Closed KlausNie closed 1 year ago
Also seeing this issue, but it occurs on configurations that are for native keycloak providers as well.
Looking into this a bit further -
It looks like the ID keycloak generates is indeed an empty string (I'm using Postgres 13). The config is actually there and is linked by this empty string ""
ID, but terraform-provider-keycloak just assumes that the resource wasn't created. The very first apply actually creates this error:
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to keycloak_authentication_execution_config.post_login_session_limiter_config, provider "provider[\"registry.terraform.io/mrparkers/keycloak\"]" produced an unexpected new
│ value: Root resource was present, but now absent.
│
│ This is a bug in the provider, which should be reported in the provider's own issue tracker
Subsequent applies generate a 409 conflict due to the empty string ID already in use.
This empty ID is not created for resources created by the admin UI. The problem also isn't timing related as the empty ID still manifests when I create a Terraform plan that creates the config on an existing execution.
Here's where the regression occurred! https://github.com/keycloak/keycloak/pull/19466
Keycloak 21.1 now supports preserving execution config IDs during import. However, it doesn't include basic validation of the imported IDs (empty IDs are allowed). The representation sent by this provider currently includes an empty string "id": ""
in its JSON payload.
I'm not familiar with Go, but it looks like the fix might be to apply an omitempty
decorator to Id field in the struct definition?
@kherock awesome! That could really be all that is needed!
I know that this provider does not yet support keycloak with version
21.1.1
but only21.0.1
.This is something to be aware when supporting that version (21.1.1).
We migrated from
20.0.5
to21.1.1
. Then some terraform apply started to break. Specifically, those which were touchingkeycloak_authentication_execution_config
.This is what we are executing
It seems like, for some reason, when executing these terraform statements, keycloak does not create valid entries for
AUTHENTICATOR_CONFIG
in the database (we are using MySQL).The
ID
field seems to be an empty string, which then breaks once it tries to update/create a new one for the same authenticator config.Yes, we are using custom providers for this and that could also be the root cause for this error. Note that it was working with previous versions of Keycloak + the provider.
The last few lines of the terraform trace: