Skip to content

deps: bump terraform-plugin-sdk to v2.38.2 to fix identity tracking bug#2841

Open
noeljackson wants to merge 1 commit intohashicorp:mainfrom
noeljackson:fix/bump-sdk-identity-tracking
Open

deps: bump terraform-plugin-sdk to v2.38.2 to fix identity tracking bug#2841
noeljackson wants to merge 1 commit intohashicorp:mainfrom
noeljackson:fix/bump-sdk-identity-tracking

Conversation

@noeljackson
Copy link

@noeljackson noeljackson commented Feb 12, 2026

Summary

Bumps terraform-plugin-sdk/v2 from v2.37.0 to v2.38.2 to fix the Unexpected Identity Change error (#2779).

The SDK already has fixes for this, the provider just needs to pick them up:

  • v2.38.1 (#1527): Skips identity change validation when the stored identity is all-null. This is the main fix.
  • v2.38.2 (#1544): Prevents "Missing Resource Identity" error when the resource create returns an error (e.g., rollout timeout).

Problem

When a resource takes a while to become ready (pod scheduling, image pull, node autoscaling) or the create times out, the Read function never runs, so identity gets written to state as all-null. On the next plan, Read populates the real values, and the SDK treats that as an identity change and errors out.

Right now the only workarounds are terraform state rm + recreate, or deleting the resource from the cluster. Both are pretty painful, especially in managed environments like Coder where users don't have direct state access.

Fix

No provider code changes needed, just the SDK bump. The SDK v2.38.1+ handles null-to-real identity transitions gracefully instead of erroring.

Testing

  • go build ./... passes
  • Patch-level SDK bump, no API changes, existing tests should pass as-is

Fixes #2779

Bumps terraform-plugin-sdk/v2 from v2.37.0 to v2.38.2, which includes
three fixes for the ResourceIdentity tracking feature:

- SDK v2.38.0 (hashicorp#1513): Validates identity values are not all-null
- SDK v2.38.1 (hashicorp#1527): Skips identity change validation when prior
  identity has all-null attributes (fixes existing corrupted state)
- SDK v2.38.2 (hashicorp#1544): Prevents 'Missing Resource Identity' error when
  resource create returns errors (e.g., timeout waiting for rollout)

This resolves the 'Unexpected Identity Change' error reported in hashicorp#2779
that affects kubernetes_pod_v1, kubernetes_deployment_v1,
kubernetes_stateful_set_v1, kubernetes_config_map_v1,
kubernetes_horizontal_pod_autoscaler_v2, and other resources.

Fixes hashicorp#2779
@noeljackson noeljackson requested a review from a team as a code owner February 12, 2026 22:27
@hashicorp-cla-app
Copy link

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

Have you signed the CLA already but the status is still pending? Recheck it.

1 similar comment
@hashicorp-cla-app
Copy link

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

Have you signed the CLA already but the status is still pending? Recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[terraform stacks/k3s] Unexpected Identity Change on every resorce update

1 participant