mirror of
https://github.com/opentofu/opentofu.git
synced 2025-01-03 20:57:09 -06:00
37b1413ab3
Previously we had a significant discrepancy between these two situations: we wrote the raw root module variables directly into the EvalContext and then applied type conversions only at expression evaluation time, while for child modules we converted and validated the values while visiting the variable graph node and wrote only the _final_ value into the EvalContext. This confusion seems to have been the root cause for #29899, where validation rules for root module variables were being applied at the wrong point in the process, prior to type conversion. To fix that bug and also make similar mistakes less likely in the future, I've made the root module variable handling more like the child module variable handling in the following ways: - The "raw value" (exactly as given by the user) lives only in the graph node representing the variable, which mirrors how the _expression_ for a child module variable lives in its graph node. This means that the flow for the two is the same except that there's no expression evaluation step for root module variables, because they arrive as constant values from the caller. - The set of variable values in the EvalContext is always only "final" values, after type conversion is complete. That in turn means we no longer need to do "just in time" conversion in evaluationStateData.GetInputVariable, and can just return the value exactly as stored, which is consistent with how we handle all other references between objects. This diff is noisier than I'd like because of how much it takes to wire a new argument (the raw variable values) through to the plan graph builder, but those changes are pretty mechanical and the interesting logic lives inside the plan graph builder itself, in NodeRootVariable, and the shared helper functions in eval_variable.go. While here I also took the opportunity to fix a historical API wart in EvalContext, where SetModuleCallArguments was built to take a set of variable values all at once but our current caller always calls with only one at a time. That is now just SetModuleCallArgument singular, to match with the new SetRootModuleArgument to deal with root module variables.
173 lines
5.6 KiB
Go
173 lines
5.6 KiB
Go
package terraform
|
|
|
|
import (
|
|
"github.com/hashicorp/terraform/internal/addrs"
|
|
"github.com/hashicorp/terraform/internal/configs"
|
|
"github.com/hashicorp/terraform/internal/dag"
|
|
"github.com/hashicorp/terraform/internal/plans"
|
|
"github.com/hashicorp/terraform/internal/states"
|
|
"github.com/hashicorp/terraform/internal/tfdiags"
|
|
)
|
|
|
|
// ApplyGraphBuilder implements GraphBuilder and is responsible for building
|
|
// a graph for applying a Terraform diff.
|
|
//
|
|
// Because the graph is built from the diff (vs. the config or state),
|
|
// this helps ensure that the apply-time graph doesn't modify any resources
|
|
// that aren't explicitly in the diff. There are other scenarios where the
|
|
// diff can be deviated, so this is just one layer of protection.
|
|
type ApplyGraphBuilder struct {
|
|
// Config is the configuration tree that the diff was built from.
|
|
Config *configs.Config
|
|
|
|
// Changes describes the changes that we need apply.
|
|
Changes *plans.Changes
|
|
|
|
// State is the current state
|
|
State *states.State
|
|
|
|
// RootVariableValues are the root module input variables captured as
|
|
// part of the plan object, which we must reproduce in the apply step
|
|
// to get a consistent result.
|
|
RootVariableValues InputValues
|
|
|
|
// Plugins is a library of the plug-in components (providers and
|
|
// provisioners) available for use.
|
|
Plugins *contextPlugins
|
|
|
|
// Targets are resources to target. This is only required to make sure
|
|
// unnecessary outputs aren't included in the apply graph. The plan
|
|
// builder successfully handles targeting resources. In the future,
|
|
// outputs should go into the diff so that this is unnecessary.
|
|
Targets []addrs.Targetable
|
|
|
|
// ForceReplace are the resource instance addresses that the user
|
|
// requested to force replacement for when creating the plan, if any.
|
|
// The apply step refers to these as part of verifying that the planned
|
|
// actions remain consistent between plan and apply.
|
|
ForceReplace []addrs.AbsResourceInstance
|
|
|
|
// Validate will do structural validation of the graph.
|
|
Validate bool
|
|
}
|
|
|
|
// See GraphBuilder
|
|
func (b *ApplyGraphBuilder) Build(path addrs.ModuleInstance) (*Graph, tfdiags.Diagnostics) {
|
|
return (&BasicGraphBuilder{
|
|
Steps: b.Steps(),
|
|
Validate: b.Validate,
|
|
Name: "ApplyGraphBuilder",
|
|
}).Build(path)
|
|
}
|
|
|
|
// See GraphBuilder
|
|
func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
|
|
// Custom factory for creating providers.
