Let sub-account-users have full access to ALL tags #205
Comments
|
Re-running the above with |
|
Thanks for the comprehensive and detailed report! I tried to replicate this with Terraform 1.1.2 and upcloud provider at 2.1.3 locally, but things work fine on my computer. Seems like there's some fundamental problem here causing all of the commands to error 🤔 As you created the account yesterday, is your account still on the free trial? And are you using a subaccount to run Terraform? Snippets from my console below: |
|
My understanding is that there is no way to run any of this without creating a sub-account, because API access is not permitted to the main account. I did create a sub-account, and confirmed that the API works, and that the sub-account has both access to the API and access to all servers, all storage, all network. (Also note that the creation of the resources did succeed, it just failed to update terraform properly, so clearly the access is not the problem.) |
|
Cheers! The free trial has some interesting restrictions (for example limited amount of CPU cores and storage) so my suspicion is that it's causing the multitude of permission errors here. Just a guess though, could be something else as well, especially as I just created a new trial account and ran You can actually use the main account if you do not enable 2FA & enable the API access in the Hub via the Account-page (top right). But UpCloud recommends you to have 2FA enabled on the main account, so subaccount is the way to go for now 😊 *) |
|
Will try paying and see if the errors continue. |
|
Let me know how it goes! I've now tried a good number of different configurations that I could think of, but cannot replicate the errors unfortunately, even with a fresh trial account. I have a fear there is some small, hard-to-spot/hard-to-realize thing somewhere causing this. |
|
Took a while to become paid. Anyway, I'm still getting all the same errors. Here is my current configuration: terraform {
required_version = ">= 1.1.2"
required_providers {
upcloud = {
source = "UpCloudLtd/upcloud"
version = ">= 2.1.3"
}
}
}
provider "upcloud" {
username = var.upcloud_username
password = var.upcloud_password
}
resource "upcloud_storage" "something01" {
title = "something01"
zone = "us-chi1"
size = 25
tier = "maxiops"
}
resource "upcloud_server" "something01" {
title = "something01"
hostname = "something01"
zone = "us-chi1"
plan = "1xCPU-1GB"
metadata = true
firewall = false
template {
storage = "Ubuntu Server 20.04 LTS (Focal Fossa)"
size = 25
address = "virtio"
}
storage_devices {
type = "disk"
address = "virtio"
storage = upcloud_storage.something01.id
}
network_interface {
type = "public"
ip_address_family = "IPv4"
bootable = false
source_ip_filtering = true
}
network_interface {
type = "public"
ip_address_family = "IPv6"
bootable = false
source_ip_filtering = true
}
network_interface {
type = "utility"
ip_address_family = "IPv4"
bootable = false
source_ip_filtering = true
}
login {
create_password = false
keys = [var.ssh_key_public]
}
}Can you please post a full working complete and self-contained simple example of both a storage and server resource, based off of Ubuntu 20.04 (just one disk/storage please, not two), with both ipv4 and ipv6, please? Also, separately, how to create a storage clone of a public template (ie: Ubuntu 20.04)? I get |
|
Your current configuration looks completely fine. I just ran it using my test account and it works for me. Here is the full transcript from my console: Click to open transcriptA bit stumped by this now, I'll try to dig deeper. I'll check the cloning and get back to you on that 😄 |
|
It shouldn't matter, but I am running all this from inside WSL2 (Ubuntu Linux on Windows 10 Pro). |
This is intentional and working as intended: you cannot clone public templates as they have custom, special initialization logic (like networking stuff) that needs to be run by a server. You can create a server from the Ubuntu 20.04 template, shut it down immediately, clone that as a custom template and use your custom template 😊
Good idea. Worked ok for me without web control panel access… |
|
Ok, so if you can't clone a public template, can you please explain or show how to create, in terraform, a server resource that uses a single defined storage resource, and it starts up with Ubuntu 20.04? |
|
Are you using, or did you use ”tags”/”tag” at some point? They have some known problems |
|
Yes, I was adding tags on the server. I deleted that from my examples as it seemed unimportant, lol 💩 . resource "upcloud_server" "something01" {
// ... above stuff ...
tags = [
var.environment,
var.automation,
"gitlocation/something/upcloud/terraform",
]
}If that is truly the problem, then I think the answer is to give an option for sub-account-user access to "All" tags, just like you have for servers, storage, and networking. |
|
Ahh, yes, so the tags are causing the weird problems 😄 UpCloud uses tags primarily for access control, so using them as ”labels” can cause problems that seem irrelevant, hehe. I’d suggest not using tags for now. We are working on a fix for this but timetable is open. As to the cloning of Ubuntu, i’m afraid it doesn’t make sense to do that in terraform as the process doesn’t conform to the ”idea” of terraform. I’d suggest simply doing it via the Hub once:
|
|
Ok, I will ignore tags for now. Is cloning doesn't make sense, is there another way to accomplish what I wish, without having to manually do anything through the web console? I should be able to create a single server resource and a single attached storage resource, and start the server with Ubuntu 20.04, all within terraform. I am able to do this on all other cloud providers that I've tried so far. |
|
Actually I just remembered we have Packer! I'd suggest using Packer to create a custom Ubuntu 20.04 template in a more "Terraform-y" way, the template should be more stable than our public template & you can have libs/apps that you might need in the template: https://github.com/UpCloudLtd/packer-plugin-upcloud and https://upcloud.com/community/tutorials/upcloud-packer-builder/ Replying to the question about this in Terraform: if you provide the |
|
I'll look into packer, but I do think this would be a useful and simple feature to have. (People should be able to get up and running without having to look into using packer.) The feature request would be that there should be a way to have the template on a server resource create the storage as a specific storage resource in terraform, or alternatively, to have there be a way to base a storage resource on a template. Separately, I can keep this issue open until the problems with tags and sub-account-users are resolved. Edit: I have no interest in packer. I run everything in docker containers. I just want a basic stable image to boot with, provided by the cloud provider. |
|
Please do create a new issue for the template on a server 👍🙂 Makes things a bit easier to digest |
veqryn
changed the title
|
Hi, any progress/updates here? |
|
Hello! No new updates on allowing subaccounts to manage tags, as those are used to manage access to servers instead of labeling them. However, we have added labels to servers (and other resources) that can be used to label your resources also from sub-accounts. |
Using version 1.1.2 of terraform, and 2.1.3 of upcloud provider.
I created an account yesterday to try upcloud out.
I tried to create the following resource in terraform:
This resulted in the following error message:
I'm not sure why I got an error, as I do have permission and had previously created a similar server in the web console, before deleting it.
However, I saw in the upcloud web console that the server was created.
Running "terraform apply" a second time, showed that the resource was going to be replaced:
So I decided to delete it and start over:
Deleting gave the above error message, but it DID delete the server from the web console.
It did NOT delete the storage device that was previously attached to it though.
Anyway, I now decided to try refreshing so that I could retry the creation:
And now terraform is stuck, with no way to move on.
Yes, I can manually edit the terraform state file, but you really aren't supposed to do that, and this provider needs to be fixed to not get into a bad state like this, and be able to recover if it does.
So the bugs I encountered are:
upcloud_server.something01 is tainted, so must be replacedThe text was updated successfully, but these errors were encountered: