push_rule API call causes 404 with selft-hosted gitlab CE

[snake007v]

What happened?

In the case of self-hosted Gitlab CE it will cause a 404 error on push_rule API call as it's available only for EE.
This call can't be turned off and the error can't be handled.

Example

	// Create a new GitLab Group
	gitlabGroup, err := gitlab.NewGroup(ctx, gitlabGroupName, &gitlab.GroupArgs{
		Name: pulumi.String(gitlabGroupName),
		Path: pulumi.String(gitlabGroupName),
	}, pulumi.Provider(gitlabProvider))
	if err != nil {
		return nil, err
	}

Diagnostics:
  gitlab:index:Group (paas-vm2-test):
    error:   sdk/resource_gitlab_group.go:564: provider: [ERROR] Failed to get push rules for group: group_id=8081 error="GET https://git.xxx.com/api/v4/groups/8081/push_rule: 404 {error: 404 Not Found}" [email protected]	

Output of pulumi about

❯ pulumi about
CLI          
Version      3.103.1
Go Version   go1.21.5
Go Compiler  gc

Plugins
NAME  VERSION
go    unknown

Host     
OS       darwin
Version  14.1.1
Arch     arm64

This project is written in go: executable='/opt/homebrew/bin/go' version='go version go1.21.6 darwin/arm64'

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[iwahbe]

Hi @snake007v. Just to clarify, is the bug that a 404 is returned, or that the error can't be handled?

In the case of self-hosted Gitlab CE it will cause a 404 error on push_rule API call as it's available only for EE.

It sounds like the 404 is correct.

[snake007v]

Hi @iwahbe

Sorry if I wasn't clear in my initial report.
This bug is about the push_rule API call itself, which will be executed even if you don't configure any rules in your code(as you can see from my example). And there is no way to disable that call.

As a result, we will always get 404 error in case if you're creating a new group in GitlabCE.

[iwahbe]

Thanks for clarifying.

[Medialo]

Hi,

I have the same problem, so I have edited the terraform provider gitlab to not read push rules if Gitlab CE is used.
@snake007v if it can help you to build your own pulumi gitlab plugin : https://gitlab.com/Medialo/terraform-provider-gitlab

[qerub]

For the record: I'm running into the same unexpected error message on self-hosted GitLab EE too for groups with no configured push rule(s). Looks like https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/merge_requests/1730 (Add push rule support to group resource) wasn't fully baked. Code in question: https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/blob/684ed8e8/internal/provider/sdk/resource_gitlab_group.go#L576-579

By the way: @Medialo's patch has been merged upstream: https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/merge_requests/1891 (Fix: 404 on group creation on Pulumi with Gitlab CE)

[iwahbe]

@Medialo thanks for the patch and @qerub thanks for letting us know it has merged. As soon as upstream releases it should be available in pulumi-gitlab.

[Zacharieg]

Hi everyone, it seems that the error still stick around, even in the last version of pulumi gitlab (which use 17.1.0 of terraform provider). Do you have any news on this bug ? Have a great day 😁

[Medialo]

@Zacharieg I have no more error with my fix for my case with a gitlab CE for push rules.
I am going to test again with last version of gitlab provider and try to check that !

[skycaptain]

Just encountered the same issue. Upgrading pulumi-gitlab from v7.0.2 to latest v8.1.0 fixed the issue for me.

[skycaptain]

I need to make a correction. It seems the error did not reoccur after re-running the Pulumi project. However, when deploying the stack from scratch, I still encounter even with the latest v8.1.0:

  gitlab:index:Group (group):
    error:   sdk/resource_gitlab_group.go:576: provider: [ERROR] Failed to get push rules for group: error="GET https://[redacted]/api/v4/groups/2944/push_rule: 404 {message: 404 Not Found}" [email protected] group_id=2944

[qerub]

@skycaptain: Is this with GitLab EE? The Terraform provider is implemented in such a way that it might log this error but continue executing: https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/blob/0f680cfb7da857f233bee03e202f925345843ac6/internal/provider/sdk/resource_gitlab_group.go#L576-579

[skycaptain]

Yes, with v17.0.3-ee.

[Zacharieg]

Same for me, in GitLab EE 17.0... Is there a way to make those errors in warnings ? When creating several nested groups, it's really a problem because it does not create subgroups if parent creation failed (even if the parent is created)

[guineveresaenger]

Hi @skycaptain @Zacharieg - would it be possible for you to send us some logs for what you see?

• the verbose output of pulumi up - https://www.pulumi.com/docs/support/troubleshooting/#verbose-logging
• and also the GRPC logs: PULUMI_DEBUG_GRPC="grpc.jsonl"

Just to clarify - this is resulting in a hard error for you on the Pulumi side but you'd like it logged as a warning, which is what Terraform does?

Thank you!

[Zacharieg]

Thanks for your awnser @guineveresaenger 😁

In facts it appear that I was wrong, the execution does continue... So this is not a critical bug (but pretty annoying).

The weird behaviour seems to be on GitLab side, when no push rules are available, it return a 404 code, it's weird (but it's a choice I think)

I think the correct behaviour that pulumi should have here is too ignore the 404 error on push_rule when getting group information, because it seems to be a normal return if the group has no push rule (which is the case of many groups).

Just for info, here is the log of pulumi up :
out.txt
grpc.json

[guineveresaenger]

Hi @Zacharieg - sorry for the late reply here.

Thank you for the logs and the confirmation that execution continues.
Ideally, GitLab would of course not return an error here; which is the underlying bug.

This may be an instance of Pulumi too eagerly forwarding "errors" logged as warnings and we'll look into that as soon as we can.

[andiolsi]

Just fyi, the error disappeared for me after i just went and set pushRules: undefined.
Or at least it didn't get logged, however you wanna put it. In any case: Annoyance -> gone.

[iwahbe]

We can't repro, so it's hard to confirm, but I'm pretty sure that pulumi/pulumi-terraform-bridge#2686 will bring our behavior fully inline with the upstream provider here.