Skip to content

Commit fc4da7a

Browse files
tamas-jozsatamas-jozsa
committed
docs: add TKT-007 through TKT-011 for provider state upgrade bugs
Five additional provider-side bugs discovered in the research team PR (terraform-cfaccounts MR !7756) that cause UpgradeResourceState failures during terraform plan. All follow the same pattern: the v5 provider UpgradeState handler expects a JSON object {} but the v4 state stored the field as a JSON array [] or plain string. Affected resources: - TKT-007: zero_trust_access_policy.connection_rules ([] → {}) - TKT-008: cloudflare_zone.plan ('enterprise' string → {}) - TKT-009: cloudflare_logpush_job.output_options ([] → {}) - TKT-010: cloudflare_notification_policy.filters ([] → {}) - TKT-011: cloudflare_ruleset.action_parameters ([] → {}) These are provider bugs in cloudflare-terraform-next, not tf-migrate issues.
1 parent 554cee4 commit fc4da7a

6 files changed

Lines changed: 126 additions & 0 deletions

‎tickets/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,24 @@ Per the commit message in `727e0f99c`:
4545
4. Used the latest `main` branch of tf-migrate instead of tagged version because
4646
v1.0.0-beta.5 cleared `service_token` entirely (TKT-004)
4747

48+
## Additional Provider State Upgrade Bugs (TKT-007 through TKT-011)
49+
50+
These are **provider-side** bugs in `cloudflare-terraform-next`. They are NOT
51+
tf-migrate issues — they occur during `terraform plan` because the v5 provider's
52+
`UpgradeResourceState` handlers fail to deserialize v4 state where the stored
53+
JSON type doesn't match what the handler expects.
54+
55+
| Ticket | Resource | Error |
56+
|--------|----------|-------|
57+
| [TKT-007](TKT-007-provider-state-upgrade-connection-rules.md) | `cloudflare_zero_trust_access_policy` | `connection_rules`: expected `{}`, got `[]` |
58+
| [TKT-008](TKT-008-provider-state-upgrade-zone-plan.md) | `cloudflare_zone` | `plan`: expected `{}`, got `"enterprise"` |
59+
| [TKT-009](TKT-009-provider-state-upgrade-logpush-output-options.md) | `cloudflare_logpush_job` | `output_options`: expected `{}`, got `[]` |
60+
| [TKT-010](TKT-010-provider-state-upgrade-notification-policy-filters.md) | `cloudflare_notification_policy` | `filters`: expected `{}`, got `[]` |
61+
| [TKT-011](TKT-011-provider-state-upgrade-ruleset-action-parameters.md) | `cloudflare_ruleset` | `action_parameters`: expected `{}`, got `[]` |
62+
63+
All follow the same pattern: v4 stored a field as a JSON array `[]` (empty or
64+
list), but the v5 UpgradeState handler expects a JSON object `{}`.
65+
4866
## E2E Tests Added
4967

5068
Test cases reproducing all issues have been added to:

‎tickets/TKT-007-provider-state-upgrade-connection-rules.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# TKT-007: Provider — connection_rules state upgrade fails (expected "{", got "[")
2+
3+
## Status
4+
Open — provider bug in cloudflare-terraform-next
5+
6+
## Error
7+
```
8+
Error: Unable to Read Previously Saved State for UpgradeResourceState
9+
with cloudflare_zero_trust_access_policy.allow_cloudflare_com_emails
10+
AttributeName("connection_rules"): invalid JSON, expected "{", got "["
11+
```
12+
13+
## Root cause
14+
The v5 provider's UpgradeState handler for `cloudflare_zero_trust_access_policy`
15+
expects `connection_rules` to be a JSON object `{}` in v4 state, but v4 stored
16+
it as a JSON array `[]`. This is a schema mismatch in the state migration handler.
17+
18+
## Note
19+
This error is partially caused by TKT-002 (include block not converted), which
20+
leaves the schema in an inconsistent state. After re-running tf-migrate with the
21+
TKT-002 fix, the config will be correct. However the state upgrade failure may
22+
still occur if the v4 state has connection_rules as `[]`.
23+
24+
## Fix location
25+
`internal/services/zero_trust_access_policy/migration/v500/handler.go` in
26+
cloudflare-terraform-next — the UpgradeState handler needs to handle `[]` as
27+
an empty/null connection_rules value.

‎tickets/TKT-008-provider-state-upgrade-zone-plan.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# TKT-008: Provider — cloudflare_zone state upgrade fails (plan: expected "{", got "enterprise")
2+
3+
## Status
4+
Open — provider bug in cloudflare-terraform-next
5+
6+
## Error
7+
```
8+
Error: Unable to Read Previously Saved State for UpgradeResourceState
9+
with cloudflare_zone.req_mtls
10+
AttributeName("plan"): invalid JSON, expected "{", got "enterprise"
11+
```
12+
13+
## Root cause
14+
The v5 provider's UpgradeState handler for `cloudflare_zone` expects the `plan`
15+
attribute to be a JSON object, but v4 stored it as a plain string `"enterprise"`.
16+
17+
## Fix location
18+
`internal/services/zone/migration/` in cloudflare-terraform-next — the
19+
UpgradeState handler needs to handle plain string values for `plan` and convert
20+
them to the v5 object format.

‎tickets/TKT-009-provider-state-upgrade-logpush-output-options.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# TKT-009: Provider — cloudflare_logpush_job state upgrade fails (output_options: expected "{", got "[")
2+
3+
## Status
4+
Open — provider bug in cloudflare-terraform-next
5+
6+
## Error
7+
```
8+
Error: Unable to Read Previously Saved State for UpgradeResourceState
9+
with cloudflare_logpush_job.audit_logs_logpush_job
10+
AttributeName("output_options"): invalid JSON, expected "{", got "["
11+
```
12+
13+
Affects all 3 logpush jobs in the research team workspace.
14+
15+
## Root cause
16+
The v5 provider's UpgradeState handler for `cloudflare_logpush_job` expects
17+
`output_options` to be a JSON object, but v4 stored it as a JSON array `[]`.
18+
19+
## Fix location
20+
`internal/services/logpush_job/migration/` in cloudflare-terraform-next

‎tickets/TKT-010-provider-state-upgrade-notification-policy-filters.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# TKT-010: Provider — cloudflare_notification_policy state upgrade fails (filters: expected "{", got "[")
2+
3+
## Status
4+
Open — provider bug in cloudflare-terraform-next
5+
6+
## Error
7+
```
8+
Error: Unable to Read Previously Saved State for UpgradeResourceState
9+
with cloudflare_notification_policy.expiring_service_token
10+
AttributeName("filters"): invalid JSON, expected "{", got "["
11+
```
12+
13+
## Root cause
14+
The v5 provider's UpgradeState handler for `cloudflare_notification_policy`
15+
expects `filters` to be a JSON object, but v4 stored it as a JSON array `[]`.
16+
17+
## Fix location
18+
`internal/services/notification_policy/migration/` in cloudflare-terraform-next

‎tickets/TKT-011-provider-state-upgrade-ruleset-action-parameters.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# TKT-011: Provider — cloudflare_ruleset state upgrade fails (action_parameters: expected "{", got "[")
2+
3+
## Status
4+
Open — provider bug in cloudflare-terraform-next
5+
6+
## Error
7+
```
8+
Error: Unable to Read Previously Saved State for UpgradeResourceState
9+
with cloudflare_ruleset.terraform_managed_resource_*
10+
AttributeName("rules").ElementKeyInt(0).AttributeName("action_parameters"):
11+
invalid JSON, expected "{", got "["
12+
```
13+
14+
Affects both rulesets in the research team workspace.
15+
16+
## Root cause
17+
The v5 provider's UpgradeState handler (or current schema) for `cloudflare_ruleset`
18+
expects `action_parameters` to be a JSON object, but the state has it stored as
19+
a JSON array `[]`.
20+
21+
## Fix location
22+
`internal/services/ruleset/` in cloudflare-terraform-next — either the
23+
UpgradeState handler or the current schema's state deserialization.

0 commit comments

Comments
 (0)