hashicorp / hashicorp/terraform-plugin-sdk

ConflictsWith deprecation warning

Open
#727 2 comments 1 reaction 0 assignees View on GitHub
enhancement terraform-plugin-framework
Dominant language
Go
Stars
485
Forks
244
Avg merge
19h 57m
Merged PRs (30d)
4

Description

### SDK version

```
github.com/hashicorp/terraform-plugin-sdk/v2 v2.4.4
```

### Use-cases

**Summary:**

Warn users prior to the breaking change of enabling ConflictsWith on provider configuration attributes.

**Details:**

In the Kubernetes and Helm providers, we're currently considering enabling `ConflictsWith` on some [mutually-exclusive authentication options](https://github.com/hashicorp/terraform-provider-kubernetes/pull/1141) in the provider config. However, to do so would be a breaking change, since the provider has supported setting multiple authentication methods since it was first created.

In the past, the provider would intake all configuration options (even ones that cannot be used together) and it would assemble a Kubernetes client config from it. The actual options being used to authenticate to a cluster could be much different from what the user expects, and there was a fairly widespread problem of users accidentally connecting to the wrong cluster. To mitigate this, we want to make the configuration process more straightforward and explicit, so that users know exactly which of their options are actually being used.

### Attempted Solutions

As far as I could tell, the only way to send a warning to users (without using debug logging) would be to use the `Deprecated` field on the schema attribute. I tried this, but I couldn't find a way to conditionally set `Deprecated`, since I only want to warn them when multiple options are used together (simulating ConflictsWith, but with a deprecation warning instead of a fatal error).

### Proposal

I want to be careful not to disrupt the users' CI pipelines that would come to a halt if I were to enable ConflictsWith without warning. My proposal is to create a new field that we could set on the schema, similar to Deprecated, where we could give it a warning string and also pass in the names of the conflicting attributes.

```
"client_key": {
Type: schema.TypeString,
Optional: true,
Description: "PEM-encoded client certificate key for TLS authentication.",
Type: schema.TypeString,
Optional: true,
DefaultFunc: schema.EnvDefaultFunc("KUBE_CLIENT_KEY_DATA", nil),
ConflictsWithWarning: "`client_key` is incompatible with one or more of the configured options. The provider will choose one and continue, but this feature will be removed in a future version. Please update your configuration to choose only one of the following:", []string{"config_path", "config_paths", "username", "password", "exec", "insecure"},
},
```

### References

- https://github.com/hashicorp/terraform-provider-kubernetes/pull/1141

Contributor guide

Open the contributing guide

Research direction

No file or test is named in the issue. Start by locating the SDK schema handling for Deprecated and ConflictsWith, then trace how provider configuration warnings are emitted. Done means a schema-level warning can identify conflicting attributes, warn only when multiple options are configured, and preserve the existing non-fatal behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, terraform
Domain
devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.