[FEAT] Add Ignore changes for docker_image tag

[vladciobancai]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Hi,

We would like to request a new feature that will ignore docker image tag if the the tag has been changed outside of terraform. For example, we created the resources with terraform and we use azure devops pipeline to build and deploy the app where the tag is changed and applied on app service but terraform knows about the old image.

Thank you

New or Affected Resource(s)/Data Source(s)

app_service_linux_container

Potential Terraform Configuration

No response

References

No response

[BzSpi]

Hello,

Thank you for this issue, this is a tricky one.
We are aware of this limitation but we do not know how to manage this since Terraform does not allow dynamic "ignore_changes" and we do not always want to ignore this setting.
This feature would do the trick hashicorp/terraform#27360

Waiting for this, you can implement a data source in your Terraform code to fetch the deployed version and pass it to the app service Terraform module.
If you have any other implementation idea, let us know.

[vladciobancai]

Hi,

Another suggestion would be in modules/container-web-app/r-appservice.tf after this line https://github.com/claranet/terraform-azurerm-app-service/blob/master/modules/container-web-app/r-appservice.tf#L335 to be added

  lifecycle {
    ignore_changes = [
      backup[0].storage_account_url,
      site_config[0].application_stack[0].docker_image_name,
    ]
  }

also after line https://github.com/claranet/terraform-azurerm-app-service/blob/master/modules/container-web-app/r-appservice.tf#L646 to be added

  lifecycle {
    ignore_changes = [
      site_config[0].application_stack[0].docker_image_name,
    ]
  }

[BzSpi]

Indeed, but this implies that you cannot change the image anymore in Terraform.
Since some use cases require it, we chose not to implement it this way.

[vladciobancai]

You're right, thank you . We will wait for hashicorp/terraform#27360 to be implemented.

[BzSpi]

I reopen this issue to keep track of this limitation, which is pretty annoying.

[xi4n]

I quite surprisingly find here actually none of the Claranet azurerm modules supports a custom ignore_changes, which makes this Terraform feature useless. Sometimes it can be quite useful for example when you want Terraform to generate an initial password (VM, DB...) then leave it there. You definitely wouldn't like Terraform to set it back after it's been changed or do other crazy stuffs in your pipelines to prevent Terraform from doing so in its next apply.

[BzSpi]

Hello @xi4n

As stated earlier, dynamic lifecycle meta argument is not supported and therefore cannot be used as module input.
In addition of the Terraform issue mentioned above, OpenTofu has also an issue opened for this subject opentofu/opentofu#1329

Be sure we'll update the modules accordingly as soon as OpenTofu get rid of it since we also wait it for a long time.