You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Allow resources to be protected from being destroy while not crashing terraform when using prevent_destroy = true.
This behaviour might be ok when running terraform from the command line but it is not compatible with Consul-Terraform-Sync as the service crashes and is not able to perform any other operation after a service deregisters from Consul and triggers a terraform destroy. Discussions on the subject (for example) come to the conclusion that the user should be running terraform state rm . While this might work when using the command line, it is not suitable when using CTS to manage infrastructure and scripting it would be hackish at best. Neither are scalable and standard to a clean production environment. Also, terraform state rm will sever the binding between Terraform and a resource which is either not always desired, a good idea or even allowed. It would also be preferred not to "orphanate" a resource.
Attempted Solutions
Using prevent_destroy = true which leads to a crash as Terraform exits with an exit code of 1. terraform state rm might work but cleaning after Terraform is not a solution and will have terraform forget about the resource which does not reflect the need and might even be hazardous.
terraform state rm should be reserved for emergency situations to force forget a resource.
Proposal
Terraform should output that a resource was not destroyed because of the prevent_destroy configuration and continue its course without crashing with an exit code of 1 as not destroying a resource that was configured to not be destroyed is exactly the expected behaviour and not an error.
If other resources are dependent of a specific protected resource then it should also be outputted and Terraform should still be able finish its run with no change to the infrastructure in respect to those resources so using it as a service in the case of CTS prevents a crash and a stall in the infrastructure management.
References
No response
The text was updated successfully, but these errors were encountered:
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Terraform Version
Use Cases
Allow resources to be protected from being destroy while not crashing terraform when using prevent_destroy = true.
This behaviour might be ok when running terraform from the command line but it is not compatible with Consul-Terraform-Sync as the service crashes and is not able to perform any other operation after a service deregisters from Consul and triggers a terraform destroy. Discussions on the subject (for example) come to the conclusion that the user should be running terraform state rm . While this might work when using the command line, it is not suitable when using CTS to manage infrastructure and scripting it would be hackish at best. Neither are scalable and standard to a clean production environment. Also, terraform state rm will sever the binding between Terraform and a resource which is either not always desired, a good idea or even allowed. It would also be preferred not to "orphanate" a resource.
Attempted Solutions
Using prevent_destroy = true which leads to a crash as Terraform exits with an exit code of 1.
terraform state rm might work but cleaning after Terraform is not a solution and will have terraform forget about the resource which does not reflect the need and might even be hazardous.
terraform state rm should be reserved for emergency situations to force forget a resource.
Proposal
Terraform should output that a resource was not destroyed because of the prevent_destroy configuration and continue its course without crashing with an exit code of 1 as not destroying a resource that was configured to not be destroyed is exactly the expected behaviour and not an error.
If other resources are dependent of a specific protected resource then it should also be outputted and Terraform should still be able finish its run with no change to the infrastructure in respect to those resources so using it as a service in the case of CTS prevents a crash and a stall in the infrastructure management.
References
No response
The text was updated successfully, but these errors were encountered: