Compute `"tags"` in Check #2655

iwahbe · 2023-07-31T11:31:55Z

Relies on pulumi/pulumi-terraform-bridge#1310.

Description copied from applyTags's doc comment:

Historically, Pulumi has struggles to handle the "tags" and "tags_all" fields correctly:

terraform-provider-aws has also struggled with implementing their desired behavior:

[Proposal] Default Tags Updates hashicorp/terraform-provider-aws#29747
[Announcement] Upcoming Changes in Version 5.0 of the AWS Provider hashicorp/terraform-provider-aws#29842
Setting tags to have empty values or changing tags from having a value to having no value is not correctly handled hashicorp/terraform-provider-aws#24449

The Terraform lifecycle simply does not have a good way to map provider configuration onto resource values, so terraform-provider-aws is forced to work around limitations in unreliable ways. For example, terraform-provider-aws does not apply tags correctly with -refresh=false.

This gives pulumi the same limitations by default. However, unlike Terraform, Pulumi does have a clear way to insert provider configuration into resource properties: Check. By writing a custom check function that applies "default_tags" to "tags" before the Terraform provider sees any resource configuration, we can give a consistent, reliable and good experience for Pulumi users.

This strategy gives concrete benefits for Pulumi users. Diffs are applied correctly with high resolution. Consider this change:

name: our-example
runtime: yaml
resources:
  p:
    type: pulumi:providers:aws
    properties:
      defaultTags:
        tags:
          foo: buzz
          abc: def
      region: us-west-2
  b:
    type: aws:s3:BucketV2
-   properties:
-     tags:
-       foo: fizz
    options:
      provider: ${p}

We now can give users an accurate diff:

𝛌 pulumi preview --diff
Previewing update (test)

View Live: https://app.pulumi.com/pulumi/our-example/test/previews/*

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:test::our-example::pulumi:pulumi:Stack::our-example-test]
warning: provider config warning: skip_metadata_api_check: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider
    ~ aws:s3/bucketV2:BucketV2: (update)
        [id=b-f4d2684]
        [urn=urn:pulumi:test::our-example::aws:s3/bucketV2:BucketV2::b]
        [provider=urn:pulumi:test::our-example::pulumi:providers:aws::p::aaefc0bd-e75f-47b8-9d61-dc8c5cba05b0]
      ~ tags: {
          ~ foo: "fizz" => "buzz"
        }
Resources:
    ~ 1 to update
    2 unchanged

Changing defaultTags in a way that doesn't effect a resource no longer shows as an update for that resource, just for the provider:

name: our-example
runtime: yaml
resources:
  p:
    type: pulumi:providers:aws
    properties:
      defaultTags:
        tags:
-         foo: buzz
          abc: def
      region: us-west-2
  b:
    type: aws:s3:BucketV2
    properties:
      tags:
        foo: fizz
    options:
      provider: ${p}

𝛌 pulumi preview --diff
Previewing update (test)

View Live: https://app.pulumi.com/pulumi/our-example/test/previews/0*

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:test::our-example::pulumi:pulumi:Stack::our-example-test]
warning: provider config warning: skip_metadata_api_check: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider
    ~ pulumi:providers:aws: (update)
        [id=aaefc0bd-e75f-47b8-9d61-dc8c5cba05b0]
        [urn=urn:pulumi:our-example::pulumi:providers:aws::p]
      ~ defaultTags              : "\"{\\\"tags\\\":{\\\"abc\\\":\\\"def\\\",\\\"foo\\\":\\\"buzz\\\"}}\"" => "\"{\\\"tags\\\":{\\\"abc\\\":\\\"def\\\"}}\""
        region                   : "us-west-2"
        skipCredentialsValidation: "false"
        skipMetadataApiCheck     : "true"
        skipRegionValidation     : "true"
Resources:              
    ~ 1 to update
    2 unchanged

Of course, this also fixes the original issue; removing all defaultTags correctly removes them from the resource.

name: our-example
runtime: yaml
resources:
  p:
    type: pulumi:providers:aws
    properties:
-     defaultTags:
-       tags:
-         foo: buzz
-         abc: def
      region: us-west-2
  b:
    type: aws:s3:BucketV2
    options:
      provider: ${p}

𝛌 pulumi preview --diff
Previewing update (test)

View Live: https://app.pulumi.com/pulumi/our-example/test/previews/*

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:test::our-example::pulumi:pulumi:Stack::our-example-test]
warning: provider config warning: skip_metadata_api_check: the use of values other than "true" and "false" is deprecated and will be removed in a future version of the provider
    ~ pulumi:providers:aws: (update)
        [id=aaefc0bd-e75f-47b8-9d61-dc8c5cba05b0]
        [urn=urn:pulumi:test::our-example::pulumi:providers:aws::p]
      - defaultTags              : (json) {
          - tags: {
              - abc: "def"
              - foo: "buzz"
            }
        }

        region                   : "us-west-2"
        skipCredentialsValidation: "false"
        skipMetadataApiCheck     : "true"
        skipRegionValidation     : "true"
    ~ aws:s3/bucketV2:BucketV2: (update)
        [id=b-f4d2684]
        [urn=urn:pulumi:test::our-example::aws:s3/bucketV2:BucketV2::b]
        [provider=urn:pulumi:test::our-example::pulumi:providers:aws::p::aaefc0bd-e75f-47b8-9d61-dc8c5cba05b0]
      - tags: {
          - abc: "def"
          - foo: "buzz"
        }
    --outputs:--        
  ~ tags: {
      - abc: "def"
      - foo: "buzz"
    }
Resources:
    ~ 2 to update
    1 unchanged

A bonus for maintainers is that because this change takes effect at the pulumi level, we no longer rely on changing how our involved diff method works, allowing us to remove XComputedInput from this provider (and then from the bridge).

iwahbe · 2023-07-31T11:42:02Z

This will show diffs on tags when upgrading from v5 to v6, so it must be introduced as part of the major version upgrade and called out in the changelog.

iwahbe · 2023-07-31T13:18:26Z

Currently, this works for:

Read is the only CRUD+ method that does not go through Check, so it will also need special behavior so that pulumi up --yes && pulumi refresh --expect-no-changes doesn't show a diff.

t0yv0 · 2023-07-31T13:21:29Z

For example, terraform-provider-aws does not apply tags correctly with -refresh=false.

I was not able to isolate this, do you have a repro? Can we file a bug upstream with a repro?

provider/resources.go

t0yv0 · 2023-07-31T13:30:09Z

How can we demonstrate that import and refresh scenarios exercising Read work as expected?

t0yv0 · 2023-07-31T13:30:39Z

What happens if a provider with this set of changes runs against stacks that used the old method and perhaps populated tags_all?

t0yv0 · 2023-07-31T13:33:02Z

Overall I appreciate this approach, if we cannot find a clean way to interface with the functionality in upstream provider, maintaining custom code around default tags seems worth it as it is a feature impacting every resource; if we can do this cleanly. There is a cost of doing so in maintaining this new code and ensuring that it does not interact in weird ways with the upstream machinery that attempts to solve the problem as well.

iwahbe · 2023-07-31T15:56:46Z

How can we demonstrate that import and refresh scenarios exercising Read work as expected?

By adding a test that exercises the behavior. We can't do that yet, since any such test will fail until pulumi/pulumi-terraform-bridge#1312 merges.

iwahbe · 2023-07-31T15:58:10Z

What happens if a provider with this set of changes runs against stacks that used the old method and perhaps populated tags_all?

They will see a diff on "tags" (see #2655 (comment)), but otherwise everything will work as expected. This doesn't change anything about "tags_all", we won't see a problem here.

t0yv0 · 2023-07-31T16:15:22Z

We can't do that yet, since any such test will fail until

Ah super, you have a way to demonstrate in a test, that's great, let's try it. I think you can make the CI exercise pre-release code via go mod-replace. Alternatively, I had some nits on pulumi/pulumi-terraform-bridge#1312 but it's also mergeable once we add a quick test in there.

t0yv0 · 2023-08-02T14:59:23Z

Having a look at this again shortly.

examples/default-tags-yaml/Pulumi.yaml

danielrbradley · 2023-08-02T15:09:05Z

upstream-patches/0029-Match-the-tags-behavior-of-other-resources.patch

+diff --git a/internal/service/s3legacy/bucket_legacy.go b/internal/service/s3legacy/bucket_legacy.go
+index 0563bd3a25..e6bd8e7013 100644
+--- a/internal/service/s3legacy/bucket_legacy.go
+++ b/internal/service/s3legacy/bucket_legacy.go


Would it make sense to just combine this into, or put this this change alongside patch 003 where we add this code?

This is interesting. The patch is still needed it just got shorter?

t0yv0 · 2023-08-02T16:09:00Z

provider/tests/go.mod

@@ -0,0 +1,217 @@
+module github.com/pulumi/pulumi-aws/provider/tests


OK with introducing a test-specific module? I've done it elsewhere but was wondering if that's idiomatic Go for the problem of isolating test dependencies.

provider/tests/provider_test.go

upstream-patches/0002-Conns-user-agent.patch

examples/examples_yaml_test.go

t0yv0 · 2023-08-02T16:22:29Z

I had a question about the semantic of one of the tests, and I'm not familiar with the underlying patch being edited. Otherwise LGTM.

TF does, and if we assume that "tags" is set correctly, we then get the expected diff.

This fix takes effect during Check, which occurs before Diff. We don't need to do anything special for Diff now.

The previous fix works on all resources... except our s3legacy bucket because it was not updated to use upstream's new tags strategy. I have changed our fork to use the new strategy. The change is here: https://github.com/pulumi/terraform-provider-aws/compare/patched-v5.9.0...patched-v5.9.0-with-modern-s3legacy-tags?expand=1

We are seeing tests fail for aws:cognito:UserPool but I know this works for aws:s3:BucketV2. These are both SDKv2 resources. Since they work differently I have ensured that both are tested.

This resource is broken upstream, so we skip the test here.

I have left skeleton code for GRPC based testing, as I often find it useful when debugging locally. I have noted that it does not run in CI, and is just there for local development.

iwahbe requested review from t0yv0 and AaronFriel July 31, 2023 11:31

iwahbe self-assigned this Jul 31, 2023

iwahbe requested a review from mikhailshilkov July 31, 2023 11:43

pulumi deleted a comment from github-actions bot Jul 31, 2023

t0yv0 reviewed Jul 31, 2023

View reviewed changes

provider/resources.go Show resolved Hide resolved

This was referenced Jul 31, 2023

Augment Provider's refresh with RawConfig filled in pulumi/pulumi-terraform-bridge#1312

Merged

SDK based providers always run with empty RawConfig values pulumi/pulumi-terraform-bridge#1313

Closed

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch 2 times, most recently from 62c00f7 to edf865e Compare August 1, 2023 12:32

pulumi deleted a comment from github-actions bot Aug 1, 2023

iwahbe mentioned this pull request Aug 1, 2023

Update pulumi-terraform-bridge #2660

Merged

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch from edf865e to 304f439 Compare August 1, 2023 19:25

pulumi deleted a comment from github-actions bot Aug 2, 2023

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch from 304f439 to 1f1737c Compare August 2, 2023 09:05

This comment was marked as off-topic.

