elastic / elastic/terraform-provider-elasticstack
[Bug]elasticstack_kibana_action_connector (.webhook OAuth2): Provider produced inconsistent result after apply although connector is created successfully
- Dominant language
- Go
- Stars
- 209
- Forks
- 150
- Avg merge
- 23h 11m
- Merged PRs (30d)
- 169
Description
## Describe the bug
When creating a `.webhook` action connector configured with OAuth2 Client Credentials authentication, `terraform apply` fails with:
```text
Error: Provider produced inconsistent result after apply
```
However, the connector is successfully created in Kibana and is visible in **Stack Management → Connectors**.
The issue appears to be caused by a mismatch between the configuration sent during creation and the configuration returned by Kibana after the connector is created.
## To Reproduce
1. Use a Terraform configuration similar to:
Example configuration:
### Terraform configuration
```hcl
resource "elasticstack_kibana_action_connector" "webhook" {
name = "example-oauth2-webhook"
connector_type_id = ".webhook"
config = jsonencode({
url = "https://api.example.com/v1/alerts"
method = "post"
hasAuth = true
authType = "webhook-oauth2-client-credentials"
accessTokenUrl = "https://auth.example.com/oauth/token"
clientId = "example-client-id"
scope = "example-scope"
headers = {
"Content-Type" = "application/json"
"api_key" = "fake-api-key-for-validation"
}
})
secrets = jsonencode({
clientSecret = "fake-client-secret-for-validation"
})
}
```
This configuration is representative of the resource generated by our Terraform module. All URLs, client IDs, API keys, scopes, and secrets have been sanitized.
2. Run:
```bash
terraform apply
```
3. Observe the error:
```text
Error: Provider produced inconsistent result after apply
When applying changes to
elasticstack_kibana_action_connector.webhook,
provider "registry.terraform.io/elastic/elasticstack"
produced an unexpected new value:
.config: was
{"accessTokenUrl":"https:///oauth/token",
"authType":"webhook-oauth2-client-credentials",
"clientId":"",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"scope":"",
"url":"https:///alerts"}
but now
{"__tf_provider_context":".webhook",
"authType":"webhook-oauth2-client-credentials",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"url":"https:///alerts"}
```
Despite the error, the connector is successfully created in Kibana.
## Expected behavior
`terraform apply` should complete successfully and the provider should reconcile state correctly.
The provider should either:
- Normalize the response returned by Kibana before state comparison, or
- Ignore fields that Kibana intentionally does not return after creation, or
- Persist the returned values into state without reporting an inconsistent result.
## Debug output
Relevant error output:
```text
.config: was
{"accessTokenUrl":"https:///oauth/token",
"authType":"webhook-oauth2-client-credentials",
"clientId":"",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"scope":"",
"url":"https:///alerts"}
but now
{"__tf_provider_context":".webhook",
"authType":"webhook-oauth2-client-credentials",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"url":"https:///alerts"}
```
Notably, the following fields are present in the submitted configuration but missing in the returned state:
```json
{
"accessTokenUrl": "...",
"clientId": "...",
"scope": "..."
}
```
Additionally, Kibana returns:
```json
{
"__tf_provider_context": ".webhook"
}
```
which was not present in the original configuration.
## Screenshots
Not applicable.
## Versions (please complete the following information)
- OS: Linux
- Terraform Version: 1.x
- Provider version: v0.14.5
- Kibana Version: 9.3.3
- Elasticsearch Version: 9.3.3
## Additional context
The issue appears specific to OAuth2-enabled webhook connectors using:
```json
{
"authType": "webhook-oauth2-client-credentials"
}
```
The connector is successfully created and functions correctly in Kibana, suggesting the issue is related to provider state reconciliation rather than connector creation.
From the Kibana UI and connector listing APIs, the OAuth2 configuration appears to be stored successfully, but the provider receives a different configuration payload after creation and reports an inconsistent result.
This may indicate that the provider needs special handling for OAuth2 webhook connector fields that are omitted or transformed by Kibana after connector creation.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the elasticstack_kibana_action_connector resource implementation and its create, read, and state-reconciliation paths. Reproduce the OAuth2 .webhook configuration from the issue, then trace how Kibana's omitted fields and __tf_provider_context are handled; done means terraform apply completes without an inconsistent-result error and subsequent state remains stable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, terraform
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100