Error: Value Conversion Error

[stevenca]

stevenca@STEVENCA-M-4RY2 wireless % terraform plan

│ Error: Value Conversion Error
│ 
│   with module.wlc.iosxe_restconf.nested_list,
│   on wlc/main.tf line 64, in resource "iosxe_restconf" "nested_list":
│   64: resource "iosxe_restconf" "nested_list" {
│ 
│ An unexpected error was encountered trying to build a value. This is always an error in the provider. Please report the following to the provider developer:
│ 
│ Received unknown value, however the target type cannot handle unknown values. Use the corresponding `types` package type or a custom type that handles unknown
│ values.
│ 
│ Path: lists[0].items
│ Target Type: []basetypes.MapValue
│ Suggested Type: basetypes.ListValue

This is the block it has issues with:

resource "iosxe_restconf" "nested_list" {
  path = "Cisco-IOS-XE-wireless-wlan-cfg:wlan-cfg-data/wlan-cfg-entries"
  lists = [{
    name = "wlan-cfg-entry"
    key  = "profile-name"
    items = [
      for idx, ssid in var.cfg.ssids : {
        "profile-name"                  = try(ssid.profile, ssid.name)
        "wlan-id"                       = ssid.number  # Auto-increment WLAN ID starting from 1
        "auth-key-mgmt-psk"             = try(ssid.auth_psk, true)    # Default to true if not specified
        "auth-key-mgmt-dot1x"           = try(ssid.auth_dot1x, false) # Default to false if not specified
        "psk"                           = ssid.psk
        "apf-vap-id-data/ssid"          = ssid.name
        "apf-vap-id-data/wlan-status"   = try(ssid.status, true) # Default to true if not specified
      }
    ]
  }]
}

This cropped up between 0.5.6 and 0.5.9. Is it my code or an issue in the provider?

Thanks,

Steven.

[danischm]

Can you try adding an empty attributes map to your resource to see if that fixes your issue:

attributes = {}

[stevenca]

resource "iosxe_restconf" "nested_list" {
  path = "Cisco-IOS-XE-wireless-wlan-cfg:wlan-cfg-data/wlan-cfg-entries"
  attributes = {}
  lists = [{
    name = "wlan-cfg-entry"
    key  = "profile-name"
    items = [
      for idx, ssid in var.cfg.ssids : {
        "profile-name"        = try(ssid.profile, ssid.name)
        "wlan-id"             = ssid.number
        "auth-key-mgmt-psk"   = try(ssid.auth_psk, true)
        "auth-key-mgmt-dot1x" = try(ssid.auth_dot1x, false)
        "psk"                 = ssid.psk
        "apf-vap-id-data/ssid"         = ssid.name
        "apf-vap-id-data/wlan-status"  = try(ssid.status, true)
      }
    ]
  }]
}

Yields the same result.

[danischm]

I tried to recreate your config with this:

locals {
  vrfs = [
    {
      name = "VRF11"
    },
    {
      name = "VRF13"
    }
  ]
}

resource "iosxe_restconf" "nested_list" {
  path = "Cisco-IOS-XE-native:native/ip"
  attributes = {}
  lists = [{
    name = "vrf"
    key  = "name"
    items = [for idx, vrf in local.vrfs : {
      name = vrf.name
    }]
  }]
}

Which works for me. It might have to do with the value of your cfg variable. You could inspect the value of cfg using terraform console.

[stevenca]

If I restructure to the following to make the console easier:

locals {
  wlan_cfg_entries = [{
    name = "wlan-cfg-entry"
    key  = "profile-name"
    attributes = {}
    items = [
      for idx, ssid in var.cfg.ssids : {
        "profile-name"        = try(ssid.profile, ssid.name)
        "wlan-id"             = ssid.number
        "auth-key-mgmt-psk"   = try(ssid.auth_psk, true)
        "auth-key-mgmt-dot1x" = try(ssid.auth_dot1x, false)
        "psk"                 = ssid.psk
        "apf-vap-id-data/ssid"         = ssid.name
        "apf-vap-id-data/wlan-status"  = try(ssid.status, true)
      }
    ]
  }]
}

resource "iosxe_restconf" "nested_list" {
  path = "Cisco-IOS-XE-wireless-wlan-cfg:wlan-cfg-data/wlan-cfg-entries"
  lists = local.wlan_cfg_entries
}

output "wlan_cfg_entries" {
  value = local.wlan_cfg_entries
}

I get:

stevenca@STEVENCA-M-4RY2 wireless % terraform console
> module.wlc.wlan_cfg_entries
[
  {
    "attributes" = {}
    "items" = [
      {
        "apf-vap-id-data/ssid" = "PSeudoCo-P101-CORP"
        "apf-vap-id-data/wlan-status" = true
        "auth-key-mgmt-dot1x" = false
        "auth-key-mgmt-psk" = true
        "profile-name" = "CORP_SSID"
        "psk" = "XXXXXXXXX"
        "wlan-id" = 1
      },
    ]
    "key" = "profile-name"
    "name" = "wlan-cfg-entry"
  },
]

Anything jump out as being an issue here?

[danischm]

attributes = {} should not be under lists, but otherwise it looks fine. Can you try stepping back provider versions by pinning it to earlier versions to see where it breaks?

[stevenca]

It worked in 0.5.6 and stops working in 0.5.7. However, in 0.5.6, I get:

2025-03-27T13:18:10.253-0500 [ERROR] vertex "module.wlc.iosxe_restconf.nested_list" error: Provider returned invalid result object after apply
╷
│ Error: Provider returned invalid result object after apply
│ 
│ After the apply operation, the provider still indicated an unknown value for module.wlc.iosxe_restconf.nested_list.attributes. All values must be known after
│ apply, so this is always a bug in the provider and should be reported in the provider's own repository. Terraform will still save the other known object values
│ in the state.
╵
2025-03-27T13:18:10.262-0500 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2025-03-27T13:18:10.272-0500 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/ciscodevnet/iosxe/0.5.6/darwin_arm64/terraform-provider-iosxe_v0.5.6 pid=31240
2025-03-27T13:18:10.272-0500 [DEBUG] provider: plugin exited

After and apply. It seems to work, however.

[stevenca]

Actually, the error using 0.5.6 seems to go away after the way I restructured it for the console (and adding attributes). But it still seems to breaks between 0.5.6 and 0.5.7.

[danischm]

It likely has to do with this (d91a622) additional validation we introduced in v0.5.7. I suspect TF cannot evaluate some of the inputs (ssid.profile, ssid.auth_psk, etc.) during "plan" and therefore fails. How is the cfg variable being populated?

[danischm]

The issue you have seen with 0.5.6 (which also exists in later versions) related to the non-existing attributes map should be fixed in the next release (9a1f127).

[stevenca]

Thanks! The cfg just comes from a yaml file read in by the parent module.

[stevenca]

Any idea when the next release will be that incorporates this fix?

[danischm]

Just to clarify, the fix only addresses the issue you have seen in v0.5.6. To fix the issue you have seen from v0.5.7, I would need a minimal config to recreate the issue.

[danischm]

Validation fix: 9e714fa

[danischm]

Can you confirm this has been fixed with v0.5.10?

[danischm]

Any update on this?