[UX2.0] service lan vpn feature perpetual diff if route-policy is not used.

[koval4ukav]

Configuration of service vpn lan:

resource "sdwan_service_lan_vpn_feature" "example-lan" {
  name                       = "SERVICE_LAN_VPN1"
  description                = "My Example"
  feature_profile_id         = "0d8d7abb-9d6e-4275-95cf-5777cd9b2407"
  vpn                        = 1
  config_description         = "VPN1"
  omp_admin_distance_ipv4    = 1
  omp_admin_distance_ipv6    = 1
  enable_sdwan_remote_access = false
  primary_dns_address_ipv4   = "10.2.1.1"
  secondary_dns_address_ipv4 = "10.2.3.52"
  primary_dns_address_ipv6   = "2001:0:0:1::1"
  secondary_dns_address_ipv6 = "2001:0:0:2::2"
  advertise_omp_ipv4s = [
    {
      protocol = "bgp"
    },
    {
      protocol = "connected"
    },
    {
      protocol = "static"
    },
    {
      protocol = "network"
      prefixes = [{
        network_address = "10.10.1.0"
        subnet_mask     = "255.255.255.0"
        },
        {
          network_address = "10.10.2.0"
          subnet_mask     = "255.255.255.0"
        }
      ]
    },
    {
      protocol = "aggregate"
      prefixes = [{
        network_address = "10.10.0.0"
        subnet_mask     = "255.255.255.0"
        aggregate_only  = true
      }]
    }
  ]
  advertise_omp_ipv6s = [
    {
      protocol = "BGP"
    },
    {
      protocol = "Connected"
    },
    {
      protocol = "Static"
    },
    {
      protocol = "Aggregate"
      prefixes = [{
        prefix         = "2001:0:0:1::/64"
        aggregate_only = true
      }]
    }
  ]
  route_leak_to_global_vpns = [{
    redistributions = [{
      protocol = "ospf"
    }]
    route_protocol = "bgp"
  }]
  route_leak_from_global_vpns = [{
    redistributions = [{
      protocol = "bgp"
    }]
    route_protocol = "static"
  }]
  route_leak_from_other_services = [{
    redistributions = [{
      protocol = "ospf"
      redistribution_policy_id = "7cc1145a-6735-40e2-ad1b-a3a2445e27d6"
    }]
    route_protocol = "static"
    route_policy_id = "7cc1145a-6735-40e2-ad1b-a3a2445e27d6"
    source_vpn     = 2
  }]
  ipv4_import_route_targets = [
    {
      route_target = "1.1.1.3:200"
    }
  ]
  ipv4_export_route_targets = [
    {
      route_target = "1.1.1.3:200"
    }
  ]
  ipv6_import_route_targets = [
    {
      route_target = "1.1.1.3:200"
    }
  ]
  ipv6_export_route_targets = [
    {
      route_target = "1.1.1.3:200"
    }
  ]
}

For configuration items where route-policy can be configured, but will not be used, TF will see diff in next run:

Terraform will perform the following actions:

