revampd opened a new issue, #318:
URL: https://github.com/apache/cloudstack-terraform-provider/issues/318
### Summary
`cloudstack_network_acl_rule`'s read populates each rule's `cidr_list` and
`protocol` with the **rule's own UUID** instead of its actual CIDR list and
protocol, and sets `rule_number` to `0`. Because the values are wrong on read
rather than on write, no configuration can ever produce a clean plan for an
imported ACL list — every rule shows a permanent diff.
### Versions
| | |
|---|---|
| provider | 0.6.0 |
| OpenTofu | 1.12.2 |
| CloudStack | 4.22.1.0 |
### Reproduce
Against an existing VPC ACL list that has rules:
```hcl
import {
to = cloudstack_network_acl_rule.example
id = "69404a2d-b05c-4b9e-b7a1-a978f6a72f53" # a network ACL list id
}
```
```
tofu plan
```
### Actual
```
~ rule {
~ cidr_list = [
- "7c3f01f2-3bee-45b9-a59f-d7354ca41bbf",
+ "10.10.10.0/26",
]
~ protocol = "7c3f01f2-3bee-45b9-a59f-d7354ca41bbf" -> "all"
~ rule_number = 0 -> 1
+ action = "allow"
+ traffic_type = "ingress"
uuids = {
"7c3f01f2-3bee-45b9-a59f-d7354ca41bbf" =
"7c3f01f2-3bee-45b9-a59f-d7354ca41bbf"
}
}
```
The `-` side is what the provider read from CloudStack. `7c3f01f2-…` is the
rule's own UUID — the same value that (correctly) appears in the `uuids` map —
appearing in both `cidr_list` and `protocol`.
The corresponding `listNetworkACLs` response for that rule is well formed:
```json
{"number": 1, "protocol": "all", "cidrlist": "10.10.10.0/26",
"action": "Allow", "traffictype": "Ingress"}
```
### Expected
`cidr_list = ["10.10.10.0/26"]`, `protocol = "all"`, `rule_number = 1`, i.e.
the values `listNetworkACLs` returns.
### Notes
- `plan -generate-config-out` is affected too, emitting the same UUIDs into
`cidr_list`/`protocol` and `rule_number = 0`. That is a symptom of the same
read, not a separate bug: hand-writing the configuration from `listNetworkACLs`
(correct HCL, verified field by field) still produces the diff above, because
the comparison is correct-config against an incorrect read.
- Impact: ACL lists cannot be adopted into Terraform/OpenTofu state
usefully. For a drift-detection use case it is worse than not supporting import
at all, since every plan reports phantom changes on every rule.
- Happy to test a patch against 4.22.1.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
