Deleting a partially created policy set in harness from TF causes TF to fail to resolve

[estein9825]

When trying to create a policy set, I had the wrong policy severity (warn instead of warning) it still created an empty policy set. When I fixed the warning and attempted to run it again I got:

╷
│ Error: Bad Request: policy set identifier must be unique
│
│ with harness_platform_policyset.opa_policyset["nonproduction_set"],
│ on main.tf line 61, in resource "harness_platform_policyset" "opa_policyset":
│ 61: resource "harness_platform_policyset" "opa_policyset" {
│
╵

I deleted the policy set in harness and went to reapply and got this error in TF:

│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to
│ harness_platform_policyset.opa_policyset["nonproduction_set"], provider
│ "provider["registry.opentofu.org/harness/harness"]" produced an
│ unexpected new value: root object was present, but now absent.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵

It still created the policy set, however.

Please fix it.

[estein9825]

Also, as a result of this failure, the policy set won't be deleted even if the rest of the infra is deleted.

[estein9825]

I changed the policy set name in TF and tried running it again and got the same error.

╷
│ Error: Provider produced inconsistent result after apply
│
│ When applying changes to
│ harness_platform_policyset.opa_policyset["production_set2"], provider
│ "provider["registry.opentofu.org/harness/harness"]" produced an
│ unexpected new value: root object was present, but now absent.
│
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵

[estein9825]

I also tried using policies instead, but it did not work.

Please remove the create and update from a single resource and instead create a policy_set_attachment resource similar to how AWS operates.

[estein9825]

I am trying to do it via this command:

resource "harness_platform_policyset" "opa_policyset" {
  for_each   = local.flat_policy_set_map
  identifier = each.key
  name       = each.key
  action     = each.value.action
  type       = each.value.type
  enabled    = each.value.enabled

  dynamic "policy_references" {
    for_each = contains(var.sets_already_created, each.key) ? each.value.policies : {}
    
    content {
      identifier = policy_references.value.identifier
      severity   = policy_references.value.severity
    }
  }
}

It creates a map with the necessary values. I used logic to where I have a variable that has the name of the policy set in there. If the name is not specified, then it will simply create the policy set without the policies. Once the name is in there, it'll try to update it.

It was no luck. Once I switched to creating the individual resources, however. It was happy. Extremely inefficient, but at least it didn't complain this time.

Changed it to this and still the same problem:

resource "harness_platform_policyset" "prod_opa_policyset" {
  count = contains(keys(local.flat_policy_set_map), "production_set") ? 1 : 0

  identifier = "production_set"
  name       = "production_set"
  action     = local.flat_policy_set_map["production_set"].action
  type       = local.flat_policy_set_map["production_set"].type
  enabled    = local.flat_policy_set_map["production_set"].enabled

  dynamic "policy_references" {
    for_each = try(local.flat_policy_set_map["production_set"].policies, {})
    content {
      identifier = policy_references.value.identifier
      severity   = policy_references.value.severity
    }
  }
}

resource "harness_platform_policyset" "nonprod_opa_policyset" {
  count = contains(keys(local.flat_policy_set_map), "nonproduction_set") ? 1 : 0

  identifier = "nonproduction_set"
  name       = "nonproduction_set"
  action     = local.flat_policy_set_map["nonproduction_set"].action
  type       = local.flat_policy_set_map["nonproduction_set"].type
  enabled    = local.flat_policy_set_map["nonproduction_set"].enabled

  dynamic "policy_references" {
    for_each = try(local.flat_policy_set_map["nonproduction_set"].policies, {})
    content {
      identifier = policy_references.value.identifier
      severity   = policy_references.value.severity
    }
  }
}

│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to
│ harness_platform_policyset.nonprod_opa_policyset[0], provider
│ "provider["registry.opentofu.org/harness/harness"]" produced an
│ unexpected new value: root object was present, but now absent.
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵

The only scenario where it worked was when I accidentally used the same policy map for both:

    for_each = try(local.flat_policy_set_map["production_set"].policies, {})

But that's not at all what we wanted.