Giters

overmindtech / cli

Identify the blast radius and risks for Terraform changes in real time

Home Page:https://overmind.tech/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

cli: issue with ending the change

DavidS-ovm opened this issue Β· comments

commented

possibly because after the S3 test change no items were available for snapshotting?

david in debian in cli on ξ‚  dev [$!?] via 🐹 via πŸ’  default on ☁️  sso-david (eu-west-2) took 6s 
❯ terraform plan
module.bucket.data.aws_region.current: Reading...
module.bucket.data.aws_caller_identity.current: Reading...
module.bucket.data.aws_partition.current: Reading...
module.bucket.data.aws_region.current: Read complete after 0s [id=eu-west-2]
module.bucket.data.aws_partition.current: Read complete after 0s [id=aws]
module.bucket.aws_s3_bucket.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]
module.bucket.data.aws_caller_identity.current: Read complete after 0s [id=261928782070]
module.bucket.aws_s3_bucket_public_access_block.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]
module.bucket.aws_s3_bucket_ownership_controls.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.bucket.aws_s3_bucket.this[0] must be replaced
-/+ resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      ~ arn                         = "arn:aws:s3:::cli-testtest20240502144618415800000001" -> (known after apply)
      ~ bucket                      = "cli-testtest20240502144618415800000001" -> (known after apply)
      ~ bucket_domain_name          = "cli-testtest20240502144618415800000001.s3.amazonaws.com" -> (known after apply)
      ~ bucket_prefix               = "cli-testtest" -> "cli-testdemo" # forces replacement
      ~ bucket_regional_domain_name = "cli-testtest20240502144618415800000001.s3.eu-west-2.amazonaws.com" -> (known after apply)
      ~ hosted_zone_id              = "Z3GKZC51ZF0DB4" -> (known after apply)
      ~ id                          = "cli-testtest20240502144618415800000001" -> (known after apply)
      + policy                      = (known after apply)
      ~ region                      = "eu-west-2" -> (known after apply)
      ~ request_payer               = "BucketOwner" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
        # (2 unchanged attributes hidden)

      - grant {
          - id          = "e55964492974ba2b8f56bade88cfb30ca2e092bdf672d45d26c46b4a90fb3434" -> null
          - permissions = [
              - "FULL_CONTROL",
            ] -> null
          - type        = "CanonicalUser" -> null
        }

      - server_side_encryption_configuration {
          - rule {
              - bucket_key_enabled = false -> null

              - apply_server_side_encryption_by_default {
                  - sse_algorithm = "AES256" -> null
                }
            }
        }

      - versioning {
          - enabled    = false -> null
          - mfa_delete = false -> null
        }
    }

  # module.bucket.aws_s3_bucket_ownership_controls.this[0] must be replaced
-/+ resource "aws_s3_bucket_ownership_controls" "this" {
      ~ bucket = "cli-testtest20240502144618415800000001" # forces replacement -> (known after apply) # forces replacement
      ~ id     = "cli-testtest20240502144618415800000001" -> (known after apply)

        # (1 unchanged block hidden)
    }

  # module.bucket.aws_s3_bucket_public_access_block.this[0] must be replaced
-/+ resource "aws_s3_bucket_public_access_block" "this" {
      ~ bucket                  = "cli-testtest20240502144618415800000001" # forces replacement -> (known after apply) # forces replacement
      ~ id                      = "cli-testtest20240502144618415800000001" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

Plan: 3 to add, 0 to change, 3 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform
apply" now.

david in debian in cli on ξ‚  dev [$!?] via 🐹 via πŸ’  default on ☁️  sso-david (eu-west-2) took 8s 
❯ overmind terraform plan
βœ… Connected to Overmind
βœ… Authentication successful, token stored locally (/home/david/.overmind/token.json)
βœ… Configuring AWS Access (config stored)

βœ… AWS Source: running
βœ… stdlib Source: running
β–ˆ Planning Changes

  Running terraform plan -out overmind.plan                                     


⏳ Processing Planned Changes
module.bucket.data.aws_caller_identity.current: Reading...
module.bucket.data.aws_partition.current: Reading...
module.bucket.data.aws_region.current: Reading...
module.bucket.data.aws_partition.current: Read complete after 0s [id=aws]
module.bucket.data.aws_region.current: Read complete after 0s [id=eu-west-2]
module.bucket.aws_s3_bucket.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]
module.bucket.data.aws_caller_identity.current: Read complete after 0s [id=261928782070]
module.bucket.aws_s3_bucket_public_access_block.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]
module.bucket.aws_s3_bucket_ownership_controls.this[0]: Refreshing state... [id=cli-testtest20240502144618415800000001]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.bucket.aws_s3_bucket.this[0] must be replaced
-/+ resource "aws_s3_bucket" "this" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      ~ arn                         = "arn:aws:s3:::cli-testtest20240502144618415800000001" -> (known after apply)
      ~ bucket                      = "cli-testtest20240502144618415800000001" -> (known after apply)
      ~ bucket_domain_name          = "cli-testtest20240502144618415800000001.s3.amazonaws.com" -> (known after apply)
      ~ bucket_prefix               = "cli-testtest" -> "cli-testdemo" # forces replacement
      ~ bucket_regional_domain_name = "cli-testtest20240502144618415800000001.s3.eu-west-2.amazonaws.com" -> (known after apply)
      ~ hosted_zone_id              = "Z3GKZC51ZF0DB4" -> (known after apply)
      ~ id                          = "cli-testtest20240502144618415800000001" -> (known after apply)
      + policy                      = (known after apply)
      ~ region                      = "eu-west-2" -> (known after apply)
      ~ request_payer               = "BucketOwner" -> (known after apply)
      - tags                        = {} -> null
      ~ tags_all                    = {} -> (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
        # (2 unchanged attributes hidden)

