Fix TypeSet hash to prevent spurious diffs on unchanged rules

The rule TypeSet was using the default hash function which includes ALL
fields, including the computed 'uuid' field. This caused Terraform to show
spurious diffs where unchanged rules appeared as being removed and re-added
when other rules in the same ruleset were modified.

Root Cause:
- When rule A is updated (e.g., action changes), its UUID may change
- The TypeSet hash included the UUID, so the set's internal representation
  changed even for unchanged rules
- Terraform interpreted this as rules being removed and re-added, even
  though only their position in the set changed

Solution:
- Added custom hash function resourceCloudStackNetworkACLRulesetRuleHash
- Hash is based only on user-configurable fields that define rule identity:
  rule_number, action, protocol, traffic_type, cidr_list, port, icmp_type,
  icmp_code, description
- Explicitly excludes the computed 'uuid' field
- This ensures rules are identified by their configuration, not by their
  API-assigned UUID

All 11 acceptance tests passing (139.0 seconds total)

Author: bhouse-nexthop

cloudstack/resource_cloudstack_network_acl_ruleset.go

@@ -64,6 +64,7 @@ func resourceCloudStackNetworkACLRuleset() *schema.Resource {
 			"rule": {
 				Type:     schema.TypeSet,
 				Required: true,
+				Set:      resourceCloudStackNetworkACLRulesetRuleHash,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"rule_number": {
@@ -128,6 +129,49 @@ func resourceCloudStackNetworkACLRuleset() *schema.Resource {
 	}
 }
 
+// resourceCloudStackNetworkACLRulesetRuleHash computes a hash for a rule based on
+// its identifying attributes, excluding the computed uuid field. This ensures that
+// rules are identified by their configuration, not by their API-assigned UUID.
+func resourceCloudStackNetworkACLRulesetRuleHash(v interface{}) int {
+	var buf strings.Builder
+	m := v.(map[string]interface{})
+
+	// Include all fields that define the rule's identity from the user's perspective
+	// Explicitly exclude "uuid" which is computed and should not affect the hash
+
+	buf.WriteString(fmt.Sprintf("%d-", m["rule_number"].(int)))
+	buf.WriteString(fmt.Sprintf("%s-", m["action"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["protocol"].(string)))
+	buf.WriteString(fmt.Sprintf("%s-", m["traffic_type"].(string)))
+
+	// Hash the cidr_list set
+	if v, ok := m["cidr_list"]; ok {
+		cidrSet := v.(*schema.Set)
+		for _, cidr := range cidrSet.List() {
+			buf.WriteString(fmt.Sprintf("%s-", cidr.(string)))
+		}
+	}
+
+	// Include optional fields
+	if v, ok := m["port"]; ok && v.(string) != "" {
+		buf.WriteString(fmt.Sprintf("port:%s-", v.(string)))
+	}
+
+	if v, ok := m["icmp_type"]; ok && v.(int) != 0 {
+		buf.WriteString(fmt.Sprintf("icmp_type:%d-", v.(int)))
+	}
+
+	if v, ok := m["icmp_code"]; ok && v.(int) != 0 {
+		buf.WriteString(fmt.Sprintf("icmp_code:%d-", v.(int)))
+	}
+
+	if v, ok := m["description"]; ok && v.(string) != "" {
+		buf.WriteString(fmt.Sprintf("desc:%s-", v.(string)))
+	}
+
+	return schema.HashString(buf.String())
+}
+
 func resourceCloudStackNetworkACLRulesetCreate(d *schema.ResourceData, meta interface{}) error {
 	// We need to set this upfront in order to be able to save a partial state
 	d.SetId(d.Get("acl_id").(string))