Changes to switch_matching rules can cause terraform to fail applying them.

[rczf]

Describe the bug

Changes to switch_matching rules can cause terraform to fail applying them.

To Reproduce

Steps to reproduce the behavior:

1. Create site template and apply it.

resource "mist_site_networktemplate" "TEST" {
  remove_existing_configs = true
  site_id                 = mist_site.TEST.id
  switch_matching = {
    enable = true
    rules = [
      {
        name       = "rule1"
        match_role = "access"
      },
      {
        name              = "rule2"
        match_role        = "core"
      },
      {
        name              = "default"
      },
    ]
  }
}

2. Modify template as follows:

resource "mist_site_networktemplate" "TEST" {
  remove_existing_configs = true
  site_id                 = mist_site.TEST.id
  switch_matching = {
    enable = true
    rules = [
      {
        name              = "default"
      },
      {
        name       = "rule1"
        match_role = "access"
      },
      {
        name              = "rule2"
        match_role        = "core"
        match_name        = "SWTESTNAME"
        match_name_offset = 0
      },
    ]
  }
}

Error Message

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.sites_EMEA.mist_site_networktemplate.TEST will be updated in-place
  ~ resource "mist_site_networktemplate" "TEST" {
      ~ switch_matching         = {
          ~ rules  = [
              ~ {
                  - match_role             = "access" -> null
                  ~ name                   = "rule1" -> "default"
                    # (6 unchanged attributes hidden)
                },
              ~ {
                  ~ match_role             = "core" -> "access"
                  ~ name                   = "rule2" -> "rule1"
                    # (6 unchanged attributes hidden)
                },
              ~ {
                  + match_name             = "SWTESTNAME"
                  + match_role             = "core"
                  ~ name                   = "default" -> "rule2"
                    # (5 unchanged attributes hidden)
                },
            ]
            # (1 unchanged attribute hidden)
        }
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.sites_EMEA.mist_site_networktemplate.TEST: Modifying...
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.sites_EMEA.mist_site_networktemplate.TEST, provider "provider[\"registry.terraform.io/juniper/mist\"]" produced an unexpected new value: .switch_matching.rules[2].match_value: was cty.StringVal(""), but now
│ cty.StringVal("SWTESTNAME").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.sites_EMEA.mist_site_networktemplate.TEST, provider "provider[\"registry.terraform.io/juniper/mist\"]" produced an unexpected new value: .switch_matching.rules[2].match_type: was cty.StringVal(""), but now
│ cty.StringVal("match_name[0:10]").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

[tmunzer]

Hi @rczf ,

The "default" rule (name==default) will always be the last one for Mist, it is not possible to move it to another place in the list.
I'll try to add some kind of validator to alert about this limitation.

[tmunzer]

Hi @rczf

Version v0.2.21 has been published and is improving the switch_matching.rules.name validation to raise a validation error in this situation. I'm closing the issue.

Thanks