Changing dnacenter_reserve_ip_subpool resource generates invalid payload and fails

mschedrin commented 1 year ago

Prerequisites

[x] Have you tested the operation in the API directly?
[x] Do you have the latest Terraform provider version?

Describe the bug Changing dnacenter_reserve_ip_subpool resource generates invalid payload and fails. Here is the payload generated by the provider

==============================================================================
~~~ REQUEST ~~~
PUT  /dna/intent/api/v1/reserve-ip-subpool/38c697bd-18a6-4334-b7ec-de039b1b276b?id=4621b079-bbe4-4da3-a87f-9966d20fd36c  HTTP/1.1
HOST   : 198.18.133.101
HEADERS:
    Accept: application/json
    Content-Type: application/json
    User-Agent: go-resty/2.7.0 (https://github.com/go-resty/resty)
    X-Auth-Token: <redacted>
BODY   :
{
   "name": "NW02_CORP_VN",
   "ipv4DhcpServers": [
      "2.2.2.2"
   ],
   "ipv4DnsServers": [
      "2.2.2.2"
   ],
   "ipv6PrefixLength": 0,
   "ipv6TotalHost": 0,
   "ipv4GateWay": "88.88.2.1"
}
------------------------------------------------------------------------------

DNAC does not like ipv6PrefixLength=0:

BODY         :
{
   "bapiKey": "6992-d8ec-42cb-88f1",
   "bapiName": "Update Reserve IP Subpool",
   "bapiExecutionId": "7489c197-a44c-4aef-b941-ecf0bd8bbb5f",
   "startTime": "Tue Nov 22 17:55:24 UTC 2022",
   "startTimeEpoch": 1669139724611,
   "endTime": "Tue Nov 22 17:55:32 UTC 2022",
   "endTimeEpoch": 1669139732107,
   "timeDuration": 7496,
   "status": "FAILURE",
   "bapiError": "{\"status\":false,\"errorMessage\":[\"Invalid ipv6 prefix length (0).\"]}",
   "runtimeInstanceId": "DNACP_Runtime_d79fe928-d415-4deb-a9a0-4a914c07f507"
}

Terraform is not supposed to change any ipv6 related parameters, here is relevant output from tf plan:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # dnacenter_reserve_ip_subpool.this["NW02_CORP_VN"] will be updated in-place
  ~ resource "dnacenter_reserve_ip_subpool" "this" {
        id   = "name:=NW02_CORP_VN\\site_id:=38c697bd-18a6-4334-b7ec-de039b1b276b"
        # (1 unchanged attribute hidden)

      ~ parameters {
            name               = "NW02_CORP_VN"
          ~ site_id            = "38c697bd-18a6-4334-b7ec-de039b1b276b" -> "0019e6b9-3b45-4212-9033-3946c60501f6"
            # (13 unchanged attributes hidden)
        }
    }

Relevant terraform output:

dnacenter_reserve_ip_subpool.this["NW02_CORP_VN"]: Modifying... [id=name:=NW02_CORP_VN\site_id:=38c697bd-18a6-4334-b7ec-de039b1b276b]
dnacenter_reserve_ip_subpool.this["NW02_CORP_VN"]: Still modifying... [id=name:=NW02_CORP_VN\site_id:=38c697bd-18a6-4334-b7ec-de039b1b276b, 10s elapsed]
╷
│ Error: Failure when executing UpdateReserveIPSubpool
│
│   with dnacenter_reserve_ip_subpool.this["NW02_CORP_VN"],
│   on ip_pool_reserve.tf line 2, in resource "dnacenter_reserve_ip_subpool" "this":
