`netbox_prefix` custom fields result in permanent state drift

[mattwilder]

Provider version: 3.9.2
Netbox Version: v4.0.11-2.9.1

We are using the netbox_prefix resource with 3 custom fields:

• account, a text field
• cloud_account, a object reference to a circuit provider account
• location, another text field

Here is an example terraform resource configuration

resource "netbox_prefix" "this" {
    custom_fields = {
        "account"       = "821287586161"
        "cloud_account" = "5"
        "location"      = "AWS US East (N. Virginia)"
    }
    description   = "aws-inquest-1"
    id            = "215"
    is_pool       = false
    mark_utilized = false
    prefix        = "10.255.168.0/21"
    role_id       = 0
    site_id       = 0
    status        = "active"
    tags          = []
    tenant_id     = 0
    vlan_id       = 0
    vrf_id        = 1
}

However, every time we run terraform plan, the cloud_account and location fields show up as to be added:

Terraform will perform the following actions:

  # module.netbox[0].netbox_prefix.this will be updated in-place
  ~ resource "netbox_prefix" "this" {
      ~ custom_fields = {
          + "cloud_account" = "5"
          + "location"      = "AWS US East (N. Virginia)"
            # (1 unchanged element hidden)
        }
        id            = "215"
        tags          = []
        # (10 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

After running terraform apply, terraform state show shows that the location field is added, but as soon as terraform plan is run again the field is dropped. It looks like the cloud_account is never actually set inside terraform state

Additionally, all 3 custom fields are actually updated to the value provided, but the cloud_account and location custom fields still show up as not set on the next terraform plan as shown above

[mattwilder]

Here is a screenshot of our custom fields setup

[fbreckle]

Yes, I think we have an MR floating around that tries to fix this in #667

[mattwilder]

Yes, I think we have an MR floating around that tries to fix this in #667

@fbreckle that's great! Any idea when it will be merged? Will this fix be packported to the 3.9.x provider?

[mattwilder]

Yes, I think we have an MR floating around that tries to fix this in #667

@fbreckle unfortunately, this MR does not appear to fix our issue. I checked out the dev branch and built the provider binary locally, then used a dev override to interact with our terraform environment, and we experience the same permanent drift

[mattwilder]

We found the problem that was causing the permanent drift in our case.

The cloud_account object reference field simply isn't supported by the current provider, as the netbox API returns the entire object instead of a reference to it by ID or something. This isn't supported by the netbox_prefix resource schema, which causes terraform to abort filling in the fields which causes the other fields to not be populated correctly either.

This was made clear by running terraform with TF_LOG=debug, which showed the following log messages

2025-04-25T14:46:03.519-0700 [INFO]  provider.terraform-provider-netbox_v3.9.3: 2025/04/25 14:46:03 [ERROR] setting state: custom_fields.cloud_account: '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[account:managed-service description:Meta provider account for all managed service cells display:managed-service (Managed Service Cells) id:5 name:Managed Service Cells url:https://netbox.internal.memcompute.com/api/circuits/provider-accounts/5/]': timestamp=2025-04-25T14:46:03.519-0700
2025-04-25T14:46:03.522-0700 [WARN]  Provider "registry.terraform.io/e-breuninger/netbox" produced an invalid plan for module.netbox.netbox_prefix.this, but we are tolerating it because it is using the legacy plugin SDK.

Once we deleted the cloud_account custom field, the permanent drift went away.

Not sure how feasible it is to support custom fields like this given the way the API is implemented, so perhaps the best course of action for this issue is to put a warning in the documentation not to use object reference custom fields.

[jdh313]

@mattwilder As a temporary workaround, you can use something like

  lifecycle {
    ignore_changes = [custom_fields]
  }

to ignore those fields on updates.

[mattwilder]

@mattwilder As a temporary workaround, you can use something like

  lifecycle {
    ignore_changes = [custom_fields]
  }

to ignore those fields on updates.

While true, this would have the pretty big downside for us of eliminating our ability to use the string style custom fields that we make use of in all of our netbox prefixes.

[dprillxyz]

My solution to this was just to add an em dash as the default value for each custom_field:

module "prefix" {
  for_each = local.prefix
  source   = "./modules/netbox-prefix"

  custom_fields = {
    aws_account     = try(each.value.aws_account, "—")
    notes           = try(each.value.notes, "—")
    primary_contact = try(each.value.contact, "—")
    region          = try(each.value.region, "—")
  }
  description   = try(each.value.description, null)
  is_pool       = try(each.value.is_pool, false)
  mark_utilized = try(each.value.mark_utilized, true)
  prefix        = each.key
  role_id       = lookup(local.role_ids, try(each.value.role, ""), null)
  site_id       = lookup(local.site_ids, try(each.value.site, ""), null)
  status        = try(each.value.status, "active")
  vrf_id        = try(each.value.vrf_id, null)
}

Works well, no more drift, also the em dash is what Netbox displays by default anyway so things look normal when not populated.

[MrKeiKun]

We found the problem that was causing the permanent drift in our case.

The cloud_account object reference field simply isn't supported by the current provider, as the netbox API returns the entire object instead of a reference to it by ID or something. This isn't supported by the netbox_prefix resource schema, which causes terraform to abort filling in the fields which causes the other fields to not be populated correctly either.

This was made clear by running terraform with TF_LOG=debug, which showed the following log messages

2025-04-25T14:46:03.519-0700 [INFO]  provider.terraform-provider-netbox_v3.9.3: 2025/04/25 14:46:03 [ERROR] setting state: custom_fields.cloud_account: '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[account:managed-service description:Meta provider account for all managed service cells display:managed-service (Managed Service Cells) id:5 name:Managed Service Cells url:https://netbox.internal.memcompute.com/api/circuits/provider-accounts/5/]': timestamp=2025-04-25T14:46:03.519-0700
2025-04-25T14:46:03.522-0700 [WARN]  Provider "registry.terraform.io/e-breuninger/netbox" produced an invalid plan for module.netbox.netbox_prefix.this, but we are tolerating it because it is using the legacy plugin SDK.

Once we deleted the cloud_account custom field, the permanent drift went away.

Not sure how feasible it is to support custom fields like this given the way the API is implemented, so perhaps the best course of action for this issue is to put a warning in the documentation not to use object reference custom fields.

It seems like, NetBox API returns these as full objects/maps, but Terraform's schema expects strings, causing type conversion errors and incomplete state population.