  # sdwan_service_lan_vpn_feature.example-lan will be updated in-place
  ~ resource "sdwan_service_lan_vpn_feature" "example-lan" {
      ~ advertise_omp_ipv4s            = [
          ~ {
              + protocol = "bgp"
            },
          ~ {
              + protocol = "connected"
            },
          ~ {
              + protocol = "static"
            },
          ~ {
              ~ prefixes = [
                  ~ {
                      + network_address = "10.10.1.0"
                      + subnet_mask     = "255.255.255.0"
                    },
                  ~ {
                      + network_address = "10.10.2.0"
                      + subnet_mask     = "255.255.255.0"
                    },
                ]
              + protocol = "network"
            },
          ~ {
              ~ prefixes = [
                  ~ {
                      + aggregate_only  = true
                      + network_address = "10.10.0.0"
                      + subnet_mask     = "255.255.255.0"
                    },
                ]
              + protocol = "aggregate"
            },
        ]
      ~ advertise_omp_ipv6s            = [
          ~ {
              + protocol = "BGP"
            },
          ~ {
              + protocol = "Connected"
            },
          ~ {
              + protocol = "Static"
            },
          ~ {
              ~ prefixes = [
                  ~ {
                      + aggregate_only = true
                      + prefix         = "2001:0:0:1::/64"
                    },
                ]
              + protocol = "Aggregate"
            },
        ]
        id                             = "7b6d5494-def8-49b8-b4ca-81e78c4ee72b"
        name                           = "SERVICE_LAN_VPN1"
      ~ route_leak_from_global_vpns    = [
          ~ {
              ~ redistributions = [
                  ~ {
                      + protocol = "bgp"
                    },
                ]
              + route_protocol  = "static"
            },
        ]
      ~ route_leak_to_global_vpns      = [
          ~ {
              ~ redistributions = [
                  ~ {
                      + protocol = "ospf"
                    },
                ]
              + route_protocol  = "bgp"
            },
        ]
      ~ version                        = 19 -> (known after apply)
        # (16 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

For the configuration items with route_policy defined (in the example above route_leak_from_other_services), a diff is not seen. Looks like update logic setting to null attributes if routePolicy.refId is missing.

Provider "registry.terraform.io/ciscodevnet/sdwan" produced an unexpected new value for sdwan_service_lan_vpn_feature.example-lan during refresh.
      - .advertise_omp_ipv6s[0].protocol: was cty.StringVal("BGP"), but now null
      - .advertise_omp_ipv6s[1].protocol: was cty.StringVal("Connected"), but now null
      - .advertise_omp_ipv6s[2].protocol: was cty.StringVal("Static"), but now null
      - .advertise_omp_ipv6s[3].prefixes[0].aggregate_only: was cty.True, but now null
      - .advertise_omp_ipv6s[3].prefixes[0].prefix: was cty.StringVal("2001:0:0:1::/64"), but now null
      - .advertise_omp_ipv6s[3].protocol: was cty.StringVal("Aggregate"), but now null
      - .route_leak_to_global_vpns[0].route_protocol: was cty.StringVal("bgp"), but now null
      - .route_leak_to_global_vpns[0].redistributions[0].protocol: was cty.StringVal("ospf"), but now null
      - .route_leak_from_global_vpns[0].redistributions[0].protocol: was cty.StringVal("bgp"), but now null
      - .route_leak_from_global_vpns[0].route_protocol: was cty.StringVal("static"), but now null
      - .advertise_omp_ipv4s[0].protocol: was cty.StringVal("bgp"), but now null
      - .advertise_omp_ipv4s[1].protocol: was cty.StringVal("connected"), but now null
      - .advertise_omp_ipv4s[2].protocol: was cty.StringVal("static"), but now null
      - .advertise_omp_ipv4s[3].prefixes[0].subnet_mask: was cty.StringVal("255.255.255.0"), but now null
      - .advertise_omp_ipv4s[3].prefixes[0].network_address: was cty.StringVal("10.10.1.0"), but now null
      - .advertise_omp_ipv4s[3].prefixes[1].network_address: was cty.StringVal("10.10.2.0"), but now null
      - .advertise_omp_ipv4s[3].prefixes[1].subnet_mask: was cty.StringVal("255.255.255.0"), but now null
      - .advertise_omp_ipv4s[3].protocol: was cty.StringVal("network"), but now null
      - .advertise_omp_ipv4s[4].prefixes[0].aggregate_only: was cty.True, but now null
      - .advertise_omp_ipv4s[4].prefixes[0].network_address: was cty.StringVal("10.10.0.0"), but now null
      - .advertise_omp_ipv4s[4].prefixes[0].subnet_mask: was cty.StringVal("255.255.255.0"), but now null
      - .advertise_omp_ipv4s[4].protocol: was cty.StringVal("aggregate"), but now null