Prevent FIPs being released from project on terraform destroy #23
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Prevent users outside the openstack project "stealing" the cluster's FIPs when the cluster infra is destroyed.
This is done by removing the
openstack_networking_floatingip_v2
resources and instead directly defining the addresses of FIPs to be attached to fixed IPs. This means FIPs must be manually associated to the OpenStack project, but also means they are not released from the project onterraform destroy
.Note experimenting showed the following will be required on applying these changes:
terraform apply
; terraform will destroy theopenstack_networking_floatingip_v2
. The FIP will be released from the project and the fixed to floating IP associations will be lost - but terraform will not error on this.terraform apply
again. The FIPs will be reassociated with the fixed IPs.