Provider crash when converting tftypes.String to tftypes.DynamicPseudoType

[Jamesits]

Terraform Version, Provider Version and Kubernetes Version

Terraform v1.10.2
on linux_amd64
+ provider registry.terraform.io/hashicorp/helm v2.17.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.35.1

Affected Resource(s)

• kubernetes_manifest

Terraform Configuration Files

resource "kubernetes_manifest" "vmservicescrape-default" {
  manifest = {
    apiVersion = "operator.victoriametrics.com/v1beta1"
    kind       = "VMServiceScrape"

    metadata = {
      "name"      = "default"
      "namespace" = data.kubernetes_namespace_v1.victoria-metrics.metadata[0].name
    }

    spec = {
      "discoveryRole" = "endpoints"
      "jobLabel"      = "app.kubernetes.io/name"
      "endpoints" = [{
        "port" = "metrics"
        "relabelConfigs" = [
          {
            "sourceLabels" = ["__meta_kubernetes_service_annotation_prometheus_io_scrape"]
            "action"       = "keep"
            "regex"        = "true"
          },
          {
            "sourceLabels" = ["__meta_kubernetes_service_annotation_prometheus_io_scheme"]
            "action"       = "replace"
            "targetLabel"  = "__scheme__"
            "regex"        = "(https?)"
          },
          {
            "sourceLabels" = ["__meta_kubernetes_service_annotation_prometheus_io_path"]
            "action"       = "replace"
            "targetLabel"  = "__metrics_path__"
            "regex"        = "(.+)"
          },
          {
            "sourceLabels" = [
              "__address__",
              "__meta_kubernetes_service_annotation_prometheus_io_port",
            ]
            "action"      = "replace"
            "targetLabel" = "__address__"
            "regex"       = "([^:]+)(?::\\d+)?;(\\d+)"
            "replacement" = "$1:$2"
          },
        ]
      }]
      "namespaceSelector" = { "any" = true }
      "selector"          = {}
    }
  }
}

Debug Output

Panic Output

TL; DR trying to convert tftypes.String to tftypes.DynamicPseudoType

Stack trace from the terraform-provider-kubernetes_v2.35.1_x5 plugin:

