Ruleset - enabled doesn't work as intended #1273
Comments
vences
added
kind/bug
|
This is one of those unfortunately side effects of combining using a boolean pointer, I'll have to have a think about what we can do here as the only thing that comes to mind is passing around |
|
I see! Having true would be better but still not the expected behaviour. For example not having for the others Rulesets (OWASP, Exposed Checked Credentials leaked) there is no such configuration for now and all rules are turned to true by default. |
…itted Updates the `rules.*.action_parameters.0.enabled` to be omitted should the value not be set. Closes #1273
|
went with the option of just passing around |
jacobbednarz
added
triage/accepted
…itted Updates the `rules.*.action_parameters.0.enabled` to be omitted should the value not be set. Closes #1273
|
Hey @jacobbednarz, Sorry to reopen that one, but I did tests with the version 3.4 and I still have the issue, it is now only limited to the update. If I update my configuration file from a line where InformationStep to reproduce1st configuration file resource "cloudflare_ruleset" "zone_level_managed_waf" {
zone_id = var.cloudflare_zone_id
name = "managed WAF"
description = "managed WAF ruleset description"
kind = "zone"
phase = "http_request_firewall_managed"
rules {
action = "execute"
action_parameters {
id = "efb7b8c949ac4650a09736fc376e9aee"
version = "latest"
overrides {
rules {
id = "5de7edfa648c4d6891dc3e7f84534ffa"
action = "block"
enabled = true
}
rules {
id = "75a0060762034a6cb663fd51a02344cb"
action = "log"
enabled = true
}
categories {
category = "wordpress"
action = "js_challenge"
enabled = true
}
action = "challenge"
}
}
expression = "true"
description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
enabled = true
}
}--> all good 2nd configuration, add of resource "cloudflare_ruleset" "zone_level_managed_waf" {
zone_id = var.cloudflare_zone_id
name = "managed WAF"
description = "managed WAF ruleset description"
kind = "zone"
phase = "http_request_firewall_managed"
rules {
action = "execute"
action_parameters {
id = "efb7b8c949ac4650a09736fc376e9aee"
version = "latest"
overrides {
rules {
id = "5de7edfa648c4d6891dc3e7f84534ffa"
action = "block"
enabled = true
}
rules {
id = "75a0060762034a6cb663fd51a02344cb"
action = "log"
enabled = true
}
categories {
category = "wordpress"
action = "js_challenge"
enabled = true
}
enabled = true
action = "challenge"
}
}
expression = "true"
description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
enabled = true
}
}--> all good as well 3rd change, removing resource "cloudflare_ruleset" "zone_level_managed_waf" {
zone_id = var.cloudflare_zone_id
name = "managed WAF"
description = "managed WAF ruleset description"
kind = "zone"
phase = "http_request_firewall_managed"
rules {
action = "execute"
action_parameters {
id = "efb7b8c949ac4650a09736fc376e9aee"
version = "latest"
overrides {
rules {
id = "5de7edfa648c4d6891dc3e7f84534ffa"
action = "block"
enabled = true
}
rules {
id = "75a0060762034a6cb663fd51a02344cb"
action = "log"
enabled = true
}
categories {
category = "wordpress"
action = "js_challenge"
enabled = true
}
action = "challenge"
}
}
expression = "true"
description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
enabled = true
}
}--> in that update the Debug filePlease find attached the debug file on all those changes. |
If I'm reading this correctly, this is expected due to the way My advice would if you're setting it, going forward we need to keep it in there explicitly to the value you want. |
|
Thanks Jacob for picking it so quickly! |
|
Sure, I'm not certain where we could put it that would make sense (in the description itself?) but we are trying to make this a thing that is easier to do in the SDK via hashicorp/terraform-plugin-sdk#817 |
|
I was thinking to add it here -> https://github.com/cloudflare/terraform-provider-cloudflare/blob/master/website/docs/r/ruleset.html.markdown?plain=1#L286 like a note at the end of the line -> |
Confirmation
Terraform and Cloudflare provider version
➜ terraform -v
Terraform v1.0.9
on darwin_amd64
Affected resource(s)
Terraform configuration files
Debug output
Panic output
No response
Expected output
The request should not contain
"enabled": falseinaction_parameters->overridesThe output should be
{ "result": { "id": "bbda5c929d9049e5b2060db619076dd4", "name": "managed WAF", "description": "managed WAF ruleset description", "source": "firewall_managed", "kind": "zone", "version": "2", "rules": [ { "id": "dfa95ef8351f409ba4da5256f375646d", "version": "1", "action": "execute", "action_parameters": { "id": "efb7b8c949ac4650a09736fc376e9aee", "version": "latest", "overrides": { "categories": [ { "category": "wordpress", "action": "js_challenge", "enabled": true } ], } }, "expression": "true", "description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset", "last_updated": "2021-10-22T09:14:32.813616Z", "ref": "dfa95ef8351f409ba4da5256f375646d", "enabled": true } ], "last_updated": "2021-10-22T09:14:32.813616Z", "phase": "http_request_firewall_managed" }, "success": true, "errors": [], "messages": [] }Actual output
That is the result of the GET on the entrypoint, I got after apply the terraform configuration.
{ "result": { "id": "bbda5c929d9049e5b2060db619076dd4", "name": "managed WAF", "description": "managed WAF ruleset description", "source": "firewall_managed", "kind": "zone", "version": "2", "rules": [ { "id": "dfa95ef8351f409ba4da5256f375646d", "version": "1", "action": "execute", "action_parameters": { "id": "efb7b8c949ac4650a09736fc376e9aee", "version": "latest", "overrides": { "categories": [ { "category": "wordpress", "action": "js_challenge", "enabled": true } ], "enabled": false } }, "expression": "true", "description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset", "last_updated": "2021-10-22T09:14:32.813616Z", "ref": "dfa95ef8351f409ba4da5256f375646d", "enabled": true } ], "last_updated": "2021-10-22T09:14:32.813616Z", "phase": "http_request_firewall_managed" }, "success": true, "errors": [], "messages": [] }Steps to reproduce
terraform apply -target cloudflare_ruleset.zone_level_managed_waf_2enabled: falseThe consequence of that configuration is all the rules within the Rulesets are disabled.
Additional factoids
I suspect a missing check on that line https://github.com/cloudflare/terraform-provider-cloudflare/blob/master/cloudflare/resource_cloudflare_ruleset.go#L693 to avoid to set
Enabledto false if not defined.References
No response
The text was updated successfully, but these errors were encountered: