search

paultyng / terraform-provider-unifi

Terraform provider for Unifi :satellite:
https://registry.terraform.io/providers/paultyng/unifi/latest/docs
Mozilla Public License 2.0
512 stars 91 forks source link

Setting `network_group` breaks WAN network #107

Open joshuaspence opened 3 years ago

joshuaspence commented 3 years ago

Terraform wanted to set network_group to "LAN" (the default value) on my WAN network, but doing so seemed to break things somehow. Before applying this change, this is what I saw in the UI:

unifi-networks

After Terraform set network_group, the network appears to have been dissociated from the gateway device:

unifi-network-after

This is what the WAN network looked like from the API before and after setting network_group:

Before

{
  "_id": "60375d9addb88d01485711b7",
  "attr_hidden_id": "WAN",
  "attr_no_delete": true,
  "name": "WAN",
  "purpose": "wan",
  "site_id": "60375bd3ddb88d0148571192",
  "wan_ip": "192.168.1.1",
  "wan_networkgroup": "WAN",
  "wan_type": "dhcp"
}

After

{
  "_id": "60375d9addb88d01485711b7",
  "attr_no_delete": true,
  "attr_hidden_id": "WAN",
  "wan_networkgroup": "WAN",
  "site_id": "60375bd3ddb88d0148571192",
  "purpose": "wan",
  "name": "WAN",
  "wan_type": "dhcp",
  "wan_ip": "192.168.1.1",
  "auto_scale_enabled": false,
  "dhcpd_boot_enabled": false,
  "dhcpd_boot_server": "",
  "dhcpd_dns_1": "",
  "dhcpd_dns_2": "",
  "dhcpd_dns_3": "",
  "dhcpd_dns_4": "",
  "dhcpd_dns_enabled": false,
  "dhcpd_enabled": false,
  "dhcpd_gateway": "",
  "dhcpd_gateway_enabled": false,
  "dhcpd_ip_1": "",
  "dhcpd_ip_2": "",
  "dhcpd_ip_3": "",
  "dhcpd_mac_1": "",
  "dhcpd_mac_2": "",
  "dhcpd_mac_3": "",
  "dhcpd_ntp_1": "",
  "dhcpd_ntp_2": "",
  "dhcpd_ntp_enabled": false,
  "dhcpd_start": "",
  "dhcpd_stop": "",
  "dhcpd_time_offset_enabled": false,
  "dhcpd_unifi_controller": "",
  "dhcpdv6_dns_auto": false,
  "dhcpdv6_enabled": false,
  "dhcpd_wins_1": "",
  "dhcpd_wins_2": "",
  "dhcpd_wins_enabled": false,
  "dhcp_relay_enabled": false,
  "dhcpguard_enabled": false,
  "dpi_enabled": false,
  "dpigroup_id": "",
  "domain_name": "",
  "enabled": true,
  "exposed_to_site_vpn": false,
  "gateway_device": "",
  "igmp_fastleave": false,
  "igmp_querier": "",
  "igmp_snooping": false,
  "igmp_supression": false,
  "ipsec_dynamic_routing": false,
  "ipsec_pfs": false,
  "ipv6_pd_prefixid": "",
  "ipv6_ra_enabled": false,
  "is_nat": false,
  "lte_lan_enabled": false,
  "networkgroup": "LAN",
  "pptpc_require_mppe": false,
  "radiusprofile_id": "",
  "remote_site_id": "",
  "report_wan_event": false,
  "require_mschapv2": false,
  "upnp_lan_enabled": false,
  "usergroup_id": "",
  "vlan_enabled": false,
  "vpn_client_default_route": false,
  "vpn_client_pull_dns": false,
  "wan_dns1": "",
  "wan_dns2": "",
  "wan_dns3": "",
  "wan_dns4": "",
  "wan_gateway": "",
  "wan_gateway_v6": "",
  "wan_ipv6": "",
  "wan_smartq_enabled": false,
  "wan_vlan_enabled": false
}

I'm happy to submit a PR to fix this, although I'm not sure why no-one else is reporting any issues...,.

joshuaspence commented 3 years ago

On an unrelated note, dhcp seems to be a valid value for wan_type, contrary to this provider's documentation.

joshuaspence commented 3 years ago

The same thing happens with some other default values that Terraform tries to apply:

joshuaspence commented 3 years ago

Actually this seems to be a problem with all networks created by the provider, I think, I just hadn't noticed it as I had imported my networks into Terraform rather than letting Terraform create them.

I created two almost-identical subnets, one via the UI and the other with Terraform.