Sign in to view

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch from 05a87ac to 16f0081 Compare August 2, 2023 12:28

iwahbe requested a review from t0yv0 August 2, 2023 13:32

danielrbradley reviewed Aug 2, 2023

View reviewed changes

examples/default-tags-yaml/Pulumi.yaml Outdated Show resolved Hide resolved

danielrbradley reviewed Aug 2, 2023

View reviewed changes

t0yv0 reviewed Aug 2, 2023

View reviewed changes

provider/tests/provider_test.go Outdated Show resolved Hide resolved

t0yv0 reviewed Aug 2, 2023

View reviewed changes

upstream-patches/0002-Conns-user-agent.patch Show resolved Hide resolved

t0yv0 reviewed Aug 2, 2023

View reviewed changes

examples/examples_yaml_test.go Outdated Show resolved Hide resolved

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch 4 times, most recently from 725c1f9 to fa2587d Compare August 3, 2023 14:27

iwahbe added 15 commits August 4, 2023 16:29

Add GRPC test to replicate 2633

dc1eb0b

Test that we set "tags" on creation

8d286ae

TF does, and if we assume that "tags" is set correctly, we then get the expected diff.

Ensure valid diffs by overriding check

356ea90

Remove .XComputeInput

8e162a2

This fix takes effect during Check, which occurs before Diff. We don't need to do anything special for Diff now.

Depend on pulumi/pulumi-terraform-bridge#1310

b65515c

Turn tests back on

512e265

Explain .Mappable() has the same shape as NewTagConfig expected

450c82a

Template out YAML Tests

8cffcbf

Accommodate aws:cognito:UserPool

3bbe42a

Switch to environment for pf

b82b56a

Add a test for aws:s3:BucketV2

12ed527

We are seeing tests fail for aws:cognito:UserPool but I know this works for aws:s3:BucketV2. These are both SDKv2 resources. Since they work differently I have ensured that both are tested.

Skip aws:cognito:UserPool test

a50c6ba

This resource is broken upstream, so we skip the test here.

Remove outdated tests

1fd15a3

I have left skeleton code for GRPC based testing, as I often find it useful when debugging locally. I have noted that it does not run in CI, and is just there for local development.

Don't pass empty tags properties

fd37ad2

iwahbe force-pushed the iwahbe/2633/default-tags-fix-untag branch from 8072478 to fd37ad2 Compare August 4, 2023 14:31

iwahbe merged commit e17996a into v6 Aug 4, 2023
15 checks passed

iwahbe deleted the iwahbe/2633/default-tags-fix-untag branch August 4, 2023 15:38

This was referenced Aug 4, 2023

Removing default tags fails to untag resources on v6 #2633

Closed

Test and validate changes related to default tagging behavior #2550

Closed

corymhall mentioned this pull request Jul 15, 2024

Tracking: remove tags related patches #4230

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Compute `"tags"` in Check #2655

Compute `"tags"` in Check #2655

iwahbe commented Jul 31, 2023 •

edited

Loading

iwahbe commented Jul 31, 2023

iwahbe commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

iwahbe commented Jul 31, 2023

iwahbe commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

This comment was marked as off-topic.

t0yv0 commented Aug 2, 2023

danielrbradley Aug 2, 2023

t0yv0 Aug 2, 2023

t0yv0 Aug 2, 2023

t0yv0 commented Aug 2, 2023

		@@ -0,0 +1,217 @@
		module github.com/pulumi/pulumi-aws/provider/tests

Compute "tags" in Check #2655

Compute "tags" in Check #2655

Conversation

iwahbe commented Jul 31, 2023 • edited Loading

iwahbe commented Jul 31, 2023

iwahbe commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

iwahbe commented Jul 31, 2023

iwahbe commented Jul 31, 2023

t0yv0 commented Jul 31, 2023

This comment was marked as off-topic.

t0yv0 commented Aug 2, 2023

danielrbradley Aug 2, 2023

Choose a reason for hiding this comment

t0yv0 Aug 2, 2023

Choose a reason for hiding this comment

t0yv0 Aug 2, 2023

Choose a reason for hiding this comment

t0yv0 commented Aug 2, 2023

Compute `"tags"` in Check #2655

Compute `"tags"` in Check #2655

iwahbe commented Jul 31, 2023 •

edited

Loading