minamijoyo/tfmigrate

Failed to terraform apply with tfplan generated by tfmigrate plan --out=tfplan in Terraform 1.1

Closed this issue · 1 comments

bash-5.1# tfmigrate -v
0.2.13

bash-5.1# terraform -v
Terraform v1.1.0
on linux_amd64

bash-5.1# TEST_ACC=1 go test -v ./tfmigrate -run=TestAccStateMigratorApply

2021/12/10 04:45:12 [DEBUG] [executor@/tmp/workDir4152694674]$ terraform apply -input=false -no-color /tmp/tmp774935950
2021/12/10 04:45:13 [TRACE] [executor@/tmp/workDir4152694674] cmd=(*tfexec.command)(0xc0003821b0)({
 osExecCmd: (*exec.Cmd)(0xc000594160)(/usr/local/bin/terraform apply -input=false -no-color /tmp/tmp774935950),
 stdout: (*bytes.Buffer)(0xc0001843c0)(),
 stderr: (*bytes.Buffer)(0xc0001843f0)(
Error: Saved plan does not match the given state

The given plan file can not be applied because it was created from a
different state lineage.
)
})

2021/12/10 04:45:13 [DEBUG] [executor@/tmp/workDir4152694674] failed to run command: (*exec.ExitError)(0xc0000be0e0)(exit status 1)
    state_migrator_test.go:298: failed to apply the saved plan file: failed to run command (exited 1): terraform apply -input=false -no-color /tmp/tmp774935950
        stdout:

        stderr:

        Error: Saved plan does not match the given state

        The given plan file can not be applied because it was created from a
        different state lineage.

After debugging, I found that the tfmigrate plan --out=tfplan option was based on a bug prior to Terraform 1.1.

Since terraform state push increments the serial of tfstate, a saved plan file in tfmigrate plan phase should not be able to terraform apply. However, prior to Terraform 1.1, there was no proper validation and terraform apply allows a such case incorrectly. Starting from Terraform 1.1, it now rejects the plan as stale, which seems to be a correct behavior.

That is, the tfmigrate plan --out=tfplan option doesn't work with Terraform 1.1 or later. There is no way to do this.

Fortunately, Terraform 1.1 added a new moved block feature, so some use-cases could be covered by the moved block.
https://www.hashicorp.com/blog/terraform-1-1-improves-refactoring-and-the-cloud-cli-experience

So, I decided to deprecate the tfmigrate plan --out=tfplan option without replacement and it will be removed in a future release.