When creating via the UI, the POST request looked like this:

{
  "dhcp_relay_enabled": false,
  "dhcpd_dns_enabled": false,
  "dhcpd_enabled": false,
  "dhcpd_gateway_enabled": false,
  "dhcpd_leasetime": 86400,
  "dhcpd_time_offset_enabled": false,
  "enabled": true,
  "gateway_type": "default",
  "ip_subnet": "192.168.50.1/24",
  "ipv6_interface_type": "none",
  "ipv6_pd_start": "::2",
  "ipv6_pd_stop": "::7d1",
  "is_nat": true,
  "name": "Test 1",
  "networkgroup": "LAN",
  "purpose": "corporate",
  "vlan": "50",
  "vlan_enabled": true
}

The API response was

{
  "data": [
    {
      "_id": "603edf20ddb88d4a962a7f2b",
      "dhcp_relay_enabled": false,
      "dhcpd_dns_enabled": false,
      "dhcpd_enabled": false,
      "dhcpd_gateway_enabled": false,
      "dhcpd_leasetime": 86400,
      "dhcpd_time_offset_enabled": false,
      "enabled": true,
      "gateway_type": "default",
      "ip_subnet": "192.168.50.1/24",
      "ipv6_interface_type": "none",
      "ipv6_pd_start": "::2",
      "ipv6_pd_stop": "::7d1",
      "is_nat": true,
      "name": "Test 1",
      "networkgroup": "LAN",
      "purpose": "corporate",
      "site_id": "60375bd3ddb88d0148571192",
      "vlan": "50",
      "vlan_enabled": true
    }
  ],
  "meta": {
    "rc": "ok"
  }
}

When creating via Terraform, the POST request:

{
 "auto_scale_enabled": false,
 "dhcpd_boot_enabled": false,
 "dhcpd_boot_server": "",
 "dhcpd_dns_1": "",
 "dhcpd_dns_2": "",
 "dhcpd_dns_3": "",
 "dhcpd_dns_4": "",
 "dhcpd_dns_enabled": false,
 "dhcpd_enabled": false,
 "dhcpd_gateway": "",
 "dhcpd_gateway_enabled": false,
 "dhcpd_ip_1": "",
 "dhcpd_ip_2": "",
 "dhcpd_ip_3": "",
 "dhcpd_leasetime": 86400,
 "dhcpd_mac_1": "",
 "dhcpd_mac_2": "",
 "dhcpd_mac_3": "",
 "dhcpd_ntp_1": "",
 "dhcpd_ntp_2": "",
 "dhcpd_ntp_enabled": false,
 "dhcpd_start": "",
 "dhcpd_stop": "",
 "dhcpd_time_offset_enabled": false,
 "dhcpd_unifi_controller": "",
 "dhcpdv6_dns_auto": false,
 "dhcpdv6_enabled": false,
 "dhcpd_wins_1": "",
 "dhcpd_wins_2": "",
 "dhcpd_wins_enabled": false,
 "dhcp_relay_enabled": false,
 "dhcpguard_enabled": false,
 "dpi_enabled": false,
 "dpigroup_id": "",
 "domain_name": "",
 "enabled": true,
 "exposed_to_site_vpn": false,
 "gateway_device": "",
 "igmp_fastleave": false,
 "igmp_querier": "",
 "igmp_snooping": false,
 "igmp_supression": false,
 "ipsec_dynamic_routing": false,
 "ipsec_pfs": false,
 "ip_subnet": "192.168.51.1/24",
 "ipv6_interface_type": "none",
 "ipv6_pd_prefixid": "",
 "ipv6_ra_enabled": false,
 "is_nat": false,
 "lte_lan_enabled": false,
 "name": "Test 2",
 "networkgroup": "LAN",
 "pptpc_require_mppe": false,
 "purpose": "corporate",
 "radiusprofile_id": "",
 "remote_site_id": "",
 "report_wan_event": false,
 "require_mschapv2": false,
 "upnp_lan_enabled": false,
 "usergroup_id": "",
 "vlan": 51,
 "vlan_enabled": true,
 "vpn_client_default_route": false,
 "vpn_client_pull_dns": false,
 "wan_dns1": "",
 "wan_dns2": "",
 "wan_dns3": "",
 "wan_dns4": "",
 "wan_gateway": "",
 "wan_gateway_v6": "",
 "wan_ipv6": "",
 "wan_smartq_enabled": false,
 "wan_vlan_enabled": false
}

And the reponse:

