Skip to content

fix(file_storage): tolerate released private IP during mount target read (GetPrivateIp 404 wedges refresh) - #2593

Open
dee-kryvenko wants to merge 1 commit into
oracle:masterfrom
dee-kryvenko:fix-mount-target-read-private-ip-404
Open

fix(file_storage): tolerate released private IP during mount target read (GetPrivateIp 404 wedges refresh)#2593
dee-kryvenko wants to merge 1 commit into
oracle:masterfrom
dee-kryvenko:fix-mount-target-read-private-ip-404

Conversation

@dee-kryvenko

Copy link
Copy Markdown

Problem

The File Storage service releases a mount target's private IP early in the deletion flow, while GetMountTarget keeps returning the record — in DELETING and then DELETED state — still carrying the stale privateIpIds reference. The mount target resource read hydrates ip_address/hostname_label from that reference unconditionally (setPrivateIpDetails), so GetPrivateIp returns 404 and the entire refresh fails:

Error: Error returned by VirtualNetwork Service. Http Status Code: 404. Error Code: NotAuthorizedOrNotFound.
Operation Name: GetPrivateIp
  with oci_file_storage_mount_target.fss["this"]

Impact

Any plan/apply/destroy that refreshes state while a mount target deletion is in flight hits this. The most damaging shape: a multi-resource destroy issues the mount target deletion, fails on an unrelated transient elsewhere in the graph, and then every retry fails at refresh on the 404 — permanently, until the deleted record ages out server-side (observed 40+ minutes). The only recovery is a manual terraform state rm. We reproduced this in CI on two independent clusters the same day (each froze at the identical refresh point), and then minimally on a scratch configuration.

Reproduction (provider 8.25.0)

  1. Create a mount target with a minimal config, terraform apply.
  2. Delete it out of band: oci fs mount-target delete --mount-target-id ....
  3. Observe the service behavior (the root of the issue):
MT=DELETING private-ip-ids=["ocid1.privateip.oc1.iad.aaaa..."]
MT=DELETED  private-ip-ids=["ocid1.privateip.oc1.iad.aaaa..."]   # stale reference retained
  1. terraform plan -refresh-only → fails with the GetPrivateIp 404 above.

Fix

Two guards in file_storage_mount_target_resource.go:

  1. Skip private IP hydration when the mount target is DELETING/DELETED — the privateIpIds reference is stale by definition in those states.
  2. Treat GetPrivateIp 404 as absent details rather than a read error — covering the race where the IP is already released but the lifecycle state has not flipped yet.

No schema changes; behavior for live mount targets is unchanged.

Verification

Same reproduction with the patched provider (dev_overrides):

# oci_file_storage_mount_target.repro has been deleted

Refresh converges cleanly (resource reported deleted and removed), and a subsequent destroy completes. Package builds and vets clean.


🤖 Generated with Claude Code

The File Storage service releases a mount target's private IP early in
the deletion flow, while GetMountTarget keeps returning the record (in
DELETING and then DELETED state) still carrying the stale privateIpIds
reference. The resource read hydrates ip_address/hostname_label from
that reference unconditionally, so GetPrivateIp returns 404 and the
whole refresh fails.

Consequence: any plan/apply/destroy that refreshes state while a mount
target deletion is in flight - most commonly a destroy retry after an
unrelated transient failure - errors permanently with

    Error returned by VirtualNetwork Service. Http Status Code: 404.
    Operation Name: GetPrivateIp
    with oci_file_storage_mount_target.<name>

until the record ages out, and the state can only be recovered with a
manual 'terraform state rm'.

Fix, two guards:
- skip private IP hydration when the mount target is DELETING/DELETED
  (the reference is stale by definition there);
- treat GetPrivateIp 404 as absent details rather than a read error,
  covering the race where the IP is released before the lifecycle
  state flips.

Reproduced live on 8.25.0: create a mount target, delete it out of
band, 'terraform plan -refresh-only' fails with the 404; with this fix
the same refresh reports the resource as deleted and converges.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Dee Kryvenko <dmytro.kryvenko@paramount.com>
@oracle-contributor-agreement

Copy link
Copy Markdown

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

@oracle-contributor-agreement oracle-contributor-agreement Bot added the OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. label Jul 31, 2026
@tf-oci-pub tf-oci-pub added the Pending Test Pending Test label for PRs label Jul 31, 2026
@tf-oci-pub

Copy link
Copy Markdown
Member

Thank you for your valuable contribution. We greatly appreciate your efforts in submitting this pull request. However, I regret to inform you that we are unable to merge it directly on GitHub at this time.

Our internal policy requires that all pull requests undergo thorough local testing and review before they can be merged into the main codebase. This process ensures the quality and stability of Terraform-Provider-OCI.

We understand that this may cause some inconvenience, but please rest assured that your contribution is highly valued. Our team will carefully review and test your changes locally to ensure they meet our standards.

We appreciate your understanding and patience in this matter. If you have any questions or need further assistance, please don't hesitate to reach out. Thank you once again for your contribution.

@mbesh

mbesh commented Aug 5, 2026

Copy link
Copy Markdown
Member

Thanks @dee-kryvenko for the PR. Looks good. I will get this fix merged in.

@mbesh

mbesh commented Aug 14, 2026

Copy link
Copy Markdown
Member

This is now pending release.

varsha-ja-jain pushed a commit that referenced this pull request Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. Pending Test Pending Test label for PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants