Terraform does not detect change when setting property in kubernetes_secret to emtpty string

[rychuhardy]

Terraform Version, Provider Version and Kubernetes Version

Terraform version: v1.2.6
Kubernetes provider version: v2.12.1
Kubernetes version: 1.22.6

Affected Resource(s)

• kubernetes_secret

Terraform Configuration Files

terraform {
  required_providers {
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "~> 2.12.1"
    }
  }
}

provider "kubernetes" {
  config_context = "test-k8s-admin"
  config_path = "~/.kube/config"
}

variable "DB_PASSWORD" {
  
}

resource "kubernetes_secret" "db_secret" {
  metadata {
    name = "db-secret"
  }

  data = {
    "PASSWORD" = var.DB_PASSWORD
  }
}

Debug Output

https://gist.github.com/rychuhardy/76f5b5fc41374dbf7f9279c327fa1fa4

Steps to Reproduce

1. terraform init
2. export TF_VAR_DB_PASSWORD="abc"
3. terraform apply -auto-approve
4. export TF_VAR_DB_PASSWORD=""
5. terraform plan

Expected Behavior

Change to kubernetes_secret should be detected.

Actual Behavior

No changes. Your infrastructure matches the configuration.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[arybolovlev]

Hi @rychuhardy,

Thank you for reporting this issue. That happens but to the following issue with the Terraform SDK: https://github.com/hashicorp/terraform-plugin-sdk/issues/282

Unfortunately, there is not much we can do at the moment until the SDK team address the issue.

[github-actions[bot]]

Marking this issue as stale due to inactivity. If this issue receives no comments in the next 30 days it will automatically be closed. If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. This helps our maintainers find and focus on the active issues. Maintainers may also remove the stale label at their discretion. Thank you!