Adding new Ingress is triggering Instance recreation

[fabiogalera]

Terraform Version and Provider Version

Terraform v1.4.5
on linux_amd64

• provider registry.terraform.io/hashicorp/null v3.2.2
• provider registry.terraform.io/hashicorp/random v3.6.0
• provider registry.terraform.io/hashicorp/template v2.2.0
• provider registry.terraform.io/oracle/oci v5.22.0

Affected Resource(s)

• oci_core_security_list

Debug Output

  # oci_core_security_list.app_sl will be updated in-place
  ~ resource "oci_core_security_list" "app_sl" {
        id             = "ocid1.securitylist.oc1.sa-vinhedo-1.aaaaaaaa7ezwzt4b3uauhgoicpklbtmjojjwszmdnlyn4ybmtnw2s7nec7pa"
        # (7 unchanged attributes hidden)

      + ingress_security_rules {
          + description = "bastion-23"
          + protocol    = "6"
          + source      = "10.10.4.0/24"
          + source_type = (known after apply)
          + stateless   = false

          + tcp_options {
              + max = 23
              + min = 23
            }
        }

        # (6 unchanged blocks hidden)
    }

  # module.apps["app-1"].data.oci_core_private_ips.private_ips[0] will be read during apply
  # (config refers to values not yet known)
 <= data "oci_core_private_ips" "private_ips" {
      + id          = (known after apply)
      + private_ips = (known after apply)
      + vnic_id     = (known after apply)
    }

  # module.apps["app-1"].data.oci_core_shapes.current_ad will be read during apply
  # (config refers to values not yet known)
 <= data "oci_core_shapes" "current_ad" {
      + availability_domain = (known after apply)
      + compartment_id      = "ocid1.compartment.oc1..aaaaaaaam2djd2v6bhjp5k7uim3r267l2sifrqvlvxxlgeu66rau4orgfzoq"
      + id                  = (known after apply)
      + shapes              = (known after apply)
    }

  # module.apps["app-1"].data.oci_core_subnet.instance_subnet[0] will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "oci_core_subnet" "instance_subnet" {
      + availability_domain        = (known after apply)
      + cidr_block                 = (known after apply)
      + compartment_id             = (known after apply)
      + defined_tags               = (known after apply)
      + dhcp_options_id            = (known after apply)
      + display_name               = (known after apply)
      + dns_label                  = (known after apply)
      + freeform_tags              = (known after apply)
      + id                         = (known after apply)
      + ipv6cidr_block             = (known after apply)
      + ipv6cidr_blocks            = (known after apply)
      + ipv6virtual_router_ip      = (known after apply)
      + prohibit_internet_ingress  = (known after apply)
      + prohibit_public_ip_on_vnic = (known after apply)
      + route_table_id             = (known after apply)
      + security_list_ids          = (known after apply)
      + state                      = (known after apply)
      + subnet_domain_name         = (known after apply)
      + subnet_id                  = "ocid1.subnet.oc1.sa-vinhedo-1.aaaaaaaat6z3p4qa4pccys6kmlmu364treto4evlrw4fva2rwekgxrsxnf4q"
      + time_created               = (known after apply)
      + vcn_id                     = (known after apply)
      + virtual_router_ip          = (known after apply)
      + virtual_router_mac         = (known after apply)
    }

  # module.apps["app-1"].data.oci_core_vnic_attachments.vnic_attachment[0] will be read during apply
  # (config refers to values not yet known)
 <= data "oci_core_vnic_attachments" "vnic_attachment" {
      + compartment_id   = "ocid1.compartment.oc1..aaaaaaaam2djd2v6bhjp5k7uim3r267l2sifrqvlvxxlgeu66rau4orgfzoq"
      + id               = (known after apply)
      + instance_id      = (known after apply)
      + vnic_attachments = (known after apply)
    }

  # module.apps["app-1"].data.oci_core_volume_backup_policies.default_backup_policies will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "oci_core_volume_backup_policies" "default_backup_policies" {
      + id                     = (known after apply)
      + volume_backup_policies = (known after apply)
    }

  # module.apps["app-1"].data.oci_identity_availability_domains.ad will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "oci_identity_availability_domains" "ad" {
      + availability_domains = (known after apply)
      + compartment_id       = "ocid1.compartment.oc1..aaaaaaaam2djd2v6bhjp5k7uim3r267l2sifrqvlvxxlgeu66rau4orgfzoq"
      + id                   = (known after apply)
    }

