ibm_cr_namespace can return before namespace is fully ready

[shemau]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform IBM Provider Version

Affected Resource(s)

• ibm_cr_namespace

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "ibm_cr_namespace" "cr_namespace" {
  count             = var.existing_namespace_name != null ? 0 : 1
  name              = var.namespace_name
  resource_group_id = var.resource_group_id
  tags              = var.tags
}

resource "ibm_resource_tag" "resource_tag" {
  count       = var.existing_namespace_name != null || length(var.tags) == 0 ? 0 : 1
  resource_id = ibm_cr_namespace.cr_namespace[0].crn
  tags        = var.tags
  tag_type    = "user"
}

Debug Output

Panic Output

Expected Behavior

The expected behaviour is to create the tags on the namespace on both first and second runs.

Actual Behavior

The first apply works as expected.
Following a destroy and second apply the ibm_resource_tags fails with

Terraform apply |   with ibm_resource_tag.resource_tag[0],
Terraform apply |   on .terraform/modules/namespaces/main.tf line 20, in resource "ibm_resource_tag" "resource_tag":
Terraform apply |   20: resource "ibm_resource_tag" "resource_tag" {

Steps to Reproduce

1. terraform apply
2. terraform destroy
3. terraform apply

Important Factoids

Slack discussion reports:

the problem was that the resource crn:v1:bluemix:public:container-registry:xx-xx:a/<account id>::namespace:tst01 was in deleted state when the customer tried to set a tag.

References

• #0000

[ocofaigh]

I don't think this is a provider issue - @mkrudele Can you confirm? I got the impression the fix is a backend fix

[mkrudele]

I don't think this is a provider issue - @mkrudele Can you confirm? I got the impression the fix is a backend fix

The issue is in the Tagging service and it is due to the reuse of the same crn for the namespace (the resource-id segment is set to the name of the ns instead of using a guid, like for mostly of the IBM Cloud resources). When tagging the namespace after destroying and re-creating it, the tagging service may find the namespace in deleted state and refuse to tag. We are fixing it in the Tagging service. Meanwhile you may add a 4 seconds delay after creating the ns, which should be enough to advertise the Tagging service that the ns was re-created.

[ocofaigh]

@mkrudele Thanks for the response. We added a 10sec delay as a temp workaround and it worked. However perhaps we can use this provider issue to track improving the error message that is logged? I think you mentioned internally that there is an extra field for the error message in the api response but its not getting displayed by provider log?

[mkrudele]

Yes, let's track with this issue. In summary we will:

1. Improve the Tagging service to detect re-created namespaces;
2. Improve the ibm_resource_tag provider to add the error message to the items whose is_error is true.

[stefano-rm]

Done.
The change took some time because, in addition to modifying our code, it also involved modifying (and approving) the IBM Platform Service SDK, and modifying (and approving) terraform-provider-ibm.
Please check if the result is as expected now.
Thank you.