uyuni-project/sumaform (github.com/uyuni-project/sumaform, 79 stars, pinned by commit not tag), module.server slice of its AWS backend
Source: https://github.com/uyuni-project/sumaform.git at c8a590801d0c7f60d9667f03391455a897900078.
Set: core. Lane: opentofu-native.
Why it is in the core set: a real project built for OpenTofu specifically, so OpenTofu-only surface is exercised
Not clear yet.
| Stage | Verdict | Detail |
|---|---|---|
| Cold deploy | pass | 11 managed resource instances, genuinely cold, genuinely unmarked |
| Migrate | pass | 7 stamped, 2 recorded (markers = record honoured at migrate time, GitHub issue #365 slice 2), 0 failed, 2 skipped |
| Replan from nothing | pass | Items 4, 5 and 6 (this script’s header) are all FIXED and the plan is genuinely empty (“No changes. Your infrastructure matches the configuration.”): live-import honours markers = record (located records for aws_instance.instance[0] and aws_ebs_volume.data_disk[0], confirmed at the store and by value against the AWS CLI both right after migrate and again after this empty replan), residue now covers NestingList/NestingSet/NestingMap blocks (internal/live/projection’s residueEligibleBlock, widened from the block’s SHAPE - whether carriesNoInformation can tell its absence from a real empty answer - never from a type name), and lex00/floci#103 (published in ghcr.io/lex00/floci@sha256:e16d9007a03093b6a6edd22273dee9d8253131f18581b0fa20ae6d34178a3079) now honours RunInstances’ BlockDeviceMapping.Ebs.VolumeSize for the root device, closing the one line (root_block_device.volume_size = 8 -> 200) that was this crossing’s own last wall. Plan moved 3 to add/0/0 (the original ABSENT gap) -> 2 to add/0/2 to destroy (item 4 fixed, item 5’s replacement exposed) -> 0 to add/1 to change/0 to destroy (item 5 fixed) -> empty (item 6 fixed by the emulator). |
| No-op apply | pass | genuine no-op: 7 tagged objects before, 7 after, no state file either time; module.server’s record-based instance and volume identities unchanged |
| Drift and reconverge | pass | the crossing VPC’s Name tag tampered out of band, plan proposed fixing exactly aws_vpc.crossing, apply changed 1 and reconverged the tag to sumaform-crossing-vpc; module.server’s record-based identities unaffected |
| Rename | pass | moved block: aws_eip.crossing_nat renamed with zero churn (0 add, 1 change, 0 destroy), marker rewritten in place; live-mv: aws_route_table.crossing_public renamed with zero churn, marker rewritten in place; stock oracle over the same two-object rename on cold_deploy’s own state also shows zero churn (0 add, 0 change, 0 destroy); both live ids unchanged, read via the AWS CLI |
| Remove a block | pass | choudoufu: deleting module.server’s block proposed exactly three destroys (0 add, 0 change, 3 destroy: the record-based instance and EBS volume, plus the untaggable/derived volume attachment), applied cleanly (0 added, 0 changed, 3 destroyed), the instance and volume are genuinely gone from the live account (instance State=terminated, volume absent, read via the AWS CLI, not choudoufu’s own report), and the next plan proposes no resource action; stock oracle on cold_deploy’s own state (E-ORACLE) also proposes the same three destroys |
| Change count (planned) | not run | |
| Replace with create_before_destroy | not run | |
| Crash between create and destroy (planned) | not run | |
| Teardown (planned) | not run | |
| Plan, review, apply (planned) | not run | |
| Greenfield apply | FAIL | the crossing VPC’s cidr differs: greenfield=172.31.0.0/16 oracle=172.16.0.0/16 |
| Strict profile (planned) | not run |
Last run at commit 28035177a6 on 2026-08-25T17:47:54Z, exit code 0.
Landed d583dc93b7 (2026-08-18) - the FIRST OpenTofu-native estate crossed (uyuni-project’s own maintainers describe it as “OpenTofu configuration,” not “Terraform configuration”), versus every prior estate tonight being Terraform-authored/OpenTofu-compatible via terraform-aws-modules. Deliberately reduced slice: the full main.tf.aws.example composes four AWS host roles from one leaf module, backend_modules/aws/host, but three of the four (bastion, module.mirror, module.minion) have no root-facing toggle to disable real SSH/Salt provisioning - the “real boot behavior, out of scope for an emulator” case. Only module.server exposes provision=false; module.base’s own network submodule was also unusable (create_network=true needs CreateDhcpOptions/ReplaceRouteTableAssociation, neither implemented in floci), so this estate’s own plain VPC/subnet/NAT resources stand in for it. A real floci gap found and fixed on the way: sumaform’s ami.tf evaluates ~23 data “aws_ami” blocks unconditionally (one per supported guest OS) regardless of which single image an estate actually launches, and floci’s catalog had zero SUSE/Marketplace/Rocky/RHEL entries - seeded 20, reconciled into the combined image alongside tonight’s other three floci fixes. cold_deploy and migrate genuinely pass (11 resources, 9 of 11 stamped - 2 correctly untaggable). test_plan blocked by two real, structural rules baked into backend_modules/aws/host itself (the one leaf module every AWS host role shares, so this isn’t an artifact of the reduced slice), and on reading both rules’ own reasoning neither looks like a choudoufu defect - both are correct, deliberate refusals, not filed: (1) an unconditional, provisioner-less connection block that checkProvisioners flags on its own terms by documented design, dead code in sumaform’s own module; (2) lifecycle { ignore_changes = [tags] } on the WHOLE tags argument of aws_instance.instance and aws_ebs_volume.data_disk - sumaform’s own comment explains why (SUSE’s internal AWS accounts add tags on apply that need preserving), but ignoring the whole argument also silently discards the update that would write tofu-address/tofu-estate, the exact marker-safety failure #306 was about tonight. The fix sumaform’s own error text names - ignore_changes = [tags[“Owner”]], not the whole argument - is an edit to sumaform’s module, out of scope here. Follow-up pass 2026-08-18 (#313 cross-check, fresh worktree, real run): confirmed neither of the two RULE-classified refusals above is #313’s wall - zero occurrences of its diagnostic in the raw plan output. Both remain exactly as already documented: permanent, deliberate refusals (checkProvisioners on a dead-code connection block; ignore_changes on the whole tags argument), not filed as new issues, no action needed.
Reproduce it#
go run ./tools/gauntlet run corpus-sumaform-awsNeeds Docker (the emulator is pulled at the pinned digest), the AWS CLI, and a
stock terraform or tofu binary on PATH for the cold deploy. The script is
live/e2e/corpus-sumaform-aws/run.sh; BREAK=1 corrupts its assertions to show they are load-bearing.