[Bug] citrix_application_icon cannot be deleted if same .ico file is used across multiple applications

[gideon-berger-FIS]

Describe the bug

I am trying to create applications across two different delivery groups (for two different clients). In each case I create a citrix_application_icon resource which points to the same base64 encoded icon file.
When I create the second citrix_application_icon, terraform returns back that it was successfully created, but returns back the ID of the icon created by the first application.
Now there is only a single icon which is being used for both applications. If I want to delete one of the applications, I must remove the icon from all other applications that are using it, otherwise it will not delete since it is in-use

I have no data source I can use to retrieve an existing icon, and even then the icon does not have any identifier associated with it to query.

Terraform command (import, apply, etc):
terraform apply
Resource impacted:
citrix_application_icon

Versions

Terraform:
1.9.6
citrix/citrix provider:
1.0.8
Operation system:
Windows 11

Terraform configuration files

After running terraform apply with two applications using the same base64 encoded string as the icon, remove one application and run terraform apply again

variable "citrix_applications" {
  type = map(object({
    application_name = string
    command_line_executable = string
    working_directory = string
    icon = string
  }))
}
resource "citrix_application" "test_applications" {
  for_each       =var.citrix_applications
  name           = "${each.key}"
  description    = "${each.value.application_name}"
  published_name = "${each.value.application_name}"
  installed_app_properties = {
    command_line_executable = each.value.command_line_executable
    working_directory       = each.value.working_directory
  }
  delivery_groups           = [citrix_delivery_group.this.id]
  icon                      = citrix_application_icon.test_applications[each.key].id
}

resource "citrix_application_icon" "test_applications" {
  for_each = var.citrix_applications
  raw_data = each.value.icon  # Use filebase64 to encode a file's content in base64 format.
}

Terraform console output

{"@Level":"error","@message":"Error: Error deleting Application Icon 6","@module":"terraform.ui","@timestamp":"2025-01-13T17:58:51.553779Z","diagnostic":{"severity":"error","summary":"Error deleting Application Icon 6","detail":"TransactionId: 4974d3a5-67c3-4ecc-9095-383bb9437797\nError message: Icon is in use."}

Terraform log file

If the issue is reproducible enable Terraform debug logging using one of the commands below. Then reproduce the issue and include the resulting log file. More information about Terraform logging is available here.

CitrixIssueId: XAC-60334

[AlanCitrix]

@gideon-berger-FIS Our expectation is that you use a single citrix_application_icon resource per unique icon. We can add some checks during citrix_application_icon creation and update the docs to ensure this case does not happen

If you switch to sharing a citrix_application_icon between your applications does everything work as expected?

[gideon-berger-FIS]

How would you envision that we reference a citrix_application_icon across different workspaces? The citrix_application takes an icon ID, and we don't have access to a data source or any identifying features on the icon within our terraform configuration.
And if we create the citrix_application_icon resource for each citrix_application so that we can reference it, we get the issue above where multiple terraform workspaces are all managing the same citrix_application_icon resources.

[AlanCitrix]

Thanks I see how this issue comes up with your for_each loop for the applications and the icons. We will take this issue to add a data source for the icons and also enhance the icon resource validation to ensure another icon with the same raw_data does not already exist.

In the meantime I think I may have a workaround for you if all of your apps with shared icons are managed by Terraform. You can de-duplicate the icons by creating a set using the icon value and then reference from the de-duplicated set. I'm doing the reference by the hash of the icon data to avoid dumping the icon data in the terraform plan output after it is created.

variable "citrix_applications" {
  type = map(object({
    application_name = string
    command_line_executable = string
    working_directory = string
    icon = string
  }))
}

locals {
  unique_icons = toset([for app in var.citrix_applications : app.icon])
  icon_map = {for icon in local.unique_icons : sha256(icon) => icon}
}

resource "citrix_application_icon" "test_applications" {
  for_each = local.icon_map // Use the hash of the icon as the key so the icon data does not appear in plan
  raw_data = each.value
}

resource "citrix_application" "test_applications" {
  for_each       =var.citrix_applications
  name           = "${each.key}"
  description    = "${each.value.application_name}"
  published_name = "${each.value.application_name}"
  installed_app_properties = {
    command_line_executable = each.value.command_line_executable
    working_directory       = each.value.working_directory
  }
  delivery_groups           = [citrix_delivery_group.this.id]
  icon = citrix_application_icon.test_applications[sha256(each.value.icon)].id
}

[gideon-berger-FIS]

Thank you for this! I do think this will indeed work if we want to reuse an icon across multiple applications in the citrix_applications within a single workspace.

However our main use case is sharing icons across different terraform workspaces. For each client we would be deploying the same set of applications with the same icons. So it would basically be your code above, but created for multiple delivery groups managed across multiple terraform workspaces.

It sounds like your solution in this case would be to create all icons we plan to use in a single place, then have all of our client workspaces retrieve the citrix_application_icon through the data source you plan to create.

Keeping this in mind it might make sense for the citrix_application_icon to have a name or other identifying feature that we can use to reference it other than the raw_data itself. For example, say we want to use one of the icons that are included by default- we would have no way to pick those since we don't have their raw_data to use in querying the data source. If possible, this would also mean that we could view the name in the Citrix DaaS UI so we could then pick the icon we are trying to query.

Thank you for taking a look at this!

[AlanCitrix]

I agree having a name would be nice. Unfortunately the backend does not support that, so the best we can do is match by raw_data for now. We will have to see what the performance is like when there are hundreds or thousands of icons.