Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mysql_grant resource with ALL_PRIVILEGES cannot be destroyed #120

Closed
otherchen opened this issue Mar 8, 2024 · 3 comments · Fixed by #121
Closed

mysql_grant resource with ALL_PRIVILEGES cannot be destroyed #120

otherchen opened this issue Mar 8, 2024 · 3 comments · Fixed by #121

Comments

@otherchen
Copy link

Hi there,

Thank you for opening an issue. Please note that we try to keep the Terraform issue tracker reserved for bug reports and feature requests. For general usage questions, please see: https://www.terraform.io/community.html.

Terraform Version

Run terraform -v to show the version. If you are not running the latest version of Terraform, please upgrade because your issue may have already been fixed.

Affected Resource(s)

Please list the resources as a list, for example:

  • mysql_grant

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

resource "mysql_grant" "user_grant" {
  user       = mysql_user.some_user.user
  host       = "%"
  database   = "some_database"
  grant      = true
  privileges = ["ALL PRIVILEGES"]
}

Debug Output

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ON `recurring_deletion_production`.* FROM 'jenkins'@'%'' at line 1

Panic Output

If Terraform produced a panic, please provide a link to a GitHub Gist containing the output of the crash.log.

Expected Behavior

What should have happened?

We should have been able to delete the mysql_grant with ALL_PRIVILEGES set.

Actual Behavior

What actually happened?

We are unable to delete the mysql_grant with ALL_PRIVILEGES and get the error pasted above.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

  1. terraform apply

Important Factoids

Are there anything atypical about your accounts that we should know? For example: Running in EC2 Classic? Custom version of OpenStack? Tight ACLs?

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

  • GH-1234
@DerekTBrown
Copy link

DerekTBrown commented Mar 9, 2024

Repro

I am able to reproduce this error. I believe it has to do with the combination of ALL PRIVILEGES + GRANT OPTION:

Ordinarily, it is valid syntax to REVOKE <PRIVILEGE>, GRANT OPTION. For instance:

Screenshot 2024-03-08 at 5 18 11 PM

This is not the case with REVOKE ALL, GRANT OPTION. For instance:

Screenshot 2024-03-08 at 5 19 01 PM

Bug

The current resource_grant implementation doesn't take this edge case into consideration, it blindly applies GRANT OPTION:

https://github.com/petoju/terraform-provider-mysql/blob/master/mysql/resource_grant.go#L181

This is also not covered by existing test cases. There are test cases for ALL PRIVILEGES and for GRANT OPTION, but none for the intersection of the two features.

Fix

I have a PR which adds test cases for this edge case, as well as fixes the cause of the bug:

#121

@petoju
Copy link
Owner

petoju commented Mar 11, 2024

Thanks for the fix - I'm working on releasing this. However, my signing cert is stored on HW token and I found out new kernel doesn't recognize it correctly. I'll do my best to resolve this ASAP.

@petoju petoju reopened this Mar 11, 2024
@petoju
Copy link
Owner

petoju commented Mar 11, 2024

This was released in 3.0.49.

(It turned out the new kernel doesn't work well with pcscd, restarting it helped at least temporarily)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants