fix(terraform/cloudflare/k8s): import existing tunnel route via data source (BOXP-135)

[boxp]

Summary

• terraform/cloudflare/b0xp.io/k8s で apply のたびに 409 Conflict (error 1014: You already have a route defined for this exact IP subnet) が発生し、tfaction が follow-up PR (chore(terraform/cloudflare/b0xp.io/k8s): follow up #11614 #11621, chore(terraform/cloudflare/b0xp.io/k8s): follow up #11668 #11675) を自動生成し続けていた問題を修正
• 根本原因: PR feat(terraform/cloudflare): migrate Cloudflare provider v4 to v5 (BOXP-122) #11342 (Cloudflare provider v4→v5 移行) でtfmigrate が cloudflare_zero_trust_tunnel_route.codex_workspace を state から削除したが、v5 の新リソース名 cloudflare_zero_trust_tunnel_cloudflared_route.codex_workspace を import する処理が欠落していた
• 修正: cloudflare_zero_trust_tunnel_cloudflared_route data source (v5.22.0 に存在) を使って既存 route の UUID を検索し、HCL import ブロックで state に取り込む

Changes

• terraform/cloudflare/b0xp.io/k8s/tunnel.tf: data source + import ブロック追加
• docs/project_docs/BOXP-135/plan.md: 調査・修正計画ドキュメント

How It Works

1. data "cloudflare_zero_trust_tunnel_cloudflared_route" "codex_workspace" が network_subset = network_superset = "192.168.10.98/32" でフィルタリングし、Cloudflare API から既存 route の UUID を取得
2. import ブロックが {account_id}/{route_uuid} 形式で route を Terraform state に取り込む
3. 初回 apply 成功後、import ブロックは idempotent (no-op)
4. データソースと import ブロックは後続の PR で削除可能

Test Plan

• terraform plan で destroy/recreate が発生しないことを確認
• terraform apply が 409 なしで成功することを確認
• follow-up PR (chore(terraform/cloudflare/b0xp.io/k8s): follow up #11614 #11621, chore(terraform/cloudflare/b0xp.io/k8s): follow up #11668 #11675) をクローズ

References

• Root cause: PR feat(terraform/cloudflare): migrate Cloudflare provider v4 to v5 (BOXP-122) #11342 (provider v4→v5)
• Failed workflows: 30088511515, 30178898607
• Follow-up PRs to close: chore(terraform/cloudflare/b0xp.io/k8s): follow up #11614 #11621, chore(terraform/cloudflare/b0xp.io/k8s): follow up #11668 #11675
• Ticket: BOXP-135

🤖 Generated with Claude Code

[boxp-tfaction]

Plan Result (terraform/cloudflare/b0xp.io/k8s)

CI link

Plan: 1 to import, 0 to add, 1 to change, 0 to destroy.

• Update
  • cloudflare_zero_trust_device_default_profile.warp_include
• Import
  • cloudflare_zero_trust_tunnel_cloudflared_route.codex_workspace

Change Result (Click me)

  # cloudflare_zero_trust_device_default_profile.warp_include will be updated in-place
  ~ resource "cloudflare_zero_trust_device_default_profile" "warp_include" {
        id                             = "1984a4314b3e75f3bedce97c7a8e0c81"
      ~ policy_id                      = "0197d1b3-fe50-7488-8b3d-55f27f26ea8b" -> (known after apply)
        # (20 unchanged attributes hidden)
    }

  # cloudflare_zero_trust_tunnel_cloudflared_route.codex_workspace will be imported
    resource "cloudflare_zero_trust_tunnel_cloudflared_route" "codex_workspace" {
        account_id         = "1984a4314b3e75f3bedce97c7a8e0c81"
        comment            = "lolice codex-workspace LoadBalancer for WARP access"
        created_at         = "2026-05-29T12:29:24Z"
        id                 = "6b22520e-ad37-4864-8e43-842ff88fa48a"
        network            = "192.168.10.98/32"
        tunnel_id          = "0eb241e1-1295-4672-8285-f18241a38210"
        virtual_network_id = "9bcd88ee-63e3-476b-bf2a-0f685c18cdd6"
    }

Plan: 1 to import, 0 to add, 1 to change, 0 to destroy.

Warning: Redundant ignore_changes element

  on tunnel.tf line 12, in resource "cloudflare_zero_trust_tunnel_cloudflared_config" "k8s_tunnel":
  12: resource "cloudflare_zero_trust_tunnel_cloudflared_config" "k8s_tunnel" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute created_at is decided by the provider alone and therefore there
can be no configured value to compare with. Including this attribute in
ignore_changes has no effect. Remove the attribute from ignore_changes to
quiet this warning.

(and one more similar warning elsewhere)

⚠️ Warnings

Warning: Redundant ignore_changes element

  on tunnel.tf line 12, in resource "cloudflare_zero_trust_tunnel_cloudflared_config" "k8s_tunnel":
  12: resource "cloudflare_zero_trust_tunnel_cloudflared_config" "k8s_tunnel" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute created_at is decided by the provider alone and therefore there
can be no configured value to compare with. Including this attribute in
ignore_changes has no effect. Remove the attribute from ignore_changes to
quiet this warning.

(and one more similar warning elsewhere)

[boxp-tfaction]

✅ Apply Succeeded (terraform/cloudflare/b0xp.io/k8s)

CI link

Apply complete! Resources: 1 imported, 0 added, 1 changed, 0 destroyed.

Details (Click me)

Jul 28 08:20:54.016 WRN The policy file is ignored unless it is allowed by "aqua policy allow" command.

$ aqua policy allow "/home/runner/work/arch/arch/aqua/aqua-policy.yaml"

If you want to keep ignoring the policy file without the warning, please run "aqua policy deny" command.

$ aqua policy deny "/home/runner/work/arch/arch/aqua/aqua-policy.yaml"

  program=aqua version=2.62.1 env=linux/amd64 exe_name=terraform package_name=hashicorp/terraform package_version=v1.15.8 registry=standard policy_file=/home/runner/work/arch/arch/aqua/aqua-policy.yaml doc=https://aquaproj.github.io/docs/reference/codes/003
cloudflare_zero_trust_tunnel_cloudflared_route.codex_workspace: Importing... [id=1984a4314b3e75f3bedce97c7a8e0c81/6b22520e-ad37-4864-8e43-842ff88fa48a]
cloudflare_zero_trust_tunnel_cloudflared_route.codex_workspace: Import complete [id=1984a4314b3e75f3bedce97c7a8e0c81/6b22520e-ad37-4864-8e43-842ff88fa48a]
cloudflare_zero_trust_device_default_profile.warp_include: Modifying... [id=1984a4314b3e75f3bedce97c7a8e0c81]
cloudflare_zero_trust_device_default_profile.warp_include: Modifications complete after 0s [id=1984a4314b3e75f3bedce97c7a8e0c81]

Apply complete! Resources: 1 imported, 0 added, 1 changed, 0 destroyed.