Cannot import resources when provider has default tags #4030
Assignees
Labels
area/import
An issue related to `pulumi import` or the import resource option.
impact/regression
Something that used to work, but is now broken
impact/usability
Something that impacts users' ability to use the product easily and intuitively
kind/bug
Some behavior is incorrect or out of spec
p1
A bug severe enough to be the next item assigned to an engineer
resolution/fixed
This issue was fixed
size/S
Estimated effort to complete (1-2 days).
Milestone
Comments
piotr-bzdyl-vertexinc
added
kind/bug
|
Thanks for reaching out @piotr-bzdyl-vertexinc! I'm sorry you're running into those issues. I'm gonna have a look into this to see if I can find the cause or find a workaround. |
flostadler
added
area/import
piotr-bzdyl-vertexinc
changed the title
|
@piotr-bzdyl-vertexinc Sorry it seems like we're incorrectly handling the merge of default tags and regular tags during imports! As a workaround you can try adding an With that change the import works for me locally. Without it fails with a diff in tags because they wrongly include the default tags as well: |
|
That's strange as I did try the following workarounds before opening this issue (I'm sorry for not mentioning it earlier):
Also I double checked your suggestion with |
|
@piotr-bzdyl-vertexinc I see that you have the following provider config in your example: Can you try without the conditional default tags like so: |
|
As a possible workaround would |
Yes, manual |
pulumi-bot
added
needs-triage
|
@piotr-bzdyl-vertexinc did the updated example from above without the conditional default tags work? I'm not able to reproduce it this way in combination with |
flostadler
added
awaiting-feedback
@flostadler the whole point of the conditional in the repro case was to create a resource with a different set of tags (as if it was created e.g. by Terraform) and then try to import it to a program that uses a different set of tags in the default tags configuration. |
pulumi-bot
added
needs-triage
|
@piotr-bzdyl-vertexinc Got it! In that case both the I updated your code example to ignore changes to both Code exampleimport pulumi
import pulumi_aws
test_import = pulumi.Config().get_bool("test_import")
bucket_name = "defaulttags-import-issue-other"
provider = pulumi_aws.Provider(
"aws",
default_tags={
"tags": {
"Project": "x",
"Environment": "dev",
"CodeRepository": "infra",
}
} if test_import else None,
)
pulumi_aws.s3.BucketV2(
bucket_name,
bucket=bucket_name,
tags={
"Environment": "dev",
"CodeRepository": "legacy-infra",
"CreatedBy": "terraform",
},
opts=pulumi.ResourceOptions(
import_=bucket_name if test_import else None,
provider=provider,
retain_on_delete=True,
ignore_changes=["tags", "tagsAll"],
),
)And here's the according test logs: Test logsDoes this solve your issue? |
flostadler
added
awaiting-feedback
|
@flostadler Yes, indeed, adding both |
pulumi-bot
added
needs-triage
corymhall
added a commit
that referenced
this issue
Jul 3, 2024
We have special logic around applying default provider tags to resources. This logic only applied to the `Check` call which means it was not applied when you were importing resources. This PR extends that logic to also run during the `Read` call. fix #4030, fix 4080
corymhall
added a commit
that referenced
this issue
Jul 11, 2024
# This is the 1st commit message: Fix import resources with provider default tags We have special logic around applying default provider tags to resources. This logic only applied to the `Check` call which means it was not applied when you were importing resources. This PR extends that logic to also run during the `Read` call. fix #4030, fix 4080 # This is the commit message #2: skip test # This is the commit message #3: fixing test # This is the commit message #4: Adding more tests # This is the commit message #5: Upgrade pulumi-terraform-bridge to v3.86.0 (#4160) This PR was generated via `$ upgrade-provider pulumi/pulumi-aws --kind=bridge --pr-reviewers=guineveresaenger`. Fixes #4091 Fixes #4137 --- - Upgrading pulumi-terraform-bridge from v3.85.0 to v3.86.0. - Upgrading pulumi-terraform-bridge/pf from v0.38.0 to v0.39.0. # This is the commit message #6: chore: run upstream provider-lint (#4120) This adds a step for running the upstream `provider-lint` make target. As part of this I had to fix some of the patches which violated some lint rules. **0009-Add-ECR-credentials_data_source.patch** - `ForceNew` does not apply to data sources **0032-DisableTagSchemaCheck-for-PF-provider.patch** - Schema have to have a `Type` - Also needed to add a ignore for `S013` which forces `Computed`, `Optional` or `Required` to be set. Looks like it can't recognize the `tagsComputed` var **0034-Fail-fast-when-PF-resources-are-dropped.patch** - Added a lint ignore for a rule which doesn't allow panics **0050-Normalize-retentionDays-in-aws_controltower_landing_.patch** - This test doesn't actually need a region or partition so replacing with a placeholder closes #4110 # This is the commit message #7: fix: CVE-2024-24791 (#4175) Fixes #4163 Upgrades minimally required Go versions to those unaffected by CVE-2024-24791.
