cloudflare_tunnel_config "no_tls_verify = true" does not apply until manual save using Web UI

[algo7]

Confirmation

• My issue isn't already found on the issue tracker.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.4.5
on linux_amd64

• provider registry.terraform.io/cloudflare/cloudflare v4.3.0
• provider registry.terraform.io/hashicorp/random v3.4.3

Affected resource(s)

• cloudflare_tunnel_config

Terraform configuration files

# Generate a random secret for the tunnel
resource "random_id" "tunnel_secret" {
  byte_length = 32
}

# Create a tunnel
resource "cloudflare_tunnel" "my_tunnel" {
  account_id = "acc_id"
  name       = "my-tunnel"
  secret     = random_id.tunnel_secret.hex
}



# Tunnel configuration
resource "cloudflare_tunnel_config" "tunnel_config" {
  account_id = "acc_id"
  tunnel_id  = cloudflare_tunnel.my_tunnel.id

  config {

    warp_routing {
      enabled = false
    }

    origin_request {
      connect_timeout = "2m0s"
      no_tls_verify   = true
    }

    ingress_rule {
      hostname = "test.example.com"
      service  = "https://<local_ip>:<port>"
    }

    # Catch-all rule to return 404
    ingress_rule {
      service = "http_status:404"
    }
  }
}

# Add the tunnel CNAME record to the domain
resource "cloudflare_record" "cf_tunnel_cname" {
  zone_id = "zone_id"
  name    = "test"
  value   = cloudflare_tunnel.my_tunnel.cname
  type    = "CNAME"
  comment = "Cloudflare Tunnel"
  proxied = true
}

Link to debug output

1st Apply: https://gist.github.com/algo7/7176c0ef7dfdf94ae299331835d480fc
2nd Apply: https://gist.github.com/algo7/f6c475f18662cb275bb9bcdb80ed7c64

Panic output

No response

Expected output

Terraform runs fine, and I should be able to go to the tunnel sub-domain without any problem.

Actual output

When I connect to my tunnel sub-domain (continuing with the example above), https://test.example.com I get 502 Bad Gateway. However, if I go to the Cloudflare Zero Trust dashboard => Tunnels => Public Hostname => Additional Settings => TLS and manually toggle on No TLS Verify and save, the connection will be established successfully.

If I run terraform plan again, it will show that there is a configuration drift, but the changes shown are the same settings.

Terraform used the selected providers to generate the following execution plan. Resource
actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # cloudflare_record.cf_tunnel_cname will be updated in-place
  ~ resource "cloudflare_record" "cf_tunnel_cname" {
      + comment         = "Cloudflare Tunnel"
        id              = "<tunnel_id>"
        name            = "test"
        tags            = []
        # (11 unchanged attributes hidden)
    }

  # cloudflare_tunnel_config.tunnel_config_1 will be updated in-place
  ~ resource "cloudflare_tunnel_config" "tunnel_config_1" {
        id         = "<new_tunnel_id>"
        # (2 unchanged attributes hidden)

      ~ config {
          + origin_request {
              + connect_timeout          = "2m0s"
              + disable_chunked_encoding = false
              + keep_alive_connections   = 100
              + keep_alive_timeout       = "1m30s"
              + no_happy_eyeballs        = false
              + no_tls_verify            = true
              + proxy_address            = "127.0.0.1"
              + proxy_port               = 0
              + tcp_keep_alive           = "30s"
              + tls_timeout              = "10s"
            }

            # (2 unchanged blocks hidden)
        }
    }

Plan: 0 to add, 2 to change, 0 to destroy.

After running terraform apply again, I tried to connect to the tunnel domain and got 502 Bad Gateway . So apparently, the only way to get Public Hostname working is to manually toggle on No TLS Verify via Cloudflare Zero Trust web UI.

Steps to reproduce

1. Use the Terraform config provided
2. Connect to the tunnel sub-domain (you should get 502 Bad Gateway)
3. Go to the CF 0 Trust dashboard => Tunnels => Public Hostname => Additional Settings => TLS and toggle on the No TLS Verify.
4. Visit the tunnel sub-domain again; you should be able to visit it successfully
5. Run terraform plan again; you should see the config drift
6. Run terraform apply again
7. Visit the tunnel sub-domain; you should get the 502 Bad Gateway message again.

Additional factoids

Repo of my full terraform config

https://github.com/algo7/terraform_cloudflare

Domain was purchased on Cloudflare

Zone TLS is set to Full (strict)

Cloudflared

cloudflared was also running successfully on the server side. It even showed the updated config with \"noTLSVerify\":true, but still failed to establish the connection as can be seen below.

cloudflared log:

2023-04-14T00:57:57Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"test.example.com\", \"service\":\"https://<local_ip>:<port>\"}, {\"service\":\"http_status:404\"}], \"originRequest\":{\"bastionMode\":false, \"caPool\":\"\", \"connectTimeout\":120000000000, \"disableChunkedEncoding\":false, \"httpHostHeader\":\"\", \"keepAliveConnections\":100, \"keepAliveTimeout\":90000000000, \"noHappyEyeballs\":false, \"noTLSVerify\":true, \"originServerName\":\"\", \"proxyAddress\":\"127.0.0.1\", \"proxyPort\":0, \"proxyType\":\"\", \"tcpKeepAlive\":30000000000, \"tlsTimeout\":10000000000}, \"warp-routing\":{\"enabled\":false}}" version=3


2023-04-14T00:58:06Z ERR  error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp local_ip:port: i/o timeout" cfRay=7b77ffa11842026f-CDG ingressRule=0 originService=https://local_ip:port

References

#2072 (comment) => I also had to perform manual resave (go to the Tunnels => Public Hostname => Save hostname) on the UI for cloudflared on the server side to get the configuration created by Terraform. This INF Updated to new configuration config=<truncated> won't show until the manual resave is performed.

#2233 => I had to apply it twice for wrap_routing = false not to show config drift when using the terraform config supplied above.

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

Terraform debug log detected ✅

[github-actions]

Terraform debug log detected ✅

[github-actions]

Terraform debug log detected ✅

[github-actions]

Terraform debug log detected ✅

[github-actions]

Terraform debug log detected ✅

[github-actions]

Terraform debug log detected ✅