"Conflicting configuration arguments" when importing project

[qerub]

What happened?

If I create a GitLab project outside of Pulumi and then try to import it with

import * as pulumi_gitlab from "@pulumi/gitlab";
new pulumi_gitlab.Project("import_test", {}, {import: "qerub/import_test", ignoreChanges: ["containerExpirationPolicy"]});

the following (stopping/blocking) errors occur during preview:

error: gitlab:index/project:Project resource 'import_test' has a problem: Conflicting configuration arguments: "container_expiration_policy.0.name_regex": conflicts with container_expiration_policy.0.name_regex_delete. Examine values at 'Project.ContainerExpirationPolicy.NameRegex'.
error: gitlab:index/project:Project resource 'import_test' has a problem: Conflicting configuration arguments: "container_expiration_policy.0.name_regex_delete": conflicts with container_expiration_policy.0.name_regex. Examine values at 'Project.ContainerExpirationPolicy.NameRegexDelete'.
error: Preview failed: one or more inputs failed to validate
error: preview failed

The ignoreChanges might look contrived but this is a reduced test case.

Expected Behavior

Expected behavior is to not get any errors about container expiration policy.

Steps to reproduce

See above.

Output of pulumi about

CLI
Version 3.70.0
Go Version go1.20.4
Go Compiler gc

Plugins
NAME VERSION
gitlab 6.0.0
nodejs unknown

Host
OS fedora
Version 37
Arch x86_64

This project is written in nodejs: executable='/usr/bin/node' version='v18.16.0'

Current Stack: dev

TYPE URN
pulumi:pulumi:Stack urn:pulumi:dev::pulum::pulumi:pulumi:Stack::pulum-dev
pulumi:providers:gitlab urn:pulumi:dev::pulum::pulumi:providers:gitlab::default_6_0_0
gitlab:index/project:Project urn:pulumi:dev::pulum::gitlab:index/project:Project::example

Found no pending operations associated with dev

Backend
Name redacted
URL file:///redacted/.pulumi
User vagrant
Organizations

Dependencies:
NAME VERSION
@pulumi/gitlab 6.0.0
@pulumi/pulumi 3.72.0
@types/node 16.18.36

Pulumi locates its logs in /tmp by default

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[t0yv0]

Thank you for reporting this issue @qerub

I've filed pulumi/pulumi-terraform-bridge#1225 to investigate further as it seems like the problem could be affecting many bridged providers.

Trying to think of possible workarounds. Could you try Pulumi import command as noted in https://www.pulumi.com/docs/using-pulumi/adopting-pulumi/import/ as an alternative way to import the resource?

[qerub]

I worked around this issue for us by changing our import strategy to not have the offending field (containerExpirationPolicy) in ignoreChanges which in some ways made more sense anyway.

Here's how the import command behaves in this scenario:

$ pulumi import gitlab:index/project:Project import_test_2 qerub/import_test_2
...
Diagnostics:
  gitlab:index:Project (import_test_2):
    warning: urn:pulumi:dev::pulum::gitlab:index/project:Project::import_test_2 verification warning: Use `container_registry_access_level` instead.
    warning: urn:pulumi:dev::pulum::gitlab:index/project:Project::import_test_2 verification warning: Deprecated in favor of `builds_access_level`
    warning: One or more imported inputs failed to validate. This is almost certainly a bug in the `gitlab` provider. The import will still proceed, but you will need to edit the generated code after copying it into your program.
    warning: gitlab:index/project:Project resource 'import_test_2' has a problem: Conflicting configuration arguments: "container_expiration_policy.0.name_regex": conflicts with container_expiration_policy.0.name_regex_delete. Examine values at 'Project.ContainerExpirationPolicy.NameRegex'.
    warning: gitlab:index/project:Project resource 'import_test_2' has a problem: Conflicting configuration arguments: "container_expiration_policy.0.name_regex_delete": conflicts with container_expiration_policy.0.name_regex. Examine values at 'Project.ContainerExpirationPolicy.NameRegexDelete'.
...
Please copy the following code into your Pulumi application. Not doing so
will cause Pulumi to report that an update will happen on the next update command.
...
const import_test_2 = new gitlab.Project("import_test_2", {
...
    containerExpirationPolicy: {
        cadence: "1d",
        keepN: 10,
        nameRegex: ".*",
        nameRegexDelete: ".*",
        olderThan: "90d",
    },
...

I leave it up to you to decide whether the Pulumi GitLab Provider or Terraform Bridge has any blame in this or whether it's just GitLab and its Terraform Provider handling the fields nameRegex and nameRegexDelete in a poor way.

[t0yv0]

Thanks so much for that comment, the fact that there is a workaround is very good to know. I believe there is indeed room for improvement in the Terraform Bridge made evident here. I'll leave the issue in the backlog for now and we will address it when we have capacity.

[t0yv0]

Still reproduces on 6.7.0 unfortunately.

[t0yv0]

import * as pulumi from "@pulumi/pulumi";
import * as pulumi_gitlab from "@pulumi/gitlab";


const proj = new pulumi_gitlab.Project("import_test", {});

const proj2 = new pulumi_gitlab.Project("import_test_2", {},
                                        {import: "pulumi/import_test-834ee8d"});

export const projId = proj.id;
export const projName = proj.name;

This succeeds now without any issues for me.

Stack:

CLI          
Version      3.117.0
Go Version   go1.22.3
Go Compiler  gc

Plugins
KIND      NAME    VERSION
resource  gitlab  8.0.1
language  nodejs  unknown

Host     
OS       darwin
Version  14.5
Arch     arm64

This project is written in nodejs: executable='/Users/anton/bin/node' version='v18.18.2'

Current Stack: anton-pulumi-corp/gitlab-293/dev

TYPE                          URN
pulumi:pulumi:Stack           urn:pulumi:dev::gitlab-293::pulumi:pulumi:Stack::gitlab-293-dev
pulumi:providers:gitlab       urn:pulumi:dev::gitlab-293::pulumi:providers:gitlab::default_8_0_1
gitlab:index/project:Project  urn:pulumi:dev::gitlab-293::gitlab:index/project:Project::import_test
gitlab:index/project:Project  urn:pulumi:dev::gitlab-293::gitlab:index/project:Project::import_test_2


Found no pending operations associated with dev

Backend        
Name           pulumi.com
URL            https://app.pulumi.com/anton-pulumi-corp
User           anton-pulumi-corp
Organizations  anton-pulumi-corp, moolumi, pulumi
Token type     personal

Dependencies:
NAME            VERSION
@pulumi/gitlab  8.0.1
@pulumi/pulumi  3.120.0
@types/node     18.19.34
typescript      5.4.5

Pulumi locates its logs in /var/folders/gd/3ncjb1lj5ljgk8xl5ssn_gvc0000gn/T/com.apple.shortcuts.mac-helper// by default

I believe that the fix we deployed in pulumi-tetrraform-bridge to disambiguate Read results to avoid conflicts should fix the problem here. Closing for now but please open issues if something is still not working as you expect.