      - grant {
          - id          = "e55964492974ba2b8f56bade88cfb30ca2e092bdf672d45d26c46b4a90fb3434" -> null
          - permissions = [
              - "FULL_CONTROL",
            ] -> null
          - type        = "CanonicalUser" -> null
        }

      - server_side_encryption_configuration {
          - rule {
              - bucket_key_enabled = false -> null

              - apply_server_side_encryption_by_default {
                  - sse_algorithm = "AES256" -> null
                }
            }
        }

      - versioning {
          - enabled    = false -> null
          - mfa_delete = false -> null
        }
    }

  # module.bucket.aws_s3_bucket_ownership_controls.this[0] must be replaced
-/+ resource "aws_s3_bucket_ownership_controls" "this" {
      ~ bucket = "cli-testtest20240502144618415800000001" # forces replacement -> (known after apply) # forces replacement
      ~ id     = "cli-testtest20240502144618415800000001" -> (known after apply)

        # (1 unchanged block hidden)
    }

  # module.bucket.aws_s3_bucket_public_access_block.this[0] must be replaced
-/+ resource "aws_s3_bucket_public_access_block" "this" {
      ~ bucket                  = "cli-testtest20240502144618415800000001" # forces replacement -> (known after apply) # forces replacement
      ~ id                      = "cli-testtest20240502144618415800000001" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

Plan: 3 to add, 0 to change, 3 to destroy.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Saved the plan to: overmind.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "overmind.plan"


βœ… Connected to Overmind
βœ… Authentication successful, token stored locally (/home/david/.overmind/token.json)
βœ… Configuring AWS Access (config stored)

βœ… AWS Source: running
βœ… stdlib Source: running
βœ… Planning Changes
βœ… Processing Planned Changes

  Processing plan from terraform plan -out overmind.plan                        


Calculating Blast Radius - finished: 1 item

Check the blast radius graph and risks at:
https://app.overmind.tech/changes/24d3171f-194d-4ebd-a669-88f8bd995e98/blast-radius



david in debian in cli on ξ‚  dev [$!?] via 🐹 via πŸ’  default on ☁️  sso-david (eu-west-2) took 2m40s 
❯ overmind terraform apply
βœ… Connected to Overmind
βœ… Using stored token
βœ… Configuring AWS Access (config stored)

βœ… AWS Source: running
βœ… stdlib Source: running

     Applying Changes                                                           
                                                                                
  Applying changes with terraform apply overmind.plan                           


Starting Change - pending
Ending Change - pending

module.bucket.aws_s3_bucket_ownership_controls.this[0]: Destroying... [id=cli-testtest20240502144618415800000001]
module.bucket.aws_s3_bucket_ownership_controls.this[0]: Destruction complete after 1s
module.bucket.aws_s3_bucket_public_access_block.this[0]: Destroying... [id=cli-testtest20240502144618415800000001]
module.bucket.aws_s3_bucket_public_access_block.this[0]: Destruction complete after 0s
module.bucket.aws_s3_bucket.this[0]: Destroying... [id=cli-testtest20240502144618415800000001]
module.bucket.aws_s3_bucket.this[0]: Destruction complete after 1s
module.bucket.aws_s3_bucket.this[0]: Creating...
module.bucket.aws_s3_bucket.this[0]: Creation complete after 1s [id=cli-testdemo20240503144813634000000001]
module.bucket.aws_s3_bucket_public_access_block.this[0]: Creating...
module.bucket.aws_s3_bucket_public_access_block.this[0]: Creation complete after 0s [id=cli-testdemo20240503144813634000000001]
module.bucket.aws_s3_bucket_ownership_controls.this[0]: Creating...
module.bucket.aws_s3_bucket_ownership_controls.this[0]: Creation complete after 1s [id=cli-testdemo20240503144813634000000001]

Apply complete! Resources: 3 added, 0 changed, 3 destroyed.

βœ… Connected to Overmind
βœ… Using stored token
βœ… Configuring AWS Access (config stored)

βœ… AWS Source: running
βœ… stdlib Source: running

     Applying Changes                                                           
                                                                                
  Applying changes with terraform apply overmind.plan                           


Starting Change - pending
Ending Change - pending








βœ… Connected to Overmind
βœ… Using stored token
βœ… Configuring AWS Access (config stored)

βœ… AWS Source: running
βœ… stdlib Source: running

     Applying Changes                                                           
                                                                                
  Applying changes with terraform apply overmind.plan                           


Starting Change - pending
Ending Change - pending



                                                                                
  β”‚ Fatal Error: failed to process end change: internal: error processing:       
  β”‚ internal: all queries failed                                                 


david in debian in cli on ξ‚  dev [$!?] via 🐹 via πŸ’  default on ☁️  sso-david (eu-west-2) took 14s 
❯
commented

There is no good way to tackle this as the logic gets threaded through api-server's queriesTracker which only sees sdp.QueryStatus_Status, which does not distinguish between NotFound and other errors.

commented

Fixed in the API Server