Resource reports back update with no sensible reason

[mikluko]

Whanever I change ip_access property of clickhouse_service resource, the plan contains a whole bunch of (known after apply) values which actually hasn't changed:

# module.clickhouse-metrics.clickhouse_service.this will be updated in-place
  ~ resource "clickhouse_service" "this" {
      ~ backup_configuration    = {
          + backup_start_time                = (known after apply)
            # (2 unchanged attributes hidden)
        }
      + byoc_id                 = (known after apply)
      ~ endpoints               = [
          - {
              - host     = "xxx.us-east-2.aws.clickhouse.cloud" -> null
              - port     = 9440 -> null
              - protocol = "nativesecure" -> null
            },
          - {
              - host     = "xxx.us-east-2.aws.clickhouse.cloud" -> null
              - port     = 8443 -> null
              - protocol = "https" -> null
            },
        ] -> (known after apply)
        id                      = "xxxxxxxx-c8df-4f5b-94ec-xxxxxxxxxxxx"
      ~ ip_access               = [
          - {
              - description = "Terraform managed" -> null
              - source      = "xxx.xxx.xxx.xxx" -> null
            },
        ]
        name                    = "unicorns-were-here"
      ~ release_channel         = "default" -> (known after apply)
      + tier                    = (known after apply)
        # (13 unchanged attributes hidden)
    }

It wouldn't be a problem if these (known after apply) weren't consumed by downstream resources. E.g., that effectively forces re-creation of clickhouse_service_private_endpoints_attachment and aws_vpc_endpoint on every ip_access update. I wouldn't expect altering IP access ACL to trigger such a serious hustle...

[whites11]

Hey @mikluko thanks for opening this ticket.

Some of the fields are "optional, computed" causing them to be "known after apply" everytime there is a change in the resource.
We are working towards limiting such fields, although it is a balance game between server side defaulting and not requiring the user to enter every detail of the service's configuration.

That being said, I'm confused about the "effectively forces re-creation of clickhouse_service_private_endpoints_attachment and aws_vpc_endpoint".

Do you have the output of a terraform plan when this happens?

[whites11]

Hello @mikluko

We released version 3.0.0 of the terraform provider, with the specific goal to improve the Plan phase and limit the number of "Known after apply" fields that were indeed too many to be acceptable.
I'd appreciate if you could test it out and provide some feedback regarding your initial concerns.
Please be aware that there is a breaking change in this release, find all the needed informations in here https://github.com/ClickHouse/terraform-provider-clickhouse#breaking-changes-and-deprecations