Drift Detection - Supported / Unsupported Elements

[tsteckenborn]

Would it be beneficial to create a list of items for which drifts can and cannot be detected? Reading through some of the issues, it seems like additional administrators assigned to a sub-account, for example, are being ignored / not reported. It might be helpful to know where automatic checks are possible and where a discrepancy cannot be automatically excluded.

[lechnerc77]

Hi @tsteckenborn thnaks for that question.

In general, a drift can only be detected for resources that are managed by Terraform i.e., that have either been created by or imported to Terraform and are present in the Terraform state. The other way round: if there is no corresponding resource, it won't be managed by Terraform. As you pointed out, the capability of Terraform to detect a drift for these resources depends on the capabilities of the underlying APIs that the Terraform provider uses internally.

For SAP BTP there are indeed some flaws with respect to the APIs and the resource-based approach of Terraform. Tehre are two major areas where drifts cannot be detected as of today:

• Role Collection Assigment: the assignment role collections has no option for a READ operation. Hence, we cannot determine drift for this resource. There is an issue open in this context ([FEATURE] Enable display of assigned role collections with group filter #748) that will improve the situation in the future.
• Service Instances: the service instances can be managed via Terraform. However the parameters handed over via JSON cannot be managed or used for drift detection. The reason is that most of the services do not return the parameters when reading them, due to a configuration of their service offering (this also makes it impossible to import these services). Hence, we cannot detect configuration drifts when parameters of a service that are part of the JSON are changed.

Anyway this is a valid request and I opened an issue for this to improve the documentation with regards to that. It should also comprise the topic of imports of resources as this basically the same story.

The issue that you can track is: #768

[tsteckenborn]

Thanks for the quick and detailed response @lechnerc77 !

May I ask two follow up questions for my understanding given I'm not that firm with Terraform yet?

A) Given a future where there is such an API for read operations and role collections assigned for specific users, manually added role collections / users would be a configuration drift and Terraform would try to reconcile this, right? So if you manage a resource in Terraform, you should not do any manual changes to that resource?

B) Managing a Subaccount / Cloud Foundry Organization in Terraform additional manually added spaces are also a drift and reconciled?

[lechnerc77]

Ad A) That depends on how we are going to implement the READ of the resource. For the role collections the behavior you describe is the one that is the one I would expect. However we must wait how the API finally looks like to make a final statement.

Ad B) No this won't be detected as Terraform does not now about this additional space that is assigned to the organization. Terraform treats every resource on its own. So if you create a CF space manually (via the cockpit or via CLI) this is "invisible" to Terraform. Only the resources that have been created by Terraform can be checked which basically means that changes in the configuration of the resource or deletions of the resource will be detected.

For the sake of completeness: when talking about drift detection I have the command terraform plan -detailed-exitcode in mind. A drift would mean that the exit code is 2 or 1.
You can of course also use the data sources to define additional checks like the one you mentioned (Reading the spaces and then comparing the state after read), but this is then not the "usual" drift detection.

[lechnerc77]

@tsteckenborn I created a first PR to elaborate on the topics we discussed. You find it here: #769 - feedback welcome

[lechnerc77]

PR is merged and updated documentation will be available with upcoming release 1.3.0