Azure LB Frontend IP configurations order issue

[yevheniishestakov]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.9.5

AzureRM Provider Version

4.10.0

Affected Resource(s)/Data Source(s)

azurerm_lb

Terraform Configuration Files

resource "azurerm_lb" "service_lb" {
  for_each = local.service_lb_map
  name = each.value.name
  location = each.value.location
  resource_group_name = each.value.resource_group_name
  sku = each.value.sku

  # dynamic frontend_ip_configuration{
  #   for_each = local.frontend_ip_configs
  #   content {
  #     name = frontend_ip_configuration.value.name
  #     subnet_id = frontend_ip_configuration.value.subnet_id
  #     public_ip_address_id = frontend_ip_configuration.value.public_ip_address_id
  #     zones = frontend_ip_configuration.value.zones
  #   }
  # }

  frontend_ip_configuration {
    name                 = "prd-prdservices"
    public_ip_address_id = null
    subnet_id            = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet"
    zones                = null
  }

  # frontend_ip_configuration {
  #   name                 = "qua-qa.b2b.e.domain.com"
  #   public_ip_address_id = null
  #   subnet_id            = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet"
  #   zones                = null
  # }

  frontend_ip_configuration {
    name                 = "qua-quaservices"
    public_ip_address_id = null
    subnet_id            = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet"
    zones                = null
  }

  frontend_ip_configuration {
    name                 = "tst-tstservices"
    public_ip_address_id = null
    subnet_id            = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet"
    zones                = null
  }

  frontend_ip_configuration {
    name                 = "prd-vpn.mfa.a.domain.com"
    public_ip_address_id = null
    subnet_id            = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet"
    zones                = null
  }
}

Debug Output/Panic Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform planned the following actions, but then encountered a problem:

  # azurerm_lb.management_lb["mgmt_lb"] will be updated in-place
  ~ resource "azurerm_lb" "management_lb" {
        id                   = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/mgmt_lb"
        name                 = "mgmt_lb"
      ~ tags                 = {
          - "App-ID" = "appid" -> null
        }
        # (7 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }
# azurerm_lb.service_lb["service_lb"] will be updated in-place
  ~ resource "azurerm_lb" "service_lb" {
        id                   = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb"
        name                 = "service_lb"
      ~ tags                 = {
          - "App-ID" = "appid" -> null
        }
        # (7 unchanged attributes hidden)

      ~ frontend_ip_configuration {
            id                                                 = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb/frontendIPConfigurations/qua-qa.b2b.e.domain.com"
          ~ name                                               = "qua-qa.b2b.e.domain.com" -> "qua-quaservices"
            # (11 unchanged attributes hidden)
        }
      ~ frontend_ip_configuration {
            id                                                 = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb/frontendIPConfigurations/qua-quaservices"
          ~ name                                               = "qua-quaservices" -> "tst-tstservices"
            # (11 unchanged attributes hidden)
        }
      ~ frontend_ip_configuration {
            id                                                 = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb/frontendIPConfigurations/tst-tstservices"
          ~ name                                               = "tst-tstservices" -> "prd-vpn.mfa.a.domain.com"
            # (11 unchanged attributes hidden)
        }
                        - frontend_ip_configuration {
          - id                                                 = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb/frontendIPConfigurations/prd-vpn.mfa.a.domain.com" -> null
          - inbound_nat_rules                                  = [] -> null
          - load_balancer_rules                                = [
              - "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/loadBalancers/service_lb/loadBalancingRules/321-prd-vpn.mfa.a.domain.com-1812-TEST",
            ] -> null
          - name                                               = "prd-vpn.mfa.a.domain.com" -> null
          - outbound_rules                                     = [] -> null
          - private_ip_address                                 = "172.20.0.196" -> null
          - private_ip_address_allocation                      = "Dynamic" -> null
          - private_ip_address_version                         = "IPv4" -> null
          - subnet_id                                          = "/subscriptions/sub_id/resourceGroups/rg_id/providers/Microsoft.Network/virtualNetworks/vnet/subnets/frontend_subnet" -> null
          - zones                                              = [] -> null
            # (3 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }
# citrixadc_csvserver.tf_csvserver["0000-qua-quaservices-443"] will be updated in-place
  ~ resource "citrixadc_csvserver" "tf_csvserver" {
        id                      = "cs-0000-qua-quaservices-443"
      ~ ipv46                   = "172.20.0.200" -> "172.20.0.202"
        name                    = "cs-0000-qua-quaservices-443"
        # (62 unchanged attributes hidden)
    }

  # citrixadc_csvserver.tf_csvserver["0000-tst-tstservices-443"] will be updated in-place
  ~ resource "citrixadc_csvserver" "tf_csvserver" {
        id                      = "cs-0000-tst-tstservices-443"
      ~ ipv46                   = "172.20.0.201" -> "172.20.0.200"
        name                    = "cs-0000-tst-tstservices-443"
        # (62 unchanged attributes hidden)
    }

  # citrixadc_csvserver.tf_csvserver_http_redirect["0000-qua-quaservices-443"] will be updated in-place
  ~ resource "citrixadc_csvserver" "tf_csvserver_http_redirect" {
        id                      = "cs-0000-qua-quaservices-443-redirect-80"
      ~ ipv46                   = "172.20.0.200" -> "172.20.0.202"
        name                    = "cs-0000-qua-quaservices-443-redirect-80"
        # (62 unchanged attributes hidden)
    }

  # citrixadc_csvserver.tf_csvserver_http_redirect["0000-tst-tstservices-443"] will be updated in-place
  ~ resource "citrixadc_csvserver" "tf_csvserver_http_redirect" {
        id                      = "cs-0000-tst-tstservices-443-redirect-80"
      ~ ipv46                   = "172.20.0.201" -> "172.20.0.200"
        name                    = "cs-0000-tst-tstservices-443-redirect-80"
        # (62 unchanged attributes hidden)
    }

  # citrixadc_lbvserver.tf_lbvserver_radius["321-prd-vpn.mfa.a.domain.com-1812"] will be updated in-place
  ~ resource "citrixadc_lbvserver" "tf_lbvserver_radius" {
        id                                 = "lbvs-321-prd-vpn.mfa.a.domain.com-1812-TEST"
      ~ ipv46                              = "172.20.0.196" -> "172.20.0.201"
        name                               = "lbvs-321-prd-vpn.mfa.a.domain.com-1812-TEST"
        # (95 unchanged attributes hidden)
    }

Plan: 0 to add, 7 to change, 0 to destroy.

Plan reports a problem and fails, but that is related to the fact I have commented out one of the frontend_ip_configuration blocks which is referred by another resource. Critical thing here is that removing one frontend_ip_configuration blocks causes the other to change.

Expected Behaviour

In the terraform snipped i have commented out only one frontend_ip_configuration resource - qua-qa.b2b.e.domain.com. Only that should be removed, others whould stay untouched. Order of frontend_ip_configuration clearly matters - it should not.

In the tf snipped provided it can be seen that normally frontend_ip_configurations are in created using dynamic block that iterates over a list of objects, for test purposes i have defined them manually in the same order, when any non-last frontend-ip_configuration object changes the problem still occurs.

Actual Behaviour

qua-qa.b2b.e.domain.com frontend_ip_configuration was removed which caused other frontend_ip_configurations to change

Steps to Reproduce

1. Add/remove non-last element in the frontend_ip_configurations section
2. Run terraform plan

Important Factoids

No response

References

No response

[neil-yechenwei]

Thanks for raising this issue. It's by TF design since it's TypeList. Though TF shows difference when tf plan but actually it only changes the modified block in the tf config.