fix: Prevent download terraform with version 1.8.2 or higher

[stasostrovskyi]

what

Short-term fix for #4471. With this change Atlantis will only download terraform version 1.8.1 or lower, still respecting constraints set in required_version field. If required_version is set to >=1.8.2 or higher Atlantis will fallback to default version.

why

Terraform packaging was changed in release 1.8.2 (see https://github.com/hashicorp/terraform/releases/tag/v1.8.2) and Atlantis throws an error for every default and custom workflow when trying to download it. Proper, long-term fix is described here - #4472 (comment).

tests

I have added two test cases to an existing test, but haven't run full Atlantis with this change.

references

• See Autodownloading Terraform 1.8.2 breaks Atlantis entirely #4471 and expected a single file: /tmp/getter3359610012/archive: Downloading terraform Version 1.8.2 #4472 for more info about issue and various workarounds.

[MicheleArturo]

In my opinion this change is useless as client can set terraform required version upper-bound constrain to "< 1.8.2".

[stasostrovskyi]

In my opinion this change is useless as client can set terraform required version upper-bound constrain to "< 1.8.2".

How many repositories you have in your org to fix? :) Also, this is counter-productive in general. People should be able to use any terraform version they want, by providing version(s) in custom image, this change just prevents auto-download function from failing.

[lukemassa]

I tested the code manually and it worked as expected.

Branch	Required version string	Outcome
main	>= 1.5.5	Fails to download 1.8.2
main	>= 1.5.5, < 1.8.2	Successfully downloads and runs 1.8.1
stasostrovskyi:prevent_latest_tf_download	>= 1.5.5	Successfully downloads and runs 1.8.1
stasostrovskyi:prevent_latest_tf_download	>= 1.5.5, < 1.8.2	Successfully downloads and runs 1.8.1

[lukemassa]

In my opinion this change is useless as client can set terraform required version upper-bound constrain to "< 1.8.2".

How many repositories you have in your org to fix? :) Also, this is counter-productive in general. People should be able to use any terraform version they want, by providing version(s) in custom image, this change just prevents auto-download function from failing.

I agree with @stasostrovskyi. IMO this is an issue with atlantis so should be solved at the atlantis level. Having users put "< 1.8.2" in repositories that have terraform that don't actually have such a constraint is confusing. This change makes atlantis have identical behavior that it had yesterday, which is if we specify latest (or something like it) you get 1.8.1. If users actually need some feature in 1.8.2, they can specify that in their required version, and this code will now correctly not attempt to download that version, since it's incompatible w atlantis.

Longer term, we likely should figure out how to extract the binary from >=1.8.2 versions, then we won't need this constraint, but this is a reasonable workaround until then.

[nitrocode]

There is a test failure. Please fix

test failure

[BioEricSalter]

We're affected by this as well and troubleshooting led me here. I very much appreciate the effort shown here and I understand the desire for a quick fix. Would it not be better though to go ahead and implement the library described in this comment? That seems like a better plan than having a hack workaround in the Atlantis repository.

For a quick workaround though, having this change available as an image (with no intent to merge) seems like a good temporary plan to me.

[stasostrovskyi]

There is a test failure. Please fix

It fails on every single PR, and fix for it is here - #4462

[lukemassa]

There is a test failure. Please fix

It fails on every single PR, and fix for it is here - #4462

I agree this is the known issue, should not affect this PR. @nitrocode any concerns?

[lukemassa]

We're affected by this as well and troubleshooting led me here. I very much appreciate the effort shown here and I understand the desire for a quick fix. Would it not be better though to go ahead and implement the library described in this comment? That seems like a better plan than having a hack workaround in the Atlantis repository.

For a quick workaround though, having this change available as an image (with no intent to merge) seems like a good temporary plan to me.

I agree we should investigate alternatives as recommended by terraform, but that will be a larger change and might necessitate a minor release.

As for not producing a release, I personally feel as I mention in my comment above #4474 (comment) that this is now a bug in atlantis and so warrants a release in atlantis.

[jamengual]

We will patch the 0.27.2 and later release the 0.28.0

[lukemassa]

/cherry-pick 0.27

[lukemassa]

/cherry-pick release-0.27

[nitrocode]

It would be nice if this value was condigurable. I recall a ticket from a frustrated user that could not set the maximum version allowed across their terraform

[nitrocode]

#3199 (comment)

[nitrocode]

Thanks again for this fix!