Terraform-provider-digitalocean: Tags for digital ocean droplets keep changing order

[hashibot]

_This issue was originally opened by @simaofreitas as hashicorp/terraform#9099. It was migrated here as part of the provider split. The original body of the issue is below._

---

Hi,

I'm using terraform for managing a set of droplets in digital ocean.
Yesterday I introduced tags (using digitalocean_tag) and everything is working correctly.
The problem is that every time I run terraform plan (or apply) I get changes because the tags keep changing their order inside the tfstate file.

Terraform version: 0.7.3

Example of tags definition:

resource "digitalocean_tag" "staging" {
    name = "staging"
}

resource "digitalocean_tag" "web" {
    name = "web"
}

Example of droplet definition

resource "digitalocean_droplet" "machine01" {
  image              = "ubuntu-14-04-x64"
  name               = "machine01"
  region             = "fra1"
  size               = "16gb"
  private_networking = true
  backups            = true
  tags               = ["${digitalocean_tag.staging.id}", "${digitalocean_tag.web.id}"]

  ssh_keys = [
     ...
  ]
}

When running terraform plan (after I already ran terraform apply) I get this:

~ digitalocean_droplet.machine01
    tags.0: "staging" => "web"
    tags.1: "web" => "staging"

If I apply, the next time I run plan I would get the reverse output. But it always changes.

Couldn't find any open issues about this.

Any ideas?

Thanks a lot

[mageddo]

Same issue here.

-                            "tags.0": "worker",
-                            "tags.1": "cluster",
+                            "tags.0": "cluster",
+                            "tags.1": "worker",

[jackivanov]

Same issue.
Use sort() is a workaround

[TheYorkshireDev]

This still seems to be an issue, @jackivanov can you elaborate and give an example?

[dharmeshptl]

this worked for me

module "do_swarm_worker" {
source = "./do_swarm_worker"
token = "${var.do_token}"
region = "${var.do_region}"
domain = "${var.domain}"
tags = ["${sort(list(digitalocean_tag.cluster.id,digitalocean_tag.worker.id))}"]
}

[soar]

Very annoying issue

[jakubgs]

I'm trying to use sort() with a list of tags but it has o effect:

locals = {
  tags = ["${var.stage}", "${var.group}", "${var.env}"]
  tags_sorted = "${sort(distinct(local.tags))}"
  tags_count = "${length(local.tags_sorted)}"
}

resource "digitalocean_tag" "host" {
  name  = "${element(local.tags_sorted, count.index)}"
  count = "${local.tags_count}"
}

resource "digitalocean_droplet" "host" {
...
    tags = ["${sort(digitalocean_tag.host.*.id)}"]
...
}

The result is still the same, tags re-ordering on every run.

[paranoidd]

Hello fellow DigitalOcean Terraformers! I've joined the group of people suffering from the issue. No sort work-arounds are working for me. I've recently also hit a hard limit of DigitalOcean firewalls (100), what caused me to start heavily rely on tags. So now for each TF workspace, we do get a plan with changes, even tho there are not real changes :(

Considering that we are kind of forced to use tags if we want to utilise digitalocean_firewall effectively, I think this issue is more than annoying. Any known work-arounds are welcome!

Side question - did anyone try to sort the problem with lifecycle & ignore_changes? I haven't explored it yet as it feels like dirty hack - I still kind of care about changes to tags (if there are actual changes)

[baffolobill]

@paranoidd It totally depends on your implementation/requirements/needs. For example, you can do it like in this demo https://github.com/baffolobill/terraform-digitalocean-tags-hack (this is part of my project, not sure that all dependencies included) - I just manually process tags via bash scripts. This is just an idea, not complete solution.

resource "null_resource" "assign_tags_to_droplet" {
    depends_on = [
        "digitalocean_droplet.bastion",
        "module.droplet_tags",
    ]
    count      = "${var.num_nodes}"

    triggers {
        tag_ids    = "${join(",", module.droplet_tags.tags)}",
        droplet_id = "${element(digitalocean_droplet.bastion.*.id, count.index)}",
    }

    # !!! All magic does this script. You can test it like so:
    provisioner "local-exec" {
        command = "\"${path.module}/../../../../scripts/assign_tags_to_droplet.sh\" ${element(digitalocean_droplet.bastion.*.id, count.index)} ${join(" ", module.droplet_tags.tags)}"
    }
}

I do so because of another problem with tags: in some cases when Terraform sees changes in tags, it destroys a tag by deleting it (contrary to "untag") (if it's not obvious, Terraform doesn't re-add resources to a tag, when it re-creates a tag). As result, this tag disappear from all resources, even from those which aren't managed by Terraform. It brings me to situation when Droplets didn't see each other (my firewall rules totally rely on tags), consul couldn't connect to leader (because auto-join rely on tags).