|
|
concreteProvider := func(a *NodeAbstractProvider) dag.Vertex {
|
|
return &NodeApplyableProvider{
|
|
NodeAbstractProvider: a,
|
|
}
|
|
}
|
|
|
|
concreteResource := func(a *NodeAbstractResource) dag.Vertex {
|
|
return &nodeExpandApplyableResource{
|
|
NodeAbstractResource: a,
|
|
}
|
|
}
|
|
|
|
concreteResourceInstance := func(a *NodeAbstractResourceInstance) dag.Vertex {
|
|
return &NodeApplyableResourceInstance{
|
|
NodeAbstractResourceInstance: a,
|
|
forceReplace: b.ForceReplace,
|
|
}
|
|
}
|
|
|
|
steps := []GraphTransformer{
|
|
// Creates all the resources represented in the config. During apply,
|
|
// we use this just to ensure that the whole-resource metadata is
|
|
// updated to reflect things such as whether the count argument is
|
|
// set in config, or which provider configuration manages each resource.
|
|
&ConfigTransformer{
|
|
Concrete: concreteResource,
|
|
Config: b.Config,
|
|
},
|
|
|
|
// Add dynamic values
|
|
&RootVariableTransformer{Config: b.Config, RawValues: b.RootVariableValues},
|
|
&ModuleVariableTransformer{Config: b.Config},
|
|
&LocalTransformer{Config: b.Config},
|
|
&OutputTransformer{Config: b.Config, Changes: b.Changes},
|
|
|
|
// Creates all the resource instances represented in the diff, along
|
|
// with dependency edges against the whole-resource nodes added by
|
|
// ConfigTransformer above.
|
|
&DiffTransformer{
|
|
Concrete: concreteResourceInstance,
|
|
State: b.State,
|
|
Changes: b.Changes,
|
|
},
|
|
|
|
// Attach the state
|
|
&AttachStateTransformer{State: b.State},
|
|
|
|
// Create orphan output nodes
|
|
&OrphanOutputTransformer{Config: b.Config, State: b.State},
|
|
|
|
// Attach the configuration to any resources
|
|
&AttachResourceConfigTransformer{Config: b.Config},
|
|
|
|
// add providers
|
|
transformProviders(concreteProvider, b.Config),
|
|
|
|
// Remove modules no longer present in the config
|
|
&RemovedModuleTransformer{Config: b.Config, State: b.State},
|
|
|
|
// Must attach schemas before ReferenceTransformer so that we can
|
|
// analyze the configuration to find references.
|
|
&AttachSchemaTransformer{Plugins: b.Plugins, Config: b.Config},
|
|
|
|
// Create expansion nodes for all of the module calls. This must
|
|
// come after all other transformers that create nodes representing
|
|
// objects that can belong to modules.
|
|
&ModuleExpansionTransformer{Config: b.Config},
|
|
|
|
// Connect references so ordering is correct
|
|
&ReferenceTransformer{},
|
|
&AttachDependenciesTransformer{},
|
|
|
|
// Detect when create_before_destroy must be forced on for a particular
|
|
// node due to dependency edges, to avoid graph cycles during apply.
|
|
&ForcedCBDTransformer{},
|
|
|
|
// Destruction ordering
|
|
&DestroyEdgeTransformer{
|
|
Config: b.Config,
|
|
State: b.State,
|
|
},
|
|
&CBDEdgeTransformer{
|
|
Config: b.Config,
|
|
State: b.State,
|
|
},
|
|
|
|
// We need to remove configuration nodes that are not used at all, as
|
|
// they may not be able to evaluate, especially during destroy.
|
|
// These include variables, locals, and instance expanders.
|
|
&pruneUnusedNodesTransformer{},
|
|
|
|
// Target
|
|
&TargetsTransformer{Targets: b.Targets},
|
|
|
|
// Close opened plugin connections
|
|
&CloseProviderTransformer{},
|
|
|
|
// close the root module
|
|
&CloseRootModuleTransformer{},
|
|
|
|
// Perform the transitive reduction to make our graph a bit
|
|
// more understandable if possible (it usually is possible).
|
|
&TransitiveReductionTransformer{},
|
|
}
|
|
|
|
return steps
|
|
}
|