Missing support for Service Orchestration active status for a Service

[etiennechabert]

Terraform Version

2.6.1

Affected Resource(s)

service

Missing feature

There is no way to change for a given service the Service Orchestration Status, while it's possible to automate everything else, like:

• service
• event_orchestration_service

Problem: We have hundreds of services for which we have via terraform automated the definition of orchestration rules, and it seems that we have now to enable the service orchestration for each of them manually?

Does not make much sense, and a bit frustrating since this API endpoint seems to be doing the trick: https://developer.pagerduty.com/api-reference/855659be83d9e-update-the-service-orchestration-active-status-for-a-service

It would be really beneficial if this could be included into the service pagerduty module, so the user can define if he wants to use service ruleset (should probably be the default) or service orchestration path

Thanks in advance

[etiennechabert]

Maybe to clarify a bit more, services are created by default in pagerduty to use service ruleset.

Not been able to change this behavior via terraform, means I now have to do this change manually for each of my services.

[etiennechabert]

For the one that might be blocked by this... here is my workaround

resource "pagerduty_service" "default" {...}

resource "null_resource" "service_event_orchestration_activer" {
  provisioner "local-exec" {
    command = "curl --request PUT --url https://api.pagerduty.com/event_orchestrations/services/${pagerduty_service.default.id}/active --header 'Accept: application/vnd.pagerduty+json;version=2' --header 'Authorization: Token token=${var.pagerduty_token}' --header 'Content-Type: application/json' --data '{\"active\": true}'"
  }

  depends_on = [pagerduty_service.default]
}

[marco-hoyer]

Hey Pagerduty folks. This actually is a big issue for us. Any idea when this could be fixed?

[NargiT]

Definitely a big blocker, we have 2000 services and I am not going to do this by hand

[etiennechabert]

@imjaroiswebdev I am really sorry for tagging you directly, doing so because:

• You are one of the main contributor of this repository (thanks for that!)
• You are working for Pagerduty
• Looking at the commits, I have the feeling you worked on Event Orchestration
• A bit out of idea about how to get traction on this mater, tried via my account manager, via regular support...

The contributors of the repository did a tremendous job to integrate Event Orchestration into this terraform provider, the interface is easy to use while allowing the full set of functionality to be used. The only problem is they have forgotten to allow a way to enable event orchestration... as a result, we cannot benefit from their efforts because of this small thing missing, since event orchestration is disabled by default on a freshly created service.

I could be wrong, but it should be quite easy to add a resource in charge of doing this HTTP call that I am using at the moment as a workaround: https://github.com/PagerDuty/terraform-provider-pagerduty/issues/565#issuecomment-1239345555

FYI: A second issue is reporting exactly the same issue here: https://github.com/PagerDuty/terraform-provider-pagerduty/issues/589

Thanks again for your contributions, and in advance for your help.

[ramfjord]

I'm gonna just chime in and mention this is a major issue for me as well. It's kind of annoying because the Pagerduty docs are pushing service orchestration so hard, this feels like a big Gotcha with using the terraform. For various reasons I won't go into, I adapted the TF+curl soln to this python script that uses TF outputs and vault secrets directly, which I'm running in our atlantis post-apply. Perhaps it can be adapted for use by someone else:

#!/usr/bin/env python3
import argparse
import json
import logging
import re
import requests
import sys
from typing import Dict

parser = argparse.ArgumentParser(
        description=r"""Enable service orchestration on all services created by this terraform.

This should hopefully be removed one day, but is a necessity due to the pagerduty
provider not allowing service orchestration to be enabled on services.

https://github.com/PagerDuty/terraform-provider-pagerduty/issues/565

This script relies on an existing tfout.json file that contains outputs for all
of your service ids with keys in the format of "service_<name>_id", as well as
a secrets.json filecontaining the same API key used by the terraform provider.
""")

parser.add_argument('-s', '--secrets', dest='secrets', type=str, default="secrets.json",
        help="Path to secrets file generated by `vault kv get -format json`, default secrets.json")

parser.add_argument('-t', '--tfout', dest='tfout', type=str, default="tfout.json",
        help="Path to terraform outputs (required to get list of services - default tfout.json generated with make)")

parser.add_argument('-d', '--debug', action="store_const", dest="loglevel",
        const=logging.DEBUG, default=logging.INFO,
        help="Print lots of debugging statements")

def pagerduty_token(secrets_path: str) -> str:
    with open(args.secrets, 'r') as file:
        secrets = json.load(file)
        return secrets["data"]["data"]["pagerduty_token"]

def read_tfout(tfout_path: str) -> Dict:
    with open(tfout_path, 'r') as file:
        return json.load(file)

def list_of_services(tfout_path: str) -> Dict[str,str]:
    tfout = read_tfout(tfout_path)
    keys = set()
    for key in tfout.keys():
        match = re.search(f'service_(\w+)_id', key)
        if match:
            # 0th is entire match - in service_foo_id we want foo
            keys.add(match.group(1))

    def id_for(key):
        return tfout[f"service_{key}_id"]["value"]

    return { key:tfout[f"service_{key}_id"]["value"] for key in keys }

def api_conn(token: str) -> requests.Session:
    s = requests.Session()
    s.headers.update({
        'Authorization': f"Token token={token}",
        'Accept': 'application/vnd.pagerduty+json;version=2',
        'Content-Type': 'application/json',
    })
    return s

API_URI = "https://api.pagerduty.com/event_orchestrations/services"
def enable_orchestration_route(service_id: str):
    return f"{API_URI}/{service_id}/active"

if __name__ == "__main__":
    args = parser.parse_args()
    logging.basicConfig(level=args.loglevel)
    logging.debug(args)

    token = pagerduty_token(args.secrets)
    api = api_conn(token)
    for service, service_id in list_of_services(args.tfout).items():
        response = api.put(enable_orchestration_route(service_id),
                           json = { "active": True })

        if not response.ok:
            logging.error("Failed API call - rerun with --debug for more info")

[imjaroiswebdev]

hey folks! @etiennechabert @marco-hoyer @NargiT @ramfjord sorry for having you waiting this long to add support for this, however I want to let you know that the other activities that were more prioritized than this one are being solved, so I my ballpark is that by next week I will be releasing an update to support Event Orchestration Service Status into the TF Provider. Please you all stay tune 🙏🏽 ✌🏽

[marco-hoyer]

@imjaroiswebdev thanks a bunch!

[etiennechabert]

@imjaroiswebdev thank you very much for your work on this one 🎖️