AzureFile NFS network settings may block terraform access once applied #890
Comments
|
This is probably hashicorp/terraform-provider-azurerm#2977. Looks like hashicorp/terraform-provider-azurerm#14220 is supposed to fix it. In the meantime, can we 'ignore' that particular change somehow in terraform so we can move forward with other changes? |
This is probably my fault for excessively trimming the error message. This error crops up during the "refreshing state" phase of terraform plan, it hasn't even got the the point of calculating the change yet, because it can't check the current state of the file share. So there's nothing to 'ignore'. |
|
Full error message:
|
|
I just ran |
|
Ah, while terraform doesn't support excluding certain resources from runs (hashicorp/terraform#2253), you can pass |
|
I can confirm that the following command worked (at least to give me access again, haven't attempted to make a change yet!)
|
|
Note that this is still a problem, and the cause is hashicorp/terraform-provider-azurerm#2977 |
github-project-automation
bot
moved this to Needs Shaping / Refinement
in DEPRECATED Engineering and Product Backlog
- Mark optional parts of node / dask node definition as optional, so utoronto.tfvars will actually apply - Parameterize core node size, and specify it explicitly. - Remove default for k8s version, specify it explicitly. This matches the current k8s version - Parameterize storage size, and match it to current reality. Note that this can't be applied via tf quite yet, due to 2i2c-org#890. Ref 2i2c-org#2594
|
I've not yet understood the details here, but I did a
I've now tested and concluded that both |
|
@yuvipanda do you think the proxycommand.py script you've created could be used for the purpose of allowing terraform to inspect things in the NFS for this as well? Looking at a NFS mount command provided, it sais... Do you think we can with a few commands route traffic from our local computers to 2i2cutorontohubstorage.file.core.windows.net via a pod created by the proxycommand.py script? |
|
@consideRatio oh, yeah it could probably do that! Will need to be some sort of HTTP proxy (rather than ssh one), may be a fun project to build. The current setup probably won't work because it's just for ssh, which is in some ways easier. I think very temporarily adding your own IP and then unadding it is easier for sure :D But must remember to unadd it though. |
I'm not sure what can we do to enforce this and make sure we don't forget to remove the IP. |
Description
sgibson91#94 partnered with #887 represents an effort to get NFS working on AzureFile storage and involved making some network changes in terraform so that the NFS share could be accessed and mounted by the k8s nodes.
While working on the Carbon Plan Azure cluster, I applied this new terraform config and then ran another
terraform plancommand, mostly to confirm to myself that the infrastructure was up-to-date, however I ran into this error message:I am now worried that by making the NFS accessible to k8s, we have locked ourselves out from managing the infrastructure via terraform.
Value / benefit
We need to retain access via terraform to sustainably manage infrastructure.
Implementation details
No response
Tasks to complete
No response
Updates
No response
The text was updated successfully, but these errors were encountered: