Merge pull request #45 from platform9/pushkar/instance-block-device

v0.1.7: block device boot sources, migration priority, port security, scheduler hints, and resmgr absence detection

Author: PF9-pushkar

CHANGELOG.md

@@ -6,6 +6,52 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.1.7] - 2026-08-18
+
+### Fixed
+
+- `pcd_cluster`, `pcd_cluster_blueprint`, `pcd_host_config` and the host reads behind
+  `pcd_host_config_assignment` / `pcd_host_role`: an object resmgr no longer has is now removed from
+  state. resmgr answers `GET` for a deleted cluster with `200` and a body of `null` rather than a
+  `404`; that decoded into a zero-value struct with no error, so Read reported the resource as
+  present-but-blank and never called `RemoveResource` — leaving Terraform convinced a destroyed
+  region still existed and unable to rebuild it. A 200 that describes no object is now absence.
+- `pcd_compute_instance`: `availability_zone = "<az>:<host>"` (admin host pin) no longer fails with "inconsistent result after apply" — the pin is preserved on read, as upstream does.
+
+### Added
+- `pcd_compute_instance`: `scheduler_hints` block (`group`, `different_host`, `same_host`,
+  `additional_properties`) — upstream parity; makes `pcd_compute_servergroup` usable for
+  affinity / anti-affinity placement.
+- **`pcd_compute_instance` gains `block_device`** — Nova `block_device_mapping_v2`, mirroring
+  `openstack_compute_instance_v2` so configurations port unchanged. This unlocks every boot
+  source the PCD UI's Deploy VM wizard offers beyond "Image": boot from a **new volume**
+  (`source_type = "image"`, `destination_type = "volume"`, `volume_size`, `volume_type`,
+  `delete_on_termination` — the wizard's default), an **existing volume**, a **volume
+  snapshot**, and **install from ISO** (a blank root volume at `boot_index = 0` plus the ISO
+  as a `device_type = "cdrom"` volume at `boot_index = 1`). `image_id`/`image_name` become
+  optional when a `block_device` with `boot_index = 0` supplies the root disk. Extra data disks
+  at boot are `boot_index = -1`. Create-only, like upstream; use `pcd_compute_volume_attach`
+  for day-2 attach/detach. When block devices are present the create call negotiates compute
+  API microversion 2.67 (required for `volume_type` in a block-device mapping; PCD 2026.4
+  serves up to 2.100); every other call keeps the provider's default so read paths are
+  unchanged. Verified live against a 2026.4 CE: all four boot sources reach ACTIVE, the ISO
+  path presents the installer as an IDE `cdrom` device with the blank target on virtio.
+- **`pcd_compute_instance` gains `migration_priority`** — how PCD's Dynamic Resource
+  Rebalancing (DRR) service treats the VM: `normal`, `low`, `high`, or `never` (excluded).
+  Stored as the `migration-priority` server-metadata key, exactly as the PCD UI's "Set
+  Migration Priority" dialog does; updatable in place, `""` clears. The key is reserved and
+  kept out of `metadata` on read, so the two attributes never drift against each other, and
+  configuring it directly in `metadata` is rejected.
+- **`pcd_networking_network` gains `port_security_enabled`** (default `true`), mirroring
+  `openstack_networking_network_v2`. Setting it `false` is what makes a Layer 2 / "Simple"
+  network (the PCD UI's Simple Networking option: no subnet, no DHCP, no security groups —
+  VMs manage their own addressing). Together with `segments` and the `simple_network` tag the
+  UI keys on, an L2 network is now fully expressible in one resource. Note that Nova refuses
+  to boot on a subnet-less network by network id ("requires a subnet in order to boot
+  instances on"): attach the instance through a `pcd_networking_port` on the network instead —
+  the L2 model anyway. The example shows both halves. Also read back by the
+  `pcd_networking_network` data source.
+
 ## [0.1.6] - 2026-08-15
 
 ### Fixed

docs/data-sources/networking_network.md

@@ -34,4 +34,5 @@ data "pcd_networking_network" "example" {
 - `description` (String) The network description.
 - `external` (Boolean) Whether the network is external.
 - `id` (String) The network ID.
+- `port_security_enabled` (Boolean) Whether port security is enforced on ports of this network. `false` on a Layer 2 / "Simple" network.
 - `shared` (Boolean) Whether the network is shared.

docs/resources/compute_instance.md

@@ -17,14 +17,20 @@ resource "pcd_networking_network" "example" {
   name = "tf-example-network"
 }
 
-resource "pcd_compute_instance" "example" {
+# Boot from an image (ephemeral root disk on the hypervisor).
+resource "pcd_compute_instance" "from_image" {
   name        = "tf-example-instance"
   image_name  = "Ubuntu-22.04"
   flavor_name = "m1.small"
   key_pair    = "tf-example-key"
 
   security_groups = ["default"]
 
+  # How PCD's Dynamic Resource Rebalancing (DRR) treats this VM when balancing
+  # hosts: normal | low | high | never (excluded). Same as the UI's
+  # "Set Migration Priority" action. Updatable in place.
+  migration_priority = "high"
+
   metadata = {
     environment = "dev"
   }
@@ -33,6 +39,137 @@ resource "pcd_compute_instance" "example" {
     uuid = pcd_networking_network.example.id
   }
 }
+
+# A VM on a Layer 2 / "Simple" network. A subnet-less network cannot be booted
+# on by network uuid (Nova requires a subnet for that), so the VM attaches
+# through a port on it — which is the L2 model anyway: a port on the segment,
+# and the guest owns its IP. No DHCP, so addressing comes from cloud-init via
+# config drive; no security groups apply (port security is off on the network).
+resource "pcd_networking_port" "l2" {
+  name       = "tf-example-l2-port"
+  network_id = "L2-NETWORK-UUID" # e.g. pcd_networking_network.l2.id
+}
+
+resource "pcd_compute_instance" "on_l2" {
+  name         = "tf-example-l2"
+  image_name   = "Ubuntu-22.04"
+  flavor_name  = "m1.small"
+  config_drive = true
+  user_data    = file("cloud-init-static-ip.yaml")
+
+  network {
+    port = pcd_networking_port.l2.id
+  }
+}
+
+# Boot from a NEW volume created from an image (persistent root disk) — the
+# PCD UI's default "New Volume" option. No image_name needed: the block_device
+# with boot_index = 0 is the root disk.
+resource "pcd_compute_instance" "from_new_volume" {
+  name        = "tf-example-bfv"
+  flavor_name = "m1.small"
+
+  block_device {
+    source_type           = "image"
+    uuid                  = "IMAGE-UUID"
+    destination_type      = "volume"
+    volume_size           = 20
+    volume_type           = "ssd"
+    boot_index            = 0
+    delete_on_termination = true
+  }
+
+  network {
+    uuid = pcd_networking_network.example.id
+  }
+}
+
+# Boot from an EXISTING volume (e.g. one restored from a backup).
+resource "pcd_compute_instance" "from_existing_volume" {
+  name        = "tf-example-existing"
+  flavor_name = "m1.small"
+
+  block_device {
+    source_type      = "volume"
+    uuid             = "VOLUME-UUID"
+    destination_type = "volume"
+    boot_index       = 0
+  }
+
+  network {
+    uuid = pcd_networking_network.example.id
+  }
+}
+
+# Boot from a VOLUME SNAPSHOT (a new volume is cloned from it).
+resource "pcd_compute_instance" "from_volume_snapshot" {
+  name        = "tf-example-snap"
+  flavor_name = "m1.small"
+
+  block_device {
+    source_type           = "snapshot"
+    uuid                  = "SNAPSHOT-UUID"
+    destination_type      = "volume"
+    boot_index            = 0
+    delete_on_termination = true
+  }
+
+  network {
+    uuid = pcd_networking_network.example.id
+  }
+}
+
+# Install from an ISO: a blank target volume to install onto (boot_index 0)
+# plus the installer ISO attached as a CD-ROM (boot_index 1) — the PCD UI's
+# "Install from ISO" option.
+resource "pcd_compute_instance" "from_iso" {
+  name        = "tf-example-iso"
+  flavor_name = "m1.small"
+
+  block_device {
+    source_type           = "blank"
+    destination_type      = "volume"
+    volume_size           = 40
+    boot_index            = 0
+    delete_on_termination = false
+  }
+
+  block_device {
+    source_type           = "image"
+    uuid                  = "ISO-IMAGE-UUID"
+    destination_type      = "volume"
+    volume_size           = 1
+    boot_index            = 1
+    device_type           = "cdrom"
+    delete_on_termination = true
+  }
+
+  network {
+    uuid = pcd_networking_network.example.id
+  }
+}
+
+# --- Placement: server groups and scheduler hints ---------------------------
+resource "pcd_compute_servergroup" "web" {
+  name     = "web-anti-affinity"
+  policies = ["anti-affinity"]
+}
+
+resource "pcd_compute_instance" "web" {
+  count       = 2
+  name        = "web-${count.index}"
+  image_name  = "cirros-0.6.2"
+  flavor_name = "m1.tiny"
+
+  network {
+    uuid = pcd_networking_network.example.id
+  }
+
+  # Each member lands on a different hypervisor.
+  scheduler_hints {
+    group = pcd_compute_servergroup.web.id
+  }
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -44,16 +181,19 @@ resource "pcd_compute_instance" "example" {
 
 ### Optional
 
-- `availability_zone` (String) Availability zone to launch in. Changing this forces a new resource.
+- `availability_zone` (String) Availability zone to launch in. Admins may pin a host with `<az>:<host>` (e.g. `nova:hyp2`); the pin is preserved on refresh (Nova only reports the zone); `terraform import` recovers only the zone, so re-set the pin in state before applying. Changing this forces a new resource.
+- `block_device` (Block List) Block devices to create the instance with (Nova `block_device_mapping_v2`), one block per device. Mirrors `openstack_compute_instance_v2`. Use it to boot from a new volume, an existing volume, or a volume snapshot, to install from an ISO, or to attach extra disks at boot. The device with `boot_index = 0` is the root disk; when one is present `image_id`/`image_name` may be omitted. Create-only: changing this forces a new resource. Attach/detach volumes on a running instance with `pcd_compute_volume_attach` instead. (see [below for nested schema](#nestedblock--block_device))
 - `config_drive` (Boolean) Whether to use a config drive. Changing this forces a new resource.
 - `flavor_id` (String) The flavor ID (alternative to flavor_name). Changing this triggers an in-place resize.
 - `flavor_name` (String) The flavor name (alternative to flavor_id). Changing this triggers an in-place resize.
-- `image_id` (String) The image ID to boot from (alternative to image_name). Changing this forces a new resource.
-- `image_name` (String) The image name to boot from, resolved via Glance (alternative to image_id). Exactly one of image_id/image_name is required. Changing this forces a new resource.
+- `image_id` (String) The image ID to boot from (alternative to image_name). Required unless a `block_device` with `boot_index = 0` supplies the boot disk. Changing this forces a new resource.
+- `image_name` (String) The image name to boot from, resolved via Glance (alternative to image_id). Required unless a `block_device` with `boot_index = 0` supplies the boot disk. Changing this forces a new resource.
 - `key_pair` (String) The name of a keypair to inject. Changing this forces a new resource.
-- `metadata` (Map of String) Key-value metadata attached to the instance.
+- `metadata` (Map of String) Key-value metadata attached to the instance. The key `migration-priority` is reserved — set it through `migration_priority` instead.
+- `migration_priority` (String) How PCD's Dynamic Resource Rebalancing (DRR) service treats this VM when balancing hosts: `normal`, `low`, `high`, or `never` (excluded from automatic migration). Unset means DRR's default. Stored as the `migration-priority` server metadata key, exactly as the PCD UI's Set Migration Priority dialog does. Updatable in place; set `""` to clear.
 - `network` (Block List) Networks to attach. Changing this forces a new resource. (see [below for nested schema](#nestedblock--network))
 - `region` (String) The region. Defaults to the provider's region.
+- `scheduler_hints` (Block List) Scheduler hints passed to Nova at boot (`os:scheduler_hints`). Mirrors `openstack_compute_instance_v2`. Use `group` with a `pcd_compute_servergroup` for affinity / anti-affinity placement, `different_host` / `same_host` to place relative to existing instances. At most one block. Create-only: changing this forces a new resource. Nova does not report hints back, so the block round-trips from configuration. (see [below for nested schema](#nestedblock--scheduler_hints))
 - `security_groups` (Set of String) Names of security groups to associate. Changing this forces a new resource.
 - `user_data` (String) User data (cloud-init) for the instance. Changing this forces a new resource.
 
@@ -63,6 +203,26 @@ resource "pcd_compute_instance" "example" {
 - `id` (String) The instance ID.
 - `status` (String) The Nova status (e.g. ACTIVE).
 
+<a id="nestedblock--block_device"></a>
+### Nested Schema for `block_device`
+
+Required:
+
+- `source_type` (String) The source of the device: `image`, `volume`, `snapshot`, or `blank`.
+
+Optional:
+
+- `boot_index` (Number) Boot order. `0` is the root disk, `1` the next device (e.g. an installer ISO), `-1` for a non-bootable data disk. Defaults to `-1`.
+- `delete_on_termination` (Boolean) Delete the created volume when the instance is deleted. Defaults to `false`.
+- `destination_type` (String) Where the device lives: `volume` (Cinder-backed, persistent) or `local` (ephemeral on the hypervisor). Defaults to `volume`.
+- `device_type` (String) The device type: `disk` (default) or `cdrom` (for an installer ISO).
+- `disk_bus` (String) The bus to attach the device on (e.g. `virtio`, `scsi`, `ide`).
+- `guest_format` (String) Filesystem format for a `blank` device (e.g. `ext4`, `swap`).
+- `uuid` (String) The ID of the source image, volume, or snapshot. Not used with `source_type = "blank"`.
+- `volume_size` (Number) Size in GiB of the volume to create. Required for `blank`; for `image`/`snapshot` sources it must be at least the source size.
+- `volume_type` (String) The Cinder volume type for a created volume.
+
+
 <a id="nestedblock--network"></a>
 ### Nested Schema for `network`
 
@@ -72,6 +232,17 @@ Optional:
 - `port` (String) Existing port to attach (required unless uuid is set).
 - `uuid` (String) Network UUID to attach to (required unless port is set).
 
+
+<a id="nestedblock--scheduler_hints"></a>
+### Nested Schema for `scheduler_hints`
+
+Optional:
+
+- `additional_properties` (Map of String) Arbitrary extra hints (key → value) passed through unvalidated, e.g. `query`. Merged last, so a key here overrides the typed attributes (`group`, `different_host`, `same_host`); `query` must be a JSON-encoded string.
+- `different_host` (List of String) Instance IDs whose hosts this instance must NOT be scheduled on.
+- `group` (String) A server group ID to place the instance in (see `pcd_compute_servergroup`).
+- `same_host` (List of String) Instance IDs whose host this instance MUST be scheduled on.
+
 ## Import
 
 Import is supported using the following syntax:

docs/resources/networking_network.md

@@ -13,6 +13,7 @@ Manages a Neutron network in PCD.
 ## Example Usage
 
 ```terraform
+# A tenant (self-service) network.
 resource "pcd_networking_network" "example" {
   name           = "tf-example-network"
   description    = "Managed by Terraform"
@@ -32,6 +33,26 @@ resource "pcd_networking_network" "provider" {
     physical_network = "physnet1"
   }]
 }
+
+# Layer 2 / "Simple" network — the PCD UI's Simple Networking option, akin to
+# a VMware port group: no subnet, no DHCP, no IP management. VMs on it manage
+# their own addressing. Three things define it, all set here:
+#   1. no pcd_networking_subnet is created for it
+#   2. port_security_enabled = false (security groups do not apply)
+#   3. the "simple_network" tag — what the PCD UI keys on to list it under
+#      "Layer 2 Networks" in the Deploy VM wizard
+resource "pcd_networking_network" "l2" {
+  name                  = "vlan-100-l2"
+  shared                = true
+  port_security_enabled = false
+  tags                  = ["simple_network"]
+
+  segments = [{
+    network_type     = "vlan"
+    physical_network = "physnet1"
+    segmentation_id  = 100
+  }]
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -43,6 +64,7 @@ resource "pcd_networking_network" "provider" {
 - `description` (String) A description of the network.
 - `external` (Boolean) Whether the network has an external routing facility.
 - `name` (String) The name of the network.
+- `port_security_enabled` (Boolean) Whether port security (security groups and anti-spoofing) is enforced on ports of this network. Defaults to `true`. Set `false` for a Layer 2 / "Simple" network, where the VM manages its own addressing and security groups do not apply — mirrors the PCD UI's Simple Network option.
 - `region` (String) The region. Defaults to the provider's region.
 - `segments` (Attributes List) Provider-network segments (admin only). One segment creates a physical network (e.g. `network_type = "flat"` / `"vlan"` on a `physical_network` label from the host config); multiple segments create a multi-provider network. Create-only: segments are not refreshed from the API and cannot be imported. Changing this forces a new resource. (see [below for nested schema](#nestedatt--segments))
 - `shared` (Boolean) Whether the network is shared across projects.