Terraform-provider-digitalocean: Fail creating new certificate for CDN endpoint (404 certificate not found)

[liarco]

Terraform Version

Terraform v0.14.5

Affected Resource(s)

• digitalocean_cdn

Terraform Configuration Files

# S3 storage (+ CDN)
resource "digitalocean_spaces_bucket" "s3_storage" {
  name = "${var.deployment_name}-storage"
  region = var.deployment_region
  acl = "private"

  cors_rule {
    allowed_methods = ["GET", "HEAD"]
    allowed_origins = var.cdn_allowed_origins
    allowed_headers = ["*"]
  }
}
resource "random_pet" "s3_storage_cert_pet" {
  # Generate a new pet name each time we change cert data to avoid name conflicts
  # see: https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet
  keepers = {
    # Keepers are not stored as "sensitive" data and so they are shown clean on the terminal output
    private_key = md5(var.storage_cert_private_key)
    leaf_certificate = md5(var.storage_cert)
    custom_domain = var.storage_domain
  }
}
resource "digitalocean_certificate" "s3_storage_cert" {
  depends_on = [
    random_pet.s3_storage_cert_pet
  ]

  name              = "${var.deployment_name}-storage-${random_pet.s3_storage_cert_pet.id}"
  type              = "custom"
  private_key       = var.storage_cert_private_key
  leaf_certificate  = var.storage_cert

  lifecycle {
    # Cannot delete a cert which is in use
    create_before_destroy = true
  }
}
resource "digitalocean_cdn" "s3_storage_cdn" {
  depends_on = [
    digitalocean_spaces_bucket.s3_storage,
    random_pet.s3_storage_cert_pet,
    digitalocean_certificate.s3_storage_cert
  ]

  origin = digitalocean_spaces_bucket.s3_storage.bucket_domain_name
  ttl = 604800
  certificate_name = digitalocean_certificate.s3_storage_cert.name
  custom_domain = random_pet.s3_storage_cert_pet.keepers.custom_domain
}

Debug Output

...

random_pet.s3_storage_cert_pet: Creation complete after 0s [id=winning-coyote]
digitalocean_certificate.s3_storage_cert: Creating...
digitalocean_certificate.s3_storage_cert: Still creating... [10s elapsed]
digitalocean_certificate.s3_storage_cert: Creation complete after 10s [id=my-deployment-name-storage-winning-coyote]
digitalocean_cdn.s3_storage_cdn: Modifying... [id=XXXXX]

Error: Error updating CDN custom domain: PUT https://api.digitalocean.com/v2/cdn/endpoints/XXXXX: 404 certificate not found

Expected Behavior

The new certificate should be created and associated with the CDN endpoint, then the old certificate should be deleted.

Actual Behavior

The new certificate is created successfully, but the CDN endpoint fails to update the custom domain _(just to let you know: omitting the custom domain fixes the error, but it's not a valid option in my case, I did it just for troubleshooting purposes)_.

Steps to Reproduce

1. terraform apply

Important Factoids

After terraform fails (but has created the new cert) updating the CDN endpoint manually using curl works fine:

curl -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer TOKEN_XXXXX" -d '{"certificate_id": "XXXXX", "certificate_name": "my-deployment-name-storage-winning-coyote", "custom_domain": "my.custom.domain"}' "https://api.digitalocean.com/v2/cdn/endpoints/XXXXX"

I tried running terraform apply multiple times before running curl, it gives the same result, except for the new cert which is not created since it already exists after the first run.

References

• #98: this issue is where I found the tip about changing the name and create_before_destroy = true but it was not enough

[andrewsomething]

Hi @liarco Thanks for raising this issue. We've just cut a bug fix release that I believe should resolve this. Though I wasn't able to reproduce the exact error you received. Please let us know if the problem remains.

https://github.com/digitalocean/terraform-provider-digitalocean/releases/tag/v2.5.1

[liarco]

Hi @andrewsomething,
thank you for your support, it seems to work perfectly now!

[liarco]

I updated my original post with a slightly different strategy so that this issue may be useful to future users.

Since keepers in random_pet are stored as plain text (and can leak through the terminal output) I replaced the cert data with an MD5 hash. This ensures that a new cert name is created when data changes, but should be safer.

Hope it helps.

[andrewsomething]

Thanks for following up @liarco! Glad to hear everything is working.