The kubernetes_secret_v1 is created without data using data_wo parameter

[malcolm061990]

Terraform Version, Provider Version and Kubernetes Version

Terraform version: v1.14.3
Kubernetes provider version: v3.0.1
Kubernetes version: 
Client Version: v1.34.0
Kustomize Version: v5.7.1
Server Version: v1.33.5-gke.2072000

Affected Resource(s)

Terraform Configuration Files

provider "kubernetes" {
  config_path    = "~/.kube/config"
  config_context = "cluster"
}

resource "kubernetes_secret_v1" "app" {
  metadata {
    name      = "test-secret"
    namespace = "default"
  }

  type = "Opaque"
  data_wo = {
    username = "appuser"
  }
}

# tried to create kubernetes_secret_v1 with data from ephemeral resource but secret was created without any data
# so tried to create secret with plain data but secret was created without any data too
ephemeral "random_password" "app_password" {
  length  = 24
  special = true
}

Steps to Reproduce

1. Run terraform apply

terraform apply
ephemeral.random_password.app_password: Opening...
ephemeral.random_password.app_password: Opening complete after 0s
ephemeral.random_password.app_password: Closing...
ephemeral.random_password.app_password: Closing complete after 0s

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # kubernetes_secret_v1.app will be created
  + resource "kubernetes_secret_v1" "app" {
      + binary_data_wo                 = (write-only attribute)
      + data                           = (sensitive value)
      + data_wo                        = (write-only attribute)
      + id                             = (known after apply)
      + type                           = "Opaque"
      + wait_for_service_account_token = true

      + metadata {
          + generation       = (known after apply)
          + name             = "test-secret"
          + namespace        = "default"
          + resource_version = (known after apply)
          + uid              = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

ephemeral.random_password.app_password: Opening...
ephemeral.random_password.app_password: Opening complete after 0s
kubernetes_secret_v1.app: Creating...
kubernetes_secret_v1.app: Creation complete after 2s [id=default/test-secret]
ephemeral.random_password.app_password: Closing...
ephemeral.random_password.app_password: Closing complete after 0s

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

2. get secret data after terraform apply. There is no username key in secret, no data at all

kubectl get secret test-secret -o yaml
apiVersion: v1
kind: Secret
metadata:
  creationTimestamp: "2026-01-28T13:26:33Z"
  name: test-secret
  namespace: default
  resourceVersion: "1769606793996751020"
  uid: d76416f1-e7b7-4e47-957d-980bbdbd23a3
type: Opaque

Expected Behavior

k8s secret must contain data field with correct keys as per data_wo parameter

Actual Behavior

k8s secret is created without data at all

Important Factoids

References

• ephemeral resource: Add write-only data fields to kubernetes_secret and kubernetes_secret_v1 #2795
• Add write-only attributes data_wo and binary_data_wo to kubernetes_secret_v1 #2692

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[brandon-gradient]

I just ran into this myself and was very perplexed

It actually seems that the schema doesn't correctly document that to use a *_wo field, the corresponding *wo_revision field must also be set and >=1. The schema does enforce the value of the "revision" field, and if trying to use the revision field without the corresponding data field, you get an error as expected.

terraform-provider-kubernetes/kubernetes/resource_kubernetes_secret_v1.go

Lines 150 to 165 in 0acfdf9

	if datarev, ok := d.Get("data_wo_revision").(int); ok && datarev >= 1 {
	wodata, diags := d.GetRawConfigAt(cty.GetAttrPath("data_wo"))
	if diags.HasError() {
	return diags
	}
	if wodata.IsWhollyKnown() && !wodata.IsNull() {
	secret.StringData = expandCtyStringMap(wodata.AsValueMap())
	}
	} else if v, ok := d.GetOk("data"); ok {
	m := map[string]string{}
	for k, v := range v.(map[string]interface{}) {
	vv := v.(string)
	m[k] = vv
	}
	secret.StringData = m
	}

It seems the schema should include a RequiredWith: []string{"data_wo_revision"}, for data_wo

terraform-provider-kubernetes/kubernetes/resource_kubernetes_secret_v1.go

Lines 80 to 92 in 0acfdf9

	"data_wo_revision": {
	Type: schema.TypeInt,
	Description: `The current revision of the write-only "data_wo" attribute. Incrementing this integer value will cause Terraform to update the write-only value.`,
	Optional: true,
	RequiredWith: []string{"data_wo"},
	ValidateFunc: validation.IntAtLeast(1),
	},
	"data_wo": {
	Type: schema.TypeMap,
	Description: "A map write-only of the secret data.",
	Optional: true,
	WriteOnly: true,
	ConflictsWith: []string{"data"},

Also this all applies for binary_data_wo and binary_data_wo_revision as well

[brandon-gradient]

Also separately it seems the list of immutable attributes wasn't updated to include the data_wo_revision and binary_data_wo_revision fields. An immutable secret should be recreated if those values change since the provider will attempt to update the secret's data field in those cases even when immutable = true, and get an error because the secret is immutable.

terraform-provider-kubernetes/kubernetes/resource_kubernetes_secret_v1.go

Lines 47 to 50 in 0acfdf9

	immutableFields := []string{
	"data",
	"binary_data",
	"immutable",