You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When the state of a dependency is encrypted and the dependency is not initialised, any terragrunt command in the dependant module fails.
Steps To Reproduce
Create two terraform modules A and B.
B is a dependency of A.
run terraform apply in both.
verify terragrunt plan works in A.
rm -rf .terragrunt-cache in B.
verify terragrunt plan still works in A
encrypt the state of B and rm -rf .terraform-cache again.
run terragrunt plan in A.
A fails with:
ERROR Failed to execute "tofu output -json"in ../B/.terragrunt-cache/779213818
│ Error: Required plugins are not installed
un-encrypt state of B and rm -rf .terraform-cache.
verify terragrunt plan works again in A.
I created a minimal example repo unfortunately in this minimal setup I can not reproduce the issue.
Any advice what I should look out for in my real production setup, that could make the difference?
Expected behavior
State encryption does not alter the behaviour of dependencies
Versions
Terragrunt version: 0.68.3
OpenTofu/Terraform version: 1.8.3
Environment details: MacOS, can reproduce in CI under Ubuntu22.04
If you need further details I am happy to help out.
The text was updated successfully, but these errors were encountered:
16:59:56.571 STDERR [../B] tofu: Error loading state: Unsupported state file format: This state file is encrypted and can not be read without an encryption configuration
The encryption config for B is added via a generate block, like in my example. But I notice, that after the failed run .terragrunt-cache in B is empty. Is this somehow an issue of order of execution maybe?
I think the main difference between the example and my real environment is the example using local state.
Indeed!
When using a remote_state {} block in my example I can reproduce the issue.
So my guess is remote state is accessed before the generate blocks are executed? And therefore the encryption config is missing, if it is defined in a generate block.
Describe the bug
When the state of a dependency is encrypted and the dependency is not initialised, any
terragrunt
command in the dependant module fails.Steps To Reproduce
terraform apply
in both.terragrunt plan
works in A.rm -rf .terragrunt-cache
in B.terragrunt plan
still works in Arm -rf .terraform-cache
again.terragrunt plan
in A.rm -rf .terraform-cache
.terragrunt plan
works again in A.I created a minimal example repo unfortunately in this minimal setup I can not reproduce the issue.
Any advice what I should look out for in my real production setup, that could make the difference?
Expected behavior
State encryption does not alter the behaviour of dependencies
Versions
If you need further details I am happy to help out.
The text was updated successfully, but these errors were encountered: