elastic / elastic/terraform-provider-elasticstack

[Bug]elasticstack_kibana_action_connector (.webhook OAuth2): Provider produced inconsistent result after apply although connector is created successfully

Open
#3,773 4 comments 0 reactions 0 assignees View on GitHub
bug needs-reproduction phase-research triaged
Dominant language
Go
Stars
209
Forks
150
Avg merge
23h 11m
Merged PRs (30d)
169

Description

## Describe the bug

When creating a `.webhook` action connector configured with OAuth2 Client Credentials authentication, `terraform apply` fails with:

```text
Error: Provider produced inconsistent result after apply
```

However, the connector is successfully created in Kibana and is visible in **Stack Management → Connectors**.

The issue appears to be caused by a mismatch between the configuration sent during creation and the configuration returned by Kibana after the connector is created.

## To Reproduce

1. Use a Terraform configuration similar to:

Example configuration:

### Terraform configuration

```hcl
resource "elasticstack_kibana_action_connector" "webhook" {
name = "example-oauth2-webhook"
connector_type_id = ".webhook"

config = jsonencode({
url = "https://api.example.com/v1/alerts"
method = "post"
hasAuth = true
authType = "webhook-oauth2-client-credentials"
accessTokenUrl = "https://auth.example.com/oauth/token"
clientId = "example-client-id"
scope = "example-scope"

headers = {
"Content-Type" = "application/json"
"api_key" = "fake-api-key-for-validation"
}
})

secrets = jsonencode({
clientSecret = "fake-client-secret-for-validation"
})
}
```

This configuration is representative of the resource generated by our Terraform module. All URLs, client IDs, API keys, scopes, and secrets have been sanitized.

2. Run:

```bash
terraform apply
```

3. Observe the error:

```text
Error: Provider produced inconsistent result after apply

When applying changes to
elasticstack_kibana_action_connector.webhook,

provider "registry.terraform.io/elastic/elasticstack"
produced an unexpected new value:

.config: was

{"accessTokenUrl":"https:///oauth/token",
"authType":"webhook-oauth2-client-credentials",
"clientId":"",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"scope":"",
"url":"https:///alerts"}

but now

{"__tf_provider_context":".webhook",
"authType":"webhook-oauth2-client-credentials",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"url":"https:///alerts"}
```

Despite the error, the connector is successfully created in Kibana.

## Expected behavior

`terraform apply` should complete successfully and the provider should reconcile state correctly.

The provider should either:

- Normalize the response returned by Kibana before state comparison, or
- Ignore fields that Kibana intentionally does not return after creation, or
- Persist the returned values into state without reporting an inconsistent result.

## Debug output

Relevant error output:

```text
.config: was

{"accessTokenUrl":"https:///oauth/token",
"authType":"webhook-oauth2-client-credentials",
"clientId":"",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"scope":"",
"url":"https:///alerts"}

but now

{"__tf_provider_context":".webhook",
"authType":"webhook-oauth2-client-credentials",
"hasAuth":true,
"headers":{
"Content-Type":"application/json",
"api_key":""
},
"method":"post",
"url":"https:///alerts"}
```

Notably, the following fields are present in the submitted configuration but missing in the returned state:

```json
{
"accessTokenUrl": "...",
"clientId": "...",
"scope": "..."
}
```

Additionally, Kibana returns:

```json
{
"__tf_provider_context": ".webhook"
}
```

which was not present in the original configuration.

## Screenshots

Not applicable.

## Versions (please complete the following information)

- OS: Linux
- Terraform Version: 1.x
- Provider version: v0.14.5
- Kibana Version: 9.3.3
- Elasticsearch Version: 9.3.3

## Additional context

The issue appears specific to OAuth2-enabled webhook connectors using:

```json
{
"authType": "webhook-oauth2-client-credentials"
}
```

The connector is successfully created and functions correctly in Kibana, suggesting the issue is related to provider state reconciliation rather than connector creation.

From the Kibana UI and connector listing APIs, the OAuth2 configuration appears to be stored successfully, but the provider receives a different configuration payload after creation and reports an inconsistent result.

This may indicate that the provider needs special handling for OAuth2 webhook connector fields that are omitted or transformed by Kibana after connector creation.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the elasticstack_kibana_action_connector resource implementation and its create, read, and state-reconciliation paths. Reproduce the OAuth2 .webhook configuration from the issue, then trace how Kibana's omitted fields and __tf_provider_context are handled; done means terraform apply completes without an inconsistent-result error and subsequent state remains stable.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, terraform
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.