Terraform validator got different results when validating plans generated after and before apply #366
Comments
|
Interesting - it's definitely not possible to validate that the plan should pass properly prior to apply, since the value of that field is unknown. However, it also shouldn't be possible to say that the plan should fail, for the same reason. Probably the ideal state would be to let it go through and issue some kind of warning that a field was unknown. This seems like something we'll run into more often and will need a generic solution for - and it's not going to be easy to implement. Marking as a persistent bug. |
melinath
added
persistent-bug
|
Please share the Terraform config used to generate this error. My understanding is that it actually isn't completely unknown—we're not retrieving info from the server—so we might be able to do something more intelligent here. |
|
Although the original terraform config would be useful, all the data we have access to (including an export of the original config) is present in the terraform plan. If we were going to do some kind of "smart thing" in this specific case, the data present here is enough. |
|
But it would be useful to have the original config for easy reproducibility. |
|
Hey folks, I've added a terraform code example on the issue. |
|
b/205617204 |
Community Note
Related Issues
Terraform Validator version
terraform-validator: v0.9.1
Affected Resource(s)
Terraform Plan JSON
Terraform plan before apply
Terraform plan after apply
Debug Output
Running terraform-validator before terraform apply
Running terraform-validator after terraform apply
Expected Behavior
Validate terraform plans generated before and after apply, should have the same results
Actual Behavior
When validating a terraform plan generated before apply, some constraints are violated, but if you apply terraform and generate a new plan, no violations are foung
Steps to Reproduce
Important Factoids
The CMEK keys are being created together with the buckets, so the plan does not know the CMEK key that is going to be used to encrypt the bucket.
Before the terraform apply, the plan does not contain the encryption value for the bucket being created in the property after.
But is possible to see the after_unknow property with encryption value:
References
The text was updated successfully, but these errors were encountered: