Can't Create/Manage Firewall Rules at Node/Cluster Level about terraform-provider-proxmox HOT 3 CLOSED

Cluster/Datacenter level would do the trick for me but even after removing the node_name attribute, I'm still getting the same iface validation error... :)

Looks like the validation with the regex net\d+ is called systematically here, even on cluster rules. The description seems to indicate otherwise however...

Network interface name. You have to use network configuration key names for VMs and containers ('net\d+'). Host related rules can use arbitrary strings.

from terraform-provider-proxmox.

Hi @bpg,

I can confirm that I am experiencing the same error as @simoncaron.

When attempting to create Firewall Rules at the cluster level, I receive the same error that they indicated in their initial report.

As an example, assume a block that appears as follows:

resource "proxmox_virtual_environment_firewall_rules" "inbound" {

  provider = "proxmox-bpg"

  # Interface: vmbr0 (Public Interface)
  rule {
    security_group = "foo"
    comment        = "Allow Rule for Public Interface for Accepting Connections from foo"
    iface          = "vmbr0"
    enabled        = true
  }

  # Interface: vmbr1 (Private Interface)
  rule {
    security_group = "bar"
    comment        = "Allow Rule for Public Interface for Accepting Connections from bar"
    iface          = "vmbr1"
    enabled        = true
  }

  [...]
}

When terraform plan is executed, the following occurs:

╷
│ Error: invalid value for iface (Must be a valid VM/Container iface key, e.g. 'net0')
│ 
│   with proxmox_virtual_environment_firewall_rules.inbound,
│   on proxmox-firewall.tf line 66, in resource "proxmox_virtual_environment_firewall_rules" "inbound":
│   66:     iface          = "vmbr0"
│ 
╵
╷
│ Error: invalid value for iface (Must be a valid VM/Container iface key, e.g. 'net0')
│ 
│   with proxmox_virtual_environment_firewall_rules.inbound,
│   on proxmox-firewall.tf line 75, in resource "proxmox_virtual_environment_firewall_rules" "inbound":
│   75:     iface          = "vmbr1"
│ 
╵

Notably, this is in spite of node_name not being present as an argument in the configuration block above. For that matter, vm_id and container_id are also not specified.

The same behavior is presented by the provider if node_name is present regardless of whether or not it has a value of null (e.g.: node_name = null) or is given the value of an empty string, e.g.: node_name = "".

In short, it appears that the provider attempts to treat the configuration as if it should be assigned to a VM or to a Container regardless of whether or not the parameter node_name is present in the configuration, and accordingly issues an error.

from terraform-provider-proxmox.

Hi @simoncaron! 👋🏼

Firewall rules are supported on cluster or VM / Container levels. In order to define a cluster-level rule you'd need to remove node_name attribute.

If this is not enough for your use case and you'd like to have a node rule support, I'll covert this ticket to 'enhancement'.

from terraform-provider-proxmox.