使用Terraform部署RabbitMQ集群Secret时遇Provider结果不一致错误

错误信息 #

╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to kubernetes_manifest.default_user_config, provider
│ "provider[\"registry.opentofu.org/hashicorp/kubernetes\"]" produced an
│ unexpected new value: .object.stringData: was
│ cty.MapVal(map[string]cty.Value{"default_user.conf":cty.StringVal("default_user
│ = user\ndefault_pass = password\n")}), but now null.
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.

对应的资源代码 #

resource "kubernetes_manifest" "default_user_config" {
  manifest = yamldecode(<<EOF
apiVersion: v1
kind: Secret
metadata:
  name: "default-user-config"
  namespace: ${var.namespace}
type: Opaque
stringData:
  default_user.conf: |
    default_user = user
    default_pass = password
  # host: dmF1bHQtZGVmYXVsdC11c2VyLmRlZmF1bHQuc3Zj
  # username: my-admin
  # password: super-secure-password
  # port: "5672"
  # provider: rabbitmq
  # type: rabbitmq
EOF
  )
}

解决方案 #

这个问题的核心是Kubernetes API对Secret的处理逻辑：当你提交stringData时，Kubernetes会自动将其编码为base64并存储在data字段中，不会保留stringData。而Terraform的kubernetes_manifest资源在同步集群状态时，只能获取到data字段，导致本地配置的stringData和集群返回的状态不一致，触发报错。

解决方式有两种：

方式一：手动替换为data字段并编码内容 #

将原代码中的stringData替换为data，并把default_user.conf的内容提前做base64编码：

resource "kubernetes_manifest" "default_user_config" {
  manifest = yamldecode(<<EOF
apiVersion: v1
kind: Secret
metadata:
  name: "default-user-config"
  namespace: ${var.namespace}
type: Opaque
data:
  default_user.conf: "ZGVmYXVsdF91c2VyID0gdXNlcgpkZWZhdWx0X3Bhc3MgPSBwYXNzd29yZAo="
EOF
  )
}

方式二：用Terraform函数动态编码 #

使用base64encode函数自动处理编码，更灵活且避免手动编码出错：

resource "kubernetes_manifest" "default_user_config" {
  manifest = {
    apiVersion = "v1"
    kind       = "Secret"
    metadata = {
      name      = "default-user-config"
      namespace = var.namespace
    }
    type = "Opaque"
    data = {
      "default_user.conf" = base64encode("default_user = user\ndefault_pass = password\n")
    }
  }
}

两种方式都能让本地配置的字段和集群返回的状态保持一致，解决Provider不一致的错误。

内容的提问来源于stack exchange，提问作者Estifanos Bireda