Cherry-pick VNA, distributed VxLAN, route controller fixes into branch_3121 (#2168)

* Fix state drift on VNA cluster when advanced_configuration omitted (#2114)

NSX auto-populates advanced_configuration (high_availability_profile,
overlay_transport_zone_path, core_allocation_profile) when the block is
absent from the manifest. The previous schema lacked Computed:true on the
TypeList and on overlay_transport_zone_path, causing Terraform to plan a
perpetual in-place update to remove the server-populated values.

Add Computed:true to the advanced_configuration list block and to
overlay_transport_zone_path so Terraform preserves server-side defaults
without generating a diff on subsequent plans.

Add TestAccResourceNsxtPolicyVirtualNetworkApplianceCluster_noAdvancedConfig
to verify zero drift on re-plan when the block is omitted.

Fixes: https://bugzilla-vcf.lvn.broadcom.net/show_bug.cgi?id=3713480

Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit c7d1f42)

* Bug 3713478: move member to data source, drop from resource (#2115)

The member list fields in the VNA cluster OpenAPI spec are all
read-only: NSX populates AppliancePath, ApplianceUniqueId, and
EdgeTransportNodePath only after VNA appliances are physically
deployed.  Keeping member as a user-configurable block in the
resource was misleading and caused import drift because NSX never
returns the configured EdgeTransportNodePath in the GET response
until deployment completes.

Changes:
- Remove member block and helpers (setVNAClusterMembersInSchema,
  getVNAClusterMembersFromSchema) from the resource; the PATCH body
  no longer sends Members.
- Add member (Computed) to the data source so callers can read the
  deployed cluster members once NSX populates them.
- Update resource acceptance tests: drop NSXT_TEST_EDGE_TRANSPORT_NODE
  pre-check, member blocks from templates, and member state assertions;
  import verify no longer needs to ignore member.
- Update data source acceptance test: remove member from resource
  template; no longer requires NSXT_TEST_EDGE_TRANSPORT_NODE.
- Add by_id_with_members unit test to the data source mock suite.
- Update docs for both resource and data source accordingly.

Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit 8d480be)

* Fix VNA credential drift after terraform import (bug 3715433) (#2130)

After 'terraform import' the NSX API does not return passwords, leaving
the credentials block absent from state and causing every subsequent
'terraform plan' to report +credentials drift.

Two provider changes fix this:

1. Importer seeds an empty credentials block before Read is called.
   setVNACredentialsInSchema already skips its early return when a block
   is present, so it then writes NSX-returned usernames into state.

2. Add suppressIfEmptyPriorState DiffSuppressFunc on cli_password and
   root_password. When old=="" (state has no password after import) and
   d.Id()!="" (resource already exists), the diff is suppressed so the
   subsequent plan shows "No changes." The d.Id()!="" guard ensures
   the suppression does not fire during Create or in unit tests.

Testing:

- Add unit tests covering the importer-seeded path and the
  DiffSuppressFunc behaviour (TestSuppressIfEmptyPriorState,
  Read_with_importer_seeded_block_writes_usernames_to_state).
- Add acceptance test TestAccResourceNsxtPolicyVirtualNetworkAppliance_
  importWithCredentials that reproduces the exact FVT failure: create
  with credentials → import → assert plan is empty.
- Add withImportIdempotencyChecks helper to utils_test.go (companion to
  withIdempotencyChecks) that auto-inserts a PlanOnly step after each
  ImportState step; reusable for any resource with write-only fields.

Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit 7ba0400)

* Fix VNA import panic on nil credentials list element (#2134)

The Terraform Plugin SDK v2 normalises an empty TypeList element set by
the importer to nil on the subsequent d.Get call.  setVNACredentialsInSchema
then panicked with an unsafe type-assertion on c[0].  Switch to a
nil-safe assertion and add a unit test that exercises this path directly.

Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit ad67355)

* Fix parallel test race in DistributedVlanConnection acceptance tests (#2136)

_basic and _importBasic both resolved display_name from the static
package-level accTestPolicyDistributedVlanConnectionCreateAttributes/
UpdateAttributes maps. Running in parallel, both created an NSX object
with the same display_name; the data source lookup then found two
matches and failed with "Found multiple DistributedVlanConnection".

Give _basic its own createName/updateName local variables and thread
them through testAccNsxtPolicyDistributedVlanConnectionTemplate.
Give _importBasic its own updateName (the existing `name` local) and
thread it through testAccNsxtPolicyDistributedVlanConnectionMinimalistic.
Each test now operates on uniquely-named resources with no shared names.

Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit de64f9c)

* fix(nsxt_policy_virtual_network_appliance_cluster): mark appliance_form_factor as Computed (#2154)

The NSX API always returns appliance_form_factor in read responses (defaulting
to "MEDIUM" when not explicitly set). The schema field was Optional-only, so
Terraform perpetually detected drift (MEDIUM -> null) when the field was omitted
from a minimal config.

Add Computed: true, consistent with the other server-defaulted fields in this
resource (appliance_type, service_type, password_managed_by_vcf). Update docs
to reflect (Optional, Computed).

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit ca61c91)

* fix: address route controller interface acc test failures on LM 9.1 (#2147)

Two distinct backend changes broke 7 acceptance tests:

1. NSX now enforces (code 640171) that interface_address subnets must
   belong to the same network as floating_ip_subnets. Fix the BGP
   neighbor test helper: align both to 192.168.200.0/24, consistent
   with the source_addresses used in the BGP neighbor configs.

2. NSX always returns mtu=1500 (default) in read responses. The mtu
   schema field was Optional-only, causing a perpetual diff (1500->null)
   after every apply. Add Computed:true so Terraform accepts the
   API-returned default when the user has not explicitly set the field.

3. nsxt_node_user's password_change_frequency attribute is set by VCF
   password policy, beginning v9.2.0

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit 624fdf5)

* fix(nsxt_policy_route_controller_bgp_neighbor): mark source_addresses as Required (#2153)

The NSX API enforces source_addresses as a required field on
RouteControllerBgpNeighbor objects (error code 255: required property
missing), but the Terraform schema declared it Optional. This caused
updates to fail at the API layer with no prior Terraform-level validation.

- Change source_addresses from Optional to Required with MinItems: 1
- Update docs to reflect the requirement

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
(cherry picked from commit 1f34b57)

* fix(nsxt_policy_route_controller_bgp_neighbor): suppress password drift after import (#2160)

NSX never returns password on GET, so terraform import leaves it
empty in state, causing a spurious diff/re-apply on every plan.
Reuse the suppressIfEmptyPriorState DiffSuppressFunc already used by
nsxt_policy_virtual_network_appliance for the same write-only-field
import issue.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
(cherry picked from commit 70b77bd)

* Fix version references in virtual_network_appliance_cluster doc (#2167)

Signed-off-by: Kobi Samoray <kobi.samoray@broadcom.com>
(cherry picked from commit f89e30c)

---------

Signed-off-by: Kobi Samoray <kobi.samoray@broadcom.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

docs/data-sources/policy_virtual_network_appliance_cluster.md

@@ -6,7 +6,7 @@ description: Policy Virtual Network Appliance Cluster data source.
 
 # nsxt_policy_virtual_network_appliance_cluster
 
-This data source provides information about a Virtual Network Appliance (VNA) Cluster configured on NSX.
+This data source provides information about a Virtual Network Appliance (VNA) Cluster configured on NSX, including its deployed cluster members.
 
 This data source is applicable to NSX Policy Manager and is supported with NSX 9.1.1 onwards.
 
@@ -51,3 +51,7 @@ In addition to arguments listed above, the following attributes are exported:
 * `path` - The NSX policy path of the resource.
 * `appliance_form_factor` - The form factor of the virtual network appliances in the cluster (`SMALL`, `MEDIUM`, `LARGE`, `XLARGE`).
 * `service_type` - The service type of the cluster (`VPC_SERVICES` or `ROUTE_CONTROLLER`).
+* `member` - List of cluster members as reported by NSX once VNA appliances are deployed. Each entry contains:
+    * `appliance_path` - The NSX policy path of the deployed virtual appliance.
+    * `appliance_unique_id` - The virtual appliance network unique ID generated by the API.
+    * `edge_transport_node_path` - The NSX policy path of the corresponding edge transport node.

docs/resources/policy_route_controller_bgp_neighbor.md

@@ -54,7 +54,7 @@ The following arguments are supported:
 * `keep_alive_time` - (Optional) Interval between keep alive messages sent to peer. Must be between 1 and 65535. Defaults to `60`.
 * `maximum_hop_limit` - (Optional) Maximum number of hops allowed to reach BGP neighbor. Must be between 1 and 255. Defaults to `1`.
 * `password` - (Optional) Password for BGP neighbor authentication. Sensitive value. Maximum 32 characters.
-* `source_addresses` - (Optional) List of source IP addresses for BGP peering. Maximum 8 entries.
+* `source_addresses` - (Required) List of source IP addresses for BGP peering. Maximum 8 entries.
 * `bfd_config` - (Optional) BFD configuration for failure detection. The following arguments are supported:
     * `enabled` - (Optional) Flag to enable/disable BFD configuration. Defaults to `false`.
     * `interval` - (Optional) Time interval between heartbeat packets in milliseconds. Must be between 50 and 60000. Defaults to `500`.

docs/resources/policy_virtual_network_appliance_cluster.md

@@ -8,17 +8,13 @@ description: A resource to configure a Virtual Network Appliance Cluster.
 
 This resource provides a method for the management of a Virtual Network Appliance (VNA) Cluster under an NSX enforcement point.
 
-A VNA Cluster is a logical grouping of Virtual Network Appliances that share common configuration such as form factor, service type, and advanced settings. It is associated with edge transport nodes that host the virtual appliances.
+A VNA Cluster is a logical grouping of Virtual Network Appliances that share common configuration such as form factor, service type, and advanced settings. Cluster members (VNA appliances and their associated edge transport nodes) are managed by NSX and are exposed as read-only attributes on the `nsxt_policy_virtual_network_appliance_cluster` data source.
 
-This resource is supported with NSX 9.2.0 onwards.
+This resource is supported with NSX 9.1.1 onwards.
 
 ## Example Usage
 
 ```hcl
-data "nsxt_policy_edge_transport_node" "edge1" {
-  display_name = "edge-node-1"
-}
-
 data "nsxt_policy_transport_zone" "overlay_tz" {
   display_name = "overlay-tz"
 }
@@ -29,10 +25,6 @@ resource "nsxt_policy_virtual_network_appliance_cluster" "example" {
   appliance_form_factor = "MEDIUM"
   service_type          = "VPC_SERVICES"
 
-  member {
-    edge_transport_node_path = data.nsxt_policy_edge_transport_node.edge1.path
-  }
-
   advanced_configuration {
     core_allocation_profile     = "L4LBSERVICE"
     overlay_transport_zone_path = data.nsxt_policy_transport_zone.overlay_tz.path
@@ -55,16 +47,12 @@ The following arguments are supported:
 * `nsx_id` - (Optional) The NSX ID of this resource. If set, this ID will be used to create the resource.
 * `site_path` - (Optional) The path of the site this cluster belongs to. `path` field of the existing `nsxt_policy_site` can be used here. Defaults to default site path.
 * `enforcement_point` - (Optional) The ID of enforcement point under given `site_path` to manage the cluster. Defaults to default enforcement point.
-* `appliance_form_factor` - (Optional) The form factor of the virtual network appliances in the cluster. Supported values: `SMALL`, `MEDIUM`, `LARGE`, `XLARGE`. When the form factor is updated, new VNAs deployed at the cluster level will use the updated value. Use the VNA redeploy API to apply the new form factor to existing appliances.
+* `appliance_form_factor` - (Optional, Computed) The form factor of the virtual network appliances in the cluster. Supported values: `SMALL`, `MEDIUM`, `LARGE`, `XLARGE`. When the form factor is updated, new VNAs deployed at the cluster level will use the updated value. Use the VNA redeploy API to apply the new form factor to existing appliances.
 * `appliance_type` - (Optional, Computed) The virtual network appliance type of the cluster.
 * `service_type` - (Optional, Computed, ForceNew) The service type for the cluster. Supported values: `VPC_SERVICES`, `ROUTE_CONTROLLER`. When set to `ROUTE_CONTROLLER`, the cluster is exclusively for route controller and cannot be used to connect VPC workloads. Defaults to `VPC_SERVICES` and cannot be modified after creation.
 * `password_managed_by_vcf` - (Optional, Computed) When set to `true`, enables VCF password management for all virtual network appliances in the cluster.
-* `member` - (Optional) A list of virtual network appliance cluster members. Each member block supports:
-    * `edge_transport_node_path` - (Required) The policy path of the corresponding edge transport node for the Virtual Network Appliance.
-    * `appliance_path` - (Optional, Computed) The path of the virtual appliance.
-    * `appliance_unique_id` - (Computed) The virtual appliance network unique ID, generated by the API.
 * `advanced_configuration` - (Optional) Advanced configuration for virtual network appliances in the cluster. This block supports:
-    * `core_allocation_profile` - (Optional, Computed) Core allocation profile for VNAs in the cluster. Defines core allocation for new or redeployed VNAs. Supported values: `L4FORWARDING`, `L7LBSERVICE`, `L4LBSERVICE`. For `VPC_SERVICES` clusters, NSX defaults to `L4LBSERVICE` when not set. A manual reboot is required for a profile change to take effect on existing appliances.
+    * `core_allocation_profile` - (Optional, Computed) Core allocation profile for VNAs in the cluster. Defines core allocation for new or redeployed VNAs. Supported values: `L4FORWARDING`, `L7LBSERVICE`, `L4LBSERVICE`. For `VPC_SERVICES` clusters, NSX defaults to `L4LBSERVICE` when not set. A manual reboot is required for a profile change to take effect on existing appliances. This attribute is supported with NSX v9.2.0 and above.
     * `high_availability_profile` - (Optional, Computed) Path to the high availability profile. If not specified, NSX assigns a default profile.
     * `overlay_transport_zone_path` - (Optional) An overlay transport zone path associated with the VNA host switch and TEP.
 

nsxt/data_source_nsxt_policy_virtual_network_appliance_cluster.go

@@ -47,6 +47,30 @@ func dataSourceNsxtPolicyVirtualNetworkApplianceCluster() *schema.Resource {
 				Computed:    true,
 				Description: "Service type of the cluster",
 			},
+			"member": {
+				Type:        schema.TypeList,
+				Computed:    true,
+				Description: "Virtual network appliance cluster members as reported by NSX",
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"appliance_path": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "Path of the deployed virtual appliance",
+						},
+						"appliance_unique_id": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "Virtual appliance network unique ID generated by the API",
+						},
+						"edge_transport_node_path": {
+							Type:        schema.TypeString,
+							Computed:    true,
+							Description: "Corresponding edge transport node path of the Virtual Network Appliance",
+						},
+					},
+				},
+			},
 		},
 	}
 }
@@ -151,5 +175,21 @@ func dataSourceNsxtPolicyVirtualNetworkApplianceClusterRead(d *schema.ResourceDa
 	d.Set("appliance_form_factor", obj.ApplianceFormFactor)
 	d.Set("service_type", obj.ServiceType)
 
+	var memberList []map[string]interface{}
+	for _, member := range obj.Members {
+		m := make(map[string]interface{})
+		if member.AppliancePath != nil {
+			m["appliance_path"] = *member.AppliancePath
+		}
+		if member.ApplianceUniqueId != nil {
+			m["appliance_unique_id"] = *member.ApplianceUniqueId
+		}
+		if member.EdgeTransportNodePath != nil {
+			m["edge_transport_node_path"] = *member.EdgeTransportNodePath
+		}
+		memberList = append(memberList, m)
+	}
+	d.Set("member", memberList)
+
 	return nil
 }

nsxt/data_source_nsxt_policy_virtual_network_appliance_cluster_test.go

@@ -14,21 +14,19 @@ import (
 func TestAccDataSourceNsxtPolicyVirtualNetworkApplianceCluster_basic(t *testing.T) {
 	testResourceName := "data.nsxt_policy_virtual_network_appliance_cluster.test"
 	displayName := getAccTestResourceName()
-	edgeTransportNodeName := getEdgeTransportNodeName()
 
 	resource.Test(t, resource.TestCase{
 		PreCheck: func() {
 			testAccPreCheck(t)
 			testAccOnlyLocalManager(t)
 			testAccNSXVersion(t, "9.1.1")
-			testAccEnvDefined(t, "NSXT_TEST_EDGE_TRANSPORT_NODE")
 			testAccEnvDefined(t, "NSXT_TEST_OVERLAY_TRANSPORT_ZONE")
 		},
 		Providers:    testAccProviders,
 		CheckDestroy: testAccNsxtPolicyVirtualNetworkApplianceClusterCheckDestroy(testResourceName),
 		Steps: []resource.TestStep{
 			{
-				Config: testAccNsxtPolicyVirtualNetworkApplianceClusterDataSourceTemplate(displayName, edgeTransportNodeName),
+				Config: testAccNsxtPolicyVirtualNetworkApplianceClusterDataSourceTemplate(displayName),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(testResourceName, "display_name", displayName),
 					resource.TestCheckResourceAttrSet(testResourceName, "id"),
@@ -41,12 +39,8 @@ func TestAccDataSourceNsxtPolicyVirtualNetworkApplianceCluster_basic(t *testing.
 	})
 }
 
-func testAccNsxtPolicyVirtualNetworkApplianceClusterDataSourceTemplate(displayName, edgeTransportNodeName string) string {
+func testAccNsxtPolicyVirtualNetworkApplianceClusterDataSourceTemplate(displayName string) string {
 	return fmt.Sprintf(`
-data "nsxt_policy_edge_transport_node" "test" {
-  display_name = "%s"
-}
-
 data "nsxt_policy_transport_zone" "test" {
   display_name = "%s"
 }
@@ -57,10 +51,6 @@ resource "nsxt_policy_virtual_network_appliance_cluster" "test" {
   appliance_form_factor = "MEDIUM"
   service_type          = "VPC_SERVICES"
 
-  member {
-    edge_transport_node_path = data.nsxt_policy_edge_transport_node.test.path
-  }
-
   advanced_configuration {
     overlay_transport_zone_path = data.nsxt_policy_transport_zone.test.path
   }
@@ -69,5 +59,5 @@ resource "nsxt_policy_virtual_network_appliance_cluster" "test" {
 data "nsxt_policy_virtual_network_appliance_cluster" "test" {
   display_name = nsxt_policy_virtual_network_appliance_cluster.test.display_name
 }
-`, edgeTransportNodeName, getOverlayTransportZoneName(), displayName)
+`, getOverlayTransportZoneName(), displayName)
 }

nsxt/resource_nsxt_node_user_test.go

@@ -15,19 +15,17 @@ import (
 )
 
 var accTestNodeUserCreateAttributes = map[string]string{ //nolint:gosec
-	"full_name":                 getAccTestRandomString(10),
-	"password":                  "Q5&WfLqv9Zd5",
-	"active":                    "true",
-	"password_change_frequency": "180",
-	"password_change_warning":   "30",
+	"full_name":               getAccTestRandomString(10),
+	"password":                "Q5&WfLqv9Zd5",
+	"active":                  "true",
+	"password_change_warning": "30",
 }
 
 var accTestNodeUserUpdateAttributes = map[string]string{ //nolint:gosec
-	"full_name":                 getAccTestRandomString(10),
-	"password":                  "Q5&WfLqv9Zd5",
-	"active":                    "false",
-	"password_change_frequency": "75",
-	"password_change_warning":   "20",
+	"full_name":               getAccTestRandomString(10),
+	"password":                "Q5&WfLqv9Zd5",
+	"active":                  "false",
+	"password_change_warning": "20",
 }
 
 func TestAccResourceNsxtNodeUser_basic(t *testing.T) {
@@ -51,7 +49,6 @@ func TestAccResourceNsxtNodeUser_basic(t *testing.T) {
 					testAccNodeUserExists(testResourceName),
 					resource.TestCheckResourceAttr(testResourceName, "full_name", accTestNodeUserCreateAttributes["full_name"]),
 					resource.TestCheckResourceAttr(testResourceName, "active", accTestNodeUserCreateAttributes["active"]),
-					resource.TestCheckResourceAttr(testResourceName, "password_change_frequency", accTestNodeUserCreateAttributes["password_change_frequency"]),
 					resource.TestCheckResourceAttr(testResourceName, "password_change_warning", accTestNodeUserCreateAttributes["password_change_warning"]),
 					resource.TestCheckResourceAttr(testResourceName, "username", testUsername),
 					resource.TestCheckResourceAttr(testResourceName, "status", nsxModel.NodeUserProperties_STATUS_ACTIVE),
@@ -66,7 +63,6 @@ func TestAccResourceNsxtNodeUser_basic(t *testing.T) {
 					testAccNodeUserExists(testResourceName),
 					resource.TestCheckResourceAttr(testResourceName, "full_name", accTestNodeUserUpdateAttributes["full_name"]),
 					resource.TestCheckResourceAttr(testResourceName, "active", accTestNodeUserUpdateAttributes["active"]),
-					resource.TestCheckResourceAttr(testResourceName, "password_change_frequency", accTestNodeUserUpdateAttributes["password_change_frequency"]),
 					resource.TestCheckResourceAttr(testResourceName, "password_change_warning", accTestNodeUserUpdateAttributes["password_change_warning"]),
 					resource.TestCheckResourceAttr(testResourceName, "username", testUsername),
 					resource.TestCheckResourceAttr(testResourceName, "status", nsxModel.NodeUserProperties_STATUS_NOT_ACTIVATED),
@@ -82,7 +78,6 @@ func TestAccResourceNsxtNodeUser_basic(t *testing.T) {
 					testAccNodeUserExists(testResourceName),
 					resource.TestCheckResourceAttr(testResourceName, "full_name", accTestNodeUserUpdateAttributes["full_name"]),
 					resource.TestCheckResourceAttr(testResourceName, "active", accTestNodeUserUpdateAttributes["active"]),
-					resource.TestCheckResourceAttr(testResourceName, "password_change_frequency", accTestNodeUserUpdateAttributes["password_change_frequency"]),
 					resource.TestCheckResourceAttr(testResourceName, "password_change_warning", accTestNodeUserUpdateAttributes["password_change_warning"]),
 					resource.TestCheckResourceAttr(testResourceName, "username", testUsername),
 					resource.TestCheckResourceAttr(testResourceName, "status", nsxModel.NodeUserProperties_STATUS_NOT_ACTIVATED),
@@ -193,9 +188,8 @@ resource "nsxt_node_user" "test" {
   full_name                 = "%s"
   password                  = "%s"
   username                  = "%s"
-  password_change_frequency = %s
   password_change_warning   = %s
-}`, attrMap["active"], attrMap["full_name"], attrMap["password"], username, attrMap["password_change_frequency"], attrMap["password_change_warning"])
+}`, attrMap["active"], attrMap["full_name"], attrMap["password"], username, attrMap["password_change_warning"])
 }
 
 func testAccNodeUserUpdate(username, password string) string {
@@ -206,7 +200,6 @@ resource "nsxt_node_user" "test" {
   full_name                 = "%s"
   password                  = "%s"
   username                  = "%s"
-  password_change_frequency = %s
   password_change_warning   = %s
-}`, attrMap["active"], attrMap["full_name"], password, username, attrMap["password_change_frequency"], attrMap["password_change_warning"])
+}`, attrMap["active"], attrMap["full_name"], password, username, attrMap["password_change_warning"])
 }