crash on cloudflare_ruleset import with empty serve_stale

[lobeck]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.7.5
on darwin_arm64

• provider registry.terraform.io/cloudflare/cloudflare v4.37.0
• provider registry.terraform.io/hashicorp/aws v5.43.0
• provider registry.terraform.io/hashicorp/http v3.4.3

Affected resource(s)

cloudflare_ruleset

Terraform configuration files

import {
  to = cloudflare_ruleset.http_request_cache_settings
  id = "zone/${cloudflare_zone.<redacted>.id}/2a26e884f96549fe9f93d500447e823d"
}

resource "cloudflare_ruleset" "http_request_cache_settings" {
  kind    = "zone"
  name    = "http_request_cache_settings"
  phase   = "http_request_cache_settings"
  zone_id = cloudflare_zone.<redacted>.id
  rules {
    action = "set_cache_settings"
    action_parameters {
      cache = true
      edge_ttl {
        mode = "bypass_by_default"
      }
      browser_ttl {
        mode = "respect_origin"
      }
      serve_stale {
        disable_stale_while_updating = false
      }
    }
    description = "<redacted>"
    enabled     = true
    expression  = "(starts_with(http.request.uri, \"/v1/<redacted>\"))"
  }
}

Link to debug output

see below

Panic output

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x0 pc=0x1038af5fc]

goroutine 46 [running]:
github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets.toRulesetResourceModel({0x1049cce68, 0x14000e3da40}, {0x40?, {0x14000c81ec0?, 0x14000c81ea0?}}, {0x20?, {0x0?, 0x0?}}, {{0x14000bc501b, 0x20}, ...})
	github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets/resource.go:624 +0x305c
github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets.(*RulesetResource).Read(0x14000c84610, {0x1049cce68, 0x14000e3da40}, {{{{0x1049d4208, 0x14000e7eb40}, {0x1043ed4a0, 0x14000e7db60}}, {0x1049d7838, 0x14000d98230}}, 0x14000c84620, ...}, ...)
	github.com/cloudflare/terraform-provider-cloudflare/internal/framework/service/rulesets/resource.go:209 +0x3e4
github.com/hashicorp/terraform-plugin-framework/internal/fwserver.(*Server).ReadResource(0x140005f0000, {0x1049cce68, 0x14000e3da40}, 0x14000e3dad0, 0x14000d7b608)
	github.com/hashicorp/[email protected]/internal/fwserver/server_readresource.go:117 +0x698
github.com/hashicorp/terraform-plugin-framework/internal/proto6server.(*Server).ReadResource(0x140005f0000, {0x1049cce68?, 0x14000e3d920?}, 0x14000e103c0)
	github.com/hashicorp/[email protected]/internal/proto6server/server_readresource.go:55 +0x314
github.com/hashicorp/terraform-plugin-mux/tf6muxserver.(*muxServer).ReadResource(0x1049ccea0?, {0x1049cce68?, 0x14000e3d620?}, 0x14000e103c0)
	github.com/hashicorp/[email protected]/tf6muxserver/mux_server_ReadResource.go:35 +0x184
github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server.(*server).ReadResource(0x14000ba0320, {0x1049cce68?, 0x14000e3ce10?}, 0x140005cd8f0)
	github.com/hashicorp/[email protected]/tfprotov6/tf6server/server.go:784 +0x224
github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6._Provider_ReadResource_Handler({0x1048d3760?, 0x14000ba0320}, {0x1049cce68, 0x14000e3ce10}, 0x14000e0ae80, 0x0)
	github.com/hashicorp/[email protected]/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go:482 +0x164
google.golang.org/grpc.(*Server).processUnaryRPC(0x14000c04200, {0x1049cce68, 0x14000e3cd80}, {0x1049d5220, 0x14000a58300}, 0x14000e3b200, 0x14000934de0, 0x1057f3ae8, 0x0)
	google.golang.org/[email protected]/server.go:1369 +0xba0
google.golang.org/grpc.(*Server).handleStream(0x14000c04200, {0x1049d5220, 0x14000a58300}, 0x14000e3b200)
	google.golang.org/[email protected]/server.go:1780 +0xc80
google.golang.org/grpc.(*Server).serveStreams.func2.1()
	google.golang.org/[email protected]/server.go:1019 +0x8c
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 52
	google.golang.org/[email protected]/server.go:1030 +0x150

Expected output

resource import and diff

Actual output

crash

Steps to reproduce

create a cache rule in the ui and select "Add setting"

This will expand the rule like this:

In the API, this causes the following response:

    "action_parameters": {
      "cache": true,
      "edge_ttl": {
        "mode": "bypass_by_default"
      },
      "browser_ttl": {
        "mode": "respect_origin"
      },
      "serve_stale": {}
    }

Note the empty serve_stale map.

When looking at the panic, it crashes while it's trying to read DisableStaleWhileUpdating / disable_stale_while_updating

https://github.com/cloudflare/terraform-provider-cloudflare/blob/master/internal/framework/service/rulesets/resource.go#L624

Additional factoids

No response

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

Thank you for reporting this issue! For maintainers to dig into issues it is required that all issues include the entirety of TF_LOG=DEBUG output to be provided. The only parts that should be redacted are your user credentials in the X-Auth-Key, X-Auth-Email and Authorization HTTP headers. Details such as zone or account identifiers are not considered sensitive but can be redacted if you are very cautious. This log file provides additional context from Terraform, the provider and the Cloudflare API that helps in debugging issues. Without it, maintainers are very limited in what they can do and may hamper diagnosis efforts.

This issue has been marked with triage/needs-information and is unlikely to receive maintainer attention until the log file is provided making this a complete bug report.

[lobeck]

Alternatively someone needs to address this to CF.

After removing the flag and having it set through terraform, the api reports it as follow:

      "serve_stale": {
        "disable_stale_while_updating": false
      }

This is now also parseable by the provider and doesn't panic anymore.

[shokerplz]

Can confirm this issue, adding disable_stale_while_updating section via UI without enabling it crashes terraform provider

[github-actions]

Marking this issue as stale due to 30 days of inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 7 days it will automatically be closed. Maintainers can also remove the lifecycle/stale label.
If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[lobeck]

How do get rid of this "needs-information" tag? Everything is there.

[jacobbednarz]

you'll need to provide the full debug log; not your snipped version of it.

[tiagoasousa]

@lobeck thank you! at least the community here is helpful on workarounds for bugs!

[github-actions]

Marking this issue as stale due to 30 days of inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 7 days it will automatically be closed. Maintainers can also remove the lifecycle/stale label.
If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

This issue was closed because it has been stalled for 7 days with no activity.