DEV Community: nomi3

How to Troubleshoot a Failed Re-creation of Google Cloud Certificate Manager Resources with Terraform

nomi3 — Tue, 21 Jan 2025 14:40:52 +0000

This note describes how to address an error that occurred when trying to recreate a certificate in Google Cloud’s Certificate Manager, which is managed via Terraform.

Note

This operation was performed in a development environment, so downtime during the troubleshooting process was not considered.

Versions

Terraform: 1.9.8
hashicorp/google: 6.16.0

Goal

We wanted to change the domain in the certificate from before.com to after.com, as shown below:

locals {
-  domain_name = "before.com"
+  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

resource "google_certificate_manager_certificate" "example" {
  name = var.prefix
  managed {
    domains = [
      local.domain_name,
      "*.${local.domain_name}"
    ]
    dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
  }
}

resource "google_certificate_manager_certificate_map_entry" "example" {
  name         = "example-certificate-map-entry"
  map          = google_certificate_manager_certificate_map.example.name
  matcher      = "PRIMARY"
  certificates = [google_certificate_manager_certificate.example.id]
}

Error Details

We encountered the following error:

Error: Error when reading or editing Certificate: googleapi: Error 400: can't delete certificate that is referenced by a CertificateMapEntry or other resources

Because the domain name change requires deleting and recreating the certificate, and the certificate is referenced by the certificate map entry, it cannot be deleted as is.

Solution

Below is the procedure used to resolve this issue.

Comment out the google_certificate_manager_certificate and google_certificate_manager_certificate_map_entry resources while changing the domain:

locals {
-  domain_name = "before.com"
+  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

-　resource "google_certificate_manager_certificate" "example" {
-   name = var.prefix
-   managed {
-     domains = [
-       local.domain_name,
-       "*.${local.domain_name}"
-     ]
-     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
-   }
- }

- resource "google_certificate_manager_certificate_map_entry" "example" {
-   name         = "example-certificate-map-entry"
-   map          = google_certificate_manager_certificate_map.example.name
-   matcher      = "PRIMARY"
-   certificates = [google_certificate_manager_certificate.example.id]
- }
+ # resource "google_certificate_manager_certificate" "example" {
+ #   name = var.prefix
+ #   managed {
+ #     domains = [
+ #       local.domain_name,
+ #       "*.${local.domain_name}"
+ #     ]
+ #     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
+ #   }
+ # }
+
+ # resource "google_certificate_manager_certificate_map_entry" "example" {
+ #   name         = "example-certificate-map-entry"
+ #   map          = google_certificate_manager_certificate_map.example.name
+ #   matcher      = "PRIMARY"
+ #   certificates = [google_certificate_manager_certificate.example.id]
+ # }

After making these changes, run:

terraform apply

Uncomment the two resources:

locals {
  domain_name = "after.com"
}

resource "google_certificate_manager_dns_authorization" "example" {
  name   = "example-dns-authorization"
  domain = local.domain_name
}

resource "google_certificate_manager_certificate_map" "example" {
  name = "example-certificate-map"
}

- # resource "google_certificate_manager_certificate" "example" {
- #   name = var.prefix
- #   managed {
- #     domains = [
- #       local.domain_name,
- #       "*.${local.domain_name}"
- #     ]
- #     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
- #   }
- # }
-
- # resource "google_certificate_manager_certificate_map_entry" "example" {
- #   name         = "example-certificate-map-entry"
- #   map          = google_certificate_manager_certificate_map.example.name
- #   matcher      = "PRIMARY"
- #   certificates = [google_certificate_manager_certificate.example.id]
- # }
+ resource "google_certificate_manager_certificate" "example" {
+   name = var.prefix
+   managed {
+     domains = [
+       local.domain_name,
+       "*.${local.domain_name}"
+     ]
+     dns_authorizations = [google_certificate_manager_dns_authorization.example.id]
+   }
+ }

+ resource "google_certificate_manager_certificate_map_entry" "example" {
+   name         = "example-certificate-map-entry"
+   map          = google_certificate_manager_certificate_map.example.name
+   matcher      = "PRIMARY"
+   certificates = [google_certificate_manager_certificate.example.id]
+ }

Finally, run:

terraform apply

This procedure updates the certificate domain successfully.

How to Handle a Failed Deletion of Resources (Including Google Cloud Storage) in Terraform

nomi3 — Mon, 20 Jan 2025 15:10:47 +0000

When managing Google Cloud resources with Terraform, you may encounter a situation where destroying development environment resources fails because force_destroy is set to false on a Cloud Storage bucket. As a result, some resources remain in a partially deleted state. Here’s how to resolve this issue.

Versions

Terraform: 1.10.4
hashicorp/google: 6.16.0

Steps

First, set force_destroy to true on the relevant Cloud Storage bucket:

resource "google_storage_bucket" "example" {
  name     = "example-bucket"
  location = "US"
  // force_destroy = false
  force_destroy = true
}

resource "another_resource" "example" {
  name   = "example-object"
}

Next, update only the Cloud Storage bucket by specifying it as the target. (If you run terraform apply without specifying a target, resources such as another_resource that were previously deleted will be recreated.)

terraform apply -target=google_storage_bucket.example

Finally, run destroy again:

terraform destroy

By doing this, the Cloud Storage bucket and any remaining resources will be properly deleted.

How to Override Decorator Arguments in Python

nomi3 — Thu, 09 Jan 2025 14:08:34 +0000

To override the decorator arguments used in a parent class method within a child class, you need to override the method in the child class. Simply declaring new class variables with the same names will not affect the decorator arguments unless you explicitly redefine the method.

Sample Code

Save the following as test.py

def my_decorator_with_args(param1, param2):
    """Decorator that takes arguments"""

    def actual_decorator(func):
        def wrapper(self, *args, **kwargs):
            print(f"[Decorator] param1={param1}, param2={param2}")
            return func(self, *args, **kwargs)

        return wrapper

    return actual_decorator


class BaseClass:
    @my_decorator_with_args(param1="BASE_PARAM1", param2="BASE_PARAM2")
    def greet(self):
        print("Hello from BaseClass!")


class DerivedClass(BaseClass):
    """
    Intending to override the decorator arguments by defining class variables,
    but since greet() itself is not redefined (overridden),
    the parent class's decorator is actually used as is.
    """

    param1 = "DERIVED_PARAM1"
    param2 = "DERIVED_PARAM2"
    # greet() is intentionally not redefined


class DerivedClassOverride(BaseClass):
    """
    This pattern redefines (overrides) the greet() method
    to change the decorator arguments.
    """

    @my_decorator_with_args(param1="OVERRIDE_PARAM1", param2="OVERRIDE_PARAM2")
    def greet(self):
        print("Hello from DerivedClassOverride!")


if __name__ == "__main__":
    print("=== BaseClass's greet ===")
    b = BaseClass()
    b.greet()

    print("\n=== DerivedClass's greet (without override) ===")
    d = DerivedClass()
    d.greet()

    print("\n=== DerivedClassOverride's greet (with override) ===")
    d_o = DerivedClassOverride()
    d_o.greet()

then run:

python test.py

Result

=== BaseClass's greet ===
[Decorator] param1=BASE_PARAM1, param2=BASE_PARAM2
Hello from BaseClass!

=== DerivedClass's greet (without override) ===
[Decorator] param1=BASE_PARAM1, param2=BASE_PARAM2
Hello from BaseClass!

=== DerivedClassOverride's greet (with override) ===
[Decorator] param1=OVERRIDE_PARAM1, param2=OVERRIDE_PARAM2
Hello from DerivedClassOverride!

Creating a Local Environment to Operate GCS Emulator from Flask

nomi3 — Fri, 03 Jan 2025 12:57:48 +0000

When creating an application that manipulates GCS (Google Cloud Storage) through Flask on Cloud Run, I wanted to use a GCS emulator in the local environment. This document describes how to set up such an environment.

Emulator to Use

fsouza/fake-gcs-server

Sample code

I created sample code in the following repository. By following the instructions in README.md, you can use the GCS emulator in a local environment to upload, download, and delete files.

Since you can start everything simply by cloning the repository and running make up, setup is straightforward.

flask-gcs

Contents of docker-compose.yml

To use the GCS emulator in the Flask container, the STORAGE_EMULATOR_HOST environment variable is set:

services:
  app:
    environment:
      - STORAGE_EMULATOR_HOST=http://gcs:4443

Configuring Flask’s StorageClient

The STORAGE_EMULATOR_HOST environment variable is checked to determine whether to use the emulator:

def get_storage_client():
    emulator_host = Config.STORAGE_EMULATOR_HOST

    if emulator_host:
        client = storage.Client(
            credentials=AnonymousCredentials(),
            project="test",
        )
    else:
        client = storage.Client()

    return client

Conclusiuon

When building an application on Cloud Run that manipulates GCS through Flask, you might want to use a GCS emulator in your local environment. These are the setup steps. Note that in production you will not use the GCS emulator, so simply do not set the STORAGE_EMULATOR_HOST environment variable, specify your BUCKET_NAME, and grant the appropriate permissions to Cloud Run.