  # module.apps["app-1"].oci_core_instance.instance[0] must be replaced
-/+ resource "oci_core_instance" "instance" {
      ~ availability_domain                 = "KZkp:SA-VINHEDO-1-AD-1" # forces replacement -> (known after apply)
      ~ boot_volume_id                      = "ocid1.bootvolume.oc1.sa-vinhedo-1.ab3ggljrdqz6kgdz6c7i4db44d33sp7drktcttwhzt4k4qdbz6kw6h4nwdfq" -> (known after apply)
      + capacity_reservation_id             = (known after apply)
      + compute_cluster_id                  = (known after apply)
      + dedicated_vm_host_id                = (known after apply)
      ~ defined_tags                        = {
          - "Oracle-Tags.CreatedBy" = "default/terragrunt"
          - "Oracle-Tags.CreatedOn" = "2023-12-08T19:28:52.052Z"
        } -> (known after apply)
      ~ extended_metadata                   = {} -> (known after apply)
      ~ fault_domain                        = "FAULT-DOMAIN-1" -> (known after apply)
      + hostname_label                      = (known after apply)
      ~ id                                  = "ocid1.instance.oc1.sa-vinhedo-1.an3ggljr4prkbsqcgvs34ehtuymt4krvrsipxwfs2dtysjsbyqu3zhobuuqq" -> (known after apply)
      ~ image                               = "ocid1.image.oc1.sa-vinhedo-1.aaaaaaaa5xjieus3tdi5xj7ha6kugd7gwe6gq44nxfhb4ol6a7fvfmgsesma" -> (known after apply)
      + instance_configuration_id           = (known after apply)
      + ipxe_script                         = (known after apply)
      ~ is_cross_numa_node                  = false -> (known after apply)
      + is_pv_encryption_in_transit_enabled = (known after apply)
      ~ launch_mode                         = "PARAVIRTUALIZED" -> (known after apply)
      ~ private_ip                          = "10.10.3.2" -> (known after apply)
      + public_ip                           = (known after apply)
      ~ region                              = "sa-vinhedo-1" -> (known after apply)
      ~ subnet_id                           = "ocid1.subnet.oc1.sa-vinhedo-1.aaaaaaaat6z3p4qa4pccys6kmlmu364treto4evlrw4fva2rwekgxrsxnf4q" -> (known after apply)
      ~ system_tags                         = {} -> (known after apply)
      ~ time_created                        = "2023-12-08 19:28:52.521 +0000 UTC" -> (known after apply)
      + time_maintenance_reboot_due         = (known after apply)
        # (7 unchanged attributes hidden)

      - availability_config {
          - is_live_migration_preferred = false -> null
          - recovery_action             = "RESTORE_INSTANCE" -> null
        }

      ~ create_vnic_details {
          ~ assign_ipv6ip             = false -> (known after apply)
          - assign_private_dns_record = false -> null
          ~ defined_tags              = {
              - "Oracle-Tags.CreatedBy" = "default/terragrunt"
              - "Oracle-Tags.CreatedOn" = "2023-12-08T19:28:52.181Z"
            } -> (known after apply)
          ~ display_name              = "app-1" -> (known after apply)
          ~ nsg_ids                   = [] -> (known after apply)
          ~ subnet_id                 = "ocid1.subnet.oc1.sa-vinhedo-1.aaaaaaaat6z3p4qa4pccys6kmlmu364treto4evlrw4fva2rwekgxrsxnf4q" # forces replacement -> (known after apply)
          + vlan_id                   = (known after apply)
            # (4 unchanged attributes hidden)
        }

      - instance_options {
          - are_legacy_imds_endpoints_disabled = false -> null
        }

      - launch_options {
          - boot_volume_type                    = "PARAVIRTUALIZED" -> null
          - firmware                            = "UEFI_64" -> null
          - is_consistent_volume_naming_enabled = true -> null
          - is_pv_encryption_in_transit_enabled = false -> null
          - network_type                        = "PARAVIRTUALIZED" -> null
          - remote_data_volume_type             = "PARAVIRTUALIZED" -> null
        }

