How to create provisioned templates using "proxmox_virtual_environment_vm"

[alteriks]

I'm having trouble creating new template using opentofu and bpg/proxmox

I've read https://bpg.sh/docs/guides/clone-vm/ and searched github for solution but I cannot find solution to my usecase.

I'd like recreate somewhat manual steps in declarative infra:

• download ISO
• create VM
• install OS
• provision using ansible
• shutdown
• mark as template

So far I've created opentofu module which can manage state for my new VMs when cloning from already prepared templates.
I'd like to recreate and manage my templates using opentofu, but I've run into an issue.
After provisioning with ansible, I thought that changing resources:

• template = true
• started = false
  Would trigger proxmox template conversion. But opentofu wants to destroy and recreate VM.
  How can I translate manual/imperative way of doing this to declarative state without destroying preprovisioned VM?

Opentofu wants to destroy VM:

tofu apply \
          -var-file="garage.tfvars" \
          -var-file="./env/templates/02_finalize_template.tfvars"
module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm: Refreshing state... [id=9222]

OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
-/+ destroy and then create replacement

OpenTofu will perform the following actions:

  # module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm must be replaced
-/+ resource "proxmox_virtual_environment_vm" "vm" {
      ~ id                                   = "9222" -> (known after apply)
      ~ ipv4_addresses                       = [] -> (known after apply)
      ~ ipv6_addresses                       = [] -> (known after apply)
      ~ mac_addresses                        = [
          - "BC:24:11:AD:07:76",
        ] -> (known after apply)
        name                                 = "coreos-template"
      ~ network_device                       = [
          ~ {
              - disconnected = false
              - trunks       = ""
                # (9 unchanged attributes hidden)
            },
        ]
      ~ network_interface_names              = [] -> (known after apply)
      - started                              = true -> null
        tags                                 = [
            "opentofu",
            "tmpl",
        ]
      ~ template                             = false -> true # forces replacement
        # (25 unchanged attributes hidden)

      + agent {
          + enabled = true
          + timeout = "60s"
          + trim    = true
          + type    = "virtio"
        }

      ~ cdrom {
          ~ file_id   = "local:iso/fedora-coreos-42.20250929.3.0-live-iso.x86_64.iso" -> "none"
            # (2 unchanged attributes hidden)
        }

      ~ cpu {
          - flags      = [] -> null
          ~ units      = 0 -> (known after apply)
            # (6 unchanged attributes hidden)
        }

      ~ disk {
          ~ file_format       = "raw" -> (known after apply)
          ~ path_in_datastore = "vm-9222-disk-0" -> (known after apply)
            # (10 unchanged attributes hidden)
        }

      ~ initialization {
          + file_format          = (known after apply)
          + meta_data_file_id    = (known after apply)
          + network_data_file_id = (known after apply)
          + type                 = (known after apply)
          + user_data_file_id    = (known after apply)
          + vendor_data_file_id  = (known after apply)
            # (2 unchanged attributes hidden)

            # (2 unchanged blocks hidden)
        }

        # (4 unchanged blocks hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Here is difference between tfvars:

diff ./env/templates/01_create_template.tfvars ./env/templates/02_finalize_template.tfvars
21,24c21,26
<     cdrom = "local:iso/fedora-coreos-42.20250929.3.0-live-iso.x86_64.iso"
<     qemu_agent = {
<       enabled = false
<     }
---
>     # qemu_agent = {
>     #   enabled = true
>     #   trim    = true
>     #   timeout = "60s"
>     # }
>     template = true

I've created VM using this:

tofu apply \
          -var-file="garage.tfvars" \
          -var-file="./env/templates/01_create_template.tfvars"
module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm: Refreshing state... [id=9222]

OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
  + create

OpenTofu will perform the following actions:

