ec_deployment_traffic_filter rules order

[wgebis]

Current Behavior

After creation ec_deployment_traffic_filter rules, every terraform plan/apply detects change due to rules order.

Possible Solution

Handling rules ordering.

Steps to Reproduce

1. Crate ec_deployment_traffic_filter with min. two rules
2. Try to terraform apply/plan
3. Change is detected

Your Environment

• Version used: 0.1.0-beta
• Operating System and version: macOS

[marclop]

Hi @wgebis I want to make sure that this is not related to your other issue #204. Could you provide a .tf example where this would apply minus any sensitive information?

[wgebis]

Hi, yeah, look at this one. It doesn't contain any associations explicitly and discovered change every time.

resource "ec_deployment" "somename" {
  region = "us-east-1"
  name = "somename"
  version = "7.10.1"
  deployment_template_id = "aws-io-optimized-v2"

  elasticsearch {
    topology {
      instance_configuration_id = "aws.data.highio.i3"
      size = "1g"
      size_resource = "memory"
      zone_count = 1
    }
  }

  kibana {
  }

  apm {
  }

  traffic_filter = [
    ec_deployment_traffic_filter.redacted-1.id,
    ec_deployment_traffic_filter.redacted-2.id,
  ]
}

resource "ec_deployment_traffic_filter" "redacted-1" {
  name   = "redacted-1"
  region = "us-east-1"
  type   = "ip"

  dynamic "rule" {
    for_each = sort(var.approved_hosts)
    content {
      source = rule.value
    }
  }
}

resource "ec_deployment_traffic_filter" "redacted-2" {
  name   = "redacted-2"
  region = "us-east-1"
  type   = "ip"

  dynamic "rule" {
    for_each = data.digitalocean_droplet.internal-dev-nodes
    content {
      source = rule.value.ipv4_address
    }
  }
}

[marclop]

Interesting, that shouldn't be the case, I'll investigate and come back with an answer.

[wgebis]

@marclop perhaps is something with the ordering of collections handles rules under ec_deployment_traffic_filter. I have tried to use sort but with no success, every rule has its own id, so perhaps ordering the rules collection by ip_addr will help?

[marclop]

@wgebis I've tried to reproduce locally with some rules and I couldn't reproduce what you're seeing:

variable "google_dns_rules" {
  type    = list(string)
  default = ["8.8.8.8/24", "8.8.4.4/24"]
}

resource "ec_deployment" "example_minimal" {
  name = "my_example_deployment"

  # Mandatory fields
  region                 = "us-east-1"
  version                = "7.10.1"
  deployment_template_id = "aws-io-optimized-v2"

  elasticsearch {}

  kibana {}

  traffic_filter = [
    ec_deployment_traffic_filter.default.id,
    ec_deployment_traffic_filter.google_dns.id,
    ec_deployment_traffic_filter.secure_dns.id,
  ]
}

resource "ec_deployment_traffic_filter" "default" {
  name   = "all traffic"
  region = "us-east-1"
  type   = "ip"

  rule {
    source = "0.0.0.0/0"
  }
}

resource "ec_deployment_traffic_filter" "google_dns" {
  name   = "google dns"
  region = "us-east-1"
  type   = "ip"

  dynamic "rule" {
    for_each = var.google_dns_rules
    content {
      source = rule.value
    }
  }
}

resource "ec_deployment_traffic_filter" "secure_dns" {
  name   = "secure dns"
  region = "us-east-1"
  type   = "ip"

  rule {
    source = "1.1.1.1/24"
  }
}

$ terraform plan
terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

ec_deployment_traffic_filter.default: Refreshing state... [id=ID]
ec_deployment_traffic_filter.google_dns: Refreshing state... [id=ID]
ec_deployment_traffic_filter.secure_dns: Refreshing state... [id=ID]
ec_deployment.example_minimal: Refreshing state... [id=ID]

------------------------------------------------------------------------

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.

[wgebis]

You have only two hosts here: default = ["8.8.8.8/24", "8.8.4.4/24"], could you try to put e.g. 10 elements?

[marclop]

Yep I was able to reproduce it with a bunch of rules more. I'll work on fixing it, thanks for reporting the bug.