Terraform Version > 1.4.4?

[fbadso]

Is Terraform > 1.4.4 supported for release 29.0.0?
Using Terraform 1.7.1 or higher, in 0-bootstrap everything worked fine until I enable CICD with Cloudbuild.

As soon as I add CICD with Cloudbuild I get:

Error: Invalid function argument
│
│   on cicd.tf line 85, in module "automation-tf-cicd-repo":
│   83:     "roles/source.reader" = concat(
│   84:       [module.automation-tf-cicd-sa[each.key].iam_email],
│   85:       each.key == "bootstrap"
│   86:       ? module.automation-tf-bootstrap-r-sa.iam_email
│   87:       : module.automation-tf-resman-r-sa.iam_email
│   88:     )
│     ├────────────────
│     │ while calling concat(seqs...)
│     │ each.key is "bootstrap"
│     │ module.automation-tf-bootstrap-r-sa.iam_email is "serviceAccount:someprefix-prod-bootstrap-0r@someprefix-prod-iac-core-0.iam.gserviceaccount.com"
│     │ module.automation-tf-resman-r-sa.iam_email is "serviceAccount:someprefix-prod-resman-0r@someprefix-prod-iac-core-0.iam.gserviceaccount.com"
│
│ Invalid value for "seqs" parameter: all arguments must be lists or tuples; got string.
╵
╷
│ Error: Invalid function argument
│
│   on outputs.tf line 22, in locals:
│   21:     for k, v in local.cicd_repositories : k => templatefile(
│   22:       "${path.module}/templates/workflow-${v.type}.yaml", {
│   23:         # If users give a list of custom audiences we set by default the first element.
│   24:         # If no audiences are given, we set
https://iam.googleapis.com/{PROVIDER_NAME}
│   25:         audiences = try(
│   26:           local.cicd_providers[v["identity_provider"]].audiences, ""
│   27:         )
│   28:         identity_provider = try(
│   29:           local.cicd_providers[v["identity_provider"]].name, ""
│   30:         )
│   31:         outputs_bucket = module.automation-tf-output-gcs.name
│   32:         service_accounts = {
│   33:           apply = try(module.automation-tf-cicd-sa[k].email, "")
│   34:           plan  = try(module.automation-tf-cicd-r-sa[k].email, "")
│   35:         }
│   36:         stage_name = k
│   37:         tf_providers_files = {
│   38:           apply = local.cicd_workflow_providers[k]
│   39:           plan  = local.cicd_workflow_providers["${k}_r"]
│   40:         }
│   41:         tf_var_files = local.cicd_workflow_var_files[k]
│   42:       }
│   43:     )
│     ├────────────────
│     │ local.cicd_providers is object with no attributes
│     │ local.cicd_workflow_providers is object with 4 attributes
│     │ local.cicd_workflow_var_files is object with 2 attributes
│     │ module.automation-tf-cicd-r-sa is object with 1 attribute "bootstrap"
│     │ module.automation-tf-cicd-sa is object with 1 attribute "bootstrap"
│     │ module.automation-tf-output-gcs.name is "someprefix-prod-iac-core-outputs-0"
│     │ v["identity_provider"] is "google-beta"
│
│ Invalid value for "vars" parameter: vars map does not contain key "tf_providers_file", referenced at ./templates/workflow-sourcerepo.yaml:96,25-42.

terraform.tfvars:

billing_account = {
  id = "somebillingid"
}
 
# locations for GCS, BigQuery, and logging buckets created here
locations = {
  bq      = "EU"
  gcs     = "EU"
  logging = "eu"
  #pubsub = [ ]
  pubsub  = [ "europe-west3", "europe-west10" ]
}
 
# use `gcloud organizations list`
organization = {
  domain      = "somedomain"
  id          = someid
  customer_id = "somecustomerid"
}
 
outputs_location = "~/fast-config"
 
# use something unique and no longer than 9 characters (real prefix is just 2 chars long)
prefix = "someprefix"
 
fast_features = {
  data_platform   = false
  gke             = true
  project_factory = true
  sandbox         = true
  teams           = true
}
 
cicd_repositories = {
 bootstrap = {
   branch            = "master"
   name              = "fast-bootstrap"
   identity_provider = "google-beta"
   type              = "sourcerepo"
 }
#  resman = {
#    branch            = "master"
#    name              = "fast-resman"
#    identity_provider = "google-beta"
#    type              = "sourcerepo"
#  }
}

[juliocc]

The first part looks like a error on our side. Can you replace lines 77-89 in cicd.tf with the following and try again?

  iam = {
    "roles/source.admin" = [
      each.key == "bootstrap"
      ? module.automation-tf-bootstrap-sa.iam_email
      : module.automation-tf-resman-sa.iam_email
    ]
    "roles/source.reader" = concat(
      [module.automation-tf-cicd-sa[each.key].iam_email],
      each.key == "bootstrap"
      ? [module.automation-tf-bootstrap-r-sa.iam_email]
      : [module.automation-tf-resman-r-sa.iam_email]
    )
  }

I think the second error is because we didn't update the sourcerepo template with the new plan-only service accounts. Give us some time to submit a fix

[juliocc]

Can you try #2019 and confirm if it fixes your issue?

