google_compute_region_instance_group_manager rolling_update instance_template resourceInUseByAnotherResource

[emalloy]

google_compute_region_instance_group_manager rolling_update instance_template resourceInUseByAnotherResource

TLDR; Maybe we need polling to wait after the instance_template gets updated in google_compute_region_instance_group_manager before attempting to destroy the former instance_template?

debug logs forthcoming, Need to scrub and encrypt. Will update.

Terraform Version

$ terraform -version
Terraform v0.11.7
+ provider.google v1.12.0
+ provider.template v1.0.0

Affected Resource(s)

• google_compute_region_instance_group_manager
• google_compute_instance_template

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

• instantiation of modules
  a lot of cruft redacted for simplicity

module "instance_template" {
  source = "<gitlab_repo_branch>/terraform-gcp-instance-template"

}

module "rmig" {
  source   = "<gitlab_repo_branch>/terraform-gcp-rmig"

  instance_template  = "${module.instance_template.instance_template}"
}

• instance_template module - outputs

output "instance_template" {
  value = "${google_compute_instance_template.instance_template.self_link}"

• instance_template module chunk (from module) (note the create_before_destroy )

// declare startup template
data "template_file" "init" {
  template = "${file("${path.module}/templates/init_template.sh")}"
  vars {
    env         = "${var.env}"
  }
}

// image declaration

data "google_compute_image" "image" {
  project = "${var.img_src_project}"
  name    = "${var.image_name}"
}

// instance template

resource "google_compute_instance_template" "instance_template" {
  tags   = "${concat("${var.app_tags}","${var.extra_tags}")}"
  labels = "${merge("${var.app_labels}","${var.extra_labels}")}"

  machine_type   = "${var.machine_type}"
  can_ip_forward = false

  scheduling {
    automatic_restart   = false
    on_host_maintenance = "TERMINATE"
  }

  lifecycle {
    create_before_destroy = true
    prevent_destroy = false
  }

  // Create a new boot disk from an image
  disk {
    source_image = "${data.google_compute_image.image.self_link}"
    disk_size_gb = "${var.root_volume_size}"
    auto_delete  = true
    boot         = true
  }

  network_interface = ["${var.network_interface}"]

  metadata_startup_script = "${file("${path.module}/files/init.sh")}"

  metadata {
    enable-oslogin = "${var.os_login}"
    _f_template    = "${element(data.template_file.init.*.rendered, count.index)}"

    _f_env     = "${var.env_file}"
    _f_scripts = "${join("\n\n","${var.scripts}")}"

  }

  service_account {
    email  = "${element(var.service_account["email"],0)}"
    scopes = "${var.service_account["scopes"]}"
  }
}

• google_compute_region_instance_group_manager chunk (from module)

resource "google_compute_region_instance_group_manager" "rmig" {
  name = "${var.name_prefix}-mig"


// outfrom from instance_template module
  instance_template  = "${var.instance_template}"

  target_size = "${var.num_instances}"

  update_strategy = "ROLLING_UPDATE"

  rolling_update_policy {
    type                  = "PROACTIVE"
    minimal_action        = "REPLACE"
    max_surge_fixed       = "${var.rolling_update_policy_surge_fixed}"
    max_unavailable_fixed = "${var.rolling_update_policy_unavailable_fixed}"
    min_ready_sec         = "${var.rolling_update_policy_min_ready_sec}"
  }

    auto_healing_policies {
      health_check      = "${var.health_check}"
      initial_delay_sec = "${var.auto_heal_init_delay}"
    }
  }

Debug Output

TBD - debug logs forthcoming, Need to scrub and encrypt. Will update.

Panic Output

No panic

Expected Behavior

On making an update that would trigger creation of a new instance_template, expectation is that

a) new instance_template is created,
b) google_compute_region_instance_group_manager now points at new instance_templates and
c) former instance template is destroyed.

Actual Behavior

What actually happened?

Perform an action that triggers the creation of a new instance_template,
a) new instance_template gets created,
b) region_instance_group_manager gets updated with new template , and
c) old template delete gets sent, but does not occur in first run.

terraform apply errors out with:

* module.instance_template.google_compute_instance_template.instance_template (destroy): 1 error(s) occurred:

* google_compute_instance_template.instance_template (deposed #0): 1 error(s) occurred:

* google_compute_instance_template.instance_template (deposed #0): Error deleting instance template: googleapi: Error 400: The instance_template resource 'projects/customer-unit-metadata-dev/global/instanceTempl
ates/terraform-20180508013337823400000001' is already being used by 'projects/customer-unit-metadata-dev/regions/us-west1/instanceGroupManagers/emalloy-internal-mig', resourceInUseByAnotherResource

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

On an already deployed instance_group_manager and instance_template

1. update some template value, such as image, or anything that could cause the instance_template to force a new resource (i.e. metadata, templates, instance_type, etc)
2. terraform plan
3. terraform apply

Important Factoids

We are passing the instance_template.self_link as an output from one self-contained module to another module (the regional_instance_group_manager)

References

[nat-henderson]

The debug logs will help with this one - lots of little details. :) Please do update when you've got those ready!

[emalloy]

Sorry for the delay on reply here - I'm closing due to lack of access to this particular scenario. I will give it another go another time, and if I can still replicate the issue, will post a new issue.

[nat-henderson]

Okay, thank you!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!