      ~ shape_config {
          + gpu_description               = (known after apply)
          ~ gpus                          = 0 -> (known after apply)
          + local_disk_description        = (known after apply)
          ~ local_disks                   = 0 -> (known after apply)
          ~ local_disks_total_size_in_gbs = 0 -> (known after apply)
          ~ max_vnic_attachments          = 2 -> (known after apply)
          ~ networking_bandwidth_in_gbps  = 2 -> (known after apply)
          ~ nvmes                         = 0 -> (known after apply)
          ~ processor_description         = "3.0 GHz Ampere® Altra™" -> (known after apply)
          ~ vcpus                         = 2 -> (known after apply)
            # (3 unchanged attributes hidden)
        }

      ~ source_details {
          ~ boot_volume_size_in_gbs = "47" -> (known after apply)
          ~ boot_volume_vpus_per_gb = "10" -> (known after apply)
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # module.apps["app-1"].oci_core_volume.volume[0] must be replaced
-/+ resource "oci_core_volume" "volume" {
      + auto_tuned_vpus_per_gb = (known after apply)
      ~ availability_domain    = "KZkp:SA-VINHEDO-1-AD-1" # forces replacement -> (known after apply)
      + backup_policy_id       = (known after apply)
      ~ defined_tags           = {
          - "Oracle-Tags.CreatedBy" = "default/terragrunt"
          - "Oracle-Tags.CreatedOn" = "2023-12-08T19:29:36.599Z"
        } -> (known after apply)
      ~ id                     = "ocid1.volume.oc1.sa-vinhedo-1.ab3ggljr7lxrcutpftqfjr26uw3dj7nloqg5lezwq6vqoxrpv22irgyrdf3q" -> (known after apply)
      ~ is_auto_tune_enabled   = false -> (known after apply)
      ~ is_hydrated            = true -> (known after apply)
      + kms_key_id             = (known after apply)
      ~ size_in_mbs            = "51200" -> (known after apply)
      ~ state                  = "AVAILABLE" -> (known after apply)
      ~ system_tags            = {
          - "orcl-cloud.free-tier-retained" = "true"
        } -> (known after apply)
      ~ time_created           = "2023-12-08 19:29:36.614 +0000 UTC" -> (known after apply)
      + volume_backup_id       = (known after apply)
      + volume_group_id        = (known after apply)
      ~ vpus_per_gb            = "10" -> (known after apply)
        # (4 unchanged attributes hidden)
    }

  # module.apps["app-1"].oci_core_volume_attachment.volume_attachment[0] must be replaced
-/+ resource "oci_core_volume_attachment" "volume_attachment" {
      ~ availability_domain                 = "KZkp:SA-VINHEDO-1-AD-1" -> (known after apply)
      + chap_secret                         = (known after apply)
      + chap_username                       = (known after apply)
      ~ compartment_id                      = "ocid1.compartment.oc1..aaaaaaaam2djd2v6bhjp5k7uim3r267l2sifrqvlvxxlgeu66rau4orgfzoq" -> (known after apply)
      + device                              = (known after apply)
      ~ display_name                        = "volumeattachment20231208192949" -> (known after apply)
      + encryption_in_transit_type          = (known after apply)
      ~ id                                  = "ocid1.volumeattachment.oc1.sa-vinhedo-1.an3ggljr4prkbsqcokmfth2yxoaywabgiytdahnezcbioqkf53qlnhmkcs7q" -> (known after apply)
      ~ instance_id                         = "ocid1.instance.oc1.sa-vinhedo-1.an3ggljr4prkbsqcgvs34ehtuymt4krvrsipxwfs2dtysjsbyqu3zhobuuqq" # forces replacement -> (known after apply)
      + ipv4                                = (known after apply)
      + iqn                                 = (known after apply)
      + is_agent_auto_iscsi_login_enabled   = (known after apply)
      + is_multipath                        = (known after apply)
      ~ is_pv_encryption_in_transit_enabled = false -> (known after apply)
      ~ is_read_only                        = false -> (known after apply)
      ~ is_shareable                        = false -> (known after apply)
      + iscsi_login_state                   = (known after apply)
      ~ multipath_devices                   = [] -> (known after apply)
      + port                                = (known after apply)
      ~ state                               = "ATTACHED" -> (known after apply)
      ~ time_created                        = "2023-12-08 19:29:50.129 +0000 UTC" -> (known after apply)
      ~ volume_id                           = "ocid1.volume.oc1.sa-vinhedo-1.ab3ggljr7lxrcutpftqfjr26uw3dj7nloqg5lezwq6vqoxrpv22irgyrdf3q" # forces replacement -> (known after apply)
        # (2 unchanged attributes hidden)
    }