Increased debug-ability

[RickardCardell]

What problem are you facing?

In some cases the apply fails with a 400 error and fails. But the output is quite sparse.
E.g in Azure when there's already an existing role-assignment:
Error: unexpected status 409 (409 Conflict) with error: RoleAssignmentExists: The role assignment already exists.
However, no sign of which role etc it was which makes it rather hard to debug.

When running TF locally one would set export TF_LOG=DEBUG and it will output a lot of useful information.
However, adding an env-var TF_LOG=DEBUG to the workspace doesn't seem to increase the logging in the TF-output on the opentofu provider-pod:

- apiVersion: opentofu.upbound.io/v1beta1
  kind: Workspace
  metadata:
    name: tofu-debug
  spec:
    deletionPolicy: Delete
    forProvider:
      enableTofuCLILogging: true
      entrypoint: ''
      env:
      - name: TF_LOG
        value: DEBUG
...

Neither setting it on the DeploymentRuntimeConfig seems to have any effect:

apiVersion: pkg.crossplane.io/v1beta1
kind: DeploymentRuntimeConfig
metadata:
  name: debug-config
spec:
  deploymentTemplate:
    spec:
      selector: {}
      template:
        spec:
          containers:
          - name: package-runtime
            args:
            - --debug
            env:
              - name: TF_LOG
                value: DEBUG
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-opentofu
spec:
  package: xpkg.upbound.io/upbound/provider-opentofu:v0.2.2
  runtimeConfigRef:
    apiVersion: pkg.crossplane.io/v1beta1
    kind: DeploymentRuntimeConfig
    name: debug-config

How could Upbound help solve your problem?

Add support for a debug-flag or enable setting TF_LOG env variable.
Please correct me if I'm doing something wrong when setting the flag or if there's already support for debugging the TF-run.

[Nepo26]

Any recommendation on what should be made to better debug?
@RickardCardell

[RickardCardell]

@Nepo26
I think I wrote it in the description but maybe it was unclear, so basically:
If the tofu-runtime and the tf-providers, i.e. azure-provider etc, could output debug-logs like they can locally, it would help a lot.
Preferably in the provider-tofu logs when some setting is enabled together with enableTofuCLILogging: true

Maybe in some cases one would like to mute the logs as well, like setting TF_LOG=WARN, so the best idea might be to be able to set the log-level. There's also other useful env-variables related to debugging that might be useful to set.