Describe the bug
Creating an elasticstack_kibana_alerting_rule resource fails because the rule returned by Kibana contains an additional tag that was not defined in the Terraform configuration:
Missing Universal Api Key
The rule is created successfully in Kibana, but Terraform reports an inconsistent result because the returned tags value differs from the configured value.
To Reproduce
Steps to reproduce the behavior:
Create an alerting rule with explicitly defined tags:
resource "elasticstack_kibana_alerting_rule" "alert" {
name = "<RULE_NAME>"
rule_type_id = "<RULE_TYPE_ID>"
consumer = "<CONSUMER>"
enabled = true
tags = [
"managed-by-terraform"
]
params = jsonencode({
# Rule parameters
})
}Execute:
terraform apply
The rule is created in Kibana, but Kibana returns an additional tag:
{
"tags": [
"managed-by-terraform",
"Missing Universal Api Key"
]
}Terraform fails because the value returned by the provider does not match the configured tags value:
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to
│ [...].module.alert.elasticstack_kibana_alerting_rule.main,
│ provider "provider["registry.terraform.io/elastic/elasticstack"]"
│ produced an unexpected new value: .tags: actual set element
│ cty.StringVal("Missing Universal Api Key") does not correlate with any
│ element in plan.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
Running terraform plan again also shows drift for the tags attribute.
Expected behavior
The alerting rule should be created with only the tags defined in the Terraform configuration.
If Missing Universal Api Key is server-managed metadata, the provider should handle it separately or prevent it from causing an inconsistent result for the user-managed tags attribute.
Ideally, the underlying API-key issue should also be returned as an explicit error rather than being added as a rule tag.
Versions (please complete the following information):
- OS: Linux
- Terraform Version 1.13.1
- Provider version 0.16.1
- Elasticsearch Version Serverless Security
Additional context
The additional tag appears to indicate that Kibana could not create or associate the API key required to execute the rule.
Adding the tag to the Terraform configuration is not a suitable workaround because it treats an operational error as desired configuration.
Using the following also hides legitimate tag drift:
lifecycle {
ignore_changes = [tags]
}
It is unclear whether the underlying issue is:
Kibana adding operational status information to the user-managed tags field
the provider failing to create or update the rule execution API key
the provider not accounting for server-managed tags in the API response
Describe the bug
Creating an elasticstack_kibana_alerting_rule resource fails because the rule returned by Kibana contains an additional tag that was not defined in the Terraform configuration:
The rule is created successfully in Kibana, but Terraform reports an inconsistent result because the returned tags value differs from the configured value.
To Reproduce
Steps to reproduce the behavior:
Create an alerting rule with explicitly defined tags:
Execute:
The rule is created in Kibana, but Kibana returns an additional tag:
{ "tags": [ "managed-by-terraform", "Missing Universal Api Key" ] }Terraform fails because the value returned by the provider does not match the configured tags value:
Running terraform plan again also shows drift for the tags attribute.
Expected behavior
The alerting rule should be created with only the tags defined in the Terraform configuration.
If Missing Universal Api Key is server-managed metadata, the provider should handle it separately or prevent it from causing an inconsistent result for the user-managed tags attribute.
Ideally, the underlying API-key issue should also be returned as an explicit error rather than being added as a rule tag.
Versions (please complete the following information):
Additional context
The additional tag appears to indicate that Kibana could not create or associate the API key required to execute the rule.
Adding the tag to the Terraform configuration is not a suitable workaround because it treats an operational error as desired configuration.
Using the following also hides legitimate tag drift:
It is unclear whether the underlying issue is:
Kibana adding operational status information to the user-managed tags field
the provider failing to create or update the rule execution API key
the provider not accounting for server-managed tags in the API response