Document tls issue and godebug usage

Snowflake-Labs · Mar 3, 2025 · 815eae5 · 815eae5
1 parent 6354dba
commit 815eae5
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/CREATING_ISSUES.md b/CREATING_ISSUES.md
@@ -292,3 +292,11 @@ during `terrform apply` they may fail with the `Error: Provider produced inconsi
 **Related issues:** [#2967](https://github.com/Snowflake-Labs/terraform-provider-snowflake/issues/2967)
 
 **Solution:** Either turn off the parameter or adjust your configurations to use only upper-cased names for identifiers and import back the resources.
+
+### Using Suricata-based firewalls (like AWS Network Firewall) with >=v1.0.4 version of the provider
+
+**Problem:** The communication from the provider is dropped, because of the firewalls that are incompatible with the `tlskyber` setting introduced in [Go v1.23](https://go.dev/doc/godebug#go-123).
+
+**Related issues:** [#3421](https://github.com/Snowflake-Labs/terraform-provider-snowflake/issues/3421)
+
+**Solution:** [Solution described in the migration guide for v1.0.3 to v1.0.4 upgrade](./MIGRATION_GUIDE.md#new-go-version-and-conflicts-with-suricata-based-firewalls-like-aws-network-firewall).
diff --git a/MIGRATION_GUIDE.md b/MIGRATION_GUIDE.md
@@ -12,6 +12,17 @@ across different versions.
 ### Fixed external_function VARCHAR return_type
 VARCHAR external_function return_type did not work correctly before ([#3392](https://github.com/Snowflake-Labs/terraform-provider-snowflake/issues/3392)) but was fixed in this version.
 
+### New Go version and conflicts with Suricata-based firewalls (like AWS Network Firewall)
+In this version we bumped our underlying Go version to v1.23.6.
+Based on issue [#3421](https://github.com/Snowflake-Labs/terraform-provider-snowflake/issues/3421)
+it seems it introduces changes to the standard library that may not be supported by other third party software.
+The issue presents one of those changes that seem to be introduced in Golang's network package.
+One thing that is valuable in such cases is to check the [GODEBUG](https://go.dev/doc/godebug)
+documentation page (especially [history section](https://go.dev/doc/godebug#history)).
+It specifies a set of parameters which can be turned on/off depending on
+what features of Go would you like to use or resign from. The solution for this issue was to set
+the GODEBUG environment variable to `GODEBUG=tlskyber=0`.
+
 ## v1.0.2 ➞ v1.0.3
 
 ### Fixed METRIC_LEVEL parameter