Skip to content

Commit 1aab1a1

Browse files
tamas-jozsatamas-jozsa
authored
feat(zone_setting): v4 to v5 migration (#84)
1 parent 71f661f commit 1aab1a1

File tree

11 files changed

+1517
-1
lines changed

11 files changed

+1517
-1
lines changed

‎e2e/drift-exemptions.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,54 @@ exemptions:
4545
- '\+ country_code = '
4646
enabled: true
4747

48+
# Zone setting migrations: one-to-many transformation
49+
# The v4 cloudflare_zone_settings_override resource is deleted from state and splits
50+
# into multiple v5 cloudflare_zone_setting resources. This causes expected initial
51+
# drift where all v5 resources need to be created via terraform apply.
52+
- name: "zone_setting_migration_drift"
53+
description: "Allow zone_setting resources to be created after migration (one-to-many transformation)"
54+
resource_types:
55+
- "cloudflare_zone_setting"
56+
patterns:
57+
- "will be created"
58+
- "\\+ resource"
59+
- "cloudflare_zone_setting"
60+
- "zone_setting"
61+
- "\\+ editable"
62+
- "\\+ enabled"
63+
- "\\+ id"
64+
- "\\+ modified_on"
65+
- "\\+ setting_id"
66+
- "\\+ time_remaining"
67+
- "\\+ value"
68+
- "\\+ zone_id"
69+
- "known after apply"
70+
- "~ value"
71+
- "~ editable"
72+
- "~ modified_on"
73+
- "\\+ strict_transport_security"
74+
- "\\+ include_subdomains"
75+
- "\\+ max_age"
76+
- "\\+ nosniff"
77+
- "\\+ preload"
78+
enabled: true
79+
80+
# Some zone settings may not be supported on all plans/zones (e.g., 0rtt on free plans)
81+
# These settings will show ongoing drift as the API doesn't accept the value
82+
- name: "zone_setting_unsupported_features"
83+
description: "Ignore zone settings that aren't supported on this zone's plan or have API bugs"
84+
resource_types:
85+
- "cloudflare_zone_setting"
86+
attributes:
87+
- "value"
88+
patterns:
89+
- "0rtt"
90+
- "with_name_mapping_zero_rtt"
91+
- "tls_1_3"
92+
- "with_interpolation_tls_1_3"
93+
- 'zrt.*on'
94+
enabled: true
95+
4896
# Example: Ignore specific resource types
4997
# - name: "zone_dnssec_computed"
5098
# description: "Ignore computed changes in zone DNSSEC resources"

‎integration/v4_to_v5/integration_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
_ "github.com/cloudflare/tf-migrate/internal/resources/zero_trust_dlp_custom_profile"
3535
_ "github.com/cloudflare/tf-migrate/internal/resources/zero_trust_gateway_policy"
3636
_ "github.com/cloudflare/tf-migrate/internal/resources/zero_trust_list"
37+
_ "github.com/cloudflare/tf-migrate/internal/resources/zone_setting"
3738
)
3839

3940
// TestMain explicitly registers migrations for this version path

‎integration/v4_to_v5/testdata/zone_setting/expected/terraform.tfstate‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"lineage": "test-zone-settings-override",
3+
"outputs": {},
4+
"resources": [
5+
{
6+
"instances": [
7+
{}
8+
],
9+
"mode": "managed",
10+
"name": "minimal",
11+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
12+
"type": "cloudflare_zone_setting"
13+
},
14+
{
15+
"instances": [
16+
{}
17+
],
18+
"mode": "managed",
19+
"name": "with_integers",
20+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
21+
"type": "cloudflare_zone_setting"
22+
},
23+
{
24+
"instances": [
25+
{}
26+
],
27+
"mode": "managed",
28+
"name": "with_minify",
29+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
30+
"type": "cloudflare_zone_setting"
31+
},
32+
{
33+
"instances": [
34+
{}
35+
],
36+
"mode": "managed",
37+
"name": "with_security_header",
38+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
39+
"type": "cloudflare_zone_setting"
40+
},
41+
{
42+
"instances": [
43+
{}
44+
],
45+
"mode": "managed",
46+
"name": "comprehensive",
47+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
48+
"type": "cloudflare_zone_setting"
49+
}
50+
],
51+
"serial": 1,
52+
"terraform_version": "1.5.0",
53+
"version": 4
54+
}

‎integration/v4_to_v5/testdata/zone_setting/expected/zone_setting.tf‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# Zone Settings Migration Test - Safe settings for all plans
2+
# Covers migration patterns without plan-restricted features
3+
4+
variable "cloudflare_account_id" {
5+
description = "Cloudflare account ID"
6+
type = string
7+
}
8+
9+
variable "cloudflare_zone_id" {
10+
description = "Cloudflare zone ID"
11+
type = string
12+
}
13+
14+
variable "cloudflare_domain" {
15+
description = "Cloudflare domain for testing"
16+
type = string
17+
}
18+
19+
locals {
20+
primary_zone_id = var.cloudflare_zone_id
21+
cache_ttls = [14400, 28800, 43200]
22+
}
23+
24+
25+
26+
27+
# Test Cases 4-6: Removed - Invalid Pattern
28+
# Multiple zone_settings_override resources for the same zone will conflict
29+
# In v4, cloudflare_zone_settings_override manages ALL settings for a zone
30+
# Having multiple such resources causes them to overwrite each other
31+
# This pattern is not supported and should not be used
32+
33+
# Test Case 7: Conditional creation
34+
locals {
35+
enable_advanced_settings = true
36+
enable_test_settings = false
37+
}
38+
39+
40+
41+
42+
43+
44+
45+
46+
resource "cloudflare_zone_setting" "minimal_always_online" {
47+
zone_id = var.cloudflare_zone_id
48+
setting_id = "always_online"
49+
value = "on"
50+
}
51+
resource "cloudflare_zone_setting" "minimal_brotli" {
52+
zone_id = var.cloudflare_zone_id
53+
setting_id = "brotli"
54+
value = "on"
55+
}
56+
resource "cloudflare_zone_setting" "with_integers_browser_cache_ttl" {
57+
zone_id = var.cloudflare_zone_id
58+
setting_id = "browser_cache_ttl"
59+
value = 14400
60+
}
61+
resource "cloudflare_zone_setting" "with_integers_challenge_ttl" {
62+
zone_id = var.cloudflare_zone_id
63+
setting_id = "challenge_ttl"
64+
value = 1800
65+
}
66+
resource "cloudflare_zone_setting" "with_security_header_ssl" {
67+
zone_id = var.cloudflare_zone_id
68+
setting_id = "ssl"
69+
value = "flexible"
70+
}
71+
resource "cloudflare_zone_setting" "with_security_header_security_header" {
72+
zone_id = var.cloudflare_zone_id
73+
setting_id = "security_header"
74+
value = {
75+
strict_transport_security = {
76+
enabled = true
77+
include_subdomains = true
78+
max_age = 86400
79+
nosniff = true
80+
preload = true
81+
}
82+
}
83+
}
84+
resource "cloudflare_zone_setting" "conditional_enabled_rocket_loader" {
85+
zone_id = var.cloudflare_zone_id
86+
setting_id = "rocket_loader"
87+
value = "on"
88+
count = local.enable_advanced_settings ? 1 : 0
89+
}
90+
resource "cloudflare_zone_setting" "conditional_enabled_websockets" {
91+
zone_id = var.cloudflare_zone_id
92+
setting_id = "websockets"
93+
value = "on"
94+
count = local.enable_advanced_settings ? 1 : 0
95+
}
96+
resource "cloudflare_zone_setting" "conditional_disabled_browser_check" {
97+
zone_id = var.cloudflare_zone_id
98+
setting_id = "browser_check"
99+
value = "on"
100+
count = local.enable_test_settings ? 1 : 0
101+
}
102+
resource "cloudflare_zone_setting" "with_functions_browser_cache_ttl" {
103+
zone_id = var.cloudflare_zone_id
104+
setting_id = "browser_cache_ttl"
105+
value = lookup({ "default" = 14400, "custom" = 28800 }, "default")
106+
}
107+
resource "cloudflare_zone_setting" "with_functions_cache_level" {
108+
zone_id = var.cloudflare_zone_id
109+
setting_id = "cache_level"
110+
value = "aggressive"
111+
}
112+
resource "cloudflare_zone_setting" "with_interpolation_automatic_https_rewrites" {
113+
zone_id = local.primary_zone_id
114+
setting_id = "automatic_https_rewrites"
115+
value = "on"
116+
}
117+
resource "cloudflare_zone_setting" "with_interpolation_min_tls_version" {
118+
zone_id = local.primary_zone_id
119+
setting_id = "min_tls_version"
120+
value = "1.2"
121+
}
122+
resource "cloudflare_zone_setting" "with_lifecycle_always_online" {
123+
zone_id = var.cloudflare_zone_id
124+
setting_id = "always_online"
125+
value = "on"
126+
lifecycle {
127+
create_before_destroy = true
128+
}
129+
}
130+
resource "cloudflare_zone_setting" "with_lifecycle_ipv6" {
131+
zone_id = var.cloudflare_zone_id
132+
setting_id = "ipv6"
133+
value = "on"
134+
lifecycle {
135+
create_before_destroy = true
136+
}
137+
}
138+
resource "cloudflare_zone_setting" "with_ignore_changes_email_obfuscation" {
139+
zone_id = var.cloudflare_zone_id
140+
setting_id = "email_obfuscation"
141+
value = "on"
142+
}
143+
resource "cloudflare_zone_setting" "with_ignore_changes_server_side_exclude" {
144+
zone_id = var.cloudflare_zone_id
145+
setting_id = "server_side_exclude"
146+
value = "on"
147+
}
148+
resource "cloudflare_zone_setting" "with_name_mapping_http2" {
149+
zone_id = var.cloudflare_zone_id
150+
setting_id = "http2"
151+
value = "on"
152+
}
153+
resource "cloudflare_zone_setting" "with_name_mapping_http3" {
154+
zone_id = var.cloudflare_zone_id
155+
setting_id = "http3"
156+
value = "on"
157+
}
158+
resource "cloudflare_zone_setting" "with_deprecated_always_online" {
159+
zone_id = var.cloudflare_zone_id
160+
setting_id = "always_online"
161+
value = "on"
162+
}
163+
resource "cloudflare_zone_setting" "with_deprecated_brotli" {
164+
zone_id = var.cloudflare_zone_id
165+
setting_id = "brotli"
166+
value = "on"
167+
}

‎integration/v4_to_v5/testdata/zone_setting/input/terraform.tfstate‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"lineage": "test-zone-settings-override",
3+
"outputs": {},
4+
"resources": [
5+
{
6+
"instances": [
7+
{}
8+
],
9+
"mode": "managed",
10+
"name": "minimal",
11+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
12+
"type": "cloudflare_zone_setting"
13+
},
14+
{
15+
"instances": [
16+
{}
17+
],
18+
"mode": "managed",
19+
"name": "with_integers",
20+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
21+
"type": "cloudflare_zone_setting"
22+
},
23+
{
24+
"instances": [
25+
{}
26+
],
27+
"mode": "managed",
28+
"name": "with_minify",
29+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
30+
"type": "cloudflare_zone_setting"
31+
},
32+
{
33+
"instances": [
34+
{}
35+
],
36+
"mode": "managed",
37+
"name": "with_security_header",
38+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
39+
"type": "cloudflare_zone_setting"
40+
},
41+
{
42+
"instances": [
43+
{}
44+
],
45+
"mode": "managed",
46+
"name": "comprehensive",
47+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
48+
"type": "cloudflare_zone_setting"
49+
}
50+
],
51+
"serial": 1,
52+
"terraform_version": "1.5.0",
53+
"version": 4
54+
}

‎integration/v4_to_v5/testdata/zone_setting/input/terraform.tfstate.backup‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"lineage": "test-zone-settings-override",
3+
"outputs": {},
4+
"resources": [
5+
{
6+
"instances": [
7+
{}
8+
],
9+
"mode": "managed",
10+
"name": "minimal",
11+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
12+
"type": "cloudflare_zone_setting"
13+
},
14+
{
15+
"instances": [
16+
{}
17+
],
18+
"mode": "managed",
19+
"name": "with_integers",
20+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
21+
"type": "cloudflare_zone_setting"
22+
},
23+
{
24+
"instances": [
25+
{}
26+
],
27+
"mode": "managed",
28+
"name": "with_minify",
29+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
30+
"type": "cloudflare_zone_setting"
31+
},
32+
{
33+
"instances": [
34+
{}
35+
],
36+
"mode": "managed",
37+
"name": "with_security_header",
38+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
39+
"type": "cloudflare_zone_setting"
40+
},
41+
{
42+
"instances": [
43+
{}
44+
],
45+
"mode": "managed",
46+
"name": "comprehensive",
47+
"provider": "provider[\"registry.terraform.io/cloudflare/cloudflare\"]",
48+
"type": "cloudflare_zone_setting"
49+
}
50+
],
51+
"serial": 1,
52+
"terraform_version": "1.5.0",
53+
"version": 4
54+
}

0 commit comments

Comments
 (0)