[fbadso]

Thank you for your quick reply. Unfortunately it didn't fix the issue.
I did the following:
Checked out #2019 , copied my 0-bootstrap-providers.tf and terraform.tfvars and run a plan and got:

Error: Invalid function argument
│
│ on cicd.tf line 85, in module "automation-tf-cicd-repo":
│ 83: "roles/source.reader" = concat(
│ 84: [module.automation-tf-cicd-sa[each.key].iam_email],
│ 85: each.key == "bootstrap"
│ 86: ? module.automation-tf-bootstrap-r-sa.iam_email
│ 87: : module.automation-tf-resman-r-sa.iam_email
│ 88: )
│ ├────────────────
│ │ while calling concat(seqs...)
│ │ each.key is "bootstrap"
│ │ module.automation-tf-bootstrap-r-sa.iam_email is "serviceAccount:wlc-prod-bootstrap-0r@wlc-prod-iac-core-0.iam.gserviceaccount.com"
│ │ module.automation-tf-resman-r-sa.iam_email is "serviceAccount:[email protected]"
│
│ Invalid value for "seqs" parameter: all arguments must be lists or tuples; got string.
╵
╷
│ Error: Invalid function argument
│
│ on outputs.tf line 22, in locals:
│ 21: for k, v in local.cicd_repositories : k => templatefile(
│ 22: "${path.module}/templates/workflow-${v.type}.yaml", {
│ 23: # If users give a list of custom audiences we set by default the first element.
│ 24: # If no audiences are given, we set https://iam.googleapis.com/{PROVIDER_NAME}
│ 25: audiences = try(
│ 26: local.cicd_providers[v["identity_provider"]].audiences, ""
│ 27: )
│ 28: identity_provider = try(
│ 29: local.cicd_providers[v["identity_provider"]].name, ""
│ 30: )
│ 31: outputs_bucket = module.automation-tf-output-gcs.name
│ 32: service_accounts = {
│ 33: apply = try(module.automation-tf-cicd-sa[k].email, "")
│ 34: plan = try(module.automation-tf-cicd-r-sa[k].email, "")
│ 35: }
│ 36: stage_name = k
│ 37: tf_providers_files = {
│ 38: apply = local.cicd_workflow_providers[k]
│ 39: plan = local.cicd_workflow_providers["${k}_r"]
│ 40: }
│ 41: tf_var_files = local.cicd_workflow_var_files[k]
│ 42: }
│ 43: )
│ ├────────────────
│ │ local.cicd_providers is object with no attributes
│ │ local.cicd_workflow_providers is object with 4 attributes
│ │ local.cicd_workflow_var_files is object with 2 attributes
│ │ module.automation-tf-cicd-r-sa is object with 1 attribute "bootstrap"
│ │ module.automation-tf-cicd-sa is object with 1 attribute "bootstrap"
│ │ module.automation-tf-output-gcs.name is "wlc-prod-iac-core-outputs-0"
│ │ v["identity_provider"] is "google-beta"
│
│ Invalid value for "vars" parameter: vars map does not contain key "tf_providers_file", referenced at ./templates/workflow-sourcerepo.yaml:96,25-42.

After replacing 77-89 in cicd.tf with

iam = {
"roles/source.admin" = [
each.key == "bootstrap"
? module.automation-tf-bootstrap-sa.iam_email
: module.automation-tf-resman-sa.iam_email
]
"roles/source.reader" = concat(
[module.automation-tf-cicd-sa[each.key].iam_email],
each.key == "bootstrap"
? [module.automation-tf-bootstrap-r-sa.iam_email]
: [module.automation-tf-resman-r-sa.iam_email]
)
}

gave me:

❯ terraform plan
╷
│ Error: Invalid value for input variable
│
│ on cicd.tf line 77, in module "automation-tf-cicd-repo":
│ 77: iam = {
│ 78: "roles/source.admin" = [
│ 79: each.key == "bootstrap" ? [module.automation-tf-bootstrap-sa.iam_email]
│ 80: : [module.automation-tf-resman-sa.iam_email]
│ 81: ]
│ 82: "roles/source.reader" = concat(
│ 83: [module.automation-tf-cicd-sa[each.key].iam_email],
│ 84: each.key == "bootstrap" ? [module.automation-tf-bootstrap-r-sa.iam_email]
│ 85: : [module.automation-tf-resman-r-sa.iam_email]
│ 86: )
│ 87: }
│
│ The given value is not suitable for module.automation-tf-cicd-repo.var.iam declared at ../../../modules/source-repository/variables.tf:24,1-15: element "roles/source.admin": element 0: string required.
╵

[juliocc]

You don't have to replace anything if you're running the code from the branch.

Are you sure you checked out #2019? You shouldn't be seeing this code anymore:

│   on cicd.tf line 85, in module "automation-tf-cicd-repo":
│   83:     "roles/source.reader" = concat(
│   84:       [module.automation-tf-cicd-sa[each.key].iam_email],
│   85:       each.key == "bootstrap"
│   86:       ? module.automation-tf-bootstrap-r-sa.iam_email
│   87:       : module.automation-tf-resman-r-sa.iam_email
│   88:     )

I just pushed another fix to a template I missed. I don't think you're using it but still.

Can you pull the PR, ensure you have the right code, and try one more time?

Thanks

[fbadso]

I apologyze - my bad.
Thank you so much, #2019 fixed the issue 👍