panic: ElementKeyInt(0): can't use tftypes.Object["attach_metadata":tftypes.Object["node":tftypes.Bool], "authorization":tftypes.Object["credentials":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "credentialsFile":tftypes.String, "type":tftypes.String], "basicAuth":tftypes.Object["password":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "password_file":tftypes.String, "username":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "bearerTokenFile":tftypes.String, "bearerTokenSecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "follow_redirects":tftypes.Bool, "honorLabels":tftypes.Bool, "honorTimestamps":tftypes.Bool, "interval":tftypes.String, "max_scrape_size":tftypes.String, "metricRelabelConfigs":tftypes.Tuple[tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.DynamicPseudoType, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String]], "oauth2":tftypes.Object["client_id":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "client_secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "client_secret_file":tftypes.String, "endpoint_params":tftypes.Map[tftypes.String], "scopes":tftypes.List[tftypes.String], "token_url":tftypes.String], "params":tftypes.Map[tftypes.List[tftypes.String]], "path":tftypes.String, "port":tftypes.String, "proxyURL":tftypes.String, "relabelConfigs":tftypes.Tuple[tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.String, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String], tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.String, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String], tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.String, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String], tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.String, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String]], "sampleLimit":tftypes.Number, "scheme":tftypes.String, "scrapeTimeout":tftypes.String, "scrape_interval":tftypes.String, "seriesLimit":tftypes.Number, "targetPort":tftypes.String, "tlsConfig":tftypes.Object["ca":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "caFile":tftypes.String, "cert":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "certFile":tftypes.String, "insecureSkipVerify":tftypes.Bool, "keyFile":tftypes.String, "keySecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "serverName":tftypes.String], "vm_scrape_params":tftypes.Object["disable_compression":tftypes.Bool, "disable_keep_alive":tftypes.Bool, "headers":tftypes.List[tftypes.String], "no_stale_markers":tftypes.Bool, "proxy_client_config":tftypes.Object["basic_auth":tftypes.Object["password":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "password_file":tftypes.String, "username":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "bearer_token":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "bearer_token_file":tftypes.String, "tls_config":tftypes.Object["ca":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "caFile":tftypes.String, "cert":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "certFile":tftypes.String, "insecureSkipVerify":tftypes.Bool, "keyFile":tftypes.String, "keySecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "serverName":tftypes.String]], "scrape_align_interval":tftypes.String, "scrape_offset":tftypes.String, "stream_parse":tftypes.Bool]] as tftypes.Object["attach_metadata":tftypes.Object["node":tftypes.Bool], "authorization":tftypes.Object["credentials":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "credentialsFile":tftypes.String, "type":tftypes.String], "basicAuth":tftypes.Object["password":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "password_file":tftypes.String, "username":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "bearerTokenFile":tftypes.String, "bearerTokenSecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "follow_redirects":tftypes.Bool, "honorLabels":tftypes.Bool, "honorTimestamps":tftypes.Bool, "interval":tftypes.String, "max_scrape_size":tftypes.String, "metricRelabelConfigs":tftypes.Tuple[tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.DynamicPseudoType, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String]], "oauth2":tftypes.Object["client_id":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "client_secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "client_secret_file":tftypes.String, "endpoint_params":tftypes.Map[tftypes.String], "scopes":tftypes.List[tftypes.String], "token_url":tftypes.String], "params":tftypes.Map[tftypes.List[tftypes.String]], "path":tftypes.String, "port":tftypes.String, "proxyURL":tftypes.String, "relabelConfigs":tftypes.Tuple[tftypes.Object["action":tftypes.String, "if":tftypes.DynamicPseudoType, "labels":tftypes.Map[tftypes.String], "match":tftypes.String, "modulus":tftypes.Number, "regex":tftypes.DynamicPseudoType, "replacement":tftypes.String, "separator":tftypes.String, "sourceLabels":tftypes.List[tftypes.String], "source_labels":tftypes.List[tftypes.String], "targetLabel":tftypes.String, "target_label":tftypes.String]], "sampleLimit":tftypes.Number, "scheme":tftypes.String, "scrapeTimeout":tftypes.String, "scrape_interval":tftypes.String, "seriesLimit":tftypes.Number, "targetPort":tftypes.String, "tlsConfig":tftypes.Object["ca":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "caFile":tftypes.String, "cert":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "certFile":tftypes.String, "insecureSkipVerify":tftypes.Bool, "keyFile":tftypes.String, "keySecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "serverName":tftypes.String], "vm_scrape_params":tftypes.Object["disable_compression":tftypes.Bool, "disable_keep_alive":tftypes.Bool, "headers":tftypes.List[tftypes.String], "no_stale_markers":tftypes.Bool, "proxy_client_config":tftypes.Object["basic_auth":tftypes.Object["password":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "password_file":tftypes.String, "username":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "bearer_token":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "bearer_token_file":tftypes.String, "tls_config":tftypes.Object["ca":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "caFile":tftypes.String, "cert":tftypes.Object["configMap":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "secret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool]], "certFile":tftypes.String, "insecureSkipVerify":tftypes.Bool, "keyFile":tftypes.String, "keySecret":tftypes.Object["key":tftypes.String, "name":tftypes.String, "optional":tftypes.Bool], "serverName":tftypes.String]], "scrape_align_interval":tftypes.String, "scrape_offset":tftypes.String, "stream_parse":tftypes.Bool]]

