2.25.0 should not require namespace in job_template's

[braunsonm]

Terraform Version, Provider Version and Kubernetes Version

Terraform version: 1.6.6
Kubernetes provider version: 2.25.0
Kubernetes version: 1.26.0

Affected Resource(s)

• kubernetes_cron_job_v1
• kubernetes_stateful_set_v1
• kubernetes_daemon_set_v1

Terraform Configuration Files

Pre 2.25.0:

resource "kubernetes_cron_job_v1" "backup" {
  metadata {
    name      = "vault-snapshot"
    namespace = "vault"
  }

  spec {
    schedule           = "@daily"
    concurrency_policy = "Replace"
    job_template {
      metadata {}
      ...

Post 2.25.0, namespace in the job_template now becomes required. If not set, the namespace gets forced to default which will not work in this context.

resource "kubernetes_cron_job_v1" "backup" {
  metadata {
    name      = "vault-snapshot"
    namespace = "vault"
  }

  spec {
    schedule           = "@daily"
    concurrency_policy = "Replace"
    job_template {
      metadata {
        namespace = "vault"
      }
      ...

Steps to Reproduce

1. terraform apply the pre 2.25.0 configuration
2. Notice that the job_template specification is trying to set the namespace to default. This will not work since the job_template is embedded in this resource and will be on the vault namespace as implied by the cron job

Relevant plan output from 2.25.0 (no diff prior to upgrade from 2.24.0)

  # module.vault.kubernetes_cron_job_v1.backup[0] must be replaced
-/+ resource "kubernetes_cron_job_v1" "backup" {
      ~ id = "vault/vault-snapshot" -> (known after apply)
      ~ metadata {
          ~ generation       = 10 -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ spec {
            # (6 unchanged attributes hidden)
          ~ job_template {
              ~ metadata {
                  + namespace        = "default" # forces replacement

Expected Behavior

The job template namespace should be implied from the cron job namespace and should not be defaulting to default when not set. Allowing null on the namespace of job template was the previous behaviour and should remain.

Actual Behavior

Job template's namespace is being defaulted to default

References

• Bug introduced in this commit: 0d9471d

[dpiddock]

This bug also impacts kubernetes_stateful_set_v1 and kubernetes_daemon_set_v1. Terraform wants to recreate all resources when upgrading the provider. kubernetes_deployment_v1 appears to have escaped the breaking change.

[AnshumanTripathi]

This change is causing replacement of our resources.

[mjseid]

Also experiencing forced replacements due to this bug

[ethankent]

Downgrading the provider version does not work if any state refresh has been applied.

Error decoding "module.foo.kubernetes_stateful_set.bar" from previous state: unsupported attribute "persistent_volume_claim_retention_policy"

We could really use an emergency hotfix here.

[arybolovlev]

Hi @braunsonm,

Thank you for reporting this issue. We are working on a fix here.

Please, keep an eye on releases.

[arybolovlev]

Hi @braunsonm,

This issue should be fixed in 2.25.2. Could you please validate this?

Thanks.

[braunsonm]

Confirmed, 2.25.2 is no longer trying to recreate our resources.

Thank you for the quick fix.