In a clustered incus_network the cluster-specific parts of the config is read back to the node-specific resource, causing a change

[vegardx]

When you set up a cluster network the config argument in incus_network on the node-specific resources contains the cluster-specific changes, this causes terraform to think there's a drift, and try to correct it. When you try to apply the changes it will return that this is a node-specific argument.

Example code:

resource "incus_network" "node_network" {
  for_each = toset(["incus-01", "incus-02", "incus-03"])
  target   = each.value

  name = "foobar"
  type = "macvlan"

  config = {
    parent = "bond0"
  }
}

resource "incus_network" "cluster_network" {
  depends_on = [
    incus_network.node_network,
  ]

  name = "foobar"
  type = "macvlan"

  config = {
    vlan = 400
  }
}

After successfully applying it and re-running terraform you will see this:

  # incus_network.node_network["incus-01"] will be updated in-place
  ~ resource "incus_network" "node_network" {
      ~ config      = {
          - "vlan"   = "400" -> null
            # (1 unchanged element hidden)
        }
        name        = "foobar"
        # (4 unchanged attributes hidden)
    }

  # incus_network.node_network["incus-02"] will be updated in-place
  ~ resource "incus_network" "node_network" {
      ~ config      = {
          - "vlan"   = "400" -> null
            # (1 unchanged element hidden)
        }
        name        = "foobar"
        # (4 unchanged attributes hidden)
    }

  # incus_network.node_network["incus-03"] will be updated in-place
  ~ resource "incus_network" "node_network" {
      ~ config      = {
          - "vlan"   = "400" -> null
            # (1 unchanged element hidden)
        }
        name        = "foobar"
        # (4 unchanged attributes hidden)
    }

As a workaround you can ignore this change by just setting a lifecycle argument on the node-specific incus_network resource.

resource "incus_network" "node_network" {
  for_each = toset(["incus-01", "incus-02", "incus-03"])
  target   = each.value

  name = "foobar"
  type = "macvlan"

  config = {
    parent = "bond0"
  }

  lifecycle {
    ignore_changes = [
      config["vlan"],
    ]
  }
}