Bug 1659970: terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0 #1442

wking · 2019-03-20T00:02:43Z

This picks up a bunch of upstream improvements including hashicorp/terraform-provider-aws#7734 to address rhbz#1659970.

Generated with a manual Gopkg.toml edit followed by:

$ cd terraform/exec/plugins
$ dep ensure

with:

$ dep version
dep:
 version     : v0.5.0-31-g73b3afe
 build date  : 2019-02-08
 git hash    : 73b3afe
 go version  : go1.10.3
 go compiler : gc
 platform    : linux/amd64
 features    : ImportDuringSolve=false

abhinavdahiya · 2019-03-20T00:13:09Z

pkg/terraform/exec/plugins/Gopkg.lock

@@ -441,6 +552,55 @@
  revision = "51d6538a90f86fe93ac480b35f37b2be17fef232"
  version = "v2.2.2"

+[[projects]]


Ooo, this does not look right, how is pulling in k8s.io/apimachinery ?

I dunno. I'll regenerate tonight with the debugging cranked up to see.

wking · 2019-03-20T18:06:27Z

...ithub.com/terraform-providers/terraform-provider-aws/aws/data_source_aws_eks_cluster_auth.go

+
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/helper/validation"
+	"github.com/kubernetes-sigs/aws-iam-authenticator/pkg/token"


@abhinavdahiya, here's where Kubernetes is getting pulled in, so I think this is not actually a problem.

This picks up a bunch of upstream improvements [1] including [2] to address [3]. Generated with a manual Gopkg.toml edit followed by: $ cd terraform/exec/plugins $ dep ensure with: $ dep version dep: version : v0.5.1 build date : 2019-03-20 git hash : faa61893 go version : go1.10.3 go compiler : gc platform : linux/amd64 features : ImportDuringSolve=false The aws-iam-authenticator pin gets us closer to [4], although (1) I don't know why dep isn't figuring that out for itself and (2) they got rid of their 0.3.1 tag [5]? Anyway, this avoids: $ hack/build.sh ... # github.com/openshift/installer/pkg/terraform/exec/plugins/vendor/github.com/terraform-providers/terraform-provider-aws/aws pkg/terraform/exec/plugins/vendor/github.com/terraform-providers/terraform-provider-aws/aws/data_source_aws_eks_cluster_auth.go:35:38: too many arguments in call to token.NewGenerator have (bool) want () ... The AWS SDK pin gets us closer to [6] and avoids: $ hack/build.sh ... # github.com/openshift/installer/pkg/terraform/exec/plugins/vendor/github.com/terraform-providers/terraform-provider-aws/aws pkg/terraform/exec/plugins/vendor/github.com/terraform-providers/terraform-provider-aws/aws/structure.go:4801:7: spec.ServiceNames undefined (type *appmesh.VirtualRouterSpec has no field or method ServiceNames) ... The = prefixes in Gopkg.toml settle things down, because [7]: Note: When you specify a version without an operator, dep automatically uses the ^ operator by default. dep ensure will interpret the given version as the min-boundary of a range... [1]: https://github.com/terraform-providers/terraform-provider-aws/blob/v2.2.0/CHANGELOG.md [2]: hashicorp/terraform-provider-aws#7734 (v2.0.0) [3]: https://bugzilla.redhat.com/show_bug.cgi?id=1659970 [4]: https://github.com/terraform-providers/terraform-provider-aws/blob/v2.2.0/go.mod#L27 [5]: https://github.com/kubernetes-sigs/aws-iam-authenticator/tags [6]: https://github.com/terraform-providers/terraform-provider-aws/blob/v2.2.0/go.mod#L7 [7]: https://golang.github.io/dep/docs/Gopkg.toml.html#version-rules

wking · 2019-03-26T22:57:05Z

I've pushed 6c2558b -> d1c17b7 adding two override stanzas and some = prefixes to Gopkg.toml to get this to compile. The AWS Terraform provider has a v2.3 out now, but I'll bump to that in follow-up work after we get this in.

wking · 2019-03-27T01:08:50Z

Through Terraform:

Flaky tests:

[Feature:Builds][Conformance] s2i build with a quota  Building from a template should create an s2i build with a quota and run it [Suite:openshift/conformance/parallel/minimal]

Failing tests:

[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Inline-volume (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Pre-provisioned PV (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]

So I think we're good to go.

abhinavdahiya · 2019-03-27T01:16:20Z

Through Terraform:

Flaky tests:

[Feature:Builds][Conformance] s2i build with a quota  Building from a template should create an s2i build with a quota and run it [Suite:openshift/conformance/parallel/minimal]

Failing tests:

[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Dynamic PV (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Inline-volume (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]
[sig-storage] In-tree Volumes [Driver: nfs] [Testpattern: Pre-provisioned PV (default fs)] subPath should be able to unmount after the subpath directory is deleted [Suite:openshift/conformance/parallel] [Suite:k8s]

So I think we're good to go.

do we need the 420K bump to fix BZ 1659970(IMO user error) 😢

wking · 2019-03-27T07:37:11Z

do we need the 420K bump to fix BZ 1659970(IMO user error)

Lots of other bugfixes in there too, see the change-log. For example:

resource/aws_s3_bucket: Prevent NoSuchBucket errors when putting lifecycle configuration on resource creation (hashicorp/terraform-provider-aws#7930)

wking · 2019-03-27T08:26:51Z

Failing tests are openshift/origin#22412, and may be happening every time.

smarterclayton · 2019-03-27T15:33:25Z

/retest

abhinavdahiya · 2019-03-27T15:41:25Z

do we need the 420K bump to fix BZ 1659970(IMO user error)

Lots of other bugfixes in there too, see the change-log. For example:

resource/aws_s3_bucket: Prevent NoSuchBucket errors when putting lifecycle configuration on resource creation (terraform-providers/terraform-provider-aws#7930)

That's not related to how we use that resource...

😢
/lgtm

openshift-ci-robot · 2019-03-27T15:41:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhinavdahiya, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [abhinavdahiya,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2019-03-27T17:15:53Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-03-27T18:20:58Z

/retest

Please review the full test history for this PR and help us cut down flakes.

wking · 2019-03-27T19:49:31Z

e2e-aws:

level=error msg="\t* aws_route_table_association.private_routing.0: timeout while waiting for state to become 'success' (timeout: 5m0s)"

/retest

sdodson · 2019-03-27T20:57:32Z

/retest

sdodson · 2019-03-27T20:58:19Z

level=fatal msg="failed to initialize the cluster: Working towards 0.0.1-2019-03-27-195700: 99% complete: timed out waiting for the condition" on the last failure

…nfiguration And alphabetize this section. The new permission avoids [1]: error getting S3 Bucket Object Lock configuration: AccessDenied which came in with our Terraform bump from d1c17b7 (terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0, 2019-03-19, openshift#1442). [1]: hashicorp/terraform-provider-aws#7550

We've been using the tagged private zone to look up the public zone since the non-Terraform destroy code landed in a8fc89b (vendor: add aws deprovision, openshift#324). When there's an existing cluster with a given domain, that can lead to false-positive removals like [1]: 1. Cluster 1 comes up like usual. 2. Cluster 2 creates a private zone. 3. Cluster 2 dies when its public record conflicts with cluster 1 (new since d1c17b7, terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0, 2019-03-19, openshift#1442). 4. 'destroy cluster' on cluster 2's metadata.json removes cluster 2 resources (good) and cluster 1's public record (bad). With the explicit dependency in this commit, we ensure that we only ever create the private zone after we have successfully claimed ownership of the public record. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1659970#c7

…nfiguration And alphabetize this section. The new permission avoids [1]: error getting S3 Bucket Object Lock configuration: AccessDenied which came in with our Terraform bump from d1c17b7 (terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0, 2019-03-19, openshift#1442). [1]: hashicorp/terraform-provider-aws#7550

openshift-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Mar 20, 2019

openshift-ci-robot requested review from aaronlevy and abhinavdahiya March 20, 2019 00:03

abhinavdahiya reviewed Mar 20, 2019

View reviewed changes

wking commented Mar 20, 2019

View reviewed changes

serbrech mentioned this pull request Mar 26, 2019

dep check fails in pkg/terraform/exec #1471

Closed

wking force-pushed the terraform-provider-aws-v2.2.0 branch from 6c2558b to d1c17b7 Compare March 26, 2019 22:55

openshift-ci-robot assigned abhinavdahiya Mar 27, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 27, 2019

openshift-merge-robot merged commit 42af12d into openshift:master Mar 28, 2019

wking deleted the terraform-provider-aws-v2.2.0 branch March 28, 2019 01:04

wking mentioned this pull request Mar 28, 2019

aws/permissions: Add s3:GetBucketObjectLockConfiguration to pre-flight checks #1491

Merged

wking mentioned this pull request Apr 1, 2019

Bug 1659970: data/aws/route53: Block private Route 53 zone on public record #1508

Merged

wking mentioned this pull request Apr 9, 2019

Existing A record error #1562

Closed

wking mentioned this pull request Aug 9, 2019

data/aws/bootstrap: Block public ACLs, etc. for the S3 bucket #1203

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug 1659970: terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0 #1442

Bug 1659970: terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0 #1442

wking commented Mar 20, 2019

abhinavdahiya Mar 20, 2019

wking Mar 20, 2019

wking Mar 20, 2019

wking commented Mar 26, 2019

wking commented Mar 27, 2019

abhinavdahiya commented Mar 27, 2019

wking commented Mar 27, 2019

wking commented Mar 27, 2019

smarterclayton commented Mar 27, 2019

abhinavdahiya commented Mar 27, 2019

openshift-ci-robot commented Mar 27, 2019

openshift-bot commented Mar 27, 2019

openshift-bot commented Mar 27, 2019

wking commented Mar 27, 2019

sdodson commented Mar 27, 2019

sdodson commented Mar 27, 2019

Bug 1659970: terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0 #1442

Bug 1659970: terraform/exec/plugins/vendor: Bump terraform-provider-aws to v2.2.0 #1442

Conversation

wking commented Mar 20, 2019

abhinavdahiya Mar 20, 2019

Choose a reason for hiding this comment

wking Mar 20, 2019

Choose a reason for hiding this comment

wking Mar 20, 2019

Choose a reason for hiding this comment

wking commented Mar 26, 2019

wking commented Mar 27, 2019

abhinavdahiya commented Mar 27, 2019

wking commented Mar 27, 2019

wking commented Mar 27, 2019

smarterclayton commented Mar 27, 2019

abhinavdahiya commented Mar 27, 2019

openshift-ci-robot commented Mar 27, 2019

openshift-bot commented Mar 27, 2019

openshift-bot commented Mar 27, 2019

wking commented Mar 27, 2019

sdodson commented Mar 27, 2019

sdodson commented Mar 27, 2019