Rundeck provider not working

[mengesb]

Seems I'm having issues using the Rundeck provider and I'm wondering if perhaps it has to do with the updates to the API. I see that the code for Terraform's Rundeck provider uses API version 13 for Rundeck. The most recent API supported by Rundeck is version 19, which may also solve noted documentation caveats (which are a bit confusing by the way) surrounding file creation of the resources file and such...

Since I couldn't get any of the resources to work, I simplified this configuration paste to just attempting to get the rundeck_project resource working...

Terraform Version

0.9.3

Affected Resource(s)

Please list the resources as a list, for example:

• rundeck_*

Terraform Configuration Files

# Terraform configuration
terraform {
  required_version = "> 0.9.0"

  backend "s3" {
    bucket = "BUCKET"
    key    = "PATH/terraform.tfstate"
    region = "us-east-1"
  }
}

provider "rundeck" {
  url        = "http://${var.rundeck["fqdn"]}/"
  auth_token = "${var.rundeck["token"]}"
}

resource "rundeck_project" "project" {
  name = "${var.project["name"]}"
  description = "${var.project["description"]}"
  ssh_key_storage_path = "keys/here"
  resource_model_source {
    type = "file"
    config = {
      format = "resourcexml"
      file = "/var/rundeck/projects/${var.project["name"]}/etc/resources.xml"
    }
  }
}

Debug Output

https://gist.github.com/mengesb/9e24c677c5bb9a994595f4fa2366cd1f

Panic Output

N/A

Expected Behavior

Rundeck project created

Actual Behavior

Error: rundeck_project.project: HTTP Error %!i(int=405)

Steps to Reproduce

1. terraform apply

Important Factoids

Attempted to use rundeck_project, rundeck_private_key, rundeck_public_key, rundeck_job and they're all failing. Seems that the root of it all is the provider.

References

• Rundeck Provider: rundeck_job doesn't have idempotency #8677
• http://rundeck.org/docs/api/

[mengesb]

And just incase... Yes I've verified that the auth token is correct by issuing my own CURLs against my rundeck system

[mengesb]

So I fiddled a bit with the ACL policies, and I updated the authtoken.aclpolicy to be as open and liberal as the admin.aclpolicy file. I ran a test API call and successfully created a project; but still getting an HTTP405 when doing so through Terraform

[mengesb]

Any speculation on this? I'm currently blocked from using the rundeck resources and the debug logging isn't much help.

[mengesb]

This might be a mis-nomer due to the way that terraform is determining the DNS address of the host I'm reaching.

Even though my local host is correctly connecting to the right host via DNS name, it seems that Terraform (GO) is looking up the IP of the DNS name for the provider, and connecting to that information. Since I'm functioning in a split horizon DNS world, this is apparently causing havoc.

Not sure if there's anything that can be done about this on the end of Terraform, but it is very real-world to have to deal with split horizon DNS and multiple valid paths to the same hostname depending on VPN rules.

I'll close this; but could someone please just acknowledge it and comment if there's another reasonable course of action that may or may not be taken on the Hashicorp side?

[apparentlymart]

Hi @mengesb,

It sounds like you've found that Terraform was connecting to the wrong server, and so the 405 Method Not Allowed was a result of trying to send Rundeck API requests to something that isn't Rundeck. Is that right?

Terraform currently leans on the Go resolver, which we know has some limitations on Mac OS X where it just uses /etc/resolv.conf rather than going through the libc resolver, as discussed in #3536. Unfortunately this limitation stems from the way we cross-compile Terraform to multiple platforms for release, and thus aren't able to use CGo to interact with libc.

In future we may be able to change our build process to include something like xgo to accommodate this properly, but this is not something we're able to do in the short term, unfortunately.

[mengesb]

Thanks @apparentlymart ; I just wanted to bring some attention to it; I'll close this one out.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.