-
Notifications
You must be signed in to change notification settings - Fork 172
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unexpected diffs on plans using the project module #182
Comments
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
Bump. |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
Bump. |
Since you are using |
Hi @imrannayer, thanks for your response. That is actually the case here though. |
@iJebus feel free to close the issue/ |
Sorry @imrannayer, my response was unclear. I meant that all bindings were being managed by code and I still believe an issue exists. |
I'm also encountering the same problem. It works when we hardcoding the service account emails but when we Implicitly reference a service account block is causes drifts. @imrannayer |
It seems like helper function just recrete whole block when you pass a service account which is not created yet. execute following code
Now uncomment the lines and execute the code again. |
Yep, this would align with what I said originally.
|
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
Oops, still a thing AFAIK. |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
Still an issue AFAIK, but I'll stop keeping the issue alive after this because I've moved on from the role where I was using this module. |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
We're also affected by this issue, for both the projects and folders IAM modules in authoritative modes. Folder/project is singular and static, same as roles - the only dynamic things are members under specific roles (service accounts). Yet it forces recreation due to apparent diff in folder/project id and role (even though they're not, they're the same between runs). |
TL;DR
Sometimes I'm seeing very noisy diffs on plans when, for example, a new account is being created and assigned to a role.
I'm not actually sure if this is expected behaviour though.
Expected behavior
The plan should only show the service account being created, and changes in the IAM project module for the roles being assigned.
Observed behavior
The plan shows the account being created and every role binding in the IAM project module states that it must be replaced.
If I do a targeted apply on the account, the plan then shows only the expected roles being updated/assigned.
Terraform Configuration
Terraform Version
Additional information
Example binding replacement diff:
The text was updated successfully, but these errors were encountered: