Plan generated, apply failed

[jaymecd]

Tunnel on local port is not recreated if using plan/apply approach with dedicated plan file.

$ terraform plan -out=terraform.tfplan
...
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  + module.app_core_de.mysql_database.this
      id:                    <computed>
      default_character_set: "utf8"
      default_collation:     "utf8_general_ci"
      name:                  "stage_whatever"

  + module.app_core_de.mysql_grant.this
      id:                    <computed>
      database:              "stage_whatever"
      grant:                 "false"
      host:                  "%"
      privileges.#:          "1"
      privileges.2914988887: "ALL"
      user:                  "stage_whatever"

  + module.app_core_de.mysql_user.this
      id:                    <computed>
      host:                  "%"
      plaintext_password:    <sensitive>
      user:                  "stage_whatever"


Plan: 3 to add, 0 to change, 0 to destroy.

------------------------------------------------------------------------

This plan was saved to: terraform.tfplan

When you run apply, local port is already released.
Fails with static and ephemeral local ports binding.

$ terraform apply terraform.tfplan
...
Error: Error applying plan:

1 error(s) occurred:

* provider.mysql: dial tcp 127.0.0.1:49876: getsockopt: connection refused

Run time versions:

$ terraform version
Terraform v0.11.0
+ provider.aws v1.3.1
+ provider.mysql v1.0.0
+ provider.null v1.0.0
+ provider.random v1.0.0
+ provider.ssh (unversioned)
+ provider.template v1.0.0

[stefansundin]

Cool. I suspected this would be a problem. I'm sure it can be solved if I research the terraform code a bit. Thanks for reporting.

[stefansundin]

Okay, so I've been investigating this for a couple of hours, and there are no good solutions.

I tried using a resource that would always be re-created, so anything that depended on it would work, but this didn't work well with providers that need a tunnel in their configuration (such as consul).

Here are two other threads that I found:

• Saved plan fails to apply when datasource depends on resource hashicorp/terraform-provider-ignition#12
• provider/ignition: ignition_config should be a data source: invalid file <file-id>, unknown file id hashicorp/terraform#11518

It would be great if we could get some input from the terraform developers if they have any thoughts.

[stefansundin]

@jaymecd I have a workaround for this situation. I've made a separate binary that you can give a plan file, and it then opens all the tunnels expected. So if you generate a plan file and then want to apply it, you run this command first to open the tunnels for you. Then you apply the plan as usual.

I think it's a reasonable workaround, what do you think?

I'll try to clean it up and push it tonight.

[stefansundin]

Okay, the program is pushed now. See the new release and give it a try: https://github.com/stefansundin/terraform-provider-ssh/releases/tag/v0.0.2

[jaymecd]

@stefansundin 👍 I've worked around this problem by running native ssh tunnel with control socket and ttl before running terraform.