ID in response: How to plan and update?

[maxinomnom]

Hey,
I am trying to use the restapi provider for some Infoblox objects, since the official provider does not support all of them. Unfortunately I am facing some problems and I don't know if the issue is my configuration or if it is simply not supported.

My current terraform configuration looks like this:

terraform {
    required_providers {
        restapi = {
            source = "Mastercard/restapi"
            version = "3.0.0-rc1"
        }
    }
}
provider "restapi" {
    uri = "https://infoblox-endpoint.com"
    debug = true
    write_returns_object = true
    username = "infobloxuser"
    password = "secret"
    insecure = true
    headers = {
        "Content-Type" = "application/json"
    }
}
resource "restapi_object" "terraform_test_monitor_icmp" {
    path = "/wapi/v2.12.3/dtc:monitor:icmp"
    create_path = "/wapi/v2.12.3/dtc:monitor:icmp?_return_fields=name"
    read_path = "/wapi/v2.12.3/{id}"
    update_path = "/wapi/v2.12.3/{id}?_return_fields=name"
    data = jsonencode({
        name  = "terraform_test_monitor_icmp1"
    })
    id_attribute = "_ref"
}

When creating an object, the Infoblox API either responds just with a string containing the object's ID or with the key "_ref" (only when "?_return_fields" is used).
When reading an object there is always the "_ref" key added to the response, no matter which "?_return_fields" are used.

Because of this, a terraform plan will always do a change, since it compares the current config containing only the name, with the target's config, always returning the name and the "_ref" ID.

It works, if I add an ignore_changes_to = ["_ref"] to the config.
But when I update an object, the Infoblox API will give you a new ID (_ref). Since "_ref" is ignored, this won't update and fail.

I've also tried ignore_server_additions = true, which unfortunately didn't help either.
And when using "read_search" and remove the "_ref" key there it also doesn't work, sice the update will not get an ID (I thought it was limited to read actions).

Is there any way to get this to work or is it just not compatible with the way the Infoblox API handles responses?

[DRuggeri]

Hey there, @maxinomnom - unfortunately, I think you're correct. I spent a fair bit of time myself trying to get the provider to work with Infoblox a few years back and ultimately gave up.

One thing I don't remember if I tried, which may be worth an experiment in the latest candidate released yesterday, is using copy_keys for _ref. This would, internal to the provider, gather the _ref and put it in the desired state (so rather than ignoring it, it becomes "managed"). It's possible the Infoblox API will reject this field being sent in... but maybe it just silently ignores it?

[maxinomnom]

Hey there, thanks for the quick reply!
I tried copy_keys for _ref. Unfortunately it was the same behavior:
After the first terraform apply the resource is deployed. If I immediately try terraform plan after this, it wants to apply a change, even when there is no.

[DRuggeri]

Hey there, @maxinomnom - sorry for the slow reply. Yes, I think this is just an incompatibility with the way the Infoblox API works and the expectations of the provider. There are a few things that stand out, but the most worrisome one is that if the Infoblox API is going to give a different ref on subsequent applys, we have no way to extract/follow that ref.

I think the only option may be to use ignore_all_server_changes since the server is doing very unexpected things. That should allow you to create/update/destroy, but at the expense of being able to manage drift.

[maxinomnom]

Don't stress! I tested a lot more, but I think I need to find another solution for Infoblox.
Thanks for helping out though :)