Crash when applying updates to AWS: Unary - is only allowed

[simonsparks]

Hi,

I was applying some updates to our AWS environment and experienced a terraform crash.
The changes included an modification to our controller.sh.tpl template which sets the user data script for our controller nodes. The change was to enable client certificate authentication on Fabio by writing a client certificate to a file then modifying the Fabio properties to use that file:

logger "Configuring Fabio client certificates"
FABIO_CONFIG=/etc/fabio.d/fabio.properties
FABIO_CLIENT_AUTH=/etc/fabio.d/clientauth.pem
sudo cat > $FABIO_CLIENT_AUTH <<EOF
${client_certs}
EOF
sudo sed -i -- "s/^proxy\.addr.*$/&;${FABIO_CLIENT_AUTH//\//\\\/}/g" $FABIO_CONFIG

The initial error refers to an unexpected EOF and a panic regarding unary - :

Error applying plan:

3 error(s) occurred:

* template_file.controller.0: unexpected EOF
* template_file.controller.1: unexpected EOF
* unexpected EOF
...
panic: Unary - is only allowed
...

Running terraform apply again didn't cause another crash but did report a similar error:

Error applying plan:

3 error(s) occurred:

* template_file.controller.1: unexpected EOF
* template_file.controller.2: unexpected EOF
* template_file.controller.0: unexpected EOF

After a bit of investigation, I found out that the actual problem was that I hadn't escaped an environment variable in the above script with a double $. Modifying the line as below resolved the error:

sudo sed -i -- "s/^proxy\.addr.*$/&;$${FABIO_CLIENT_AUTH//\//\\\/}/g" $FABIO_CONFIG

I thought I should report the crash anyway as another potential instance of the Unary - bug, issues referenced below.

Terraform Version

Terraform v0.6.15

Affected Resource(s)

Guessing:

• aws_instance
• template_file

Debug Output

https://gist.github.com/simonsparks/241af7ecbe7df678d3d6b01f9722964b

Panic Output

crash.log.zip

References

• Terraform Crashes with panic: Unary - is only allowed #6498
• panic: 'Unary - is only allowed' crash #6170

[jen20]

Hi @simonsparks! This looks like a parser bug to me. Could you post a snippet of the resource which is causing the issue so I can try to reproduce? Thanks!

[simonsparks]

Hi @jen20
Yes, the template_file resource and associated template module looked something like this:

module "controller_template" {
  source = "../../../templates/controller"
}

resource "template_file" "controller" {
  template = "${module.controller_template.user_data}"
  count    = "${var.servers}"

  vars {
    data_dir          = "/opt"
    provider          = "aws"
    region            = "${var.region}"
    datacenter        = "aws-${var.region}"
    bootstrap_expect  = "${var.servers}"
    zone              = "${element(split(",", var.zones), count.index % length(split(",", var.zones)))}"
    machine_type      = "${var.machine_type}"
    nomad_join_name   = "${var.nomad_join_name}"
    nomad_log_level   = "${var.nomad_log_level}"
    consul_log_level  = "${var.consul_log_level}"
    cert_subject      = "${var.controller_cert_subject}"
    client_certs      = "${var.client_certs}"
    local_ip_url      = "http://169.254.169.254/2014-02-25/meta-data/local-ipv4"
  }
}

The tf source file for the "controller_template" module looked like this:

output "user_data" { value = "${path.module}/controller.sh.tpl" }

And the problematic part of the script template looked like this:

logger "Configuring Fabio client certificates"
FABIO_CONFIG=/etc/fabio.d/fabio.properties
FABIO_CLIENT_AUTH=/etc/fabio.d/clientauth.pem
sudo cat > $FABIO_CLIENT_AUTH <<EOF
${client_certs}
EOF
sudo sed -i -- "s/^proxy\.addr.*$/&;${FABIO_CLIENT_AUTH//\//\\\/}/g" $FABIO_CONFIG

where the sed command at the bottom should have had a double $ to escape the bash variable in the template file:

sudo sed -i -- "s/^proxy\.addr.*$/&;$${FABIO_CLIENT_AUTH//\//\\\/}/g" $FABIO_CONFIG

[phinze]

Just verified that this is fixed on master with some of the recent HCL work. 👍

In order to achieve the $${ in your rendered template you'll need to escape both dollar signs: $$$${FABIO..., but there's no more crash or error!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.