Skip to content

Commit 0aa6318

Browse files
committed
Add Terraform policy warning
1 parent 88dbffb commit 0aa6318

File tree

8 files changed

+19
-4
lines changed

8 files changed

+19
-4
lines changed

src/content/docs/cloudflare-one/policies/gateway/dns-policies/index.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ When creating a DNS policy, you can select as many security risk categories and
2424
params={{ type: "query", example: "Source IP", example2: "Resolved IP" }}
2525
/>
2626

27+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
28+
2729
## Actions
2830

2931
Just like actions in HTTP policies, actions in DNS policies allow you to choose what to do with a given set of elements. You can assign one action per policy.

src/content/docs/cloudflare-one/policies/gateway/egress-policies/index.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ Egress policies allow you to control which dedicated egress IP is used and when,
1818

1919
Cloudflare does not publish WARP egress IP ranges. WARP egress IPs are not documented at [Cloudflare's IP Ranges](https://cloudflare.com/ips). To obtain a dedicated WARP egress IP, contact your account team.
2020

21+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
22+
2123
## Force IP version
2224

2325
To control whether only IPv4 or IPv6 is used to egress, ensure you are [filtering DNS traffic](/cloudflare-one/policies/gateway/initial-setup/dns/), then create a DNS policy to [block AAAA or A records](/cloudflare-one/policies/gateway/dns-policies/common-policies/#control-ip-version).

src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ An HTTP policy consists of an **Action** as well as a logical expression that de
2626
params={{ type: "query", example: "Source IP", example2: "Resolved IP" }}
2727
/>
2828

29+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
30+
2931
## Actions
3032

3133
Actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.

src/content/docs/cloudflare-one/policies/gateway/network-policies/index.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ A network policy consists of an **Action** as well as a logical expression that
2626
params={{ type: "query", example: "Source IP", example2: "Resolved IP" }}
2727
/>
2828

29+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
30+
2931
## Actions
3032

3133
Like actions in DNS and HTTP policies, actions in network policies define which decision you want to apply to a given set of elements. You can assign one action per policy.

src/content/docs/cloudflare-one/policies/gateway/resolver-policies.mdx

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ Gateway will filter, resolve, and log your queries regardless of endpoint.
7979

8080
For more information on creating a DNS policy, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/).
8181

82+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
83+
8284
## Selectors
8385

8486
### Content Categories

src/content/partials/cloudflare-one/gateway/create-resolver-policy.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
4. In **Select DNS resolver**, choose _Configure custom DNS resolvers_.
1616
5. Enter the IP addresses of your custom DNS resolver.
17-
:::tip[Search virtual networks]
17+
:::note[Search virtual networks]
1818
As you enter an IP address, Gateway will search through your [virtual networks](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/) configured in Zero Trust.
1919
:::
2020
6. In **Network**, choose whether to route queries publicly (to the Internet) or privately (to a private network service).

src/content/partials/cloudflare-one/gateway/order-of-enforcement.mdx

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,9 +142,7 @@ When [resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) ar
142142
params={{ one: "DNS, network, or HTTP" }}
143143
/>
144144

145-
:::caution[Terraform precedence limitation]
146-
To avoid conflicts, Terraform applies a hash calculation to policy precedence. For example, a precedence of `1000` may become `1000901`. This can cause errors when reordering policies. To avoid this issue, manually set the precedence of your policies with the [Update a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/update/) endpoint.
147-
:::
145+
<Render file="gateway/terraform-precedence-warning" product="cloudflare-one" />
148146

149147
## Example
150148

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
{}
3+
---
4+
5+
:::caution[Terraform precedence limitation]
6+
To avoid conflicts, Terraform applies a hash calculation to policy precedence. For example, a precedence of `1000` may become `1000901`. This can cause errors when reordering policies. To avoid this issue, manually set the precedence of policies created with Terraform using the [Update a Zero Trust Gateway rule](/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/update/) endpoint.
7+
:::

0 commit comments

Comments
 (0)