When we upgrade modules should be always ensure all namespaces have to to be tagged with latest versions?

[AntonyBishop]

Question: When we upgrade modules should be always ensure all namespaces have to to be tagged with latest versions?

We be good to understand what we do now, pros, cons, and alternatives?

Discuss!

[davidread]

I'd appreciate it someone can explain a bit about this question, for my benefit

[razvan-moj]

my take on this: if we keep the current rule, which is "en every release, the tag is changed for all using instances in the environments repo" this can be

• a bit nerve-wrecking
• discouraging breaking but useful changes

[jasonBirchall]

@davidread Currently, every release to a Terraform module (i.e. RDS) results in us having to make a commit in cloud platform namespaces that contains an RDS call to the module. Sometimes, as with RDS, you can be touching/upgrading as many as 150 RDS instances at once. Which is rather scary, as Raz mentions.

[razvan-moj]

Con: pinned modules can stray too much from current releases, blocking upgrades of the terraform binary or providers.

[razvan-moj]

a possible fix is to have all the needed binaries locally, feature possible since terraform 0.14

[jasonBirchall]

We manage out of date modules via the reports page. I feel this is quite effective and essentially nags you to upgrade.

[razvan-moj]

I feel maybe it nags the wrong channel, and teams may be more interested to fix/upgrade themselves if they have visibility into the reasons why the new release exists.

[jasonBirchall]

What would be the alternative to changing the pin in a module call? latest/main?

This brings its own set of problems.