Provider uses Go's resolver rather than the OS's

[jbg]

Terraform Version

Terraform v1.2.6
on darwin_arm64
+ provider registry.terraform.io/cyrilgdn/postgresql v1.16.0

Affected Resource(s)

postgresql_*

Expected Behavior

The provider should use the OS's resolver, so that DNS behaves as the user expects.

Actual Behavior

The provider uses the primitive resolver built in to Go, causing it to behave differently than all other software running on the same system.

Steps to Reproduce

(This is one example, using one specific feature of the macOS resolver that Go doesn't implement, but the issue is a general one and affects all platforms in some way or another.)

1. echo "nameserver 1.2.3.4" > /etc/resolver/internal.example.com
2. configure the provider to connect to db.internal.example.com
3. observe that the provider tries to look up db.internal.example.com on the system default nameserver rather than on 1.2.3.4

Important Factoids

This issue affects more than just macOS. The Go resolver deviates from the system resolver behaviour in at least one way on all platforms. But to use macOS as an example, as shown above it is possible to set different resolvers for different domain name suffixes, for example in order to look up names for internal infrastructure via the DNS server on a VPN while sending public queries to the default resolver. This does not work with this provider because it doesn't use the system resolver. That's particularly problematic with this provider given how common it is to use private DNS zones for internal infrastructure like databases.

By using Go's built-in resolver, DNS resolution for the provider differs from all other software running on the same system, leading to confusing situations that cannot be solved easily.

Terraform core builds with CGO_ENABLED=1 on all platforms since 1.0.1 to avoid this issue, and most providers (all major ones) have also moved to building with CGo, so hopefully this should be easily fixed in this provider too.

[jakeschurch]

@jbg I experienced same issue with cloudflare warp and found a solution.

The cgo dns resolver has remained default for name resolution for go binaries on linux / macos systems. The cgo dns resolver uses getaddrinfo getaddrname for dns resolution. The newer go dns resolver which is not default, uses /etc/resolv.conf instead, and is what we bot h want.

so technically what you are experiencing is expected behavior 😅.

Anyone can get around this by setting GODEBUG var to netdns=go.

So when I run terragrunt or someone runs terraform, use GODEBUG=netdns=go terraform apply. This should resolve your issue and resolved mine 👍

[jakeschurch]

@cyrilgdn you may want to consider updating the README to highlight that this env var needs to be set if you want to use system resolver / VPN / /etc/resolv.conf for name resolution since some majority of the provider's users may not have this information.

happy to put in a docs PR if you'd like :+1 just lmk.

---

edit: I assume this would also close out #272