│    2: resource "dnacenter_reserve_ip_subpool" "this" {
│
╵

TF debug log: tf.log

Expected behavior Correct payload not containing unchanged values should be generated. Variables "ipv6PrefixLength": 0, "ipv6TotalHost": 0 are not supposed to be added to payload.

Screenshots

Environment (please complete the following information):

Cisco DNA Center version and patch: 2.3.3.4-72142
Terraform version: 1.3.4
Cisco DNA Center provider version: 1.0.13-beta
OS Version: macOS 12.6.1

fmunozmiranda commented 1 year ago

Hi @mschedrin in version 1.0.14-beta of provider this issue should be solved, test it and if it works for you feel free to close this issue, opposite case comment us if it doesn't work.

mschedrin commented 1 year ago

It still does not work as expected. Here is the change I have attempted to push:

Terraform will perform the following actions:

  # dnacenter_reserve_ip_subpool.this["NW02_1"] will be updated in-place
  ~ resource "dnacenter_reserve_ip_subpool" "this" {
        id   = "name:=NW02_1\\site_id:=f9f1284c-5380-4386-93a3-ed4d19299d9c"
        # (1 unchanged attribute hidden)

      ~ parameters {
          ~ ipv4_gate_way      = "88.88.2.1" -> "88.88.3.1"
          ~ ipv4_subnet        = "88.88.2.0" -> "88.88.3.0"
            name               = "NW02_1"
            # (12 unchanged attributes hidden)
        }
    }

In the debug log I can see that the provider has generated BODY without ipv4_subnet field, additionally it has added unnecessary fields that are not supposed to be changed: name, ipv4DhcpServers, ipv4DnsServers.

==============================================================================
~~~ REQUEST ~~~
PUT  /dna/intent/api/v1/reserve-ip-subpool/f9f1284c-5380-4386-93a3-ed4d19299d9c?id=bd06efee-ed35-452b-9e45-dbb8f8c73bc4  HTTP/1.1
HOST   : 198.18.133.101
HEADERS:
    Accept: application/json
    Content-Type: application/json
    User-Agent: go-resty/2.7.0 (https://github.com/go-resty/resty)
    X-Auth-Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MWQyMzIxYWZiODI0NTMzZTA4YjVjZWQiLCJhdXRoU291cmNlIjoiaW50ZXJuYWwiLCJ0ZW5hbnROYW1lIjoiVE5UMCIsInJvbGVzIjpbIjYxZDIzMjE5ZmI4MjQ1MzNlMDhiNWNlYyJdLCJ0ZW5hbnRJZCI6IjYxZDIzMjE4ZmI4MjQ1MzNlMDhiNWNlYSIsImV4cCI6MTY2OTkwNDcwNCwiaWF0IjoxNjY5OTAxMTA0LCJqdGkiOiIyODE1YTI2NC0yYjBhLTRlZmYtYjQ4ZC1mZjZjNWRkYTVmNTEiLCJ1c2VybmFtZSI6ImFkbWluIn0.opv8sHQqCSwTRkYwdIs9OaOGrO8YEmI3lScIgdMEG_Dhx5Hbk8u0687jqD5N9W2ggXrWFhA0KPVgF5FHHbFUmDv4HgcZs8p2Xa-VBUwU9bpyIoj6nU3QKRSox9QY_JaiQTRyFEhIgxiRK5rNtrxGusITVw-u5XPGJO4uiPznKmjbTXwducuZ8yD6ob0-y-QiBDrzmHTGQ71wBAA1g22_dq7WApd_xUZ5Y-Q75IRM-qgDbaEYUYP_tlPq0x7xNIUnWiEwiwzaicx0UZPzk9dkFlXs7oEp2eGBMbaGRMF0upiyW4ity3kkIujWy_XE7ljOn1FH5oRFNRJsdUVK_JCrgg
BODY   :
{
   "name": "NW02_1",
   "ipv4DhcpServers": [
      "2.2.2.2"
   ],
   "ipv4DnsServers": [
      "2.2.2.2"
   ],
   "ipv4GateWay": "88.88.3.1"
}

