fix: Protect against concurrent terraform init

mafredri · mafredri · commit ca6b211db3da · 2022-08-04T12:08:55.000+03:00
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
@@ -23,6 +23,7 @@ import (
 )
 
 type executor struct {
+	initMu     sync.Locker
 	binaryPath string
 	cachePath  string
 	workdir    string
@@ -142,6 +143,19 @@ func (e executor) init(ctx context.Context, logr logger) error {
 		"-no-color",
 		"-input=false",
 	}
+
+	// When cache path is set, we must protect against multiple calls
+	// to `terraform init`.
+	//
+	// From the Terraform documentation:
+	//     Note: The plugin cache directory is not guaranteed to be
+	//     concurrency safe. The provider installer's behavior in
+	//     environments with multiple terraform init calls is undefined.
+	if e.cachePath != "" {
+		e.initMu.Lock()
+		defer e.initMu.Unlock()
+	}
+
 	return e.execWriteOutput(ctx, args, e.basicEnv(), outWriter, errWriter)
 }
 
diff --git a/provisioner/terraform/serve.go b/provisioner/terraform/serve.go
@@ -3,6 +3,7 @@ package terraform
 import (
 	"context"
 	"path/filepath"
+	"sync"
 
 	"github.com/cli/safeexec"
 	"github.com/hashicorp/go-version"
@@ -109,15 +110,20 @@ func Serve(ctx context.Context, options *ServeOptions) error {
 }
 
 type server struct {
+	// initMu protects against executors running `terraform init`
+	// concurrently when cache path is set.
+	initMu sync.Mutex
+
 	binaryPath string
 	cachePath  string
 	logger     slog.Logger
 }
 
-func (t server) executor(workdir string) executor {
+func (s *server) executor(workdir string) executor {
 	return executor{
-		binaryPath: t.binaryPath,
-		cachePath:  t.cachePath,
+		initMu:     &s.initMu,
+		binaryPath: s.binaryPath,
+		cachePath:  s.cachePath,
 		workdir:    workdir,
 	}
 }
