Terraform and Proxmox: an SSH key change that was going to destroy four containers
I wanted to add my laptop's SSH key to every container from a common list. The plan said «4 to add, 4 to destroy». Among them, messaging with its whole database and the public door to the websites.
- Terraform
- Proxmox VE
The change
Every container file repeated its list of admin keys. The obvious move was to centralise it in a Terraform local and have them all use it. A one-line change.
locals {
admin_ssh_keys = [var.key_pc, var.key_laptop]
}
# and in each container:
user_account { keys = local.admin_ssh_keys }What the plan said
terraform plan came back with 4 resources to create and 4 to destroy. In the bpg/proxmox provider, the container account's keys are only applied on creation: any change to that field forces the whole container to be recreated.
Recreating messaging would have wiped its messages and its bots' encrypted identity. Recreating the proxy would have taken every website down.
What was done
- Don't apply that plan.
- Add the new key by hand on the existing containers (in their authorized_keys, through the hypervisor).
- Keep the common list in the code for containers created from now on, and check the plan over the existing ones showed no changes.
A close cousin: renaming a resource
The same happens when renaming a resource in the code: to Terraform it's a different resource and it wants to destroy the old one. Move it in the state first (terraform state mv or a moved block) and check the plan comes out empty.