Importing RuleSet gives a warning

[zbuchheit]

What happened?

When attempting to import a RuleSet I encountered a warning about read-only fields.

Example

Previewing import (dev)

View Live: https://app.pulumi.com/zbuchheit-pulumi-corp/cloudflare-ts/dev/previews/780dc99b-4153-4473-8236-9df93dd93748


    pulumi:pulumi:Stack cloudflare-ts-dev running 
    cloudflare:index:Zone example  
 =  cloudflare:index:Ruleset domain-rate-limits import 
 =  cloudflare:index:Ruleset domain-rate-limits import warning: One or more imported inputs failed to validate. This is almost certainly a bug in the `cloudflare` provider. The import will still proceed, but you will need to edit the generated code after copying it into your program.
 =  cloudflare:index:Ruleset domain-rate-limits import warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
 =  cloudflare:index:Ruleset domain-rate-limits import warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
 =  cloudflare:index:Ruleset domain-rate-limits import warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
    pulumi:pulumi:Stack cloudflare-ts-dev  
Diagnostics:
  cloudflare:index:Ruleset (domain-rate-limits):
    warning: One or more imported inputs failed to validate. This is almost certainly a bug in the `cloudflare` provider. The import will still proceed, but you will need to edit the generated code after copying it into your program.
    warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
    
    Refer to the provider documentation or contact the provider developers for additional information about configurable and read-only attributes that are supported.. Examine values at 'domain-rate-limits.rules[0].lastUpdated'.
    warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
    
    Refer to the provider documentation or contact the provider developers for additional information about configurable and read-only attributes that are supported.. Examine values at 'domain-rate-limits.rules[0].id'.
    warning: cloudflare:index/ruleset:Ruleset resource 'domain-rate-limits' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
    
    Refer to the provider documentation or contact the provider developers for additional information about configurable and read-only attributes that are supported.. Examine values at 'domain-rate-limits.rules[0].version'.

Resources:
    = 1 to import
    2 unchanged

Output of pulumi about

CLI          
Version      3.112.0
Go Version   go1.22.1
Go Compiler  gc

Plugins
NAME        VERSION
cloudflare  5.24.1
nodejs      unknown

Host     
OS       darwin
Version  14.2.1
Arch     arm64

This project is written in nodejs: executable='/Users/zbuchheit/.nvm/versions/node/v18.17.1/bin/node' version='v18.17.1'

Current Stack: zbuchheit-pulumi-corp/cloudflare-ts/dev

TYPE                         URN
pulumi:pulumi:Stack          urn:pulumi:dev::cloudflare-ts::pulumi:pulumi:Stack::cloudflare-ts-dev
pulumi:providers:cloudflare  urn:pulumi:dev::cloudflare-ts::pulumi:providers:cloudflare::default_5_24_1
cloudflare:index/zone:Zone   urn:pulumi:dev::cloudflare-ts::cloudflare:index/zone:Zone::example


Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/zbuchheit-pulumi-corp
User           zbuchheit-pulumi-corp
Organizations  zbuchheit-pulumi-corp
Token type     personal

Dependencies:
NAME                VERSION
@pulumi/cloudflare  5.24.1
@pulumi/pulumi      3.112.0
@types/node         18.19.26

Pulumi locates its logs in /var/folders/lh/l71cdh810xb33t0jc7qmt5_80000gn/T/ by default

Additional context

It functionally is able to import the ruleSet but a subsequent up causes a diff on the rules to remove the unnecessary input read-only input fields. This could cause some confusion or worry in users not expecting a diff, and wanting to import a resource without changes.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[iwahbe]

Thanks for reporting this @zbuchheit.

Are you setting these values in your Pulumi program?

• domain-rate-limits.rules[0].version
• domain-rate-limits.rules[0].id
• domain-rate-limits.rules[0].lastUpdated

A program that reproduces this warning would make debugging this a lot easier.

[zbuchheit]

Here is my repro and details from the diffs

Repro

Repro Program

Note: I create the ruleSet, remove it from state and import it again immediately to make it quick. I also export the ruleId and zoneId to make the import statement easier

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const example = new cloudflare.Zone("example", {
    accountId: "redacted",
    zone: "zbuchheit-my-test-domain.com",
});

const ruleset = new cloudflare.Ruleset("domain-rate-limits", {
    zoneId: example.id,
    name: "transform rule for URI path",
  description: "change the URI path to a new static path",
  kind: "zone",
  phase: "http_request_transform",
  rules: [{
    action: "rewrite",
    actionParameters: {
      // algorithms: [],
      // autominifies: [],
      // headers: [],
      // responses: [],
      uri: {
        path: {
          value: "/my-new-route"
        }
      }
    },
    expression: "(http.host eq \"example.com\" and http.request.uri.path eq \"/old-path\")",
    description: "example URI path transform rule",
    enabled: true,
  }]
});

export const zoneId = example.id;
export const rulesetId = ruleset.id;

Pulumi preview --diff after the import

Pulumi preview --diff after the import

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::cloudflare-ts::pulumi:pulumi:Stack::cloudflare-ts-dev]
      cloudflare:index/ruleset:Ruleset: (same) 🔓
        [id=f731228721cc4d6c8a14941f3f21cc8d]
        [urn=urn:pulumi:dev::cloudflare-ts::cloudflare:index/ruleset:Ruleset::domain-rate-limits]
        [provider=urn:pulumi:dev::cloudflare-ts::pulumi:providers:cloudflare::default_5_24_1::d4c7c55b-25ca-4731-a657-c4da7d598e62]
        description: "change the URI path to a new static path"
        kind       : "zone"
        name       : "transform rule for URI path"
        phase      : "http_request_transform"
      ~ rules      : [
          ~ [0]: {
                  - __defaults      : []
                    action          : "rewrite"
                  ~ actionParameters: {
                      - __defaults  : []
                      - algorithms  : []
                      - autominifies: []
                      - headers     : []
                      - responses   : []
                      ~ uri         : {
                          - __defaults: []
                          ~ path      : {
                              - __defaults: []
                                value     : "/my-new-route"
                            }
                        }
                    }
                    description     : "example URI path transform rule"
                    enabled         : true
                    expression      : "(http.host eq \"example.com\" and http.request.uri.path eq \"/old-path\")"
                  - id              : "051bcef2c4d24a4db7cb523be7bfb78f"
                  - lastUpdated     : "2024-04-03 16:27:22.966067 +0000 UTC"
                  - ref             : "051bcef2c4d24a4db7cb523be7bfb78f"
                  - version         : "1"
                }
        ]
        zoneId     : "b8dd00d8831bc2f0d6c785172faa67f3"

Pulumi preview --diff after the inputs match

Preview --diff results if I set all the inputs I have access to to match

Note: I don't have the ability to set id, lastUpdated, ref, or version. Not that I necessarily need to, those seem to be calculated/generated values. I don't see a way to configure those in the CloudFlare portal anyways.

Previewing update (dev)

View Live: https://app.pulumi.com/zbuchheit-pulumi-corp/cloudflare-ts/dev/previews/98093f8f-39dd-4046-84de-3b9432b92f1c

  pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::cloudflare-ts::pulumi:pulumi:Stack::cloudflare-ts-dev]
      cloudflare:index/ruleset:Ruleset: (same) 🔓
        [id=f731228721cc4d6c8a14941f3f21cc8d]
        [urn=urn:pulumi:dev::cloudflare-ts::cloudflare:index/ruleset:Ruleset::domain-rate-limits]
        [provider=urn:pulumi:dev::cloudflare-ts::pulumi:providers:cloudflare::default_5_24_1::d4c7c55b-25ca-4731-a657-c4da7d598e62]
        description: "change the URI path to a new static path"
        kind       : "zone"
        name       : "transform rule for URI path"
        phase      : "http_request_transform"
      ~ rules      : [
          ~ [0]: {
                  - __defaults      : []
                    action          : "rewrite"
                  ~ actionParameters: {
                      - __defaults  : []
                      ~ uri         : {
                          - __defaults: []
                          ~ path      : {
                              - __defaults: []
                                value     : "/my-new-route"
                            }
                        }
                    }
                    description     : "example URI path transform rule"
                    enabled         : true
                    expression      : "(http.host eq \"example.com\" and http.request.uri.path eq \"/old-path\")"
                  - id              : "051bcef2c4d24a4db7cb523be7bfb78f"
                  - lastUpdated     : "2024-04-03 16:27:22.966067 +0000 UTC"
                  - ref             : "051bcef2c4d24a4db7cb523be7bfb78f"
                  - version         : "1"
                }
        ]
        zoneId     : "b8dd00d8831bc2f0d6c785172faa67f3"
Resources:
    3 unchanged

(edit: made it more readable)

[iwahbe]

Thanks for the repro @zbuchheit.

[zbuchheit]

yep! Let me know if I can help with anything else.

[dirien]

@iwahbe,

I am getting the same error on a different provider:

  azapi:index:Resource (app-service-plan):
    error: azapi:index/resource:Resource resource 'app-service-plan' has a problem: Invalid Configuration for Read-Only Attribute. Cannot set value for this attribute as the provider has marked it as read-only. Remove the configuration line setting the value.
    
    Refer to the provider documentation or contact the provider developers for additional information about configurable and read-only attributes that are supported.. Examine values at 'app-service-plan.output'.