Problem
After making changes to VCS connection (e.g. re-authorizing it), webhooks are showing 401 errors on the VCS side as below:
In details, the following error message below is displayed:
{"errors":["vcs repo no longer connected to a workspace"],"success":false}
This error is also visible in tfe-sidekiq log file (example from the Support Bundle collected from the affected TFE instance):
[ERROR] resource=Vcs::WebhookPayloadProcessorWorker msg=Received error parsing the webhook_payload exception=401 Unauthorized webhook_payload_id=59885 service_provider=bitbucket_hosted vcs_repo_external_id=vcrepo-Ua6bKLzxkmppmmML metadata={"request_id"=>"3008623a-24bd-4098-a3a3-4940deaf5a8a", "start_time"=>1701378786123} jid=1acc5328bfa9e6b77868da0d
Cause
When a VCS connection is modified, the existing webhooks for all modules associated with the old VCS connection become invalidated.
Solutions:
You will need to delete the entire module, followed by re-publishing that module to your organization.
The process of publishing a module will also import all the previous valid tags or versions of that module.
There are 2 possible ways to do that:
-
UI
-
API
- List all modules for the organization
- Run the Get a Module API and parse the response to identify modules without a Webhook URL.
- For each module that does not have a Webhook URL, export the
vcs-repo
from thecurl
response from the API above:
"vcs-repo": {
"branch": "",
"ingress-submodules": true,
"identifier": "lafentres/terraform-aws-my-module",
"display-identifier": "lafentres/terraform-aws-my-module",
"oauth-token-id": "ot-hmAyP66qk2AMVdbJ",
5. Add a module back with using the vcs-repo
information from the previous API in the payload
Outcome
These steps will re-register the Webhook, and you will be able to publish new releases to your modules.