mattrobinsonsre/terrapod v1.7.2

on GitHub

Terrapod is a free, open-source platform replacement for Terraform Enterprise. This patch fixes a run held after its plan by a mandatory policy set, an enforced security scan or a mandatory run task: such a run could no longer be released once its plan Job was cleaned up, and tofu apply waited on it until then.

Bug Fixes

• A run held at a post-plan gate stays held until someone decides (#1725, part of #1704). A run whose plan had finished but which a mandatory policy set, an enforced security scan or a mandatory run task held stays in planning. About ten minutes after the plan, Kubernetes cleaned up the finished plan Job, and the run was then errored with Job deleted. An admin could no longer override it, and the change had to be planned again. The run now stays held however long the decision takes, and moves on as soon as its gate is overridden or passes.
• tofu apply no longer waits on a held run. The plan of a held run was still reported as running, so the CLI kept polling its log until the run errored. The plan now reports finished as soon as it is, and the CLI returns without applying. It does not yet say why; open the run to see what holds it.
• A held run never blocks a newer run, and a held speculative plan still times out. A newer apply run queued while an older run was still planning now supersedes that run once it is held. A plan-only run (a drift check, a speculative plan) held by a run task that never calls back is still subject to the drift cap and the stale timeout.
• A held run can be discarded or superseded. Discard used to accept only planned runs, so a held run could only be canceled, and a newer run queued behind it did not replace it. A held run that can apply is now discardable, and a newer apply-capable run supersedes it as it would a planned one. A run whose plan is still running is left alone.

New

• Runs report what holds them. A new read-only blocked-by attribute on runs names the gate holding a run whose plan has finished: run-task, policy or security-scan, or null otherwise. Automation can tell a run waiting for a decision from a plan still running, which both report planning on 1.7. go-terrapod gains Run.BlockedBy.

  This adds an API attribute in a patch release, which Terrapod's versioning policy normally keeps for minor releases. It is a deliberate exception, made so operators on 1.7 can see and handle held runs now. The attribute is read-only and additive; clients that do not read it are unaffected.

Upgrade notes

• Held runs are no longer cleaned up for you. A run held after its plan used to disappear as errored within minutes; it now waits for someone to override it, discard it, or queue a newer run. See the runbook entry Policy enforcement blocking all runs.
• 2.0 will report held runs with Terraform Enterprise's statuses — policy_override, post_plan_awaiting_decision or post_plan_running in place of planning — which lets tofu apply show the failing checks and offer an override. blocked-by is unchanged. See deprecations.md.
• No migrations and no configuration changes.

Status

Stable — a patch for the 1.7 line.

Full Changelog: v1.7.1...v1.7.2