Comments (6)
The problem is that TF has no way to know that your second resource depends on the first. One option would be to reference the mount's path in defining the secret's path definition. For example,
path = "${vault_mount.team5_k8s_apiserver.path}/root/generate/internal"
By doing so you tell Terraform that the second resource requires the first, and they should be done serially.
Alternatively you could use depends_on
to specify the relationship w/o using interpolation in the path. Personally, I'd prefer the interpolation route. Doing so allows you to change it in one location, should you want to, rather than tracking them down. Ultimately either way you're letting Terraform know that resource B needs resource A and that is the critical information it needs to make the decision.
from terraform-provider-vault.
Thanks for filing this! I just bumped into it myself. @therealbill your answer is spot-on - I'm applying the dependency-ordering-via-interpolation workaround to my config right now.
It still would be nice if Terraform could sort out these implicit dependencies between certain kinds of resources. I believe that would require a new core <-> provider API. It's definitely worth considering. I'll chat with the TF core folks about it at some point. 💭 👍
from terraform-provider-vault.
@andrejvanderzee @phinze https://www.terraform.io/intro/getting-started/dependencies.html#implicit-and-explicit-dependencies
from terraform-provider-vault.
Ah thanks @syndbg I had forgotten we call dependencies created via interpolation "implicit dependencies". I guess the potential feature I was referring to was more like "automatic dependencies" whereby Terraform would recognize that resources of a certain type need to always follow resources of another type given certain matching attributes. Just me musing on potential core functionality. 😄
In the meantime - using interpolation to draw "implicit dependencies" is the way to go!
from terraform-provider-vault.
Yep, it would be easier for use, but overall increase the complexity of the code greatly.
from terraform-provider-vault.
Terraform itself is responsible for managing the dependency graph. If one resource references an attribute of another, that resource will be created first e.g:
resource "vault_generic_secret" "team5_k8s_apiserver_ca" {
path = "${vault_mount.team5_k8s_apiserver.path}/root/generate/internal"
data_json = <<EOT
{
"common_name": "xxx.io"
}
EOT
}
Closing this out as it is not a provider issue.
from terraform-provider-vault.
Related Issues (20)
- [Bug]: Provider segfaults when certain backend conditions are met
- [Enhancement]: Provide a hashed value of data.vault_generic_secret.secret.data
- [Enhancement]: vault_azure_secret_backend_role support for EntraID Roles
- [Bug]: vault_jwt_auth_backend tune block always updates unless config matches Vault server defaults
- [Enhancement]: Allow setting num_uses and ttl for vault_approle_auth_backend_role_secret_id
- [Enhancement]: `signature_bits ` field missing on some resources
- [Enhancement]: Allow setting not_after for vault_pki_secret_backend_root_cert
- [Bug]: Error 404: Unsupported Path for IdentityOidcRole API Request when using email as name HOT 1
- [Bug]: Wrong creation of intermediate CA certificate with `max_path_length = 0`
- [Bug]: vault_nomad_secret_backend can't be initialized without token
- [Bug]: vault_jwt_auth_backend sends request to false API path HOT 2
- [Docs]: MFA type is not documented HOT 1
- [Enhancement]: Allow updating `vault_kv_secret_v2 metadata` with `disable_read=true`
- [Bug]: `add_address_to_env` does not affect `local-exec` provisioners
- [Enhancement]: data source for getting Vault server address
- [Bug]: vault_ssh_secret_backend_ca gets replaced after provider upgrade HOT 2
- [Docs]: Update docs to include 'address' Argument for TFC/E Secrets backend
- [Enhancement]: Add persist_app parameter to vault_azure_secret_backend_role resource
- [Bug]: Snapshot agent local_max_space 0 is not allowed
- [Bug]: resource vault_identity_oidc_provider doesn't support import
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-provider-vault.