{
 "meta": {
  "rc": "ok"
 },
 "data": [
  {
   "auto_scale_enabled": false,
   "dhcpd_boot_enabled": false,
   "dhcpd_boot_server": "",
   "dhcpd_dns_1": "",
   "dhcpd_dns_2": "",
   "dhcpd_dns_3": "",
   "dhcpd_dns_4": "",
   "dhcpd_dns_enabled": false,
   "dhcpd_enabled": false,
   "dhcpd_gateway": "",
   "dhcpd_gateway_enabled": false,
   "dhcpd_ip_1": "",
   "dhcpd_ip_2": "",
   "dhcpd_ip_3": "",
   "dhcpd_leasetime": 86400,
   "dhcpd_mac_1": "",
   "dhcpd_mac_2": "",
   "dhcpd_mac_3": "",
   "dhcpd_ntp_1": "",
   "dhcpd_ntp_2": "",
   "dhcpd_ntp_enabled": false,
   "dhcpd_start": "",
   "dhcpd_stop": "",
   "dhcpd_time_offset_enabled": false,
   "dhcpd_unifi_controller": "",
   "dhcpdv6_dns_auto": false,
   "dhcpdv6_enabled": false,
   "dhcpd_wins_1": "",
   "dhcpd_wins_2": "",
   "dhcpd_wins_enabled": false,
   "dhcp_relay_enabled": false,
   "dhcpguard_enabled": false,
   "dpi_enabled": false,
   "dpigroup_id": "",
   "domain_name": "",
   "enabled": true,
   "exposed_to_site_vpn": false,
   "gateway_device": "",
   "igmp_fastleave": false,
   "igmp_querier": "",
   "igmp_snooping": false,
   "igmp_supression": false,
   "ipsec_dynamic_routing": false,
   "ipsec_pfs": false,
   "ip_subnet": "192.168.51.1/24",
   "ipv6_interface_type": "none",
   "ipv6_pd_prefixid": "",
   "ipv6_ra_enabled": false,
   "is_nat": false,
   "lte_lan_enabled": false,
   "name": "Test 2",
   "networkgroup": "LAN",
   "pptpc_require_mppe": false,
   "purpose": "corporate",
   "radiusprofile_id": "",
id": "",
   "report_wan_event": false,
   "require_mschapv2": false,
   "upnp_lan_enabled": false,
   "usergroup_id": "",
   "vlan": 51,
   "vlan_enabled": true,
   "vpn_client_default_route": false,
   "vpn_client_pull_dns": false,
   "wan_dns1": "",
   "wan_dns2": "",
   "wan_dns3": "",
   "wan_dns4": "",
   "wan_gateway": "",
   "wan_gateway_v6": "",
   "wan_ipv6": "",
   "wan_smartq_enabled": false,
   "wan_vlan_enabled": false,
   "site_id": "60375bd3ddb88d0148571192",
   "_id": "603edfbaddb88d4a962a80bc"
  }
 ]
}

Also some warnings in the Terraform logs that may or may not be relevant:

2021/03/03 12:00:41 [WARN] Provider "registry.terraform.io/paultyng/unifi" produced an unexpected new value for unifi_network.test, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .x_wan_password: was null, but now cty.StringVal("")
      - .igmp_snooping: was null, but now cty.False
      - .wan_username: was null, but now cty.StringVal("")
      - .ipv6_ra_enable: was null, but now cty.False
      - .ipv6_static_subnet: was null, but now cty.StringVal("")
      - .wan_ip: was null, but now cty.StringVal("")
      - .domain_name: was null, but now cty.StringVal("")
      - .ipv6_pd_interface: was null, but now cty.StringVal("")
      - .wan_networkgroup: was null, but now cty.StringVal("")
      - .dhcp_enabled: was null, but now cty.False
      - .dhcp_start: was null, but now cty.StringVal("")
      - .wan_type: was null, but now cty.StringVal("")
      - .ipv6_pd_prefixid: was null, but now cty.StringVal("")
      - .subnet: was cty.StringVal("192.168.51.1/24"), but now cty.StringVal("192.168.51.0/24")
      - .dhcp_stop: was null, but now cty.StringVal("")

unifi-test-networks

paultyng commented 3 years ago

This may be related to the v6 controller, I haven't tested it very thoroughly in it yet, my UDM just was upgraded recently, I'll need to take a peek.

paultyng commented 3 years ago

What version of the controller are you using and how are you running it (docker, UDM, UDM-Pro?, etc.)?

joshuaspence commented 3 years ago

Controller version is 6.0.45 and it's currently running as a Home Assistant add-on (so Docker).

paultyng commented 3 years ago

Still investigating this, the tests all run against docker so that's at least not the issue.

It seems like you are aware and already doing this, but I think the main thing to be aware of for anyone else coming to this issue is that the UI will be defaulting a lot of things that Terraform won't, so you'll have to be a lot more explicit in Terraform. Doing an import after configuring in the UI and updating your configuration until there is no diff is probably the easiest way to achieve this, but this may be an issue of Terraform not managing some of the newer v6 settings or something.

paultyng commented 3 years ago

Just added a number of WAN settings for static WAN configuration in #119 based on your work and someone else's. I'll publish a new version of the provider shortly and we can see if that helps and what other fields we may need to address.

paultyng commented 3 years ago

We may still need to include #118, just didn't get a chance to look at it yet, but hopefully this coming week.

joshuaspence commented 3 years ago

No problem. I managed the solve the issue by modifying the network config in MongoDB and so it's easy for me to test this now, I can just restore a backup if it breaks things.

paultyng commented 3 years ago

It looks like this same situation is going to happen for the other network types as well (VPN, etc). I need to get a VPN setup manually and look at the responses there.

YurNaybor commented 2 years ago

I am affected by this issue as well. Is there a solution or workaround apart from fiddling with the mongo database? I'd rather avoid changing anything by bypassing the unifi api..

YurNaybor commented 2 years ago

Ah nevermind. I just found out that I had to set network_group to an empty string instead of null for wan networks..