Provider produced inconsistent result after apply

[Tarasovych]

Terraform Version, Provider Version and Kubernetes Version

Terraform version: v0.15.5
Kubernetes provider version: v2.4.1
Kubernetes version: 1.21 (EKS)

Affected Resource(s)

kubernetes_manifest

Terraform Configuration Files

resource "kubernetes_namespace" "actions-runner-system" {
  metadata {
    name = "actions-runner-system"
  }
}

resource "kubernetes_manifest" "runner-deployment" {
  provider = kubernetes

  manifest = {
    apiVersion = "actions.summerwind.dev/v1alpha1"
    kind       = "RunnerDeployment"
    metadata = {
      name      = "self-hosted-runner"
      namespace = kubernetes_namespace.actions-runner-system.id
    }
    spec = {
      replicas = 1
      template = {
        spec = {
          nodeSelector = {
            purpose = "ci"
          }
          tolerations = [
            {
              effect   = "NoSchedule"
              key      = "purpose"
              operator = "Exists"
            }
          ]
          organization = "my-github-org"
          env          = [] // <-- this caused an error
        }
      }
    }
  }
}

Debug Output

Steps to Reproduce

1. terraform apply

Expected Behavior

Resource is created without errors

Actual Behavior

Resource is created with following error:

kubernetes_manifest.runner-deployment: Creating...
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to kubernetes_manifest.runner-deployment, provider
│ "provider[\"registry.terraform.io/hashicorp/kubernetes\"]" produced an
│ unexpected new value: .object.spec.template.spec.env: was
│ cty.ListValEmpty(cty.Object(map[string]cty.Type{"name":cty.String,
│ "value":cty.String,
│ "valueFrom":cty.Object(map[string]cty.Type{"configMapKeyRef":cty.Object(map[string]cty.Type{"key":cty.String,
│ "name":cty.String, "optional":cty.Bool}),
│ "fieldRef":cty.Object(map[string]cty.Type{"apiVersion":cty.String,
│ "fieldPath":cty.String}),
│ "resourceFieldRef":cty.Object(map[string]cty.Type{"containerName":cty.String,
│ "divisor":cty.DynamicPseudoType, "resource":cty.String}),
│ "secretKeyRef":cty.Object(map[string]cty.Type{"key":cty.String,
│ "name":cty.String, "optional":cty.Bool})})})), but now null.
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵

Important Factoids

Error was gone after I removed env = []

References

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[dmikalova]

I got the same issue trying to create a Tekton task with the following config:

resource "kubernetes_manifest" "task_echo_hello_world" {
  manifest = {
    apiVersion = "tekton.dev/v1alpha1"
    kind       = "Task"
    metadata = {
      name      = "echo-hello-world"
      namespace = "default"
    }
    spec = {
      steps = [
        {
          args = [
            "HelloWorld",
          ]
          command = [
            "echo",
          ]
          image = "ubuntu"
          name  = "echo"
        },
      ]
    }
  }
}

If I do a plan after this error, Terraform shows a diff on the tainted manifest with an empty resources block in the step. Adding resources = {} to the config above fixes the issue. It seems like Kubernetes is automatically filling that in based on the CRD and that is tripping up Terraform.

[Tarasovych]

Still an issue

$ terraform version
Terraform v1.2.7
on linux_amd64
+ provider registry.terraform.io/hashicorp/aws v4.30.0
+ provider registry.terraform.io/hashicorp/helm v2.6.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.7.1

$ terragrunt --version
terragrunt version v0.38.7

[github-actions[bot]]

Marking this issue as stale due to inactivity. If this issue receives no comments in the next 30 days it will automatically be closed. If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. This helps our maintainers find and focus on the active issues. Maintainers may also remove the stale label at their discretion. Thank you!