Provider produced inconsistent final plan for azuredevops_serviceendpoint_kubernetes

[allenvino1]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and Azure DevOps Provider) Version

Affected Resource(s)

• azuredevops_serviceendpoint_kubernetes

Terraform Configuration Files

resource "azuredevops_serviceendpoint_kubernetes" "kubernetes_service_account" {
  project_id            = var.azure_devops_project
  service_endpoint_name = "${var.team_name}-${var.environment_name}-gke"
  apiserver_url         = "https://${google_container_cluster.primary.endpoint}"
  authorization_type    = "ServiceAccount"

  service_account {
    token   = data.kubernetes_secret.azure_devops_integration.binary_data["token"]
    ca_cert = data.kubernetes_secret.azure_devops_integration.binary_data["ca.crt"]
  }
}

Debug Output

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

1. terraform apply

Important Factoids

Note

1. Im trying to do GKE + creating azure devops service connection.
2. When I applied the second time it pushed thru maybe because the gke cluster is established already.
3. Seems like the handling of the provider seems broken with dynamic values from other terraform resources. I tried hardcoding values it works.

References

• #0000

[xuzhang3]

Hi @spacejam101 I cannot reproduce this error. Which Terraform version and provider version are you use? This seems like https://github.com/hashicorp/terraform/issues/20517

[allenvino1]

Hello @xuzhang3. I'm using terraform v1.0.3. This my provider versions:

[allenvino1]

Is there anyway I can help inorder for you to solve this? @xuzhang3

[xuzhang3]

@spacejam101 You should mask the cert and tokens.

[xuzhang3]

Hi @spacejam101 what's the output of terraform plan. Will token and cert changed during the terraform apply, the real value will changed by GKE?

[allenvino1]

I'm afraid my flow does not use static token and cert. I would like it to be on the fly.

The flow would be GKE is created and then I do a secret lookup on the serviceaccount to be passed to azure devops.

Plan output:

[xuzhang3]

@spacejam101 I create a new aks cluster and use kubernetes_secret to get the credentials, all resource can be created without error.

[allenvino1]

Interesting. Sorry im new to terraform. Not sure how to debug this one. Uhmm Maybe try it with GKE cluster?

[korenlev]

same issue here (tipalti.com)