bcrypt does not work in tf v0.12.24 on the console

[everflux]

Terraform Version

Terraform v0.12.24

Terraform Configuration Files

...

Crash Output

$ terraform console
> bcrypt("demo")

>  
Error: Result depends on values that cannot be determined until after "terraform apply".

Expected Behavior

As documented in https://www.terraform.io/docs/configuration/functions/bcrypt.html a crypt output

Actual Behavior

Error message from terraform

Steps to Reproduce

1. terraform console
2. bcrypt("sample")

[danieldreier]

I've reproduced this on 0.13.0 beta 1.

[apparentlymart]

This behavior arises because bcrypt is one of a small number of functions that isn't a proper function in that it returns a different value each time it's called. To deal with that, Terraform arranges for it to return an unknown value during every phase except the apply phase, thus modelling the fact that its final result during apply can't be predicted until we're actually doing the apply operation. The same is true for timestamp and uuid, for the same reason.

With that said, there isn't really any harm in these functions working in terraform console: they'd just produce a throwaway result that can be viewed in the console but would never be returned again by a future call. The console results are already throwaway (we never use them to drive any externally-visible side-effects), and making these functions work there would be convenient for folks who are using the console mainly just to rehearse expressions they might put in configuration later.

To get this done, we could add the "eval" walk as a third exception to the rule, in addition to the apply and destroy walks:

terraform/terraform/evaluate.go

Lines 70 to 77 in 098428d

	func (e *Evaluator) Scope(data lang.Data, self addrs.Referenceable) *lang.Scope {
	return &lang.Scope{
	Data: data,
	SelfAddr: self,
	PureOnly: e.Operation != walkApply && e.Operation != walkDestroy,
	BaseDir: ".", // Always current working directory for now.
	}
	}

The terraform console command uses walkEval, which is a special walk type that we use only to resolve input variables, local values, and output values in preparation for using their results as part of console expressions. The eval walk is explicitly documented as being for "expression evaluation only", so it's reasonable for it to be able to evaluate "impure functions" because any use of its results for externally-visible side-effects would be outside of its documented purpose. (It also, currently, has no caller aside from the terraform console command, so we can tailor it to what that command needs.)

[alisdair]

This issue was fixed in #25442, and released as part of 0.13.0-beta3:

$ terraform-0.13.0-beta3 console
> bcrypt("demo")
$2a$10$WcIqvrHZhjTnh3Pv26igIu1usjuLymR5bbSD8VyeBG3T2dgpLNY7i

[mcwienczek]

So no plans to backport this functionality to 0.12?

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.