Page MenuHomePhabricator
Create Task
Maniphest T423970

[tofu-cloudvps] Document importing legacy cloudvps_puppet_prefix objects
Open, Needs TriagePublicFeature
Actions

Description

Feature summary:

Make tofu import cloudvps_puppet_prefix $ID possible.

Use case(s):

As a co-maintainer of multiple Cloud VPS projects that predate Tofu usage, I would like to be able to import existing cloudvps_puppet_prefix objects so that Tofu can take over management of them.

Benefits (why should this be implemented?):

It is currently reasonably possible to create new puppet prefix settings related to a specific instance (named after FQDN), an arbitrary prefix, and project-wide (name empty or _). Unfortunately if there is already configuration at any of these name defined levels it is not possible to just overwrite the current config. Instead you have to figure out how to first delete the existing prefix which requires figuring out how to call the DELETE /v1/<project>/prefix/<prefix> puppet-enc API directly somehow. You'll probably need to lock Puppet on affected nodes first, then delete the prefix, then recreate it with tofu, and finally unlock Puppet on any instances where you locked it. Possible, but not fun, easy, or obvious.

See T423970#12267831 for an explanation of how to find the ID for an existing prefix so that you can then use tofu import to add it to the state graph. Once that has happened tofu can update or delete the object.

It would be really nice to have a tool that can also output the tofu config matching a given prefix to make migrating from Horizon managed prefixes to tofu managed versions relative simple.

Related Objects
Search...

Event Timeline

• bd808 created this task.Apr 20 2026, 11:43 PM
Restricted Application added a project: cloud-services-team. · View Herald TranscriptApr 20 2026, 11:43 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
taavi subscribed.Apr 21 2026, 8:27 AM

As far as I can tell, the provider already has code for this. Did you try that and find it not working, or was this task filed on the assumption that it wouldn't be there?

We also should do a better job of exposing those numerical prefix IDs to users to make this an actually viable option.

• bd808 added a comment.Apr 21 2026, 4:11 PM

It may just be tracking down the ID that I didn't know exactly how to do. I think I tried to figure out how to do an import several months ago when I was working on the zuul project tofu setup, but things were in such an early state there that I ended up using the delete workflow (which I also apparently don't remember exactly how to do the auth for).

• bd808 added a parent task: T394316: Use infrastructure as code techniques to rebuild the Beta Cluster.Jun 8 2026, 6:06 PM
• bd808 mentioned this in T433998: Planning for a plan to migrate Beta Cluster again.Aug 4 2026, 5:21 PM
• bd808 added a comment.Aug 29 2026, 4:58 AM

Totally possible today. The necessary magic is knowing how to lookup an $ID value. The puppet-enc server can be queried from inside a Beta Cluster 'make shell' session:

bd808$ make shell
🖥️ Entering Docker container...
Identity added: /dev/fd/63 (betadevopsbot)
/srv/app/bin/start-socks-proxy.sh: connect: Connection refused
/srv/app/bin/start-socks-proxy.sh: line 11: /dev/tcp/127.0.0.1/1080: Connection refused
Starting SOCKS5 proxy at 127.0.0.1:1080...
Warning: Permanently added 'bastion.wmcloud.org' (ED25519) to the list of known hosts.
somebody@deployer:/srv/app$ curl -s -H "Accept: application/json" -H "X-Auth-Token: $(OS_DEBUG= openstack token issue -f yaml | yq .id)" "https://puppet-enc.cloudinfra.wmcloud.org/v1/deployment-prep/prefix?detailed" | jq '.prefixes[] | select(.prefix | startswith("deployment-mediawiki"))'
{
  "id": 14426,
  "prefix": "deployment-mediawiki"
}
{
  "id": 21178,
  "prefix": "deployment-mediawiki13.deployment-prep.eqiad1.wikimedia.cloud"
}
{
  "id": 21177,
  "prefix": "deployment-mediawiki14.deployment-prep.eqiad1.wikimedia.cloud"
}
{
  "id": 23620,
  "prefix": "deployment-mediawiki15.deployment-prep.eqiad1.wikimedia.cloud"
}
{
  "id": 23619,
  "prefix": "deployment-mediawiki16.deployment-prep.eqiad1.wikimedia.cloud"
}

$ tofu init
$ tofu import 'module.mediawiki.cloudvps_puppet_prefix.vm["15"]' 23620
Restricted Application added a project: tools-infrastructure-team. · View Herald TranscriptAug 29 2026, 4:58 AM
• bd808 added a comment.Aug 29 2026, 5:03 AM

The problem that T436412: [tofu-cloudvps] cloudvps_puppet_prefix.hiera is not idempotent and should be discusses as "the second issue" is the use case that led me to submit this feature request to provide a work around.

• bd808 renamed this task from [tofu-cloudvps] Add support for importing legacy cloudvps_puppet_prefix objects to [tofu-cloudvps] Document importing legacy cloudvps_puppet_prefix objects.Aug 31 2026, 1:55 AM
• bd808 added a project: Documentation.
• bd808 updated the task description. (Show Details)
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits