Use state for unknown for computed attributes which won't change during plan application (#677)

* Use state for unknown for computed attributes which won't change during plan application

These values may potentially change throughout a deployment lifecycle, but those changes will be picked up during the refresh phase, updating state prior to computing the plan

These values, when unset, should be 'known' as they are provided in the API response

* Config with empty plugins is empty

* CloudID is unknown if name changes or if kibana is being enabled/disabled

* Remove 1.3.9 control from CI acceptance tests

* Set APM secret token to null if there is no apm/integrations_server resource

* Traffic filter WIP

* Use private state to track traffic filters previously managed by the deployment resource

* Acceptance tests

* Regenerate docs

* TF 1.4 in unit tests

* Acceptance tests

* Fix tests

* Lint

* Code cleanup

* Fix build

* Fix build

* Fix build

* Changelog

* Changelog

Author: tobio

.changelog/640.txt

@@ -1,2 +1,3 @@
 ```release-note:feature
-resource/deployment: Adds endpoints integrations server resources. This allows consumers to explicitly capture service urls for dependent modules (e.g APM and Fleet).```
+resource/deployment: Adds endpoints integrations server resources. This allows consumers to explicitly capture service urls for dependent modules (e.g APM and Fleet).
+```

.changelog/642.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+resource/deployment: Add `reset_elasticsearch_password` attribute to the deployment resource. When true, this will reset the system password for the target deployment, updating the `elasticsearch_password` output as a result.
+```

.changelog/648.txt

@@ -0,0 +1,3 @@
+```release-note:bug-fix
+resource/deployment: Fix validation and application of elasticsearch plan strategy
+```

.changelog/677.txt

@@ -0,0 +1,3 @@
+```release-note:bug-fix
+provider: Fix incompatibilities causing infinite configuration drift when used with Terraform CLI 1.4 or higher
+```

.changelog/682.txt

@@ -0,0 +1,3 @@
+```release-note:bug-fix
+resource/deployment: Fix bugs related to transitioning to/from deployment topologies which include dedicated master nodes
+```

build/Makefile.test

@@ -20,7 +20,7 @@ _report_path:
 .PHONY: unit
 unit: _report_path
 	@ echo "-> Running unit tests for $(BINARY)..."
-	@ TF_ACC_TERRAFORM_VERSION=1.3.9 go test $(TEST) $(TESTARGS) $(TESTUNITARGS)
+	@ go test $(TEST) $(TESTARGS) $(TESTUNITARGS)
 
 ## Alias to "unit".
 tests: unit
@@ -42,7 +42,7 @@ endif
 
 .PHONY: testacc-ci
 testacc-ci:
-	@ TF_ACC_TERRAFORM_VERSION=1.3.9 EC_API_KEY=$(shell cat .ci/.apikey) $(MAKE) testacc
+	@ EC_API_KEY=$(shell cat .ci/.apikey) $(MAKE) testacc
 
 .PHONY: sweep-ci
 sweep-ci:

docs/resources/deployment.md

@@ -268,7 +268,7 @@ resource "ec_deployment" "ccs" {
 - `request_id` (String) Request ID to set when you create the deployment. Use it only when previous attempts return an error and `request_id` is returned as part of the error.
 - `reset_elasticsearch_password` (Boolean) Explicitly resets the elasticsearch_password when true
 - `tags` (Map of String) Optional map of deployment tags
-- `traffic_filter` (Set of String) List of traffic filters rule identifiers that will be applied to the deployment. Removing this attribute entirely *will not* remove managed traffic filters, instead first set it to an empty list (e.g `traffic_filter = []`) to remove the managed traffic filters.
+- `traffic_filter` (Set of String) List of traffic filters rule identifiers that will be applied to the deployment.
 
 ### Read-Only
 
@@ -765,6 +765,7 @@ Optional:
 
 - `config` (Attributes) Optionally define the Integrations Server configuration options for the IntegrationsServer Server (see [below for nested schema](#nestedatt--integrations_server--config))
 - `elasticsearch_cluster_ref_id` (String)
+- `endpoints` (Object) URLs for the accessing the Fleet and APM API's within this Integrations Server resource. (see [below for nested schema](#nestedatt--integrations_server--endpoints))
 - `instance_configuration_id` (String)
 - `ref_id` (String)
 - `size` (String)
@@ -773,7 +774,6 @@ Optional:
 
 Read-Only:
 
-- `endpoints` (Attributes) URLs for the accessing the Fleet and APM API's within this Integrations Server resource. (see [below for nested schema](#nestedatt--integrations_server--endpoints))
 - `http_endpoint` (String)
 - `https_endpoint` (String)
 - `region` (String)
@@ -795,10 +795,10 @@ Optional:
 <a id="nestedatt--integrations_server--endpoints"></a>
 ### Nested Schema for `integrations_server.endpoints`
 
-Read-Only:
+Optional:
 
-- `apm` (String) URL to access the APM server instance for this Integrations Server resource
-- `fleet` (String) URL to access the Fleet server instance for this Integrations Server resource
+- `apm` (String)
+- `fleet` (String)
 
 
 

ec/acc/deployment_basic_test.go

@@ -35,12 +35,10 @@ func TestAccDeployment_basic_tf(t *testing.T) {
 	randomAlias := "alias" + acctest.RandStringFromCharSet(5, acctest.CharSetAlphaNum)
 	trafficFilterCfg := "testdata/deployment_basic_with_traffic_filter_2.tf"
 	trafficFilterUpdateCfg := "testdata/deployment_basic_with_traffic_filter_3.tf"
-	emptyTrafficFilterCfg := "testdata/deployment_basic_with_empty_traffic_filter.tf"
 	resetPasswordCfg := "testdata/deployment_basic_reset_password.tf"
 	cfg := fixtureAccDeploymentResourceBasicWithAppsAlias(t, startCfg, randomAlias, randomName, getRegion(), defaultTemplate)
 	cfgWithTrafficFilter := fixtureAccDeploymentResourceBasicWithTF(t, trafficFilterCfg, randomName, getRegion(), defaultTemplate)
 	cfgWithTrafficFilterUpdate := fixtureAccDeploymentResourceBasicWithTF(t, trafficFilterUpdateCfg, randomName, getRegion(), defaultTemplate)
-	cfgWithEmptyTrafficFilter := fixtureAccDeploymentResourceBasicWithAppsAlias(t, emptyTrafficFilterCfg, randomAlias, randomName, getRegion(), defaultTemplate)
 	cfgResetPassword := fixtureAccDeploymentResourceBasicWithAppsAlias(t, resetPasswordCfg, randomAlias, randomName, getRegion(), defaultTemplate)
 	deploymentVersion, err := latestStackVersion()
 	if err != nil {
@@ -59,7 +57,7 @@ func TestAccDeployment_basic_tf(t *testing.T) {
 					resource.TestCheckResourceAttr(resName, "alias", randomAlias),
 					resource.TestCheckNoResourceAttr(resName, "apm.config"),
 					resource.TestCheckNoResourceAttr(resName, "enterprise_search.config"),
-					resource.TestCheckNoResourceAttr(resName, "traffic_filter"),
+					resource.TestCheckResourceAttr(resName, "traffic_filter.#", "0"),
 					// Ensure at least 1 account is trusted (self).
 					resource.TestCheckResourceAttr(resName, "elasticsearch.trust_account.#", "1"),
 				),
@@ -78,16 +76,9 @@ func TestAccDeployment_basic_tf(t *testing.T) {
 					resource.TestCheckResourceAttr(resName, "traffic_filter.#", "1"),
 				),
 			},
-			// Unset the traffic filter (this should not remove the traffic filter)
+			// Unset the traffic filter to remove the traffic filter
 			{
 				Config: cfg,
-				Check: checkBasicDeploymentResource(resName, randomName, deploymentVersion,
-					resource.TestCheckResourceAttr(resName, "traffic_filter.#", "1"),
-				),
-			},
-			// Explicitly set the traffic filter to an empty list to remove the traffic filter
-			{
-				Config: cfgWithEmptyTrafficFilter,
 				Check: checkBasicDeploymentResource(resName, randomName, deploymentVersion,
 					resource.TestCheckResourceAttr(resName, "traffic_filter.#", "0"),
 					func(s *terraform.State) error {

ec/acc/deployment_ccs_test.go

@@ -50,6 +50,12 @@ func TestAccDeployment_ccs(t *testing.T) {
 			{
 				// Create a CCS deployment with the default settings.
 				Config: cfg,
+				// The legacy CCS DT does not support autoscaling, which leads to autoscaling being 'unknown'.
+				// Ideally we would set autoscaling to null if the deployment template does not support autoscaling,
+				// but that would require's refactoring our schema and this template is no longer part of the public offering.
+				//
+				// We can revisit this if there's demand for clean plans when the template does not support autoscaling.
+				ExpectNonEmptyPlan: true,
 				Check: resource.ComposeAggregateTestCheckFunc(
 
 					// CCS Checks
@@ -94,7 +100,8 @@ func TestAccDeployment_ccs(t *testing.T) {
 			},
 			{
 				// Change the Elasticsearch topology size and node count.
-				Config: secondConfigCfg,
+				Config:             secondConfigCfg,
+				ExpectNonEmptyPlan: true,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					// Changes.
 					resource.TestCheckResourceAttrSet(ccsResName, "elasticsearch.hot.instance_configuration_id"),

ec/acc/deployment_pre_node_role_migration_test.go

@@ -62,6 +62,9 @@ func TestAccDeployment_pre_node_roles(t *testing.T) {
 			},
 			{
 				Config: cfgF(upgradeVersionCfg),
+				// Expect a non-empty plan here. We explicitly avoid migrating node_roles when the version changes
+				// however will the migrate the deployment to node_roles on the next TF application.
+				ExpectNonEmptyPlan: true,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttrSet(resName, "elasticsearch.hot.instance_configuration_id"),
 					resource.TestCheckResourceAttr(resName, "elasticsearch.hot.size", "1g"),