Issues with new 'cloud block' functionality

[jderieg]

Hi there, first off, let me say thanks for adding the ability to use the Cloud block! This is great.
However, I'm hitting an error when I try to actually use it. This is what my cloud-block looks like:

terraform {
  cloud {
    hostname     = "terrakube-api.dev.mydomain.com"
    organization = "devops-test"
    workspaces {
      tags = ["vpc", "aws"]
    }
  }
}

When I do a terraform init, I get the following response from Terraform:

Error: Failed to get existing workspaces: 405 Method Not Allowed

When I check the logs in the API pod, this is the error I see:

WARN 1 --- [nio-8080-exec-1] .w.s.m.s.DefaultHandlerExceptionResolver : Resolved [org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'GET' not supported]

Seems like it may be something missing in the code?
Any ideas? Thanks!

[alfespa17]

Which terrakube version are you using?

I added that feature a few days ago, if you want to use it you should use the latest beta 2.15.0-beta.1

[jderieg]

Looks like that's an attribute in my tf state file included in an aws_iam_policy_document:

...
"resources": [
    {
      "module": "module.vpc",
      "mode": "data",
      "type": "aws_iam_policy_document",
      "name": "flow_log_cloudwatch_assume_role",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "index_key": 0,
          "schema_version": 0,
          "attributes": {
            "id": "1021377347",
            "json": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AWSVPCFlowLogsAssumeRole\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"vpc-flow-logs.amazonaws.com\"\n      }\n    }\n  ]\n}",
            "override_json": null,
            "override_policy_documents": null,
            "policy_id": null,
            "source_json": null,
            "source_policy_documents": null,
            "statement": [
...

[alfespa17]

Do you have any idea how i can reproduce that issue? Maybe you could share the terraform commands that you are using ?

[jderieg]

We're currently using app.terraform.io as our backend for all our terraform. So what I do is a terraform state pull to pull the state file down from there locally to my machine. Then I change the cloud-block in my code to point to terrakube, do another terraform init to initialize the connection to terrakube, and then attempt to do a terraform state push. Like this:

terraform state pull > ~/mystatefile

(then I change the cloud block to point to terrakube and run terraform init)

terraform state push ~/mystatefile

I've used this same method to perform workspace migrations in the past and it has worked successfully.

Also, I ran that state push with Trace logging on and I'm looking through the output right now to see if anything sticks out. It's a lot of data, some of it sensitive, so I don't want to post the output here.

[alfespa17]

I think I can use the provided information to test it, I will create some sample workspace in app.terraform.io and run

terraform init (with app.terraform.io)
terraform state pull > ~/mystatefile
terraform init (with terrakube)
terraform state push ~/mystatefile

I will try to debug a similar scenario.

Thank you for the information.

[jderieg]

Thanks for your help with this! I appreciate the super-responsiveness.

[jderieg]

I also need the ability to change execution mode from 'remote' to 'local' in a workspace. Is there a way to change that in the API? In the UI it looks like a link, but it doesn't do anything when you click on it.

[alfespa17]

For now we only support remote executions. There is no way to change that in the API.

[jderieg]

Added a feature request for this: #451

[jderieg]

I installed the version 2.15.0-beta.2 for the api, ui, executor, and registry. I'm happy to report that I was able to switch my workspace to local execution mode, and successfully migrate a state file from app.terraform.io over to our terrakube instance!

[alfespa17]

That sound great 👍, let me know if you face any issue

[jderieg]

I opened a couple other issues:
#457
#458