CODEWITHSUNDEEP
terraformcloudflareterraform-provider-aws
Pix81
Pix81

Reputation: 675

How to update an existing cloudflare_record in terraform and github actions

I creaed my project with code from Hashicorp tutorial "Host a static website with S3 and Cloudflare", but the tutorial didn't mention github actions. So, when I put my project in github actions, even though terraform plan and terraform apply output successfully locally, I get errors on terraform apply:

Error: expected DNS record to not already be present but already exists

 with cloudflare_record.site_cname ...
 with cloudflare_record.www

I have two resources in my main.tf, one for the site domain and one for www, like the following:

resource "cloudflare_record" "site_cname"  {
zone_id = data.cloudflare_zones.domain.zones[0].id
name    = var.site_domain
value   = aws_s3_bucket.site.website_endpoint
type    = "CNAME"
ttl     = 1
proxied = true
}

resource "cloudflare_record" "www" {
zone_id = data.cloudflare_zones.domain.zones[0].id
name    = "www"
value   = var.site_domain
type    = "CNAME"

ttl     = 1
proxied = true
}

If I remove these lines of code from my main.tf and then run terraform apply locally, I get the warning that this will destroy my resource.

Which should I do?

  1. add an allow_overwrite somewhere (don't see examples of how to use this in the docs) and the ways I've tried to add it generated errors.
  2. remove the lines of code from main.tf knowing the github actions run will destroy my cloudflare_record.www and cloudflare_record.site_cname knowing I can see my zone id and CNAME if I log into cloudflare so maybe this code isn't necessary after the initial set up
  3. run terrform import somewhere? If so, where do I find the zone ID and record ID

or something else?

Upvotes: 2

Views: 2859

Answers (2)

Konstantin Tarkus
Konstantin Tarkus

Reputation: 38378

It shouldn't be a problem if Terraform would drop and re-create DNS records, but for better result, you need to ensure that GitHub Actions has access to the (current) workspace state.

Since Terraform Cloud provides a free plan, there is no reason not to take advantage of it. Just create a workspace through their dashboard, add "remote" backend configuration to your project and ensure that GitHub Actions uses Terraform API Token at runtime (you would set it via GitHub repository settings > Secrets).

You may want to check this example — Terraform Starter Kit

  • infra/backend.tf
  • infra/dns-records.tf
  • scripts/tf.js

Here is how you can pass Terraform API Token from secrets.TERRAFORM_API_TOKEN GitHub secret to Terraform CLI:

- env: { TERRAFORM_API_TOKEN: "${{ secrets.TERRAFORM_API_TOKEN }}" }
  run: |
    echo "credentials \"app.terraform.io\" { token = \"$TERRAFORM_API_TOKEN\" }" > ./.terraformrc

Upvotes: 1

Hik
Hik

Reputation: 101

Where is your terraform state? Did you store it locally or in a remote location?

Because it would explain why you don't have any problems locally and why it's trying to recreate the resources in Github actions.

More information about terraform backend (where the state is stored) -> https://www.terraform.io/docs/language/settings/backends/index.html

And how to create one with S3 for example -> https://www.terraform.io/docs/language/settings/backends/s3.html

Upvotes: 0

Related Questions