Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

from terraform-provider-cloudflare.

Thank you for reporting this issue! For maintainers to dig into issues it is required that all issues include the entirety of TF_LOG=DEBUG output to be provided. The only parts that should be redacted are your user credentials in the X-Auth-Key, X-Auth-Email and Authorization HTTP headers. Details such as zone or account identifiers are not considered sensitive but can be redacted if you are very cautious. This log file provides additional context from Terraform, the provider and the Cloudflare API that helps in debugging issues. Without it, maintainers are very limited in what they can do and may hamper diagnosis efforts.

This issue has been marked with triage/needs-information and is unlikely to receive maintainer attention until the log file is provided making this a complete bug report.

from terraform-provider-cloudflare.

Let me attach TF_LOG=DEBUG output applying terraform with cyphers line commented like this:

resource "cloudflare_zone_settings_override" "website" {
  zone_id = local.cloudflare_zone_id
    ...
    tls_1_3                     = "zrt"
    ...
    #ciphers = ["ECDHE-RSA-CHACHA20-POLY1305","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-RSA-AES256-GCM-SHA384"]
  }
}

terraform.apply.debug.cipherscommentedandNOTrollbacked.filtered14.log

from terraform-provider-cloudflare.

thanks for this @mcortinas - a couple of things to note.

the first is that i highly recommend you do not manage all zone settings in this resource, only the modified ones. our docs also mention this in case it wasn't clear - https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zone_settings_override . we will be superseding this resource in the near-ish future with individual settings to avoid some of the baggage and misunderstanding that has been created with this resource.

the second is along a similar vein but the way this resource "defaults" values back is really inconsistent and not supported for all endpoints. it attempts to track the state internally and when it notices a change, force the defaults back to the expected values. there are a bunch of issues with the resource as well as the internal diff customisation that makes this pretty hard to do and realistically, it against how resources should be managed in terraform.

this is all to say, the problem here is kind of expected and we shouldn't depend on it operating correctly. instead, if you want this to work, you'll need to always provide the expected values. sorry! hoping to make this better with the replacement resources in time.

from terraform-provider-cloudflare.

sure! thank you for your answer and also thank you for share your strategy in order to avoid use this resource and use other little resources just to simplify this kind of consistency and idempotency. step by step, right now, this resource is very useful to onboard with Terraform in Cloudflare

apologies I should close this issue last 21Mar due to Unsmart|Tech debt bot answered quickly to me in this discord thread https://discord.com/channels/595317990191398933/1043025669036187678/1222251756772393152

Thank you @jacobbednarz for your effort in this provider/project , I'm using a lot and it has been pretty useful for me

from terraform-provider-cloudflare.

np! glad it has helped out!

from terraform-provider-cloudflare.