search

CiscoISE / terraform-provider-ciscoise

Terraform Provider for Cisco ISE
https://registry.terraform.io/providers/CiscoISE/ciscoise/latest/docs
MIT License
10 stars 4 forks source link

Destroyed resource 'ciscoise_trusted_certificate_import' does not delete the certificate from ISE #59

Closed aussietexan closed 2 years ago

aussietexan commented 2 years ago

Environment:

ISE version and patch: ISE 3.1 patch 3
Terraform version: 1.2.3
ISE provider version: 0.6.8-beta
OS version: MacOS 12.6

Describe the bug Using the resource 'ciscoise_trusted_certificate_import' with the required parameters works as expected to imported a CA certificate into the ISE Trusted Certificates store. When executing 'terraform destroy' however, only the terraform state is destroyed. The destroy operation does not delete the certificate from ISE, even though there are no dependencies on that certificate. The admin is forced to login to the ISE GUI and manually delete the certificate.

Deleting the certificate via the OpenAPI using the {id} parameter used by the API works correctly. https://developer.cisco.com/docs/identity-services-engine/v1/#!certificate-openapi

Expected behavior When destroying the resource, the DELETE API should be called to delete the certificate from ISE using the {id} parameter tracked by the TF state.

API 200 Response { "response": { "message": "Trusted certificate deleted successfully" }, "version": "1.0.1" }

fmunozmiranda commented 2 years ago

@aussietexan Could you please active debug and pass me answer please?

To active debug please export this env variables:


set -x ISE_DEBUG 'true'
set -x TF_LOG 'DEBUG'
aussietexan commented 2 years ago

Hi Francisco,

Please find attached the output from ‘terraform destroy’ after enabling those debug env variables.

Please let me know if you need any additional info.

Thanks, Greg

From: Francisco Muñoz Miranda @.> Date: Tuesday, 11 October 2022 at 11:51 am To: CiscoISE/terraform-provider-ciscoise @.> Cc: greg aussietexan.com @.>, Author @.> Subject: Re: [CiscoISE/terraform-provider-ciscoise] Destroyed resource 'ciscoise_trusted_certificate_import' does not delete the certificate from ISE (Issue #59)

Could you please active debug and pass me answer please?

To active debug:

set -x ISE_DEBUG 'true'

set -x TF_LOG 'DEBUG'

— Reply to this email directly, view it on GitHubhttps://github.com/CiscoISE/terraform-provider-ciscoise/issues/59#issuecomment-1273952676, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUVNKME2XLPNYLXO57SSH4TWCS22HANCNFSM6AAAAAARBYU2YU. You are receiving this because you authored the thread.Message ID: @.***>

@. ise-certificate]$ @. ise-certificate]$ set -x ISE_DEBUG 'true' @.*** ise-certificate]$ set -x TF_LOG 'DEBUG'

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:

Terraform will perform the following actions:

ciscoise_system_certificate_import.admin-cert-ise31-2 will be destroyed

Plan: 0 to add, 0 to change, 2 to destroy.

Do you really want to destroy all resources? Terraform will destroy all your managed infrastructure, as shown above. There is no undo. Only 'yes' will be accepted to confirm.

Enter a value: yes

ciscoise_system_certificate_import.admin-cert-ise31-2: Destroying... [id=1665454629] ciscoise_system_certificate_import.admin-cert-ise31-2: Destruction complete after 0s ciscoise_trusted_certificate_import.root-ca-ise31-2: Destroying... [id=1665454628] ciscoise_trusted_certificate_import.root-ca-ise31-2: Destruction complete after 0s

Destroy complete! Resources: 2 destroyed.

fmunozmiranda commented 2 years ago

Hey @aussietexan , as you can see in documentation, this is not a complete resource, it just do import action, you can't handle it as a conventional resource:

Documentation:

https://registry.terraform.io/providers/CiscoISE/ciscoise/latest/docs/resources/trusted_certificate_import

May be you can handle it with this resource, try it and let us know if it works for you:

Resource:

https://registry.terraform.io/providers/CiscoISE/ciscoise/latest/docs/resources/trusted_certificate

aussietexan commented 2 years ago

Hi Francisco,

I did see the text in the ‘trusted_certificate’ documentation stating “This resource deletes a Trust Certificate from Trusted Certificate Store based on a given ID.” It’s not clear, however, how this resource can be used to trigger the DELETE API call.

Is there a ‘delete’ option for the ‘status’ parameter or how would the delete be done?

Thanks, Greg

From: Francisco Muñoz Miranda @.> Date: Wednesday, 12 October 2022 at 3:16 am To: CiscoISE/terraform-provider-ciscoise @.> Cc: greg aussietexan.com @.>, Mention @.> Subject: Re: [CiscoISE/terraform-provider-ciscoise] Destroyed resource 'ciscoise_trusted_certificate_import' does not delete the certificate from ISE (Issue #59)

Hey @aussietexanhttps://github.com/aussietexan , as you can see in documentation, this is not a complete resource, it just do import action, you can't handle it as a conventional resource:

Documentation:

https://registry.terraform.io/providers/CiscoISE/ciscoise/latest/docs/resources/trusted_certificate_import

May be you can handle it with this resource, try it and let us know if it works for you:

Resource:

https://registry.terraform.io/providers/CiscoISE/ciscoise/latest/docs/resources/trusted_certificate

— Reply to this email directly, view it on GitHubhttps://github.com/CiscoISE/terraform-provider-ciscoise/issues/59#issuecomment-1274949455, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AUVNKMGA4IXX3H4QMTVNJNLWCWHE3ANCNFSM6AAAAAARBYU2YU. You are receiving this because you were mentioned.Message ID: @.***>

fmunozmiranda commented 2 years ago

Here's a work arround:

resource "ciscoise_trusted_certificate_import" "example" {
  provider = ciscoise
  lifecycle {
    create_before_destroy = true
  }
  parameters {
    allow_basic_constraint_cafalse         = "false"
    allow_out_of_date_cert                 = "false"
    allow_sha1_certificates                = "false"
    data                                   = file("./file.pem")
    description                            = "string"
    name                                   = "Test"
    trust_for_certificate_based_admin_auth = "false"
    trust_for_cisco_services_auth          = "false"
    trust_for_client_auth                  = "false"
    trust_for_ise_auth                     = "false"
    validate_certificate_extensions        = "false"
  }
}

resource "ciscoise_trusted_certificate" "example" {
  provider = ciscoise
  parameters {
    id = ciscoise_trusted_certificate_import.example.item[0].id
    name                                   = "Test"
  }
}

With this you can handle certificates. Try it and tell us if it works for you.

aussietexan commented 2 years ago

Hi @fmunozmiranda. I tested adding the "ciscoise_trusted_certificate" resource block (with the 0.6.9-beta version) and confirmed that the 'terraform destroy' does indeed delete the certificate from the ISE node.