The CustomResourceDefinition root status field is forbidden

[sambonbonne]

Please note this is not a duplicate of #158.

Terraform, Provider, Kubernetes versions

Terraform version: 1.0.0
Provider version: 0.5.0
Kubernetes version: 1.21.1

Affected Resource(s)

• kubernetes_manifest, applying a CustomResourceDefinition with a status block (not empty)

Terraform Configuration Files

See this first Gist: https://gist.github.com/sambonbonne/34f06f54c7d166f8ab446ece42680dcf.

Debug Output

See this second Gist: https://gist.github.com/sambonbonne/4657bec9cadbc73ac70eb2594303c008.

Steps to Reproduce

1. terraform init
2. terraform plan

Expected Behavior

The RabbitMQ CRD should be valide.

Actual Behavior

The status field of the RabbitMQ CRD is not accepted by the kubernetes-alpha provider:

╷
│ Error: Forbidden attribute key in "manifest" value
│
│   with module.kind_kubernetes.kubernetes_manifest.rabbitmq_resource_0,
│   on ../../common/kubernetes/resources.tf line 163, in resource "kubernetes_manifest" "rabbitmq_resource_0":
│  163: resource "kubernetes_manifest" "rabbitmq_resource_0" {
│
│ 'status' attribute key is not allowed in manifest configuration
╵

References

I'm installing the RabbitMQ cluster operator, in its 1.8.0 version. The YAML is valid and accepted by kubectl so no issue on their side.

Note their is an empty subresourecs.status block but I know this is a known issue (see #158). The issue is not on this field but on the root status field (line 4402 of the 1.8.0 manifest):

status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[sambonbonne]

My workaround for now: download the operator manually, edit it to remove the status field and use file() to import it (so the http provider is not used but the kubernetes-alpha can still be used with yamldecode()).

[alexsomesan]

The status field seems to be a read-only field from the user perspective. It makes little sense to pass this field to the API server. Do you have a specific use-case where you need to set something on "status" as a Terraform user?
I suspect clients like kubectl just filter this out transparently, but in Terraform we use the exact configuration supplied by the user and instead validate before applying and report an error.

[sambonbonne]

I thought for CRD it was a read-write field but in fact it was a stupid assumption on my side. The chart is the problem here.

Sorry for the inconvenience.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.