|
Slight variation for readability: import pulumi
import pulumi_aws
test_import = pulumi.Config().get_bool("test_import")
bucket_name = "pulumi-aws-defaulttags-import-issue-anton-6"
provider = pulumi_aws.Provider(
"aws1",
default_tags={
"tags": {
"Environment": "dev",
"CodeRepository": "infra",
}
}
)
if not test_import:
print('PROVISIONING')
pulumi_aws.s3.BucketV2(
bucket_name,
bucket=bucket_name,
tags={
"CodeRepository": "legacy-infra",
"CreatedBy": "terraform",
},
opts=pulumi.ResourceOptions(provider=provider))
else:
print('IMPORTING')
pulumi_aws.s3.BucketV2(
bucket_name,
bucket=bucket_name,
tags={
"CodeRepository": "legacy-infra",
"CreatedBy": "terraform",
},
opts=pulumi.ResourceOptions(provider=provider, import_=bucket_name))#!/usr/bin/env bash
set -euo pipefail
pulumi destroy --yes --skip-preview
pulumi stack export --file empty-state.json
pulumi config set test_import false
pulumi up --yes --skip-preview
pulumi stack import --file empty-state.json
sleep 5
pulumi config set test_import true
pulumi up --yes --skip-previewThis fails on latest but succeeds on pulumi-aws 5.42.0. |
mikhailshilkov
added
the
p1
corymhall
added a commit
that referenced
this issue
Jul 23, 2024
We have special logic around applying default provider tags to
resources. This logic only applied to the `Check` call which means it
was not applied when you were importing resources. This PR extends that
logic to also run during the `Read` call by utilizing
`TransformOutputs`.
While it is true that `TransformOutputs` also runs during `Create` &
`Update`
this is a side effect that I think is ok. From my understanding `tags`
and `tagsAll`
should always be equal. If we have an additional place where we make
sure they are equal
it shouldn't harm anything.
I've added tests (see `testTagsPulumiLifecycle`) which test the complete
lifecycle of a pulumi program
1. `Up` with both provider `defaultTags`/`ignoreTags` and resource level
`tags`
1a. Run validations on result
2. `Refresh` with no changes
3. `Import` using the resource option. Ensures resource can be
successfully imported
3a. Allows for a hook to be run prior to import being run. e.g. Add tags
remotely
4. `Import` using the CLI. Ensures resources can be successfully
imported
4a. Allows for a hook to be run prior to import being run. e.g. Add tags
remotely
5. `Refresh` with no changes
fix #4030, fix #4080, fix #3311
|
This issue has been addressed in PR #4169 and shipped in release v6.45.2. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe what happened
When an AWS provider instance has
defaultTagsconfigured, AWS resources cannot be imported into Pulumi state usingpulumi upbecause of differences shown by pulumi in the imported resource tags.Sample program
Log output
Affected Resource(s)
No response
Output of
pulumi aboutAdditional context
No response
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: