Terraform-provider-cloudflare: Cloudflare Load Balancer (and Pool) examples are not working

[ghost]

_This issue was originally opened by @abacao as hashicorp/terraform#17948. It was migrated here as a result of the provider split. The original body of the issue is below._

---

I'm able to set all the DNS entries just fine but when I'm trying to provision the Load Balancer as shown in the examples pages:
https://www.terraform.io/docs/providers/cloudflare/r/load_balancer.html
and
https://www.terraform.io/docs/providers/cloudflare/r/load_balancer_pool.html

What I get is this:

• cloudflare_load_balancer_pool.foo: 1 error(s) occurred:

• cloudflare_load_balancer_pool.foo: error creating load balancer pool: error from makeRequest: HTTP status 400: content "{\n \"result\": null,\n \"success\": false,\n \"errors\": [\n {\n \"code\": 1002,\n \"message\": \"the origin list length must be in range [1, 0]: validation failed\"\n }\n ],\n \"messages\": []\n}\n"

From the example, I have only changed the zone name to correspond my own.
The output message is not helping me to figure it out either.

the complete tf file is this:
`
resource "cloudflare_load_balancer" "bar" {
zone = "example.com"
name = "example-load-balancer"
fallback_pool_id = "${cloudflare_load_balancer_pool.foo.id}"
default_pool_ids = ["${cloudflare_load_balancer_pool.foo.id}"]
description = "example load balancer using geo-balancing"
proxied = true
pop_pools {
pop = "LAX"
pool_ids = ["${cloudflare_load_balancer_pool.foo.id}"]
}
region_pools {
region = "WNAM"
pool_ids = ["${cloudflare_load_balancer_pool.foo.id}"]
}
}

resource "cloudflare_load_balancer_pool" "foo" {
name = "example-lb-pool"
origins {
name = "example-1"
address = "192.0.2.1"
enabled = false
}
}
`

PS - the terraform plan runs OK, it's only when applying that the $* hits the fan...

[abacao]

What kind of information can I provide more?

[lawrencejones]

Hey @abacao, I reckon you probably hit this issue because the account you're using doesn't have load balancers enabled. You'll need to pay a small monthly fee and actually enable this feature before you'll be able to create load balancers.

Do that, and the error message about origin list length should go away.

[abacao]

@lawrencejones, I was and am using a Enterprise Plan and I have the load balancer active.

[lawrencejones]

My misstep then- I had the exact same error until I went into the dashboard and clicked "Enable load balancers". Obviously if you've already done this then it's no help to you, but best of luck with your problem!

[prdonahue]

Did @lawrencejones ' suggestion resolve your issue @abacao ? If so, I will investigate internally with the Load Balancing team.

Btw, here's the LB test I did with the provider: https://developers.cloudflare.com/terraform/tutorial/load-balance/. In this case, I had previously set up LB in my Enterprise account, so it's possible there's an issue there.

[abacao]

@prdonahue @lawrencejones suggestion didn't work because I'm on an Enterprise Plan with the Load Balancer feature "Active" and it still doesn't work.

I'm starting with a fresh domain, no Load Balancers created.

[prdonahue]

Hi @abacao, did that resolve your issue (starting with a fresh domain)?

[abacao]

@prdonahue I'm sorry, it seems that I wasn't able to express myself clearly.

All my "findings" happened with a new domain with no LB created.

This newdomain is on a enterprise plan but i can't use the example to create the loadbalancer with terraform.

Can you or someone try to create a new load balancer with terraform by using the example?
If you succeed, please share your code and I will test on my side...

[pranj]

Was anyone able to find a solution or a workaround for this?

I am running into the same issue and am unable to create a load balancer pool. I'm on an enterprise account with the load balancer feature enabled. I'm also able to create load balancer pools through the UI but am unable to do so via terraform.

[abacao]

I'm still on hold with this one

[jakubgs]

This appear to be still an issue. I have Load Balancers enabled but I cannot crate any due to the error:

HTTP status 400: content "{\n  \"result\": null,\n  \"success\": false,\n  \"errors\": [\n    {\n      \"code\": 1002,\n      \"message\": \"the origin list length must be in range [1, 0]: validation failed\"\n    }\n  ],\n  \"messages\": []\n}\n"

[jakubgs]

This makes no sense. I've tried multiple formats:

resource "cloudflare_load_balancer_pool" "test" {
  name               = "test"
  origins = {
    name = "test1"
    address = "11.12.13.12"
  }
  origins = {
    name = "test2"
    address = "11.12.13.14"
  }
}

And:

resource "cloudflare_load_balancer_pool" "test" {
  name               = "test"
  origins = [{
    name = "test1"
    address = "11.12.13.12"
  },
  {
    name = "test2"
    address = "11.12.13.14"
  }]
}

Or:

resource "cloudflare_load_balancer_pool" "test" {
  name               = "test"
  origins = [{
    name = "test1"
    address = "11.12.13.12"
  }]
  origins = [{
    name = "test2"
    address = "11.12.13.14"
  }]
}

It all fails the same way:

the origin list length must be in range [1, 0]: validation failed

[garrettgalow]

I'll give this a whirl today to see if I can reproduce.

[garrettgalow]

according to the TF docs since our pool is a TypeSet resource it would be the following:
``` resource "example_security_group" "ex" {
name = "sg_test"
description = "managed by Terraform"

ingress {
protocol = "tcp"
from_port = 80
to_port = 9000
cidr_blocks = ["10.0.0.0/8"]
}

ingress {
protocol = "tcp"
from_port = 80
to_port = 8000
cidr_blocks = ["0.0.0.0/0", "10.0.0
}
}
```

Almost have my TF resources up to test this myself

[garrettgalow]

tested this and I got it to work with the syntax described above. Example tf config:

resource "cloudflare_load_balancer_pool" "example_pool" {
   name = "pool"
   origins {
      name = "origin1"
      address = "ip"
      enabled = true
   }
   origins {
      name = "origin2"
      address = "ip"
      enabled = true
   }
   description = "description"
   enabled = true
   minimum_origins = 1
   notification_email = "[email protected]"
   monitor = "monitor_id"
}

I changed a few of the inputs from what I actually used but otherwise this is the exact format, and it created the pool properly

[jakubgs]

This indicates to me that this might be an issue with CloudFlare API(at least partially).
I will do some tests tomorrow when I'm not drunk.

[garrettgalow]

if you can get a consistent repro, then please send the config plus your account id and I can follow up

[jakubgs]

Here is the exact config I'm trying:

resource "cloudflare_load_balancer_pool" "test" {
  name               = "test"
  minimum_origins    = 1
  enabled = true

  origins = {
    name = "test1"
    address = "11.12.13.12"
  }
  origins = {
    name = "test2"
    address = "11.12.13.14"
  }
}

And here is the TRACE log from Terraform:
https://gist.github.com/jakubgs/40ef5df351e271c11a1fd5d92a8320a8

Not sure what's different about my setup.

[garrettgalow]

sorry for the delay in getting to this. I copied and pasted that exact config and was able to deploy it.
Can you output and show your version of TF and the CF provider?
Also since I don't see it in the trace log can you tell me what the account id you are trying to provision this in is? (zone id for what zone you would apply the LB to would also suffice).

[garrettgalow]

just a note of my versions when I ran that:
Terraform v0.11.7

• provider.cloudflare v1.0.0

[patryk]

If you are a member of an Organization or were invited to someone else's account, please try adding one of these to provider section:

provider "cloudflare" {
  org_id = "xxx"
# or
  use_org_from_zone = "${var.cloudflare_domain}"
}

https://www.terraform.io/docs/providers/cloudflare/#org_id
https://www.terraform.io/docs/providers/cloudflare/#use_org_from_zone

[justinbarrick]

It seems strange that we don't look up the org id for the zone specified in the load balancer. What if I'm a part of multiple organizations?

[patryk]

In that case you would need to create separate modules for each Orgnization and instanciate provider for each with different settings, e.g.

$ cat test.tf
module "org1" {
  source = "./org1"
}
module "org2" {
  source = "./org2"
}
$ cat org1/cf.tf
provider "cloudflare" {
  org_id = "org1id"
}
$ cat org2/cf.tf
provider "cloudflare" {
  org_id = "org2id"
}

Balancer Pool needs to specify an Organization ID is because each user owns an implicit Account, in addition to any accounts they have been invited to (including Organization accounts). The non-org_id'ed provider by default attempts to create a Pool for /user/load_balancers/pools API endpoint.

On the other hand the Load Balancer resource is searching through available zones to you on first use and then remembers its Zone ID, which is unique among all accounts.

The error you get is because User's Account Balancer Pool is attempted to be attached to Organization's Account Load Balancer, which in itself is attached to Organization's Account Zone. And that is not possible.

I agree this is confusing and something we should definitely improve. I'm really sorry about the confusion.

[jakubgs]

I can verify that specifying org_id in the provider definition does fix errors like this.

[patryk]

Great to hear that, thanks!