HTTPS Target proxy / SSL certificate - allow for certificate deletion #3748
Comments
|
I just read this in the google_compute_target_https_proxy documentation: ssl_certificates - (Required) A list of SslCertificate resources that are used to authenticate connections between users and the load balancer. Currently, exactly one SSL certificate must be specified. So even though "ssl_certificates" is a list the last sentence states that I should never specify more than one certificate here. Since there is never supposed to be more than a single certificate the ability to delete one doesn't really make sense. (Although I suppose that theoretically someone may want to delete the sole certificate on their HTTPS load balancer.) The word "currently" seems to indicate that multiple certs will be supported at some point, at which time I would assume the ability to delete on via Terraform will be integrated. This ticket can probably be closed unless I am misunderstanding what the documentation is indicating. |
|
The documentation listed there is out of date, up to 15 are supported. Can you share a more full config (including variables), the error message you received, and the debug logs when you attempt to apply the change? Doing this succeeded when I attempted to reproduce the issue. |
|
I've since worked around this by separating out my certificate creation to another module (this makes more sense for my workflow anyways) so I don't have the original configuration to post. To help track this down, here is a simple configuration that allows me to reproduce the behaviour: When I remove "test2.key" and "test2.crt" from the local variables the plan shows: But the delete operation fails. Here is the debug output which includes the error text: |
|
This is happening because Terraform core is processing operations in an impossible order, and the provider has no control here / no means to mitigate this case. Unfortunately, Core has decided that the deletion of the cert needs to happen before updating the target proxy. I'm not sure why that's the case- maybe deletes are processed before updates? I'd suggest filing against https://github.com/hashicorp/terraform, linking to this issue so they don't just re-open it in the provider repo. |
|
Also, this is the same underlying problem as #1883 |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks! |
ghost
locked and limited conversation to collaborators
Community Note
Terraform Version
terraform - v0.12.0
terraform-provider-google - v2.7.0
Affected Resource(s)
google_compute_ssl_certificate
google_compute_target_https_proxy
Description
There are currently two certificates loaded on a GCP load balancer. I would like to delete one. Removing the cert from google_compute_ssl_compute creates a plan that shows it will delete that certificate and then update google_compute_target_https_proxy in place to not include the removed certificate. This fails because it attempts the destroy first, while the certificate is still in use by the proxy.
This behaviour was noted in issue # 216 but in that case using create_before_destroy was an acceptable workaround because the goal was to update a cert, not remove one.
Terraform Configuration Files
resource "google_compute_ssl_certificate" "web" {
count = length(var.path_to_private_key)
project = var.project
name_prefix = "${var.cust_id}-certificate"
private_key = file(var.path_to_private_key[count.index])
certificate = file(var.path_to_certificate[count.index])
lifecycle {
create_before_destroy = true
}
}
resource "google_compute_target_https_proxy" "web" {
project = var.project
name = "${var.environment}-${var.cust_id}-httpsweb-v${var.revision_number}"
url_map = google_compute_url_map.httpsweb.self_link
ssl_certificates = google_compute_ssl_certificate.web.*.self_link
}
Expected Behavior
Terraform should edit the proxy config to not include the cert it is removing and then remove the certificate.
Actual Behavior
The apply fails because Terraform attempts to remove the certificate while it is still in use by the proxy.
References
https://github.com/terraform-providers/terraform-provider-google/issues/216
The text was updated successfully, but these errors were encountered: