Skip to content

Conversation

@chrxmvtik
Copy link
Contributor

Actual behaviour:

CIDR list parameter is critical feature when it comes to loadbalancer rules and it is missing at the moment.
When you create a loadbalancer rule using resource, it allows all CIDRs, which is not indented every time.

What was updated?

Added cidrlist parameter to loadbalancer_rule resource, so we can create rules with specific CIDRs instead of allowing everyone to access loadbalancer.

Would be great if you guys could release a new version of provider even as a minor which include this feature.

@chrxmvtik
Copy link
Contributor Author

Added docs and squashed previous commits.

fix: acceptance tests

style: remove comment

docs: added cidrlist to loadbalancer_rule docs

fix: adjust delimiter to cidr array
Copy link
Collaborator

@kiranchavala kiranchavala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM tested manually


resource "cloudstack_loadbalancer_rule" "default" {
  name          = "loadbalancer-rule-1"
  description   = "Loadbalancer rule 1"
  ip_address_id = "20a23048-a6e8-4db9-a3c1-3966043838ff"
  algorithm     = "roundrobin"
  private_port  = 80
  public_port   = 80
  member_ids    = ["3d8b9cf8-44ed-4066-9e62-2f0b67560d0b"]
  cidrlist      = ["10.0.0.0/8"] 
}

terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # cloudstack_loadbalancer_rule.default will be created
  + resource "cloudstack_loadbalancer_rule" "default" {
      + algorithm     = "roundrobin"
      + cidrlist      = [
          + "10.0.0.0/8",
        ]
      + description   = "Loadbalancer rule 1"
      + id            = (known after apply)
      + ip_address_id = "20a23048-a6e8-4db9-a3c1-3966043838ff"
      + member_ids    = [
          + "3d8b9cf8-44ed-4066-9e62-2f0b67560d0b",
        ]
      + name          = "loadbalancer-rule-1"
      + private_port  = 80
      + project       = (known after apply)
      + protocol      = (known after apply)
      + public_port   = 80
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

cloudstack_loadbalancer_rule.default: Creating...
cloudstack_loadbalancer_rule.default: Creation complete after 9s [id=639f4d8b-193c-4309-b724-fa3125775041]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
╭─ ~/Desktop/cloudstack-India-demo/cloudstack-terraform copy                                                                                           ✔ ╱ 10s ╱ Azure subscription 1  ╱ 05:40:19 PM 
╰─ terraform destroy
cloudstack_loadbalancer_rule.default: Refreshing state... [id=639f4d8b-193c-4309-b724-fa3125775041]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # cloudstack_loadbalancer_rule.default will be destroyed
  - resource "cloudstack_loadbalancer_rule" "default" {
      - algorithm     = "roundrobin" -> null
      - cidrlist      = [
          - "10.0.0.0/8",
        ] -> null
      - description   = "Loadbalancer rule 1" -> null
      - id            = "639f4d8b-193c-4309-b724-fa3125775041" -> null
      - ip_address_id = "20a23048-a6e8-4db9-a3c1-3966043838ff" -> null
      - member_ids    = [
          - "3d8b9cf8-44ed-4066-9e62-2f0b67560d0b",
        ] -> null
      - name          = "loadbalancer-rule-1" -> null
      - private_port  = 80 -> null
      - public_port   = 80 -> null
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

cloudstack_loadbalancer_rule.default: Destroying... [id=639f4d8b-193c-4309-b724-fa3125775041]
cloudstack_loadbalancer_rule.default: Destruction complete after 8s

Destroy complete! Resources: 1 destroyed.
Screenshot 2025-08-29 at 5 40 27 PM

@CodeBleu
Copy link
Collaborator

FYI - This is related and once it gets merged, then we'll be able to create TF to update the source CIDR in the LB as well 😄

@CodeBleu CodeBleu self-requested a review August 29, 2025 13:29
Copy link
Collaborator

@CodeBleu CodeBleu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm - haven't tested though

@DaanHoogland DaanHoogland merged commit aba1fde into apache:main Aug 31, 2025
24 checks passed
ianc769 pushed a commit to ianc769/cloudstack-terraform-provider that referenced this pull request Sep 3, 2025
kiranchavala pushed a commit that referenced this pull request Sep 16, 2025
* Add CloudStack project resource

* Add test for empty display_text defaulting to name value

* Uncomment and implement tests for accountid and userid in project resource

* Minor README Fix

* Update display_text to required for API compatibility and adjust documentation

* Clean up tests for 4.20.1.0

* fix: include domain ID when looking up projects by ID

Fix issue where getProjectByID() would always return "id not found" while
getProjectByName() could find the same project. CloudStack projects are only
unique within a domain context, so we now include domain ID in lookups.

- Modified getProjectByID() to accept optional domain parameter
- Updated all calls to include domain when available
- Updated test functions accordingly
- Updated documentation to clarify domain requirement for project imports

* feat: add cloudstack_project data source and corresponding tests

* remove rogue testing script

* Update cloudstack/resource_cloudstack_project.go

Co-authored-by: Copilot <[email protected]>

* adding domain validation to ensure projects are only reused within the intended scope

Co-authored-by: Copilot <[email protected]>

* Updated cloudstack go sdk to v2.17.1 (#193)

* Fix creation of firewall & Egress firewall rules when created in a project

* chore(deps): bump github.com/cloudflare/circl from 1.3.7 to 1.6.1

Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.7 to 1.6.1.
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.7...v1.6.1)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-version: 1.6.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

* resolve retrieveError issue

* Update cloudstack/resource_cloudstack_project.go

Co-authored-by: Copilot <[email protected]>

* Update cloudstack/resource_cloudstack_project.go

Co-authored-by: Copilot <[email protected]>

* Change display_text field from required to optional in resourceCloudStackProject

* Pin github actions version for opentofu

* rat + excludes and add licenses to other files (#200)

* readme: add specific test instruction in readme (#211)

Add instructions for specific test execution

* data: get vpc in project by project name (#209)

* Support additional parameters for cloudstack_nic resource (#210)

* serviceoffering: add params for custom offering, storage tags, encryptroot (#212)

* Support desc and ruleId in create_network_acl_rule

* fix review comment

* change rule_id -> rule_number and add doc

* add params in unit tests

* verify description and rule_number in unit test

* use fields defined in schema

* fix test verification sequence

* handle review comments

* Add support for additional optional parameters for creating network offerings (#205)

* Add disk_offering & override_disk_offering to instance resource

* Update website/docs/r/instance.html.markdown

Co-authored-by: Copilot <[email protected]>

* Allow specifying private end port & public end port for port forward rules

* Update tests

* Add `cloudstack_physicalnetwork` and some underlying additional resources (#201)

* feat: add cidrlist parameter to loadbalancer rule (#147)

* feat: add cloudstack_project resource to provider

* fix: update display_text to displaytext in project resource and tests.
fix: update lookup to use getAccountNameByID helper function

* fix: rename display_text to displaytext in project resource and tests

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Suresh Kumar Anaparti <[email protected]>
Co-authored-by: Pearl Dsilva <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: vishesh92 <[email protected]>
Co-authored-by: dahn <[email protected]>
Co-authored-by: Manoj Kumar <[email protected]>
Co-authored-by: Wei Zhou <[email protected]>
Co-authored-by: Abhishek Kumar <[email protected]>
Co-authored-by: ABW <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants