FYI: https://github.com/hashicorp/terraform/issues/35075

Atlantis needs to change a go library which is used to download tf binaries

Seems like we can do a couple things. 1. The fix a. Long term solution: Use the

hc-install

library that

radeksimko

mentioned b. (hack) Modify our current installation to have a slight change for terraform versions after

1.8.1

2. Alternatives a. Use opentofu b. Create a block list of versions for opentofu/terraform c. Create a max version to download versions for opentofu/terraform

and a bit of a code around it probably

Idk if we want to change the default as many tf users depend on that… but users can certainly modify it in their configuration

Hard to depend on something which is totally broken atm 🙂

I have maybe 1500 root dirs where the default terraform is set to 0.11, the versions range from 0.11 to 1.x and they all depend on the

release_version

unless they use the default which is 0.11. Changing the default of tf-download would be a breaking change for many of my root dirs.

tomorrow there can be 1.8.3 🙂

its not a long term solution lol

But I think Atlantis should do some quick-fix release, which will disallow downloading >= 1.8.1?

yes that would be nice. Please put in a PR 🙂

say here - https://github.com/runatlantis/atlantis/blob/main/server/core/terraform/terraform_client.go#L310 or here - https://github.com/runatlantis/atlantis/blob/main/server/core/terraform/terraform_client.go#L530

Atlantis should be best-effort. I like Stas' approach

Atlantis should be best-effort. I like Stas’ approach

so short-term you want to default tf-download to disable and release a new version ?

yes, agreed.

if users want >= 1.8.1, they can add the binary to the image themselves

My idea is to add one more constraint here - https://github.com/runatlantis/atlantis/blob/main/server/core/terraform/terraform_client.go#L340 - and hardcode it to

<= 1.8.1

. This will mean that new version will satisfy both

required_version

from terraform and our new limitation. It will also mean that there will be an error if

required_version

is set to

>= 1.8.2

or anything like that. What do you think?

fwiw I'm in the process of doing basically the equivalent in repos I own ^^

-  required_version = ">= v1.5.5"
+  required_version = ">= v1.5.5, < 1.8.2"

and it is working as expected

In our case, we just turned off tf-download, because we don't use that version in our custom workflow anyway 🙂

I’m almost confident in this change

You can merge the branch in your fork and your fork will automatically build a release image

That's true. I can also build and test locally, and I will do it tomorrow

I was able to test, worked as expected

Thanks for the PR, the automated tests, and the manual test!

As follow up from yesterday's incident I opened https://github.com/runatlantis/atlantis/issues/4483 to discuss long term solutions