  # module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm will be created
  + resource "proxmox_virtual_environment_vm" "vm" {
      + acpi                                 = true
      + bios                                 = "seabios"
      + boot_order                           = [
          + "scsi0",
          + "ide0",
        ]
      + delete_unreferenced_disks_on_destroy = false
      + hotplug                              = "network,disk,usb"
      + id                                   = (known after apply)
      + ipv4_addresses                       = (known after apply)
      + ipv6_addresses                       = (known after apply)
      + keyboard_layout                      = "pl"
      + mac_addresses                        = (known after apply)
      + migrate                              = true
      + name                                 = "coreos-template"
      + network_device                       = [
          + {
              + bridge      = "vmbr0"
              + enabled     = true
              + firewall    = false
              + mac_address = "BC:24:11:AD:07:76"
              + model       = "virtio"
              + mtu         = 0
              + queues      = 0
              + rate_limit  = 0
              + vlan_id     = 510
            },
        ]
      + network_interface_names              = (known after apply)
      + node_name                            = "hal"
      + on_boot                              = true
      + protection                           = false
      + purge_on_destroy                     = true
      + reboot                               = false
      + reboot_after_update                  = true
      + scsi_hardware                        = "virtio-scsi-single"
      + started                              = true
      + stop_on_destroy                      = false
      + tablet_device                        = true
      + tags                                 = [
          + "opentofu",
          + "tmpl",
        ]
      + template                             = false
      + timeout_clone                        = 1800
      + timeout_create                       = 1800
      + timeout_migrate                      = 1800
      + timeout_move_disk                    = 1800
      + timeout_reboot                       = 1800
      + timeout_shutdown_vm                  = 1800
      + timeout_start_vm                     = 1800
      + timeout_stop_vm                      = 300
      + vm_id                                = 9222

      + cdrom {
          + enabled   = false
          + file_id   = "local:iso/fedora-coreos-42.20250929.3.0-live-iso.x86_64.iso"
          + interface = "ide0"
        }

      + cpu {
          + cores      = 2
          + hotplugged = 0
          + limit      = 0
          + numa       = false
          + sockets    = 1
          + type       = "x86-64-v2-AES"
          + units      = (known after apply)
        }

      + disk {
          + aio               = "io_uring"
          + backup            = true
          + cache             = "writeback"
          + datastore_id      = "local-zfs"
          + discard           = "on"
          + file_format       = (known after apply)
          + interface         = "scsi0"
          + iothread          = true
          + path_in_datastore = (known after apply)
          + replicate         = true
          + size              = 10
          + ssd               = false
        }

      + initialization {
          + datastore_id         = "local-zfs"
          + file_format          = (known after apply)
          + interface            = "ide2"
          + meta_data_file_id    = (known after apply)
          + network_data_file_id = (known after apply)
          + type                 = (known after apply)
          + user_data_file_id    = (known after apply)
          + vendor_data_file_id  = (known after apply)

          + dns {
              + domain  = "lan"
              + servers = [
                  + "10.5.10.2",
                  + "10.5.10.3",
                ]
            }

          + ip_config {
              + ipv4 {
                  + address = "dhcp"
                }
            }
        }

      + memory {
          + dedicated      = 1024
          + floating       = 1024
          + keep_hugepages = false
          + shared         = 0
        }

      + operating_system {
          + type = "l26"
        }

      + serial_device {
          + device = "socket"
        }

      + vga {
          + memory = 4
          + type   = "serial0"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions in workspace "template"?
  OpenTofu will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm: Creating...
module.vm_templates["coreos-template"].proxmox_virtual_environment_vm.vm: Creation complete after 4s [id=9222]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

[bpg-dev]

Hi @alteriks,

The template attribute used to have ForceNew set, which is why you were seeing the destroy-and-recreate plan. This was fixed in #2508 (merged after v0.99.0) — the template attribute now supports in-place conversion from false to true without destroying the VM. This will be available in the next release.

That said, your workflow of swapping tfvars files to drive a multi-phase process (create VM → provision with Ansible → convert to template) is fighting Terraform's declarative model a bit. Terraform expects you to declare the desired end-state, not step through intermediate states. Each time you apply with a different tfvars file, Terraform sees the delta and tries to reconcile — which can produce unexpected changes beyond just the template flag (note the cdrom, agent, and other diffs in your plan).

A more Terraform-idiomatic approach would be to either:

1. Cloud-init based templates — Use a cloud-init enabled image (Ubuntu, Fedora Cloud, etc.) and let the provider handle provisioning declaratively via the initialization block. This way you declare template = true from the start and cloud-init handles the OS configuration. See our Cloud-Init guide and Clone a VM guide for examples.

2. Packer for image building — Use Packer to build your template image. Packer is designed for this exact create→provision→templatize workflow, then reference the resulting template in Terraform for cloning.

3. Single desired state — Keep a single tfvars file with the final desired state (template = true) and use external provisioning tools (Ansible) outside the Terraform lifecycle, then just terraform apply once when everything is ready.

Once the next release is out, the in-place conversion should work for simpler cases where the only change is template = false → true. But note that converting a template back to a regular VM is not supported by Proxmox API, so this is a one-way operation.