fix: fix propagation issues in bootstrap on retry #1437
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Error and trigger of a retry Build was sucessful after the retry |
daniel-cit
requested review from
a team,
eeaton,
rjerrems and
sleighton2022
as code owners
…by VPC Service Controls
|
@apeabody Could you PTAL? |
|
/gemini review |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request addresses two separate issues: it adds explicit depends_on attributes to several Terraform resources to mitigate propagation delays during retries, and it removes an unsupported service from the VPC Service Controls configuration. The changes are generally good and address the stated goals. I have one suggestion to make one of the new dependencies more specific, which should improve the robustness of the fix.
| role = "roles/artifactregistry.reader" | ||
| member = "serviceAccount:${google_service_account.terraform-env-sa[each.key].email}" | ||
|
|
||
| depends_on = [module.tf_source] |
There was a problem hiding this comment.
For better dependency clarity and robustness, it's recommended to make this dependency more specific. This resource grants permissions on an Artifact Registry repository, which is created by module.tf_cloud_builder. While module.tf_cloud_builder depends on module.tf_source, explicitly depending on module.tf_cloud_builder ensures that the repository is fully created before attempting to modify its IAM policy. This makes the configuration more resilient to potential race conditions related to the repository's creation.
depends_on = [module.tf_cloud_builder]
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a set of depends to the module that creates the CI/CD project to prevent errors when granting roles to resources in that project during a retry of execution.
Additionally this PR also fixes an error related to the service 'alpha-documentai.googleapis.com' not being supported any more as a restricted service in VPC-SC