Error loading state: writing

[mchauhan75]

Hi There,

We are getting below errors while we run the terraform apply/plan. Even we tried to force-unlock but did not help (terraform force-unlock 55c1e2b0-fe57-118a-81ee-d7442c0d353d) . Does anyone had any idea how to fix?

Error loading state: writing "gs://secret-meridian-680-tfstate/terraform.tflock" failed: googleapi: Error 412: Precondition Failed, conditionNotMet
Lock Info:
ID: 55c1e2b0-fe57-118a-81ee-d7442c0d353d
Path:
Operation: init
Who: mchauhan@Mchauhan-Latitude-E7450
Version: 0.11.0
Created: 2017-11-22 12:13:24.559036694 +0000 UTC
Info:

Thanks
Manoj

Terraform Version

...

Terraform Configuration Files

...

Debug Output

Crash Output

Expected Behavior

Actual Behavior

Steps to Reproduce

Important Factoids

References

[ghost]

Same here,

terraform 0.11.0 on an existing project.

[ghost]

It is reproduceable as far as I see. In terraform 0.11 that introduced gcs with lock you can reproduce the issue using the following setup.

Adding terraform_remote_state is causing a double lock that always fails.
Remove the terraform_remote_state section and all goes fine.

provider "google" {
  credentials = "service-account.json"
  project     = "my-project"
  region      = "europe-west1"
}

terraform {
  backend "gcs" {
    credentials = "service-account.json"
    project     = "my-project"
    bucket      = "my-bucket"
    path        = "test.tfstate"
  }
}

data "terraform_remote_state" "k8s" {
  backend = "gcs"

  config {
    credentials = "service-account.json"
    project     = "my-project"
    bucket      = "my-bucket"
    path        = "test.tfstate"
  }

}

Note: Based on what I see, I am not sure even if there is any good solution for this scenario. Double lock will happen if we use remote-backend and at the same time try to load it through terraform_remote_state. unless if we can assume no lock is needed during terraform_remote_state load.

[octo]

@kavehmzta there is no terraform_remote_state in the example you provided. Can you please provide the config that is triggering the issue? Thanks!

[ghost]

@octo sorry my bad. a typo while I was editing.

[kavehmz]

@octo @tombuildsstuff can you please take a look at #16852 and see if it can be considered a fix or if I have missed something?

[Markbnj]

Just FYI we've hit this as well, and until the fix is released a workaround is to pass the -lock=false flag to terraform commands.

[Markbnj]

I just upgraded our build server to terraform 0.11.2 and removed the -lock=false flag from the command line, and this issue appears to be fixed. Thanks, devs!

[slavaaaaaaaaaa]

Apologies for awakening an old thread: I just hit this on 0.11.11, google provider 1.20.0 by (I think) accidentally adding a second provider without an alias. Removed the state lock file via gsutil (after verifying for safety), added an alias to the second provider block, everything seems to work well now.

Cheers!

[curtbushko]

@smaslennikov How did you add an alias to the second provider? I believe I am hitting the same problem on 0.11.11

[slavaaaaaaaaaa]

@curtbushko Here's what that section of my code looks like now:

variable "project" { default = "dev" }
variable "region" { default = "us-central1" }

terraform {
  backend "gcs" {
    bucket  = "dev-tf-state"
    prefix  = "terraform/state"
  }
}

data "terraform_remote_state" "default" {
  backend = "gcs"
  config {
    bucket  = "${var.project}-tf-state"
    prefix  = "terraform/state"
  }
}

provider "google" {
  alias   = "shared-network"
  version = "~> 1.19"
  project = "shared-network-dev"
  region  = "${var.region}"
}

provider "google" {
  version = "~> 1.19"
  project = "${var.project}"
  region  = "${var.region}"
}

resource "google_storage_bucket" "terraform-state" {
  name = "${var.project}-tf-state"
  versioning {
    enabled = true
  }
}

provider resource accepts an alias definition, allowing for a given provider to be called as google.<alias>. Here's how I use it:

resource "google_compute_network" "shared_network" {
  name = "shared-net"
  auto_create_subnetworks = "false"
  project = "shared-network-dev"
}

resource "google_compute_firewall" "allow-public-rdp" {
  name    = "sn-allow-public-rdp"
  network = "${google_compute_network.shared_network.name}"
  provider = "google.shared-network"

  allow {
    protocol = "tcp"
    ports    = ["3389"]
  }

  source_ranges = [ "0.0.0.0/0" ]

  target_tags = ["allow-public-rdp"]
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.