cloudflare_zero_trust_tunnel_cloudflared_config: Permanent diff if warp_routing.enabled is set to false

[jalaziz]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.9.8
on darwin_arm64

• provider registry.terraform.io/cloudflare/cloudflare v4.44.0

Affected resource(s)

• cloudflare_zero_trust_tunnel_cloudflared_config

Terraform configuration files

provider "cloudflare" {}

data "cloudflare_zone" "this" {
  name = "test.io"
}

resource "random_password" "this" {
  length = 64
}

locals {
  tunnel_token = base64sha256(random_password.this.result)
}

resource "cloudflare_zero_trust_tunnel_cloudflared" "this" {
  account_id = data.cloudflare_zone.this.account_id
  name       = "test"
  config_src = "cloudflare"
  secret     = local.tunnel_token
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "this" {
  account_id = data.cloudflare_zone.this.account_id
  tunnel_id  = cloudflare_zero_trust_tunnel_cloudflared.this.id

  config {
    warp_routing {
      enabled = false
    }

    // default ingress rule
    ingress_rule {
      service = "http_status:404"
    }
  }
}

Link to debug output

https://gist.github.com/jalaziz/c8be034fb0237603418e1faad3959b10

Panic output

No response

Expected output

No changes. Your infrastructure matches the configuration.

Actual output

Terraform will perform the following actions:

  # cloudflare_zero_trust_tunnel_cloudflared_config.this will be updated in-place
  ~ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "this" {
        id         = "ff9ecfbb-d807-4ce3-a7e3-6e827e744442"
        # (2 unchanged attributes hidden)

      ~ config {
          + warp_routing {
              + enabled = false
            }

            # (1 unchanged block hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Steps to reproduce

1. Create a new terraform workspace and set the CLOUDFLARE_API_TOKEN environment variable.
2. Use the provided configuration above.
3. Run terraform apply and accept the initial changes
4. Run terraform plan

Additional factoids

No response

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.