Improve error reporting for external data sources

[antspy]

Hi,

I am having trouble debugging an external data source error using terragrunt.

The first problem is that terragrunt moves and executes the scripts in a temporary directory, so I cannot reference other scripts using relative paths. This was hard to debug already, but now I am trying to use absolute paths - with the caveat that I need them to run both locally and on github actions.

My main.tf file contains the following:

data "external" "container_sha" {
  program = [
    "bash", "./get_container_sha.sh",
    "${local.artifact_registry_path}",
    "${var.container_tag}"
  ]
}


locals {
  container_sha          = data.external.container_sha.result["container_sha"]
}

While the get_container_sha.sh script contains the following:

if [[ -v GITHUB_WORKSPACE ]]; then
  ROOT="${GITHUB_WORKSPACE}";
elif [[ -v WORKSPACE ]]; then
  ROOT="${WORKSPACE}";
else
  echo "Unable to find repo root" && exit 1;
fi

echo $("${ROOT}/src/mypath/get_container_sha.sh" "$1" "$2")

So the local script is just a way to compute the absolute path of the real script, passing the right arguments.

Anyway - everything works fine locally - terragrunt plan & apply all work fine, find the scripts, return the correct results, etc.
On github actions, the external data source breaks in a way that's impossible to debug - there is virtually no information given, simply 'script didn't work'. The output is not printed anywhere at any log level.

My github actions file:

      - name: temporary
        run: src/modules/cloud-run/get_container_sha.sh repo tag # <--- This works correctly!! 

      - name: Call terragrunt apply
        uses: gruntwork-io/terragrunt-action@v2
        env:
          GOOGLE_OAUTH_ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }}
        with:
          tf_version: "1.10.0"
          tg_version: "0.69.13"
          tg_dir: 'src/prod/cloud-run'
          tg_command: 'apply --terragrunt-log-level trace --terragrunt-debug'

The error message (see below) only says that something went wrong, but I cannot figure out what. How can I debug the script execution to understand what went wrong?

Calling the script by itself in a separate stage works fine and returns the correct results, it only breaks when terragrunt runs it (on github actions - it also works fine locally). I need to debug it from terragrunt perspective - but how?

Error message:

11:46:38.437 STDOUT terraform: data.external.container_sha: Reading...
11:46:38.666 STDERR terraform: ╷
11:46:38.666 STDERR terraform: │ Error: Unexpected External Program Results
11:46:38.666 STDERR terraform: │ 
11:46:38.666 STDERR terraform: │   with data.external.container_sha,
11:46:38.666 STDERR terraform: │   on main.tf line 19, in data "external" "container_sha":
11:46:38.666 STDERR terraform: │   19:   program = [
11:46:38.666 STDERR terraform: │   20:     "bash", "./get_container_sha.sh",
11:46:38.666 STDERR terraform: │   21:     "${local.artifact_registry_path}",
11:46:38.666 STDERR terraform: │   22:     "${var.container_tag}"
11:46:38.667 STDERR terraform: │   23:   ]
11:46:38.667 STDERR terraform: │ 
11:46:38.667 STDERR terraform: │ The data source received unexpected results after executing the program.
11:46:38.667 STDERR terraform: │ 
11:46:38.667 STDERR terraform: │ Program output must be a JSON encoded map of string keys and string values.
11:46:38.667 STDERR terraform: │ 
11:46:38.667 STDERR terraform: │ If the error is unclear, the output can be viewed by enabling Terraform's
11:46:38.667 STDERR terraform: │ logging at TRACE level. Terraform documentation on logging:
11:46:38.667 STDERR terraform: │ https://www.terraform.io/internals/debugging
11:46:38.667 STDERR terraform: │ 
11:46:38.667 STDERR terraform: │ Program: /usr/bin/bash
11:46:38.667 STDERR terraform: │ Result Error: unexpected end of JSON input
11:46:38.667 STDERR terraform: ╵

[yhakbar]

Hey @antspy ,

Take a look at HCL functions like the following:

• https://terragrunt.gruntwork.io/docs/reference/built-in-functions/#get_terragrunt_dir
• https://terragrunt.gruntwork.io/docs/reference/built-in-functions/#get_repo_root

They're designed to help you work out paths consistently when using Terragrunt, regardless of where you're using it.

The error that you're getting is coming from Terraform, not Terragrunt, which is why you might be having trouble troubleshooting it.

For what it's worth, you don't need to use a data "external" to get your container sha when working with Terragrunt.

You can resolve it with run_cmd, then pass it in as an input. I personally find it easier to reason about what's going on when I don't use things like data "external" in my .tf code, but you might prefer it this way.

[antspy]

Thanks a lot! I am now using get_repo_root, and it's working nicely :) [0]

The error that you're getting is coming from Terraform, not Terragrunt, which is why you might be having trouble troubleshooting it.

I see, thank you! It was indeed hard to troubleshoot. The issue turned out to be related to the fact that I was running the command using the terragrunt action, which runs the scripts inside a docker container where the environment is not what I expected it to be :)

Anyway, thanks a lot! :)

[0] Btw since it's a terragrunt-only function, I have added it as a terraform variable and in the terragrunt.hcl file I pass

inputs = {
  repo_root = get_repo_root()
}

Is this the intended way to use it?

[yhakbar]

If it works, it is! 😂

Terragrunt functions are meant to be used within Terragrunt HCL configurations. There are a couple ways that data can be pass to OpenTofu/Terraform configurations, and one of those is by setting inputs. Under the hood, what Terragrunt is doing is setting an appropriate environment variable that OpenTofu/Terraform expect to populate variables.

In this example, setting repo_root will populate the environment variable TF_VAR_repo_root, which is what OpenTofu/Terraform can use to populate the values of variables they define.

[antspy]

It does work! :D

Great, thanks for the explanation! :)