cloudflare_zero_trust_tunnel_cloudflared_config doesn't create DNS records

[shinebayar-g]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement. Feature requests should be submitted with Cloudflare Support or your account team.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

Terraform v1.10.3
on linux_amd64
+ provider registry.terraform.io/cloudflare/cloudflare v4.49.1

Affected resource(s)

• cloudflare_zero_trust_tunnel_cloudflared_config

Terraform configuration files

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "my_tunnel_config" {
  account_id = "<ID>"
  tunnel_id  = data.cloudflare_zero_trust_tunnel_cloudflared.my_tunnel_config.id
  config {
    ingress_rule {
      hostname = "foo.example.com"
      service  = "http://foo.bar.svc.cluster.local"
    }
    ingress_rule {
      service = "http_status:404"
    }
  }
}

Link to debug output

N/A

Panic output

No response

Expected output

CNAME DNS record created for the domain.

Actual output

Creating public hostname through Cloudflare console creates appropriate CNAME record. However, cloudflare_zero_trust_tunnel_cloudflared_config doesn't do the same.

Steps to reproduce

1. terraform apply
2. go to cloudflare DNS console
3. look for the CNAME record

Additional factoids

Also, tunnel configurations created this way doesn't allow changing the hostname. For example, after applying the above configuration, go to Cloudflare Zero Trust - Networks - Tunnels - Edit - Public Hostname - Edit - and try to change the Subdomain field.

You'll get an error

Error getting DNS record for foo.example.com:<ID>.cfargotunnel.com

This subdomain should be editable. It seems something is definitely wrong here.

References

No response

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[github-actions]

Thank you for reporting this issue! For maintainers to dig into issues it is required that all issues include the entirety of TF_LOG=DEBUG output to be provided. The only parts that should be redacted are your user credentials in the X-Auth-Key, X-Auth-Email and Authorization HTTP headers. Details such as zone or account identifiers are not considered sensitive but can be redacted if you are very cautious. This log file provides additional context from Terraform, the provider and the Cloudflare API that helps in debugging issues. Without it, maintainers are very limited in what they can do and may hamper diagnosis efforts.

This issue has been marked with triage/needs-information and is unlikely to receive maintainer attention until the log file is provided making this a complete bug report.

[jacobbednarz]

this isn't a bug but intentional behaviour. the terraform provider doesn't create resources it doesn't manage. if you have a look in the UI, there is an additional API call made for the DNS record. if you'd like to emulate that same behaviour, you can chain a DNS record resource into your workflow.

[shinebayar-g]

Ah gotcha. That's good to know. Perhaps it could be documented somewhere. How can I get the CNAME value?

https://registry.terraform.io/providers/cloudflare/cloudflare/4.49.1/docs/data-sources/zero_trust_tunnel_cloudflared resource doesn't expose its cname value..

[jacobbednarz]

you need to reference the resource, not datasource - https://registry.terraform.io/providers/cloudflare/cloudflare/4.49.1/docs/resources/zero_trust_tunnel_cloudflared#cname-1

it is the id attribute + "cfargotunnel.com".

[shinebayar-g]

It was created outside of the terraform...

it is the id attribute + "cfargotunnel.com".

Thanks for the hint. This worked beautifully.

content = "${data.cloudflare_zero_trust_tunnel_cloudflared.my_tunnel.id}.cfargotunnel.com"

It seems adding a direct attribute cname on the data source would be a cheap win :D

[jacobbednarz]

you're welcome to lodge a request with cloudflare support to send through to the service team for consideration. going forward, the only attributes are publicly documented ones via the OpenAPI schemas; not manually maintained ones like cname is today on the resource.