lobeck commented 1 month ago

Confirmation

[X] This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
[X] I have searched the issue tracker and my issue isn't already found.
[X] I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.7.5 on darwin_arm64

provider registry.terraform.io/cloudflare/cloudflare v4.37.0
provider registry.terraform.io/hashicorp/aws v5.43.0
provider registry.terraform.io/hashicorp/http v3.4.3

Affected resource(s)

cloudflare_ruleset

Terraform configuration files

import {
  to = cloudflare_ruleset.http_request_cache_settings
  id = "zone/${cloudflare_zone.<redacted>.id}/2a26e884f96549fe9f93d500447e823d"
}

resource "cloudflare_ruleset" "http_request_cache_settings" {
  kind    = "zone"
  name    = "http_request_cache_settings"
  phase   = "http_request_cache_settings"
  zone_id = cloudflare_zone.<redacted>.id
  rules {
    action = "set_cache_settings"
    action_parameters {
      cache = true
      edge_ttl {
        mode = "bypass_by_default"
      }
      browser_ttl {
        mode = "respect_origin"
      }
      serve_stale {
        disable_stale_while_updating = false
      }
    }
    description = "<redacted>"
    enabled     = true
    expression  = "(starts_with(http.request.uri, \"/v1/<redacted>\"))"
  }
}

Link to debug output

see below

Panic output

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1038af5fc]

goroutine 46 [running]:
github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets.toRulesetResourceModel({0x1049cce68, 0x14000e3da40}, {0x40?, {0x14000c81ec0?, 0x14000c81ea0?}}, {0x20?, {0x0?, 0x0?}}, {{0x14000bc501b, 0x20}, ...})
    github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets/resource.go:624 +0x305c
github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets.(*RulesetResource).Read(0x14000c84610, {0x1049cce68, 0x14000e3da40}, {{{{0x1049d4208, 0x14000e7eb40}, {0x1043ed4a0, 0x14000e7db60}}, {0x1049d7838, 0x14000d98230}}, 0x14000c84620, ...}, ...)
    github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets/resource.go:209 +0x3e4
github.com/hashicorp/terraform-plugin-framework/internal/fwserver.(*Server).ReadResource(0x140005f0000, {0x1049cce68, 0x14000e3da40}, 0x14000e3dad0, 0x14000d7b608)
    github.com/hashicorp/terraform-plugin-framework@v1.10.0/internal/fwserver/server_readresource.go:117 +0x698
github.com/hashicorp/terraform-plugin-framework/internal/proto6server.(*Server).ReadResource(0x140005f0000, {0x1049cce68?, 0x14000e3d920?}, 0x14000e103c0)
    github.com/hashicorp/terraform-plugin-framework@v1.10.0/internal/proto6server/server_readresource.go:55 +0x314
github.com/hashicorp/terraform-plugin-mux/tf6muxserver.(*muxServer).ReadResource(0x1049ccea0?, {0x1049cce68?, 0x14000e3d620?}, 0x14000e103c0)
    github.com/hashicorp/terraform-plugin-mux@v0.16.0/tf6muxserver/mux_server_ReadResource.go:35 +0x184
github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server.(*server).ReadResource(0x14000ba0320, {0x1049cce68?, 0x14000e3ce10?}, 0x140005cd8f0)
    github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov6/tf6server/server.go:784 +0x224
github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6._Provider_ReadResource_Handler({0x1048d3760?, 0x14000ba0320}, {0x1049cce68, 0x14000e3ce10}, 0x14000e0ae80, 0x0)
    github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go:482 +0x164
google.golang.org/grpc.(*Server).processUnaryRPC(0x14000c04200, {0x1049cce68, 0x14000e3cd80}, {0x1049d5220, 0x14000a58300}, 0x14000e3b200, 0x14000934de0, 0x1057f3ae8, 0x0)
    google.golang.org/grpc@v1.63.2/server.go:1369 +0xba0
google.golang.org/grpc.(*Server).handleStream(0x14000c04200, {0x1049d5220, 0x14000a58300}, 0x14000e3b200)
    google.golang.org/grpc@v1.63.2/server.go:1780 +0xc80
google.golang.org/grpc.(*Server).serveStreams.func2.1()
    google.golang.org/grpc@v1.63.2/server.go:1019 +0x8c
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 52
    google.golang.org/grpc@v1.63.2/server.go:1030 +0x150

Expected output

resource import and diff

Actual output

crash

Steps to reproduce

create a cache rule in the ui and select "Add setting"

This will expand the rule like this:

Screenshot 2024-07-12 at 12 46 34

In the API, this causes the following response:

    "action_parameters": {
      "cache": true,
      "edge_ttl": {
        "mode": "bypass_by_default"
      },
      "browser_ttl": {
        "mode": "respect_origin"
      },
      "serve_stale": {}
    }

Note the empty serve_stale map.

When looking at the panic, it crashes while it's trying to read DisableStaleWhileUpdating / disable_stale_while_updating

https://github.com/cloudflare/terraform-provider-cloudflare/blob/master/internal/framework/service/rulesets/resource.go#L624

Additional factoids

No response

References

No response

github-actions[bot] commented 1 month ago

Community Note

Voting for Prioritization

Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

If you are interested in working on this issue, please leave a comment.
If this would be your first contribution, please review the contribution guide.

github-actions[bot] commented 1 month ago

Thank you for reporting this issue! For maintainers to dig into issues it is required that all issues include the entirety of TF_LOG=DEBUG output to be provided. The only parts that should be redacted are your user credentials in the X-Auth-Key, X-Auth-Email and Authorization HTTP headers. Details such as zone or account identifiers are not considered sensitive but can be redacted if you are very cautious. This log file provides additional context from Terraform, the provider and the Cloudflare API that helps in debugging issues. Without it, maintainers are very limited in what they can do and may hamper diagnosis efforts.

This issue has been marked with triage/needs-information and is unlikely to receive maintainer attention until the log file is provided making this a complete bug report.

lobeck commented 1 month ago

Alternatively someone needs to address this to CF.

After removing the flag and having it set through terraform, the api reports it as follow:

      "serve_stale": {
        "disable_stale_while_updating": false
      }

This is now also parseable by the provider and doesn't panic anymore.

shokerplz commented 4 days ago

Can confirm this issue, adding disable_stale_while_updating section via UI without enabling it crashes terraform provider

cloudflare / terraform-provider-cloudflare

crash on cloudflare_ruleset import with empty serve_stale #3452