proxmox_virtual_environment_vm can't manage VMs with ISOs

[easontm]

Describe the bug
I adopted (state import) a VM I have that was created with an ISO as installation media (in my case, a Talos ISO). When trying to align the Terraform code with the remote state (plan -> edit -> repeat until no diff), I set a disk block to include this ISO as described by the Terraform state.

    disk {
        cache             = "none"
        datastore_id      = "my-datastore"
        file_format       = "iso"
        interface         = "ide2"
        path_in_datastore = "iso/nocloud-amd64.iso"
    }

However, this setting the disk to an iso is forbidden

Error: expected file_format to be one of ["qcow2" "raw" "vmdk"], got iso

To Reproduce
Steps to reproduce the behavior:

1. Create a VM with ISO boot media using the Proxmox UI
2. Create a stub proxmox_virtual_environment_vm resource with the correct VM ID (ex. 100).
3. Run import, e.g. terraform import proxmox_virtual_environment_vm.my_vm my_node/100
4. Run plan and update code to reduce diff (alternatively, have terraform show the state then just copy it)
5. See error

Here is a copy of my tg state show which has been cleaned to remove non-settable attributes

resource "proxmox_virtual_environment_vm" "talos_prototype_node" {
    acpi                                 = true
    bios                                 = "seabios"
    boot_order                           = [
        "scsi0",
        "ide2",
        "net0",
    ]
    delete_unreferenced_disks_on_destroy = true
    mac_addresses                        = []
    migrate                              = false
    name                                 = "talos-prototype-1"
    node_name                            = "pve1"
    on_boot                              = false
    protection                           = false
    purge_on_destroy                     = true
    reboot                               = false
    reboot_after_update                  = true
    scsi_hardware                        = "virtio-scsi-pci"
    started                              = true
    stop_on_destroy                      = false
    tablet_device                        = true
    tags                                 = []
    template                             = false
    timeout_clone                        = 1800
    timeout_create                       = 1800
    timeout_migrate                      = 1800
    timeout_move_disk                    = 1800
    timeout_reboot                       = 1800
    timeout_shutdown_vm                  = 1800
    timeout_start_vm                     = 1800
    timeout_stop_vm                      = 300
    vm_id                                = 820

    agent {
        enabled = true
        timeout = "15m"
        trim    = false
    }

    cpu {
        cores      = 2
        flags      = []
        hotplugged = 0
        limit      = 0
        numa       = false
        sockets    = 1
        type       = "x86-64-v2-AES"
    }

    disk {
        aio               = "io_uring"
        backup            = true
        cache             = "none"
        datastore_id      = "pve-shared"
        discard           = "ignore"
        file_format       = "iso"
        interface         = "ide2"
        iothread          = false
        path_in_datastore = "iso/nocloud-amd64.iso"
        replicate         = true
        ssd               = false
    }
    disk {
        aio               = "io_uring"
        backup            = true
        cache             = "none"
        datastore_id      = "local-lvm"
        discard           = "ignore"
        file_format       = "raw"
        interface         = "scsi0"
        iothread          = false
        path_in_datastore = "vm-820-disk-0"
        replicate         = true
        size              = 32
        ssd               = false
    }

    memory {
        dedicated      = 2048
        floating       = 0
        keep_hugepages = false
        shared         = 0
    }

    network_device {
        bridge       = "vmbr0"
        disconnected = false
        enabled      = true
        firewall     = true
        mac_address  = "BC:24:11:F7:F8:34"
        model        = "virtio"
        mtu          = 0
        queues       = 0
        rate_limit   = 0
        vlan_id      = 0
    }

    operating_system {
        type = "l26"
    }
}

and the output of terraform|tofu apply.

Error: expected file_format to be one of ["qcow2" "raw" "vmdk"], got iso

Expected behavior
Non-read-only attributes can be set to all values that their state shows.

• Single or clustered Proxmox: clustered
• Proxmox version: 9.1.1
• Provider version (ideally it should be the latest version): 0.94.0
• Terraform/OpenTofu version: OpenTofu v1.11.4
• OS (where you run Terraform/OpenTofu from): macOS Tahoe 26.2
• Debug logs (TF_LOG=DEBUG terraform apply):

[svengreb]

Why do you want to use the ISO when the VM has already been bootstrapped? I also use Talos Linux, so I know the way it works and the ISO must only be used for initial installation or, when not using another method, when upgrading to newer versions.
Anyway, the disk block is not the one that should be used for ISOs because (back in the old days 😄) an ISO file was mainly used to clone a CD-ROM so you must use the cdrom block.

To use it you must define a proxmox_virtual_environment_download_file resource to download the Talos Linux ISO. Then define the cdrom block and reference the downloaded ISO by passing its ID via the file_id attribute.

Example:

resource "proxmox_virtual_environment_download_file" "talos-linux-1.12.2-metal-amd64-iso" {
  content_type       = "iso"
  # Adjust to your storage setup.
  datastore_id       = "local"
  file_name          = "talos-linux-1.12.2-metal-amd64.iso"
  node_name          = "NAME_OF_YOUR_NODE"
  # Or "https://factory.talos.dev/image/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba/v1.12.2/metal-amd64.iso" when you prefer the officially hosted Talos Linux factory.
  url                = "https://github.com/siderolabs/talos/releases/download/v1.12.2/metal-amd64.iso"
  # Copied from https://github.com/siderolabs/talos/releases/download/v1.12.2/sha256sum.txt.
  checksum           = "d29b117edbc6fbb1be7c5bf1319510eec81e13bd374703452bacf2a21c3fd9e9"
  checksum_algorithm = "sha512"
}

resource "proxmox_virtual_environment_vm" "ubuntu_vm" {
  #…
  cdrom {
    file_id = proxmox_virtual_environment_download_file.talos-linux-1.12.2-metal-amd64-iso.id
    # Must be in format "ideN" (defaults to "ide3") where "N" is the number.
    # Note that "q35" machine type only supports "ide0" and "ide2"!
    interface = "ide2"
  }
  #…
}

But again, you could remove the ISO from the VM using the Proxmox VE web UI and set the file_id to none to still attack the CD-ROM drive to the VM, but not mount the ISO. I also wonder how the VM can work anyway when the ISO is attached because it would always boot from the ISO instead of the disk where Talos is installed.

[easontm]

The reason the ISO is included is because I was experimenting with making a template of an unstarted VM. I wasn't really concerned with leaving the installation media attached because I was going to set the VM disk first in the boot order.

Regardless of the specifics of how I got here, I think having the rendered state of the resource being meaningfully different from the implementation that would create it is an experience that could be improved.

[bpg-dev]

Thanks for reporting this @easontm, and @svengreb for the helpful context on the cdrom block!

@svengreb is right that the cdrom block is the correct way to attach ISOs. However, the underlying bug here is real: the provider's own read/import logic doesn't filter out media=cdrom devices from the disk block. It only skips cloud-init drives, so when you import a VM with an iso attached, the iso ends up in the sate as a disk with file_format = "iso", which the schema validator then rejects as it only allows qcow2/raw/vmdk.

I think the fix should be to skip media=cdrom devices during disk read-back (similar to how cloud-init drives are already skipped), and ensure they're handled by the cdrom block instead.

[svengreb]

@bpg Oh nice catch, that's a nasty bug that is not easy to detect!
I focused on the fact that an ISO was used in a disk block, but not took the fact into account that the VM was imported.