consul_keys show up as changed randomly

[dansteen]

Since v0.6.13, consul_keys that are set in my config show up as "modified" in my "terraform plan"s randomly. I have not yet found a pattern as to when they will show up and when they won't. Here is a config example:

resource "consul_keys" "api" {
    #datacenter = "awse"
    token = "${var.consul_token}"

    # host url
    key {
      name = "${var.name} host"
      path = "service/app/${var.name}/${var.env}"
      value = "${aws_route53_record.api_base.name}"
    }
}

This results in the following plan, but nothing has changed:

~ module.api_prod.consul_keys.api
    key.1143578597.default: "" => ""
    key.1143578597.delete:  "" => "0"
    key.1143578597.name:    "" => "api host"
    key.1143578597.path:    "" => "service/app/api/prod"
    key.1143578597.value:   "" => "api-prod.xxxx.com"
    key.4276726269.default: "" => ""
    key.4276726269.delete:  "0" => "0"
    key.4276726269.name:    "api host" => ""
    key.4276726269.path:    "service/app/api/prod" => ""

[phinze]

Hi @dansteen - thanks for the report.

consul_keys did see some changes in v0.6.13 -> #5210

Is this plan you cited shown once after upgrading or are you getting repeated diffs?

[dansteen]

It happens repeatedly, but it's not always the same keys. Rather, I should say, that for each "apply" I do it's the same keys, but from one "apply" to the next, the keys that show up will be different. It's also not always all the keys defined in a single "consul_key" set. So, for example, if I have 5 keys set in a single consul_key set, it may show this for only one of them, or it may show this for all 5.

Thanks!

[dansteen]

Ok. So I figured out what is going on here. Basically, I had the following in a module:

resource "consul_keys" "api" {
  token = "${var.consul_token}"

  # host url
  key {
    name = "${var.name} host"
    path = "service/app/${var.name}/${var.env}"
    value = "${aws_route53_record.api_base.name}"
  }
}

and the following not in a module:

resource "consul_keys" "api-service" {
  token = "${var.consul_token}"

  # server url
  key {
    name = "api host"
    path = "service/app/api/prod"
    value = "${aws_route53_record.api_traitify_com.name}"
  }
}

What would happen is that it would alternately set the consul path "service/app/api/prod" to one value and then the next, so that values in consul would alternate with each run. Not sure this is a bug at all, but this was definitely an odd result.

[apparentlymart]

Hi @dansteen,

Having conflicting settings in different bits of Terraform will generally have weird, undefined behavior. I'm sorry that it was hard to see what was going on here... we could potentially explore a feature that allows providers to identify and warn about conflicts in different resources but that is not something Terraform is able to do today.

Sorry for the trouble, but I'm glad you were able to figure it out!

I'm going to close this out for now, since I don't think there's any Terraform change we could make in the short term that would've made the experience better here, though we might later get enough examples of this sort of problem to think about a new issue around detecting conflicts.

[dansteen]

not a problem. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.