Can't remove L4-L7 Service Graph from Contract Subject

[thjonson]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

2022-11-22T09:52:24.706-0500 [INFO] Terraform version: 1.3.5
2022-11-22T09:52:24.706-0500 [DEBUG] using github.com/hashicorp/go-tfe v1.9.0
2022-11-22T09:52:24.706-0500 [DEBUG] using github.com/hashicorp/hcl/v2 v2.15.0
2022-11-22T09:52:24.706-0500 [DEBUG] using github.com/hashicorp/terraform-config-inspect v0.0.0-20210209133302-4fd17a0faac2
2022-11-22T09:52:24.706-0500 [DEBUG] using github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734
2022-11-22T09:52:24.706-0500 [DEBUG] using github.com/zclconf/go-cty v1.12.1
2022-11-22T09:52:24.706-0500 [INFO] Go runtime version: go1.19.3
2022-11-22T09:52:24.707-0500 [INFO] CLI args: []string{"terraform", "-v"}
2022-11-22T09:52:24.707-0500 [DEBUG] Attempting to open CLI config file: /Users/thjonson/.terraformrc
2022-11-22T09:52:24.707-0500 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2022-11-22T09:52:24.707-0500 [INFO] Loading CLI configuration from /Users/thjonson/.terraform.d/credentials.tfrc.json
2022-11-22T09:52:24.707-0500 [DEBUG] ignoring non-existing provider search directory terraform.d/plugins
2022-11-22T09:52:24.707-0500 [DEBUG] ignoring non-existing provider search directory /Users/thjonson/.terraform.d/plugins
2022-11-22T09:52:24.707-0500 [DEBUG] ignoring non-existing provider search directory /Users/thjonson/Library/Application Support/io.terraform/plugins
2022-11-22T09:52:24.707-0500 [DEBUG] ignoring non-existing provider search directory /Library/Application Support/io.terraform/plugins
2022-11-22T09:52:24.710-0500 [INFO] CLI command args: []string{"version", "-v"}
Terraform v1.3.5
on darwin_arm64

• provider registry.terraform.io/ciscodevnet/aci v2.5.2

APIC version and APIC Platform

• V 5.2.6e and on-prem

Affected Resource(s)

• aci_contract_subject

Terraform Configuration Files

terraform {
  required_providers {
    aci = {
      source = "ciscodevnet/aci"
    }
  }
}

#configure provider with your cisco aci credentials.
provider "aci" {
  # cisco-aci user name
  username = var.aci_user
  # cisco-aci password
  password = var.aci_password
  # cisco-aci url
  url      = var.aci_url
  insecure = true
}


data "aci_tenant" "tenant" {
  name = "test"
}

# Create Service Graph Template
resource "aci_l4_l7_service_graph_template" "l4_l7_service_graph_template" {
  tenant_dn      = data.aci_tenant.tenant.id
  name           = "PBR_template"
  term_prov_name = "prov"
  term_cons_name = "cons"
}

resource "aci_contract" "contract" {
  tenant_dn = data.aci_tenant.tenant.id
  name      = "test_contract"
}

resource "aci_contract_subject" "contract_subject" {
  name = "test_subject"
  contract_dn = aci_contract.contract.id
  relation_vz_rs_subj_filt_att = [aci_filter.filter.id]
  relation_vz_rs_subj_graph_att = aci_l4_l7_service_graph_template.l4_l7_service_graph_template.id
  #relation_vz_rs_subj_graph_att = null
}

resource "aci_filter" "filter" {
  tenant_dn = data.aci_tenant.tenant.id
  name      = "test_filter"
}

Debug Output

https://gist.github.com/thjonson/41accef2a5eb7738353527ced1e17b62

Panic Output

Expected Behavior

The goal is to remove or unset a L4-L7 Service Graph relationship from a Contract Subject. I would think either commenting out the relation_vz_rs_subj_graph_att variable, or setting it to "" or null would accomplish this.

Actual Behavior

Terraform doesn't seem to notice the unset or absent variable, so the Graph remains attached to the subject.

Steps to Reproduce

1. terraform apply
2. comment out the relation_vz_rs_subj_graph_att line, or set it to "" or null
   3.terraform apply --> relationship remains.

Important Factoids

In aci_contract_subject, the relation_vz_rs_subj_filt_att seems to work as expected. If you comment out that line after the initial apply, Terraform will want to remove the filter from the subject.

References

• #0000

[shrsr]

@thjonson We applied your configuration at our end and were able to reproduce it. Today, we don't have the capability to change behaviour/fix the issue due to limitations in the plugin framework.
There's already a similar issue open for this so I'm going to close your issue for now.

[lhercot]

Duplicate of #202