{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2009","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2009/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2009/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2009/events","html_url":"https://github.com/hashicorp/terraform/issues/2009","id":77868325,"number":2009,"title":"Problems when setting OpenStack security groups for an instance by ID","user":{"login":"dupuy","id":33216,"avatar_url":"https://avatars.githubusercontent.com/u/33216?v=3","gravatar_id":"","url":"https://api.github.com/users/dupuy","html_url":"https://github.com/dupuy","followers_url":"https://api.github.com/users/dupuy/followers","following_url":"https://api.github.com/users/dupuy/following{/other_user}","gists_url":"https://api.github.com/users/dupuy/gists{/gist_id}","starred_url":"https://api.github.com/users/dupuy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dupuy/subscriptions","organizations_url":"https://api.github.com/users/dupuy/orgs","repos_url":"https://api.github.com/users/dupuy/repos","events_url":"https://api.github.com/users/dupuy/events{/privacy}","received_events_url":"https://api.github.com/users/dupuy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/openstack","name":"provider/openstack","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-19T00:33:14Z","updated_at":"2015-10-31T12:18:18Z","closed_at":null,"body":"My OpenStack Terraform configuration file contains lines like these:\r\n\r\n```\r\nprovider \"openstack\" {\r\n    auth_url = \"${var.auth_url}\"\r\n    tenant_name = \"${var.tenant}\"\r\n}\r\n\r\nmodule \"dmz\" {\r\n    source = \"github.com/pitmine/ext-net\"\r\n\r\n    region = \"${var.region}\"\r\n    name = \"${var.tenant}-dmz\"\r\n    subnet = \"10.42.0.0/23\"\r\n    external_gateway = \"${var.external_gateway}\"\r\n    tenant_id = \"${lookup(var.tenant_ids,var.tenant)}\"\r\n}\r\n\r\nresource \"openstack_compute_secgroup_v2\" \"https_server\" {\r\n    region = \"${var.region}\"\r\n    name = \"https-server\"\r\n    description = \"Public HTTPS Server on 443/tcp\"\r\n    rule {\r\n        from_port = 443\r\n        to_port = 443\r\n        ip_protocol = \"tcp\"\r\n        cidr = \"0.0.0.0/0\"\r\n    }\r\n}\r\n\r\nresource \"openstack_compute_instance_v2\" \"webserver\" {\r\n    region = \"${var.region}\"\r\n    name = \"webserver\"\r\n    image_name = \"${var.host_image}\"\r\n    flavor_name = \"m1.small\"\r\n    security_groups = [\r\n        # can't use name as any duplicate causes conflictingRequest error\r\n        \"${openstack_compute_secgroup_v2.https_server.id}\",\r\n        \"default\"\r\n    ]\r\n    network {\r\n        uuid = \"${module.dmz.uuid}\"\r\n    }\r\n }\r\n\r\nvariable \"auth_url\" {\r\n    description = \"Keystone authentication URL\"\r\n}\r\n\r\nvariable \"tenant\" {\r\n    description = \"OpenStack tenant to be terraformed\"\r\n}\r\n\r\nvariable \"tenant_ids\" {\r\n    default = {\r\n\t example = \"a2be8b04bad045df90575b3eb6e530ee\"\r\n    }\r\n}\r\n\r\nvariable \"region\" {\r\n    description = \"Hosting region\"\r\n    default     = \"RegionOne\"\r\n}\r\n\r\nvariable \"host_image\" {\r\n    description = \"Name of Linux distribution image for normal host instances\"\r\n    default     = \"cirros\"\r\n}\r\n\r\nvariable \"external_gateway\" {\r\n    description = \"Network UUID for external (public) Internet\"\r\n}\r\n```\r\n\r\nAs noted in the comment, I use the `id` attribute of the `openstack_compute_secgroup_v2` objects because it is guaranteed to be unique and won't fail to be created because of some left-over secgroup object with the same name.\r\n\r\nHowever, when I run `terraform plan` a second time, I get the following output:\r\n\r\n```\r\n~ openstack_compute_instance_v2.webserver\r\n    network.0.uuid:    \"25655a37-d7a2-44d4-8c8c-e0ccb706a74c\" => \"2411593d-2a82-4861-8415-8015470b39d0\"\r\n    security_groups.0: \"default\" => \"ebb87443-4866-4f4e-b521-a18a1a8c8d86\"\r\n    security_groups.1: \"https-server\" => \"default\"``\r\n```\r\n\r\nAnd running `terraform apply a second time will remove the http_server secgroup from the instance (a third apply will bring it back):\r\n```\r\n$ terraform apply\r\nModifying...\r\n  network.0.uuid:    \"25655a37-d7a2-44d4-8c8c-e0ccb706a74c\" => \"2411593d-2a82-4861-8415-8015470b39d0\"\r\n  security_groups.0: \"default\" => \"ebb87443-4866-4f4e-b521-a18a1a8c8d86\"\r\n  security_groups.1: \"https-server\" => \"default\"\r\nopenstack_compute_instance_v2.webserver: Modifications complete\r\n\r\nApply complete! Resources: 0 added, 1 changed, 0 destroyed.\r\n\r\n$ terraform plan\r\n...\r\n~ openstack_compute_instance_v2.webserver\r\n    network.0.uuid:    \"25655a37-d7a2-44d4-8c8c-e0ccb706a74c\" => \"2411593d-2a82-4861-8415-8015470b39d0\"\r\n    security_groups.#: \"1\" => \"2\"\r\n    security_groups.0: \"default\" => \"ebb87443-4866-4f4e-b521-a18a1a8c8d86\"\r\n    security_groups.1: \"\" => \"default\"\r\n\r\n$ terraform apply\r\nopenstack_compute_instance_v2.webserver: Modifying...\r\n  network.0.uuid:    \"25655a37-d7a2-44d4-8c8c-e0ccb706a74c\" => \"2411593d-2a82-4861-8415-8015470b39d0\"\r\n  security_groups.#: \"1\" => \"2\"\r\n  security_groups.0: \"default\" => \"ebb87443-4866-4f4e-b521-a18a1a8c8d86\"\r\n  security_groups.1: \"\" => \"default\"\r\nopenstack_compute_instance_v2.webserver: Modifications complete\r\n\r\nApply complete! Resources: 0 added, 1 changed, 0 destroyed.\r\n...\r\n```\r\n\r\nThe problem is that the Terraform OpenStack provider is attempting to match the names to the ids, and doesn't have code to do that.  But this would be cosmetic and only a minor annoyance, if it were not for the fact that the provider implements secgroup changes as \"add then remove.\"  In this case, the `https_server` group is added (by id), which is a no-op as it is already present with the specified id. However, the remove step is *not* a no-op, since it removes the secgroup named \"https_server.\"  Repeated application continues to remove and re-add the secgroup.\r\n\r\nA better approach would be at a minimum to do \"remove before create\" since the removal by name would be very quickly undone by the (re-)addition of the secgroup by id. \r\n\r\nIf the provider could detect that an id matched a name and not mark it as changed, that would be even better, and would remove the several second \"gap\" when the secgroup is removed but before it is re-added.\r\n\r\nI've submitted a PR ( #2008) for the \"remove before create\" change that works for me.\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/152730843","html_url":"https://github.com/hashicorp/terraform/issues/2009#issuecomment-152730843","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/2009","id":152730843,"user":{"login":"jtopjian","id":46959,"avatar_url":"https://avatars.githubusercontent.com/u/46959?v=3","gravatar_id":"","url":"https://api.github.com/users/jtopjian","html_url":"https://github.com/jtopjian","followers_url":"https://api.github.com/users/jtopjian/followers","following_url":"https://api.github.com/users/jtopjian/following{/other_user}","gists_url":"https://api.github.com/users/jtopjian/gists{/gist_id}","starred_url":"https://api.github.com/users/jtopjian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtopjian/subscriptions","organizations_url":"https://api.github.com/users/jtopjian/orgs","repos_url":"https://api.github.com/users/jtopjian/repos","events_url":"https://api.github.com/users/jtopjian/events{/privacy}","received_events_url":"https://api.github.com/users/jtopjian/received_events","type":"User","site_admin":false},"created_at":"2015-10-31T12:18:18Z","updated_at":"2015-10-31T12:18:18Z","body":"Regarding the ability to specify or refer to a security group by ID, I don't think this is possible. OpenStack Nova will always want the security group _name_ and never the ID. Upon specifying an ID, you get the following error (as of Kilo):\r\n\r\n```json\r\n{\"badRequest\": {\"message\": \"Security group 3697 not found for project 7ab5f9f65b4b417d24d774a23fcdf45b.\", \"code\": 400}}                                                         \r\n```\r\n\r\nI modified the compute resource to make it look up the name of the group when it comes across an string of all digits (assuming it's an ID). Even then, Nova will always report back the name, and Terraform will always want to change it back to the ID.\r\n\r\nGiven the add/remove order has been taken care of, was there anything else that needed to be noted with this issue? If not, I'll go ahead and close it."}}