search

cloudflare / terraform-provider-cloudflare

Cloudflare Terraform Provider
https://registry.terraform.io/providers/cloudflare/cloudflare
Mozilla Public License 2.0
789 stars 610 forks source link

Provider 1.16.0 issue with cloudflare_zone_settings_override #388

Closed andrevdh closed 4 years ago

andrevdh commented 5 years ago

Terraform Version

Terraform v0.12.1

Affected Resource(s)

Please list the resources as a list, for example:

Terraform Configuration Files

# Zone settings override

resource "cloudflare_zone_settings_override" "default_zone_settings" {
  name = "${var.domain}"

  settings {
    always_online               = "${var.settings_always_online}"
    always_use_https            = "${var.settings_always_use_https}"
    automatic_https_rewrites    = "${var.settings_automatic_https_rewrites}"
    brotli                      = "${var.settings_brotli}"
    browser_check               = "${var.settings_browser_check}"
    cache_level                 = "${var.settings_cache_level}"
    challenge_ttl               = "${var.settings_challenge_ttl}"
    cname_flattening            = "${var.settings_cname_flattening}"
    development_mode            = "${var.settings_development_mode}"
    edge_cache_ttl              = "${var.settings_edge_cache_ttl}"
    hotlink_protection          = "${var.settings_hotlink_protection}"
    h2_prioritization           = "${var.settings_h2_prioritization}"
    http2                       = "${var.settings_http2}"
    image_resizing              = "${var.settings_image_resizing}"
    ip_geolocation              = "${var.settings_ip_geolocation}"
    ipv6                        = "${var.settings_ipv6}"
    max_upload                  = "${var.settings_max_upload}"
    mirage                      = "${var.settings_mirage}"
    opportunistic_encryption    = "${var.settings_opportunistic_encryption}"
    origin_error_page_pass_thru = "${var.settings_origin_error_page_pass_thru}"
    polish                      = "${var.settings_polish}"
    prefetch_preload            = "${var.settings_prefetch_preload}"
    privacy_pass                = "${var.settings_privacy_pass}"
    pseudo_ipv4                 = "${var.settings_pseudo_ipv4}"
    response_buffering          = "${var.settings_response_buffering}"
    rocket_loader               = "${var.settings_rocket_loader}"
    security_level              = "${var.settings_security_level}"
    server_side_exclude         = "${var.settings_server_side_exclude}"
    sort_query_string_for_cache = "${var.settings_sort_query_string_for_cache}"
    ssl                         = "${var.settings_ssl}"
    tls_1_2_only                = "${var.settings_tls_1_2_only}"
    tls_1_3                     = "${var.settings_tls_1_3}"
    tls_client_auth             = "${var.settings_tls_client_auth}"
    true_client_ip_header       = "${var.settings_true_client_ip_header}"
    waf                         = "${var.settings_waf}"
    webp                        = "${var.settings_webp}"
    websockets                  = "${var.settings_websockets}"

    minify {
      js   = "${var.settings_minify_js}"
      css  = "${var.settings_minify_css}"
      html = "${var.settings_minify_html}"
    }

    mobile_redirect {
      status           = "${var.settings_mobile_redirect_status}"
      mobile_subdomain = "${var.settings_mobile_redirect_mobile_subdomain}"
      strip_uri        = "${var.settings_mobile_redirect_strip_uri}"
    }

    security_header {
      enabled            = "${var.settings_security_header_enabled}"
      max_age            = "${var.settings_security_header_max_age}"
      include_subdomains = "${var.settings_security_header_include_subdomains}"
      preload            = "${var.settings_security_header_preload}"
      nosniff            = "${var.settings_security_header_nosniff}"
    }
  }
}

Debug Output

Error: error from makeRequest: HTTP status 400: content "{\"success\":false,\"errors\":[{\"code\":1006,\"message\":\"Unrecognized zone setting name\"},{\"code\":1006,\"message\":\"Unrecognized zone setting name\"}],\"messages\":[],\"result\":null}"

  on main.tf line 20, in resource "cloudflare_zone_settings_override" "default_zone_settings":
  20: resource "cloudflare_zone_settings_override" "default_zone_settings" {

Expected Behavior

terraform wants to make a change to the zone settings as 2 new fields h2_prioritization and image_resizing have been added recently - from "" to "off" - so we are adding them in as code

Actual Behavior

The terraform apply is failing as the new fields are invalid according to the apply stage validator

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

  1. terraform plan
  2. terraform apply
andrevdh commented 5 years ago

plan output is here: 