TF state before change in case you need that:

> terraform state show dnacenter_reserve_ip_subpool.this[\"NW02_1\"]
# dnacenter_reserve_ip_subpool.this["NW02_1"]:
resource "dnacenter_reserve_ip_subpool" "this" {
    id   = "name:=NW02_1\\site_id:=f9f1284c-5380-4386-93a3-ed4d19299d9c"
    item = [
        {
            group_name     = "NW02_1"
            group_owner    = "DNAC"
            id             = "bd06efee-ed35-452b-9e45-dbb8f8c73bc4"
            ip_pools       = [
                {
                    client_options          = jsonencode({})
                    configure_external_dhcp = "false"
                    context                 = [
                        {
                            context_key   = "siteId"
                            context_value = "f9f1284c-5380-4386-93a3-ed4d19299d9c"
                            owner         = "DNAC"
                        },
                        {
                            context_key   = "reserved_by"
                            context_value = "DNAC"
                            owner         = "DNAC"
                        },
                    ]
                    create_time             = 1669899522560
                    dhcp_server_ips         = [
                        "\"2.2.2.2\"",
                    ]
                    dns_server_ips          = [
                        "\"2.2.2.2\"",
                    ]
                    gateways                = [
                        "88.88.2.1",
                    ]
                    group_uuid              = "bd06efee-ed35-452b-9e45-dbb8f8c73bc4"
                    id                      = "f41c2519-ebea-4b66-9f30-f714360a97cd"
                    ip_pool_cidr            = "88.88.2.0/24"
                    ip_pool_name            = "NW02_1"
                    ipv6                    = "false"
                    last_update_time        = 1669899522616
                    overlapping             = "false"
                    owner                   = "DNAC"
                    parent_uuid             = "0927f307-166f-42ff-899a-ff0e3a98c79d"
                    shared                  = "true"
                    total_ip_address_count  = 256
                    used_ip_address_count   = 0
                    used_percentage         = "0"
                },
            ]
            site_hierarchy = "Global/Norway/Southern Norway/NW02"
            site_id        = "f9f1284c-5380-4386-93a3-ed4d19299d9c"
            type           = "generic"
        },
    ]

    parameters {
        ipv4_dhcp_servers  = [
            "2.2.2.2",
        ]
        ipv4_dns_servers   = [
            "2.2.2.2",
        ]
        ipv4_gate_way      = "88.88.2.1"
        ipv4_global_pool   = "88.88.0.0/16"
        ipv4_prefix        = "true"
        ipv4_prefix_length = 24
        ipv4_subnet        = "88.88.2.0"
        ipv4_total_host    = 0
        ipv6_prefix_length = 0
        ipv6_total_host    = 0
        name               = "NW02_1"
        site_id            = "f9f1284c-5380-4386-93a3-ed4d19299d9c"
        type               = "Generic"
    }
}

mschedrin commented 1 year ago

Additionally DNAC provides quite controversial reply in execution status. It reports both error and success. Terraform provider interprets resource change to be successful, however it should be fail. Here I think it needs to be fixed in DNAC API, but until this is done the provider should handle error, I suppose. Are you able to report bug to DNAC team if you agree with my logic?

