digitalocean_ssh_key keeps being forced as a new resource

[sjourdan]

⚠️ This bug is in an unreleased RC release
(Update: still on 0.7.0 final)

Terraform Version

Terraform v0.7.0-rc4 (abfd2c1daf914867b8737ac9419f3bd2ecc7a822)

Terraform v0.7.0

Affected Resource(s)

• digitalocean_ssh_key

Terraform Configuration Files

The simplest main.tf:

# Vars
variable "do_token" {}
variable "ssh_key_file" {}

# Provider
provider "digitalocean" {
  token = "${var.do_token}"
}

# Create a new SSH key
resource "digitalocean_ssh_key" "default" {
  name       = "Digital Ocean SSH Key (bug)"
  public_key = "${file("${var.ssh_key_file}.pub")}"
}

A simple terraform.tfvars:

do_token = "now_redacted_token"
ssh_key_file = "./keys/key"

Debug Output

https://gist.github.com/sjourdan/5117947064fcfdb52560eba6164c594c

Expected Behavior

• No modification expected, as no change happened

Actual Behavior

• DO SSH key keeps being recreated

Steps to Reproduce

1. terraform plan or/and
2. terraform apply

Important Factoids

This is obviously perfectly working in 0.6.x - we're talking 0.7.0 RC4 (0.7.0 final impacted too.)

References

• none

[lexsys27]

I have experienced the same issue on 0.7.0 release. The cause is change in file() behavior - it adds newline at the end of public key which leads to resource recreation.

public_key:  "ssh-rsa AAAAB3N.." => "ssh-rsa AAAAB3N..\n" (forces new resource)

I haven't found notes on this behavior in changelog. Is it intended change or bug?

As a workaround you can replace call to file() function with contents of the file.

[lucapette]

I can't confirm the problem is exactly the behaviour of file (my knowledge of terraform internals are still very limited sadly) but I can confirm I'm seeing the very same problem. I'll try to dig into the code base to see if I can help (I'd love to, I love the project). Thank you for your hard work!

[tam7t]

Can you actually confirm that it was working in 0.6.x? I ask because I noticed this behavior before 0.7.

It seems that the digitalocean API strips the whitespace on the public key, and that the actual file does include the newline. I verified that I could make terraform 0.7.0 work as expected by removing the newline from the public key file with perl -pi -e 'chomp if eof' filename.

My current workaround is to do

public_key = "${trimspace(file(var.ssh_key_path))}"

[lucapette]

@tam7t It works fine with 0.6.14. I've just tried your workaround with trimspace and it works! Thank you for sharing that!

[sjourdan]

@tam7t I confirm it's working with 0.6.15 (don't worry about my container):

(code from below is available at https://github.com/sjourdan/terraform_digitalocean_issue_7889/)

$ docker run -it --rm -v `pwd`:/data sjourdan/terraform:0.6.15 --version
Terraform v0.6.15

$ docker run -it --rm -v `pwd`:/data sjourdan/terraform:0.6.15 apply
digitalocean_ssh_key.default: Creating...
  fingerprint: "" => "<computed>"
  name:        "" => "Digital Ocean SSH Key (bug)"
  public_key:  "" => "ssh-rsa AAAA [...] test@bug\n"
digitalocean_ssh_key.default: Creation complete

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Now we can apply again and again:

$ docker run -it --rm -v `pwd`:/data sjourdan/terraform:0.6.15 apply
digitalocean_ssh_key.default: Refreshing state... (ID: 2847649)

The same with 0.7.0 keeps recreating the key:

docker run -it --rm -v `pwd`:/data sjourdan/terraform:0.7.0 apply
digitalocean_ssh_key.default: Refreshing state... (ID: 2847649)
digitalocean_ssh_key.default: Destroying...
digitalocean_ssh_key.default: Destruction complete
digitalocean_ssh_key.default: Creating...
  fingerprint: "" => "<computed>"
  name:        "" => "Digital Ocean SSH Key (bug)"
  public_key:  "" => "ssh-rsa AAAA [...] test@bug\n"
digitalocean_ssh_key.default: Creation complete

Apply complete! Resources: 1 added, 0 changed, 1 destroyed.

[tam7t]

Yup, tried again with 0.6.14 and confirmed that it doesn't attempt to destroy/create the SSH key due to the whitespace. Tracked it down to #7345 and submitted a fix #8173

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.