On kubernetes_manifest, the returned object field content is not updated after the wait completion

[alexandrst88]

Terraform Version, Provider Version and Kubernetes Version

Terraform version: v1.3.4
Kubernetes provider version: v2.16.1
Kubernetes version:  v1.25.4

Affected Resource(s)

kubernetes_manifest

Steps to Reproduce

terraform apply

Terraform Configuration Files

resource "kubernetes_manifest" "example" {

  field_manager {
    force_conflicts = true
  }

  manifest = {
    apiVersion = "v1"
    kind       = "Service"
    metadata = {
      annotations = {
        "cloud.google.com/neg" = "{\"exposed_ports\": {\"3100\":{}}}"
      }
      labels = {
        "foo" = "bar"
      }
      name      = "example"
      namespace = "example"
    }
    spec = {
      ports = [
        {
          name       = "http"
          port       = 3100
          protocol   = "TCP"
          targetPort = 3100
        },
      ]
      selector = {
        "foo" = "bar"
      }
      type = "NodePort"
    }
  }
  wait {
    fields = {
      "metadata.annotations[\"cloud.google.com/neg-status\"]" = ".*3100.*",
    }
  }
}

neg_name = jsondecode(kubernetes_manifest.example.object.metadata.annotations["cloud.google.com/neg-status"]).network_endpoint_groups.3100

Debug Output

│ Error: Invalid index
│
│   on locals.tf line 41, in locals:
│   41:   neg_name = jsondecode(kubernetes_manifest.example.object.metadata.annotations["cloud.google.com/neg-status"])
│     ├────────────────
│     │ kubernetes_manifest.example.object.metadata.annotations is map of string with 1 element
│
│ The given key does not identify an element in this collection value.

Expected Behavior

The cloud.google.com/neg-status should be present as attribute in the neg_name variables, but seems like it didn't check actuall value.

References

- GH-1234 issue reports the same bug, but it was closed due unactivity.

[arybolovlev]

Hi @alexandrst88,

This issue happens because the provider works with the object that the Kubernetes cluster returns after creation and doesn't update the object(request a newer version) once the conditions are met. Because of that the initial object(the one that the provider receives right after the create call) ends up in the TF state. This object doesn't have the annotation you are looking for in the wait block. As a result, Terraform fails to find it.

I am working on the solution and hope that it will be accepted and available in the upcoming release.

Thank you for reporting this issue.