goroutine 115 [running]:
github.com/hashicorp/terraform-plugin-go/tftypes.NewValue(...)
        github.com/hashicorp/[email protected]/tftypes/value.go:278
github.com/hashicorp/terraform-provider-kubernetes/manifest/morph.DeepUnknown({0x25c59d0, 0xc00bce35c0}, {{0x25c59d0?, 0xc00bfca390?}, {0x1df7600?, 0xc0101167b0?}}, 0xc010117500)
        github.com/hashicorp/terraform-provider-kubernetes/manifest/morph/scaffold.go:86 +0x19b3
github.com/hashicorp/terraform-provider-kubernetes/manifest/morph.DeepUnknown({0x25c5540, 0xc00bd0fcb0}, {{0x25c5540?, 0xc00bfcb1d0?}, {0x1f28100?, 0xc00bf88d20?}}, 0xc010117440)
        github.com/hashicorp/terraform-provider-kubernetes/manifest/morph/scaffold.go:33 +0x1cb5
github.com/hashicorp/terraform-provider-kubernetes/manifest/morph.DeepUnknown({0x25c5540, 0xc00bf88330}, {{0x25c5540?, 0xc00bfe62a0?}, {0x1f28100?, 0xc00bf885a0?}}, 0xc0101168d0)
        github.com/hashicorp/terraform-provider-kubernetes/manifest/morph/scaffold.go:33 +0x1cb5
github.com/hashicorp/terraform-provider-kubernetes/manifest/provider.(*RawProviderServer).PlanResourceChange(0xc0001a5180, {0x25bd108, 0xc001790a20}, 0xc000e2e910)
        github.com/hashicorp/terraform-provider-kubernetes/manifest/provider/plan.go:395 +0x3785
github.com/hashicorp/terraform-plugin-mux/tf5muxserver.(*muxServer).PlanResourceChange(0xc0001a5100, {0x25bd108?, 0xc001790750?}, 0xc000e2e910)
        github.com/hashicorp/[email protected]/tf5muxserver/mux_server_PlanResourceChange.go:73 +0x2ad
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).PlanResourceChange(0xc0000e4460, {0x25bd108?, 0xc0013dfcb0?}, 0xc0013a6980)
        github.com/hashicorp/[email protected]/tfprotov5/tf5server/server.go:825 +0x3f0
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_PlanResourceChange_Handler({0x21b9cc0, 0xc0000e4460}, {0x25bd108, 0xc0013dfcb0}, 0xc0013a6900, 0x0)
        github.com/hashicorp/[email protected]/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:593 +0x1a6
google.golang.org/grpc.(*Server).processUnaryRPC(0xc0001a0c00, {0x25bd108, 0xc0013dfc20}, {0x25c69e0, 0xc000d0e000}, 0xc0013db200, 0xc000666540, 0x36cb820, 0x0)
        google.golang.org/[email protected]/server.go:1394 +0xe49
google.golang.org/grpc.(*Server).handleStream(0xc0001a0c00, {0x25c69e0, 0xc000d0e000}, 0xc0013db200)
        google.golang.org/[email protected]/server.go:1805 +0xe8b
google.golang.org/grpc.(*Server).serveStreams.func2.1()
        google.golang.org/[email protected]/server.go:1029 +0x8b
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 38
        google.golang.org/[email protected]/server.go:1040 +0x125

Error: The terraform-provider-kubernetes_v2.35.1_x5 plugin crashed!

Steps to Reproduce

1. terraform apply

Expected Behavior

What should have happened?

Actual Behavior

What actually happened?

Important Factoids

• The crash only happens when we have more than 1 elements in relabelConfigs[]

References

Similar to:

• Stop forcing lists containing dynamic values to be tftypes.Tuple #1981
• Crash reading kubernetes_manifest remote object #2537
• Plugin Crash with Error: The terraform-provider-kubernetes_v2.27.0_x5 plugin crashed #2440
• Error: Failed to update proposed state from prior state #2487
• kubernetes_manifest panics when dealing list of mismatched object shapes #2170
• panic: AttributeName("*"): can't use tftypes.DynamicPseudoType as tftypes.List #2052

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment