Deploying CRD using terraform causes the error Forbidden attribute key in "manifest" value

[Lexmark-jrichey]

An error occurs when attempting to install the file sloth.slok.dev_prometheusservicelevels.yaml using terraform and the kubernetes provider (kubernetes_manifest resource). Reproduced using hashicorp/kubernetes v2.7.1 and Terraform v1.0.11

 Error: Forbidden attribute key in "manifest" value

    with kubernetes_manifest.sloth_crd,
    on sloth.tf line 16, in resource "kubernetes_manifest" "sloth_crd":
    16: resource "kubernetes_manifest" "sloth_crd" {

   'status' attribute key is not allowed in manifest configuration

example terraform:

resource "kubernetes_manifest" "sloth_crd" {
  provider = kubernetes

  manifest = yamldecode(file("sloth.slok.dev_prometheusservicelevels.yaml"))
}

Using the sloth CRD to install the sloth operator via terraform generates an error due to the unexpected .status element at the root level.

As mentioned in the kubernetes-alpha provider repo here "..the status field seems to be a read-only field from the user perspective. It makes little sense to pass this field to the API server ..in Terraform we use the exact configuration supplied by the user and instead validate before applying and report an error."

The workaround is to remove the .status properties (and sub-elements) from the CRD yaml file.

[slok]

Hi @Lexmark-jrichey

The CRDs are autogenerated with official Kubernetes tooling (https://github.com/kubernetes/code-generator). As you may see in these examples of official and very common deployed stacks, also have it:

• https://github.com/aws/eks-charts/blob/a78f6372c9739ed4a2472ee2eeba4cb8810a0a93/stable/aws-load-balancer-controller/crds/crds.yaml#L469
• https://github.com/prometheus-operator/kube-prometheus/blob/9b532dac0c8b00e984d2f77b2f2f0ef0dae6e751/manifests/setup/0prometheusCustomResourceDefinition.yaml#L8128
• https://github.com/kubernetes-sigs/application/blob/c8e2959e57a02b3877b394984a288f9178977d8b/deploy/kube-app-manager-aio.yaml#L537
• https://github.com/aws/amazon-vpc-cni-k8s/blob/235567459fa3b4d9e051eef418dbe349994c1a94/config/master/calico-operator.yaml#L174
• https://github.com/kubernetes-csi/external-snapshotter/blob/d74ae665fde0502c32135a879ce4549d029be1ee/client/config/crd/snapshot.storage.k8s.io_volumesnapshots.yaml#L228

I'm not saying that is ok, however, ignoring status it's a minor thing, that doesn't hurt anyone and reduces complexity on all sides, even, other official tools like kubectl/apiserver are already doing it.

So... IMHO, this is a problem on terraform side: hashicorp/terraform-provider-kubernetes#1428