elastic / elastic/terraform-provider-elasticstack
[Bug] elasticstack_kibana_alerting_rule creation fails because Elastic adds an unexpected tag
- Dominant language
- Go
- Stars
- 209
- Forks
- 150
- Avg merge
- 22h 58m
- Merged PRs (30d)
- 172
Description
**Describe the bug**
Creating an elasticstack_kibana_alerting_rule resource fails because the rule returned by Kibana contains an additional tag that was not defined in the Terraform configuration:
> Missing Universal Api Key
The rule is created successfully in Kibana, but Terraform reports an inconsistent result because the returned tags value differs from the configured value.
**To Reproduce**
Steps to reproduce the behavior:
Create an alerting rule with explicitly defined tags:
```hcl
resource "elasticstack_kibana_alerting_rule" "alert" {
name = ""
rule_type_id = ""
consumer = ""
enabled = true
tags = [
"managed-by-terraform"
]
params = jsonencode({
# Rule parameters
})
}
```
Execute:
> terraform apply
The rule is created in Kibana, but Kibana returns an additional tag:
```hcl
{
"tags": [
"managed-by-terraform",
"Missing Universal Api Key"
]
}
```
Terraform fails because the value returned by the provider does not match the configured tags value:
> │ Error: Provider produced inconsistent result after apply
> │
> │ When applying changes to
> │ [...].module.alert.elasticstack_kibana_alerting_rule.main,
> │ provider "provider[\"registry.terraform.io/elastic/elasticstack\"]"
> │ produced an unexpected new value: .tags: actual set element
> │ cty.StringVal("Missing Universal Api Key") does not correlate with any
> │ element in plan.
> │
> │ This is a bug in the provider, which should be reported in the provider's
> │ own issue tracker.
Running terraform plan again also shows drift for the tags attribute.
**Expected behavior**
The alerting rule should be created with only the tags defined in the Terraform configuration.
If Missing Universal Api Key is server-managed metadata, the provider should handle it separately or prevent it from causing an inconsistent result for the user-managed tags attribute.
Ideally, the underlying API-key issue should also be returned as an explicit error rather than being added as a rule tag.
**Versions (please complete the following information):**
- OS: Linux
- Terraform Version 1.13.1
- Provider version 0.16.1
- Elasticsearch Version Serverless Security
**Additional context**
The additional tag appears to indicate that Kibana could not create or associate the API key required to execute the rule.
Adding the tag to the Terraform configuration is not a suitable workaround because it treats an operational error as desired configuration.
Using the following also hides legitimate tag drift:
>
> lifecycle {
> ignore_changes = [tags]
> }
>
It is unclear whether the underlying issue is:
Kibana adding operational status information to the user-managed tags field
the provider failing to create or update the rule execution API key
the provider not accounting for server-managed tags in the API response
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the failure with the elasticstack_kibana_alerting_rule resource and inspect its tag handling and Kibana API response. Determine whether “Missing Universal Api Key” is server-managed metadata or an API-key failure; done means Terraform no longer reports inconsistent user-managed tags and the underlying failure is surfaced explicitly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, terraform
- Domain
- backend, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100