support terraform debug logging

[k0da]

Currently there is no way to set TF_LOG and logging done on terraform-exec level

[chanwit]

Have you tried?

spec:
  runnerPodTemplate:
    spec:
      env:
      - name: TF_LOG
        value: "true"

Let me know if it's still not working for you.

[k0da]

Yes, I did.

https://github.com/hashicorp/terraform-exec/blob/c3eeeea58419c22fda4600718d2a5245884af5ad/tfexec/terraform.go#L38

This is denied by terraform-exec go package

[chanwit]

I see. Then we cannot support that too.

But we have another flag for you to try.

https://github.com/weaveworks/tf-controller/blob/main/runner/server.go#L202

Hope it's useful a bit.

[Nalum]

We could look at exposing the Terraform.SetLog (here) and related functions in some way.

[daveoy]

i came here to post this issue -- HELM_DEUBG="1" doesn't seem possible either. not that its rejected, its just ineffective.

would love to be able to do this.

[daveoy]

We could look at exposing the Terraform.SetLog (here) and related functions in some way.

i can understand a TF_VAR_xxx env variable being prohibited but i would have though TF_LOG wouldn't be? especially when combined with the sensitive logs env var mentioned earlier.

if you can point me at where to run those SetLog and SetLogPath commands i'm happy to build the project and test their usage.

this is a big blocker for me right now as im seeing helm_release resources in terraform just run for hours and hours under the tf-controller and not make anything in GKE.

[Nalum]

@daveoy it's not that we are blocking them, I understand it that the tf-exec package blocks them so that they can be set by that package exclusively. In order to support those functions we will need to update tf-controller/tf-runner to allow them to be set.

@chanwit would it be best to make these part of the Terraform CRD? Something like spec.setLog or maybe group them all in spec.tfExec?

[chanwit]

spec.logging: info # debug would be possible, but I could see some security concerns.

https://github.com/weaveworks/tf-controller/blob/b7c13da914c0240eb4aec1a905a080385b9fc37f/runner/server.go#L198-L205

[chanwit]

We shall add this as the "observabilities" item to the roadmap.

[squaremo]

Closing to take this off the radar for now. We do still care about having visibility into the terraform logs, so it may be dealt with elsewhere.