[Bug] OCI provided values overwritten by this module about terraform-oci-oke HOT 9 CLOSED

Are you using the whole thing as a terraform module?

from terraform-oci-oke.

Yep, is that not the aim of the repo?

It seems to me like the repo currently has a bit of an identity crisis - on the one hand there's a whole set of variables and outputs indicating that this is a TF module and on the other there's a pre-defined set of tfvars which indicates that it isn't.

This certainly addresses a huge gap in the OCI offering right now and ideally I'd like to work with you to adapt this module for production use rather than going off on my own and creating a dedicated module for the purpose.

If the repo isn't intended as that though I'd greatly appreciate knowing that so I can focus my efforts on writing a module from scratch and getting moving with onboarding to OCI.

from terraform-oci-oke.

Can you share how you are defining this as a module in your project?

from terraform-oci-oke.

Sure - the same as any other module:

module "oke" {
  source               = "github.com/oracle-terraform-modules/terraform-oci-oke"

  [ parameters here ]
}

from terraform-oci-oke.

Ok thanks. Let me make a test and get back to you.

from terraform-oci-oke.

I created a module like you did and passed the identity, ssh keys, label_prefix, and region as parameters. I also passed a couple of additional parameters to override the defaults:

 module "oke" {
  source               = "github.com/oracle-terraform-modules/terraform-oci-oke"
  api_fingerprint      = "${var.api_fingerprint}"
  api_private_key_path = "${var.api_private_key_path}"
  compartment_name     = "${var.compartment_name}"
  compartment_ocid     = "${var.compartment_ocid}"
  tenancy_ocid         = "${var.tenancy_ocid}"
  user_ocid            = "${var.user_ocid}"
  ssh_private_key_path = "${var.ssh_private_key_path}"
  ssh_public_key_path  = "${var.ssh_public_key_path}"

  # general
  label_prefix = "test"
  region       = "${var.region}"

  # networking
  vcn_name ="test_module_vcn"

  # oke
  cluster_name ="testoke"
}

In my root, I also created a provider:

provider "oci" {
  tenancy_ocid         = "${var.tenancy_ocid}"
  user_ocid            = "${var.user_ocid}"
  fingerprint          = "${var.api_fingerprint}"
  private_key_path     = "${var.api_private_key_path}"
  region               = "${var.region}"
  disable_auto_retries = true
}

It works fine. The VCN name and cluster names are overriden as I expected.

from terraform-oci-oke.

The intention is definitely to have it as a reusable TF module upon which you can build additional stuff (see https://github.com/oracle-terraform-modules/terraform-oci-oke/tree/master/modules/addons for example) and help with your OKE deployment. We are also hoping to publish it to Hashicorp's registry in the near future. There's a bit of internal discussions going on as well and I want to ensure that it will be of a good quality before taking this next step. In the meantime, you can point to the github repo like you did to build on top of it.

As this is a very young project, we want to build a community of contributors, like yourself, around it. The purpose of the predefined tfvars.example is for those who are taking this for a first spin, provide a basic and working set of parameters that they can use to create a cluster so they don't need to build their variable file from scratch. If we make their first experience with this project pleasant and easy, hopefully we will have more contributors.

Your ideas and contributions are interesting and very much welcome.

from terraform-oci-oke.

Let me be clear on the

I created a module like you did and passed the identity, ssh keys, label_prefix, and region as parameters. I also passed a couple of additional parameters to override the defaults:

 module "oke" {
  source               = "github.com/oracle-terraform-modules/terraform-oci-oke"
  api_fingerprint      = "${var.api_fingerprint}"
  api_private_key_path = "${var.api_private_key_path}"
  compartment_name     = "${var.compartment_name}"
  compartment_ocid     = "${var.compartment_ocid}"
  tenancy_ocid         = "${var.tenancy_ocid}"
  user_ocid            = "${var.user_ocid}"
  ssh_private_key_path = "${var.ssh_private_key_path}"
  ssh_public_key_path  = "${var.ssh_public_key_path}"

  # general
  label_prefix = "test"
  region       = "${var.region}"

  # networking
  vcn_name ="test_module_vcn"

  # oke
  cluster_name ="testoke"
}

In my root, I also created a provider:

provider "oci" {
  tenancy_ocid         = "${var.tenancy_ocid}"
  user_ocid            = "${var.user_ocid}"
  fingerprint          = "${var.api_fingerprint}"
  private_key_path     = "${var.api_private_key_path}"
  region               = "${var.region}"
  disable_auto_retries = true
}

It works fine. The VCN name and cluster names are overriden as I expected.

Perhaps I didn't explain the issue very well - what I mean is that you should not have to specify the same parameters to both the module and the provider. So this should work:

provider "oci" {
  tenancy_ocid         = "${var.tenancy_ocid}"
  user_ocid            = "${var.user_ocid}"
  fingerprint          = "${var.api_fingerprint}"
  private_key_path     = "${var.api_private_key_path}"
  region               = "${var.region}"
  disable_auto_retries = true
}

module "oke" {
  source               = "github.com/oracle-terraform-modules/terraform-oci-oke"
  compartment_name     = "${var.compartment_name}"
  compartment_ocid     = "${var.compartment_ocid}"
  ssh_private_key_path = "${var.ssh_private_key_path}"
  ssh_public_key_path  = "${var.ssh_public_key_path}"

  # general
  label_prefix = "test"

  # networking
  vcn_name = "test_module_vcn"

  # oke
  cluster_name = "testoke"
}

Yet it doesn't because the module isn't reading those values from the provider but instead requires them a second time even if they're defined already in the provider.

As a side note - my thoughts on this are that you should probably use the same variable names as the provider (i.e. fingerprint instead of api_fingerprint) since the difference in naming just adds further confusion.

from terraform-oci-oke.

Ok I understand now.

The reason why you need to pass to the module as well is because of the auth submodule: https://github.com/oracle-terraform-modules/terraform-oci-oke/tree/master/modules/auth

This module optionally creates an auth token for the user on oci. The auth token is later used to create a secret in OKE, which can then be used as imagePullSecrets to pull images from OCIR.

Identity operations can only be done with a provider initialized with the tenancy's "home region" whereas the other resources can be different from the home region. So, this means I need to initialize a new provider for home and it requires the other parameters.

from terraform-oci-oke.