==============================================================================
~~~ REQUEST ~~~
GET  /dna/intent/api/v1/dnacaap/management/execution-status/7b2fde2d-e6b6-4444-b1fc-f11c9b7aa680  HTTP/1.1
HOST   : 198.18.133.101
HEADERS:
    Accept: application/json
    Content-Type: application/json
    User-Agent: go-resty/2.7.0 (https://github.com/go-resty/resty)
    X-Auth-Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2MWQyMzIxYWZiODI0NTMzZTA4YjVjZWQiLCJhdXRoU291cmNlIjoiaW50ZXJuYWwiLCJ0ZW5hbnROYW1lIjoiVE5UMCIsInJvbGVzIjpbIjYxZDIzMjE5ZmI4MjQ1MzNlMDhiNWNlYyJdLCJ0ZW5hbnRJZCI6IjYxZDIzMjE4ZmI4MjQ1MzNlMDhiNWNlYSIsImV4cCI6MTY2OTkwNDcwNCwiaWF0IjoxNjY5OTAxMTA0LCJqdGkiOiIyODE1YTI2NC0yYjBhLTRlZmYtYjQ4ZC1mZjZjNWRkYTVmNTEiLCJ1c2VybmFtZSI6ImFkbWluIn0.opv8sHQqCSwTRkYwdIs9OaOGrO8YEmI3lScIgdMEG_Dhx5Hbk8u0687jqD5N9W2ggXrWFhA0KPVgF5FHHbFUmDv4HgcZs8p2Xa-VBUwU9bpyIoj6nU3QKRSox9QY_JaiQTRyFEhIgxiRK5rNtrxGusITVw-u5XPGJO4uiPznKmjbTXwducuZ8yD6ob0-y-QiBDrzmHTGQ71wBAA1g22_dq7WApd_xUZ5Y-Q75IRM-qgDbaEYUYP_tlPq0x7xNIUnWiEwiwzaicx0UZPzk9dkFlXs7oEp2eGBMbaGRMF0upiyW4ity3kkIujWy_XE7ljOn1FH5oRFNRJsdUVK_JCrgg
BODY   :
***** NO CONTENT *****
------------------------------------------------------------------------------
~~~ RESPONSE ~~~
STATUS       : 200 OK
PROTO        : HTTP/1.1
RECEIVED AT  : 2022-12-01T14:25:09.659221+01:00
TIME DURATION: 61.436459ms
HEADERS      :
    Cache-Control: no-store
    Connection: keep-alive
    Content-Length: 696
    Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data:
    Content-Type: application/json
    Date: Thu, 01 Dec 2022 13:25:09 GMT
    Info: This API is deprecated. Please use the URI : /dnacaap/management/executions/status/{bapiExecutionId}
    Pragma: no-cache
    Server: webserver
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Via: api-gateway
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-Request-Id: a232ca4f77a194b13c3dcf52589273ba
    X-Xss-Protection: 1
BODY         :
{
   "bapiKey": "6992-d8ec-42cb-88f1",
   "bapiName": "Update Reserve IP Subpool",
   "bapiExecutionId": "7b2fde2d-e6b6-4444-b1fc-f11c9b7aa680",
   "startTime": "Thu Dec 01 13:25:04 UTC 2022",
   "startTimeEpoch": 1669901104572,
   "endTime": "Thu Dec 01 13:25:08 UTC 2022",
   "endTimeEpoch": 1669901108270,
   "timeDuration": 3698,
   "status": "SUCCESS",
   "bapiSyncResponse": "{\"name\":\"NW02_1\",\"result\":\"Subpool Creation did not complete successfully. FailureReason: NCIP10237: Failed to update group NW02_1 because: NCIP10077: Invalid gateway 88.88.3.1 for network 88.88.2.0/24.\",\"status\":\"False\"}",
   "runtimeInstanceId": "DNACP_Runtime_2dd5ff17-d747-4b52-90b2-a7d03ac434cb"
}

fmunozmiranda commented 1 year ago

Hey @mschedrin , in DNA Center documentation payload for PUT is:

{
    "name": "string",
    "ipv6AddressSpace": "boolean",
    "ipv4DhcpServers": [
        "string"
    ],
    "ipv4DnsServers": [
        "string"
    ],
    "ipv6GlobalPool": "string",
    "ipv6Prefix": "boolean",
    "ipv6PrefixLength": "integer",
    "ipv6Subnet": "string",
    "ipv6GateWay": "string",
    "ipv6DhcpServers": [
        "string"
    ],
    "ipv6DnsServers": [
        "string"
    ],
    "ipv6TotalHost": "integer",
    "slaacSupport": "boolean",
    "ipv4GateWay": "string"
}

As you can see ipv4_subnet parameter is not in documentaion, if this documentation is wrong, could you help us with a valid payload to update it?

The bug of status Success is already reported to @zapodeanu , thanks for reporting. Thanks.

mschedrin commented 1 year ago

You are right, it seems that changing ipv4Prefix for ip subpool is not supported by API.

fmunozmiranda commented 1 year ago

Ok, if there´s anything else feel free to close the issue, or comment if there´s other problem.

cisco-en-programmability / terraform-provider-dnacenter

Changing dnacenter_reserve_ip_subpool resource generates invalid payload and fails #109