frostmoln_appgw_config_apply (Resource)

Dispatches an Application Gateway's authored configuration to the appliance, and waits for the appliance's verdict.

Authoring is not applying. A listener, route, backend, certificate or published WAF version is recorded when you apply it, but the gateway keeps serving what it last acknowledged until a configuration apply dispatches the change. Without this resource in your configuration, terraform apply records your intent and the gateway does not serve it.

Feed each child's updated_at into triggers — see the example. Because the server sets those timestamps on every write, any change to a listener, route, pool, backend or certificate changes an input here, so Terraform's own graph orders this last and re-runs it exactly when something changed. This resource also re-plans on its own whenever the gateway has authored changes it is not serving, which covers a deleted child and an edit made outside Terraform.

~> This resource FAILS the apply if the appliance refuses the configuration, quoting the proxy's own words. That is deliberate: a terraform apply that succeeds while the gateway is serving something else is worse than one that fails.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — gateway_id: the apply belongs to its gateway.

Example Usage

# Authoring is not applying. A listener, route, backend, certificate or
# published WAF version is RECORDED when you apply it — the gateway keeps
# serving what it last acknowledged until a configuration apply dispatches the
# change. Without this resource, `terraform apply` records your intent and the
# gateway does not serve it.
#
# `triggers` is what orders this. Feed in a value from each child that moves
# when the child moves; any change to any of them changes an input here, so
# Terraform's own graph runs this last and re-runs it exactly when something
# changed. A child left out is a child whose change will not be dispatched.
resource "frostmoln_appgw_config_apply" "edge" {
  gateway_id = frostmoln_application_gateway.edge.id

  triggers = {
    # Listeners, routes, pools, backends and certificates carry `updated_at`, a
    # server-set timestamp with sub-second precision.
    "listener.https"  = frostmoln_appgw_listener.https.updated_at
    "route.app"       = frostmoln_appgw_route.app.updated_at
    "pool.app"        = frostmoln_appgw_backend_pool.app.updated_at
    "backend.app_1"   = frostmoln_appgw_backend.app_1.updated_at
    "certificate.app" = frostmoln_appgw_certificate.app.updated_at

    # A published WAF version also reaches the appliance only on the next
    # configuration apply, so the publication belongs here too. It exports a
    # NUMBER, so stringify it.
    #
    # NOTE: the appliance sources its ruleset from the gateway's
    # applied_waf_version, which the platform does not yet write — so a
    # publication is dispatched but no compiled ruleset is packed with it today.
    # Listing it here is still correct and becomes effective when that lands.
    "waf.publication" = tostring(frostmoln_appgw_waf_policy_publication.app.version)
  }
}

# The apply fails if the appliance refuses the configuration, quoting the
# proxy's own words — so a `terraform apply` that succeeds means the gateway is
# serving what you declared.
output "gateway_config_revision" {
  value = frostmoln_appgw_config_apply.edge.revision
}

Schema

Required

• gateway_id (String) The Application Gateway whose configuration to dispatch.

• triggers (Map of String) A value from every child object that changes when the child changes, keyed however you like. This is an ordering input, not something the server reads: it is what makes Terraform run this after the children and re-run it exactly when one of them moved. A child left out of this map is a child whose change will not be dispatched.

  Use each child's updated_at. Listeners, routes, backend pools, backends and certificates carry a server-set timestamp rather than the numeric revision that WAF rules have, which is why this is a map of strings — feed a WAF publication in with tostring(...).

  ~> frostmoln_appgw_health_check exposes NO such attribute, because the API does not return one for it. A health-check change therefore moves nothing here. It is still dispatched, one run late: the write bumps the gateway's generation, and this resource re-plans on its own whenever the gateway has authored changes it is not serving.

Optional

• timeouts (Block, Optional) (see below for nested schema)

Read-Only

• applied_at (String) When the appliance acknowledged the configuration.
• id (String) The gateway id and the applied revision, joined.
• revision (Number) The configuration generation that was dispatched and acknowledged.
• sha256 (String) Identifies the rendered bytes, so two applies that produced the same configuration are visibly the same configuration.
• status (String) The appliance's verdict on this apply. applied when it converged.

Nested Schema for timeouts

Optional:

• create (String) How long the provider waits for the create operation to converge before giving up (e.g. "45m", "2h").
• delete (String) How long the provider waits for the delete to complete before giving up (e.g. "30m").
• update (String) How long the provider waits for an update (resize, in-place change) to converge before giving up (e.g. "30m").