cli: enable constellation apply to create new clusters

.github/actions/constellation_create/action.yml

@@ -138,7 +138,12 @@ runs:
       if : inputs.selfManagedInfra != 'true'
       shell: bash
       run: |
-        constellation create -y --debug --tf-log=DEBUG
+        # TODO(v2.14): Remove workaround for CLIs not supporting apply command
+        cmd='apply --skip-phases="init,attestationconfig,certsans,helm,image,k8s"'
+        if constellation --help | grep -q init; then
+          cmd=create
+        fi
+        constellation $cmd -y --debug --tf-log=DEBUG -
 
     - name: Constellation create (self-managed)
       if : inputs.selfManagedInfra == 'true'
@@ -163,7 +168,7 @@ runs:
       shell: bash
       run: |
         # TODO(v2.14): Remove workaround for CLIs not supporting apply command
-        cmd=apply
+        cmd="apply --skip-phases=infrastructure"
         if constellation --help | grep -q init; then
           cmd=init
         fi

cli/internal/cloudcmd/apply.go

@@ -121,6 +121,11 @@ func (a *Applier) RestoreWorkspace() error {
 	return restoreBackup(a.fileHandler, a.workingDir, filepath.Join(a.backupDir, constants.TerraformUpgradeBackupDir))
 }
 
+// WorkingDirIsEmpty returns true if the working directory of the Applier is empty.
+func (a *Applier) WorkingDirIsEmpty() (bool, error) {
+	return a.fileHandler.IsEmpty(a.workingDir)
+}
+
 func (a *Applier) terraformApplyVars(ctx context.Context, conf *config.Config) (terraform.Variables, error) {
 	imageRef, err := a.imageFetcher.FetchReference(
 		ctx,

cli/internal/cloudcmd/tfplan.go

@@ -53,9 +53,9 @@ func plan(
 		return false, fmt.Errorf("terraform plan: %w", err)
 	}
 
-	// If we are planning in a new workspace, we don't want to show a diff
+	// If we are planning in a new workspace, we don't want to show the plan
 	if isNewWorkspace {
-		return false, nil
+		return hasDiff, nil
 	}
 
 	if hasDiff {
@@ -67,14 +67,15 @@ func plan(
 }
 
 // restoreBackup replaces the existing Terraform workspace with the backup.
+// If no backup exists, this function simply removes workingDir.
 func restoreBackup(fileHandler file.Handler, workingDir, backupDir string) error {
 	if err := fileHandler.RemoveAll(workingDir); err != nil {
 		return fmt.Errorf("removing existing workspace: %w", err)
 	}
 	if err := fileHandler.CopyDir(
 		backupDir,
 		workingDir,
-	); err != nil {
+	); err != nil && !errors.Is(err, os.ErrNotExist) { // ignore not found error because backup does not exist for new clusters
 		return fmt.Errorf("replacing terraform workspace with backup: %w", err)
 	}
 

cli/internal/cloudcmd/tfplan_test.go

@@ -9,6 +9,7 @@ package cloudcmd
 import (
 	"context"
 	"io"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -123,40 +124,42 @@ func TestTFPlan(t *testing.T) {
 func TestRestoreBackup(t *testing.T) {
 	existingWorkspace := "foo"
 	backupDir := "bar"
+	testFile := "file"
 
 	testCases := map[string]struct {
-		prepareFs func(require *require.Assertions) file.Handler
-		wantErr   bool
+		prepareFs            func(require *require.Assertions) file.Handler
+		wantRemoveWorkingDir bool
+		wantErr              bool
 	}{
 		"success": {
 			prepareFs: func(require *require.Assertions) file.Handler {
 				fs := file.NewHandler(afero.NewMemMapFs())
-				require.NoError(fs.MkdirAll(existingWorkspace))
-				require.NoError(fs.MkdirAll(backupDir))
+				require.NoError(fs.Write(filepath.Join(existingWorkspace, testFile), []byte{}, file.OptMkdirAll))
+				require.NoError(fs.Write(filepath.Join(backupDir, testFile), []byte{}, file.OptMkdirAll))
 				return fs
 			},
 		},
-		"existing workspace does not exist": {
+		"only backup exists": {
 			prepareFs: func(require *require.Assertions) file.Handler {
 				fs := file.NewHandler(afero.NewMemMapFs())
-				require.NoError(fs.MkdirAll(backupDir))
+				require.NoError(fs.Write(filepath.Join(backupDir, testFile), []byte{}, file.OptMkdirAll))
 				return fs
 			},
 		},
-		"backup dir does not exist": {
+		"only existingWorkspace exists": {
 			prepareFs: func(require *require.Assertions) file.Handler {
 				fs := file.NewHandler(afero.NewMemMapFs())
-				require.NoError(fs.MkdirAll(existingWorkspace))
+				require.NoError(fs.Write(filepath.Join(existingWorkspace, testFile), []byte{}, file.OptMkdirAll))
 				return fs
 			},
-			wantErr: true,
+			wantRemoveWorkingDir: true,
 		},
 		"read only file system": {
 			prepareFs: func(require *require.Assertions) file.Handler {
 				memFS := afero.NewMemMapFs()
 				fs := file.NewHandler(memFS)
-				require.NoError(fs.MkdirAll(existingWorkspace))
-				require.NoError(fs.MkdirAll(backupDir))
+				require.NoError(fs.Write(filepath.Join(existingWorkspace, testFile), []byte{}, file.OptMkdirAll))
+				require.NoError(fs.Write(filepath.Join(backupDir, testFile), []byte{}, file.OptMkdirAll))
 				return file.NewHandler(afero.NewReadOnlyFs(memFS))
 			},
 			wantErr: true,
@@ -174,6 +177,14 @@ func TestRestoreBackup(t *testing.T) {
 				return
 			}
 			assert.NoError(err)
+			_, err = fs.Stat(filepath.Join(backupDir, testFile))
+			assert.ErrorIs(err, os.ErrNotExist)
+			_, err = fs.Stat(filepath.Join(existingWorkspace, testFile))
+			if tc.wantRemoveWorkingDir {
+				assert.ErrorIs(err, os.ErrNotExist)
+			} else {
+				assert.NoError(err)
+			}
 		})
 	}
 }