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # cloudflare_zone_settings_override.default_zone_settings will be updated in-place
  ~ resource "cloudflare_zone_settings_override" "default_zone_settings" {
        id                       = "0151ec703d9be0104be35f89edda8f3d"
        initial_settings         = [
            {
                always_online               = "on"
                always_use_https            = "off"
                automatic_https_rewrites    = "off"
                brotli                      = "on"
                browser_cache_ttl           = 14400
                browser_check               = "on"
                cache_level                 = "aggressive"
                challenge_ttl               = 1800
                cname_flattening            = "flatten_at_root"
                development_mode            = "off"
                edge_cache_ttl              = 7200
                email_obfuscation           = "on"
                h2_prioritization           = ""
                hotlink_protection          = "off"
                http2                       = "on"
                image_resizing              = ""
                ip_geolocation              = "on"
                ipv6                        = "on"
                max_upload                  = 100
                min_tls_version             = ""
                minify                      = [
                    {
                        css  = "off"
                        html = "off"
                        js   = "off"
                    },
                ]
                mirage                      = "off"
                mobile_redirect             = [
                    {
                        mobile_subdomain = ""
                        status           = "off"
                        strip_uri        = false
                    },
                ]
                opportunistic_encryption    = "on"
                opportunistic_onion         = ""
                origin_error_page_pass_thru = "off"
                polish                      = "off"
                prefetch_preload            = "off"
                privacy_pass                = "on"
                pseudo_ipv4                 = "off"
                response_buffering          = "off"
                rocket_loader               = "off"
                security_header             = [
                    {
                        enabled            = false
                        include_subdomains = false
                        max_age            = 0
                        nosniff            = false
                        preload            = false
                    },
                ]
                security_level              = "medium"
                server_side_exclude         = "on"
                sha1_support                = "off"
                sort_query_string_for_cache = "off"
                ssl                         = "full"
                tls_1_2_only                = "off"
                tls_1_3                     = "on"
                tls_client_auth             = "off"
                true_client_ip_header       = "off"
                waf                         = "off"
                webp                        = "off"
                websockets                  = "on"
            },
        ]
        initial_settings_read_at = "2018-07-23T13:40:18.353708Z"
        name                     = "xxxxxxx"
        readonly_settings        = [
            "advanced_ddos",
        ]

      ~ settings {
            always_online               = "off"
            always_use_https            = "off"
            automatic_https_rewrites    = "off"
            brotli                      = "off"
            browser_cache_ttl           = 14400
            browser_check               = "on"
            cache_level                 = "aggressive"
            challenge_ttl               = 1800
            cname_flattening            = "flatten_at_root"
            development_mode            = "off"
            edge_cache_ttl              = 7200
            email_obfuscation           = "on"
          + h2_prioritization           = "off"
            hotlink_protection          = "off"
            http2                       = "on"
          + image_resizing              = "off"
            ip_geolocation              = "on"
            ipv6                        = "on"
            max_upload                  = 100
            min_tls_version             = "1.0"
            mirage                      = "off"
            opportunistic_encryption    = "off"
            opportunistic_onion         = "on"
            origin_error_page_pass_thru = "off"
            polish                      = "off"
            prefetch_preload            = "off"
            privacy_pass                = "on"
            pseudo_ipv4                 = "off"
            response_buffering          = "off"
            rocket_loader               = "off"
            security_level              = "medium"
            server_side_exclude         = "on"
            sort_query_string_for_cache = "off"
            ssl                         = "full"
            tls_1_2_only                = "off"
            tls_1_3                     = "on"
            tls_client_auth             = "off"
            true_client_ip_header       = "off"
            waf                         = "off"
            webp                        = "off"
            websockets                  = "on"

            minify {
                css  = "off"
                html = "off"
                js   = "off"
            }

            mobile_redirect {
                status    = "off"
                strip_uri = false
            }

            security_header {
                enabled            = true
                include_subdomains = true
                max_age            = 15552000
                nosniff            = true
                preload            = true
            }
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

------------------------------------------------------------------------
pjmpsu commented 5 years ago

@andrevdh I ran into the same issue and found this comment on the always_use_https setting https://github.com/terraform-providers/terraform-provider-cloudflare/blob/master/cloudflare/resource_cloudflare_zone_settings_override.go#L429 So I commented out that setting as we aren't currently modifying the default cloudflare setting and it stopped returning the 400.

roman-vynar commented 5 years ago

Same here.

resource "cloudflare_zone_settings_override" "XXX_com" {
  name = "XXX.com"

  settings {
    always_use_https = "on"
    ssl              = "strict"
    security_level   = "essentially_off"
    min_tls_version  = "1.2"
    sha1_support     = "off"

    security_header {
      enabled            = true
      preload            = true
      max_age            = 31536000
      include_subdomains = true
      nosniff            = true
    }
  }
}

The plan shows

          + sha1_support                = "off"

The result is 

Error: error from makeRequest: HTTP status 400: content "{\"success\":false,\"errors\":[{\"code\":1006,\"message\":\"Unrecognized zone setting name\"}],\"messages\":[],\"result\":null}"

  on XXX.com.tf line 1, in resource "cloudflare_zone_settings_override" "XXX_com":
   1: resource "cloudflare_zone_settings_override" "XXX_com" {

TF 0.12.3 terraform-provider-cloudflare_v1.16.0_x4

jacobbednarz commented 5 years ago

sha1_support has been removed from the API and I've cleaned it up in #415. Are you able to try master and let me know if you're still experiencing this one?

roman-vynar commented 5 years ago

Not setting this option at all now as it is deprecated or even removed from CF API and it works now with the existing version.