Terraform configurations here - for large Terraform configs,

please use a service like Dropbox and share a link to the ZIP file. For

security, you can also encrypt the files using our GPG public key.

### Panic Output

Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-996:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-996), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {



Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-995:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-995), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {



Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-994:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-994), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {

### Expected Behavior

Should create VM

### Actual Behavior

Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-996:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-996), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {



Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-995:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-995), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {



Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-994:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-994), ACTION (PolicyIDByVirtualDisk)

  on EDB_SRSETUP_VMWARE/main.tf line 25, in resource "vsphere_virtual_machine" "EDB_SR_SETUP":
  25: resource "vsphere_virtual_machine" "EDB_SR_SETUP" {


### Steps to Reproduce

Please list the steps required to reproduce the issue, for example:
1. `terraform apply`

[neogen19]

V 1.16.1 requires additional permission. Was that added?
**** Requires profile-driven storage permissions for Terraform user. (#881)**

Refer to change log for complete details.

[isometry]

For others' benefit, it is sufficient to ensure that the Terraform user has the StorageProfile.View privilege (non-propagating) on the root vCenter object.

[manishingole-coder]

Hello,

I have permission for my role on vcenter and permission is "All Storage views Privileges"

If you could help with exact permission I can ask my system admin to grant it.

[manishingole-coder]

Hello,

Can someone put more lights here?

[jonavh]

Hello,

Can someone put more lights here?

We had the same issue and this fixed it: #974 (comment)

For others' benefit, it is sufficient to ensure that the Terraform user has the StorageProfile.View privilege (non-propagating) on the root vCenter object.

[Oats87]

@manishingole-coder In the vSphere 6.7 UI, the permission is found under Profile-driven storage -> Profile-driven storage view, not Storage views

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!