openstack allowed_address_pairs are overwritten by Terraform

[rptaylor]

Sometimes on Openstack you need to modify allowed address pairs (allowed_address_pairs in Terraform), e.g. for the network requirements of operating a load balancer or for some Calico overlay network modes.

For example it is documented here that you need to run some Openstack commands to do this in some cases.

However, since awhile ago (I believe it may have been this change: #8709) , doing Terraform apply erases any allowed address pairs that may have been configured outside of Terraform:

  # module.compute.openstack_networking_port_v2.k8s_nodes_port["p03"] will be updated in-place
  ~ resource "openstack_networking_port_v2" "k8s_nodes_port" {
        id                     = "3a2ce586-c711-4a9c-8937-66df66d14ae2"
        name                   = "cluster-dev-k8s-node-p03"
        tags                   = []
        # (14 unchanged attributes hidden)

      - allowed_address_pairs {
          - ip_address = "10.0.0.249" -> null
        }
      - allowed_address_pairs {
          - ip_address = "10.233.64.0/18" -> null
        }

        # (1 unchanged block hidden)
    }

In this case it would remove access for proxying traffic in kube_pods_subnet, breaking the cluster.

Currently there is nothing in kubespray that would modify allowed_address_pairs:

$ grep allowed_address_pairs -r .

so we need to allow users to modify this outside of Terraform, e.g. via openstack CLI as documented or other means (we use Ansible roles), without the risk of terraform apply undoing the required allowed address pair configuration.

Environment:

• Cloud provider or hardware configuration:
  Openstack
• OS (printf "$(uname -srm)\n$(cat /etc/os-release)\n"):
  Almalinux 8
• Version of Ansible (ansible --version):
  N/A

Kubespray version (commit) (git rev-parse --short HEAD):
aea150e

Network plugin used:
Calico