.get can succeed and return empty result even when resource is missing

[lukehoban]

We saw an example of a Terraform Provider which returns empty results, but not an error, from Read even when the resource does not exist at all.

This leads to code like the following in Pulumi triggering very surprising behaviour - where the get succeeds, but the resulting object has empty values for all it's properties:

gcp.container.Cluster.get("mycluster", "mycluster", { name: "mycluster" })

This is using this TF provider: https://github.com/terraform-providers/terraform-provider-google/blob/e95fa4674ce86246965fcf659086cedbfc6d1417/google/resource_container_cluster.go#L710

It's not clear if this is a common or technically supported pattern for Terraform providers, but the resulting behaviour of Pulumi .get is more problematic than what is likely to be observable as a result of this - so this may be something we need to handle better.

[pgavlin]

Do you know if the return object had a non-empty id?

[lukehoban]

Do you know if the return object had a non-empty id?

Given that this was opened 9 months ago - I suspect someone will need to try to reproduce and investigate. I do believe I have seen/heard of other case of this sort of thing happening.

[lukehoban]

Simple repro:

import * as aws from "@pulumi/aws";
const role = aws.iam.Role.get("myrole", "abcdef");
export const roleArn = role.arn;

Results in a successful deployment with an undefined output. Among other things, this violates the TypeScript typing for the resource (they do not mark arn as | undefined).

Here's a small part of the debug logs:

    debug: IAM Role "abcdef" not found, removing from state
    debug: ReadResource RPC finished: resource:myrole[aws:iam/role:Role]#...; err: null, resp: urn:pulumi:dev::terraform262::aws:iam/role:Role::myrole,
    debug: RegisterResourceOutputs RPC prepared: urn=urn:pulumi:dev::terraform262::pulumi:pulumi:Stack::terraform262-dev
    debug: RegisterResourceOutputs RPC finished: urn=urn:pulumi:dev::terraform262::pulumi:pulumi:Stack::terraform262-dev; err: null, resp: 

This issue has led several users to second order failures where undefineds flow into unexpected places - such as pulumi/pulumi-eks#58.

[lukehoban]

In particular - this looks like it may be the key thing we are not handling correctly:

debug: IAM Role "abcdef" not found, removing from state

[lukehoban]

We believe the issue is that we are not checking the id in the Read RPC response from the NodeJS/Python SDKs. We should check it and fail if it is not set.

[pgavlin]

Closed by pulumi/pulumi#3123.