Merge branch 'main' into node-taint-unique-by-key-and-effect

xinkechen-evernorth · web-flow · commit 9bb079b6e74f · 2025-08-20T11:09:05.000-04:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,33 @@
+## 2.38.0 (Jul 21, 2025)
+
+ENHANCEMENTS:
+
+* Add ResourceIdentity support to kubernetes_manifest [[GH-2737](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2737)]
+* Add `sub_path_expr` to volume mount options pod spec [[GH-2622](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2622)]
+* Add support for ResourceIdentity to SDKv2 resources [[GH-2751](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2751)]
+
+BUG FIXES:
+
+* Fixed goroutine-safety in the CRD and metadata cache, resulting in far fewer provider metadata requests. [[GH-2699](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2699)]
+* `data_source/kubernetes_pod_v1`: fix an issue when the provider cuts out toleration under pod spec(`spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `data_source/kubernetes_pod`: fix an issue when the provider cuts out toleration under pod spec(`spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_cron_job: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_cron_job_v1: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_daemon_set_v1: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_daemonset: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_deployment: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_deployment_v1: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_job: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_job_v1: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_replication_controller_v1`: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_replication_controller`: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_stateful_set: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+* `resource/kubernetes_stateful_set_v1: fix an issue when the provider cuts out toleration under pod spec template(`*.template.spec.toleration`) if it uses a well-known [taint](https://kubernetes.io/docs/reference/labels-annotations-taints/). That could lead to a perpetual diff behavior. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+
+NOTES:
+
+* We have updated the logic of resources that use the Pod specification template, such as `kubernetes_deployment_v1`, `kubernetes_stateful_set_v1`, etc, and now the provider will keep all tolerations(`spec.toleration`) returned by Kubernetes. The same is applicable for the data sources `kubernetes_pod_v1` and `kubernetes_pod`. The behavior of resources `kubernetes_pod_v1` and `kubernetes_pod` remains unchanged, i.e. the provider will keep removing tolerations with well-known [taints](https://kubernetes.io/docs/reference/labels-annotations-taints/) since they might be attached to the object by Kubernetes controller and could lead to a perpetual diff. [[GH-2380](https://github.com/hashicorp/terraform-provider-kubernetes/issues/2380)]
+
 ## 2.37.1 (May 21, 2025)
 
 BUG FIXES:
diff --git a/kubernetes/resource_kubernetes_ingress_class_v1.go b/kubernetes/resource_kubernetes_ingress_class_v1.go
@@ -113,7 +113,7 @@ func resourceKubernetesIngressClassV1Create(ctx context.Context, d *schema.Resou
 	log.Printf("[INFO] Submitted new IngressClass: %#v", out)
 	d.SetId(out.ObjectMeta.GetName())
 
-	err = setResourceIdentityNonNamespaced(d, "networking/v1", "IngressClass", out.GetName())
+	err = setResourceIdentityNonNamespaced(d, "networking.k8s.io/v1", "IngressClass", out.GetName())
 	if err != nil {
 		return diag.FromErr(err)
 	}
@@ -156,7 +156,7 @@ func resourceKubernetesIngressClassV1Read(ctx context.Context, d *schema.Resourc
 		return diag.FromErr(err)
 	}
 
-	err = setResourceIdentityNonNamespaced(d, "networking/v1", "IngressClass", ing.GetName())
+	err = setResourceIdentityNonNamespaced(d, "networking.k8s.io/v1", "IngressClass", ing.GetName())
 	if err != nil {
 		return diag.FromErr(err)
 	}
diff --git a/kubernetes/resource_kubernetes_ingress_class_v1_test.go b/kubernetes/resource_kubernetes_ingress_class_v1_test.go
@@ -75,7 +75,7 @@ func TestAccKubernetesIngressClassV1_identity(t *testing.T) {
 					statecheck.ExpectIdentity(
 						resourceName, map[string]knownvalue.Check{
 							"name":        knownvalue.StringExact(name),
-							"api_version": knownvalue.StringExact("networking/v1"),
+							"api_version": knownvalue.StringExact("networking.k8s.io/v1"),
 							"kind":        knownvalue.StringExact("IngressClass"),
 						},
 					),
diff --git a/kubernetes/resource_kubernetes_ingress_v1.go b/kubernetes/resource_kubernetes_ingress_v1.go
@@ -275,7 +275,7 @@ func resourceKubernetesIngressV1Read(ctx context.Context, d *schema.ResourceData
 		return diag.FromErr(err)
 	}
 
-	err = setResourceIdentityNamespaced(d, "networking/v1", "Ingress", namespace, name)
+	err = setResourceIdentityNamespaced(d, "networking.k8s.io/v1", "Ingress", namespace, name)
 	if err != nil {
 		return diag.FromErr(err)
 	}
diff --git a/kubernetes/resource_kubernetes_ingress_v1_test.go b/kubernetes/resource_kubernetes_ingress_v1_test.go
@@ -398,7 +398,7 @@ func TestAccKubernetesIngressV1_identity(t *testing.T) {
 						resourceName, map[string]knownvalue.Check{
 							"namespace":   knownvalue.StringExact("default"),
 							"name":        knownvalue.StringExact(name),
-							"api_version": knownvalue.StringExact("networking/v1"),
+							"api_version": knownvalue.StringExact("networking.k8s.io/v1"),
 							"kind":        knownvalue.StringExact("Ingress"),
 						},
 					),
diff --git a/kubernetes/resource_kubernetes_mutating_webhook_configuration_v1.go b/kubernetes/resource_kubernetes_mutating_webhook_configuration_v1.go
@@ -198,7 +198,7 @@ func resourceKubernetesMutatingWebhookConfigurationV1Read(ctx context.Context, d
 		return diag.FromErr(err)
 	}
 
-	err = setResourceIdentityNonNamespaced(d, "admissionregistration/v1", "MutatingWebhookConfiguration", name)
+	err = setResourceIdentityNonNamespaced(d, "admissionregistration.k8s.io/v1", "MutatingWebhookConfiguration", name)
 	if err != nil {
 		return diag.FromErr(err)
 	}
diff --git a/kubernetes/resource_kubernetes_mutating_webhook_configuration_v1_test.go b/kubernetes/resource_kubernetes_mutating_webhook_configuration_v1_test.go
@@ -170,7 +170,7 @@ func TestAccKubernetesMutatingWebhookConfigurationV1_identity(t *testing.T) {
 					statecheck.ExpectIdentity(
 						resourceName, map[string]knownvalue.Check{
 							"name":        knownvalue.StringExact(name),
-							"api_version": knownvalue.StringExact("admissionregistration/v1"),
+							"api_version": knownvalue.StringExact("admissionregistration.k8s.io/v1"),
 							"kind":        knownvalue.StringExact("MutatingWebhookConfiguration"),
 						},
 					),
diff --git a/kubernetes/resource_kubernetes_network_policy_v1.go b/kubernetes/resource_kubernetes_network_policy_v1.go
@@ -313,7 +313,7 @@ func resourceKubernetesNetworkPolicyV1Read(ctx context.Context, d *schema.Resour
 	if err != nil {
 		return diag.FromErr(err)
 	}
-	err = setResourceIdentityNamespaced(d, "networking/v1", "NetworkPolicy", namespace, name)
+	err = setResourceIdentityNamespaced(d, "networking.k8s.io/v1", "NetworkPolicy", namespace, name)
 	if err != nil {
 		return diag.FromErr(err)
 	}
diff --git a/kubernetes/resource_kubernetes_network_policy_v1_test.go b/kubernetes/resource_kubernetes_network_policy_v1_test.go
@@ -386,7 +386,7 @@ func TestAccKubernetesNetworkPolicyV1_identity(t *testing.T) {
 						resourceName, map[string]knownvalue.Check{
 							"namespace":   knownvalue.StringExact("default"),
 							"name":        knownvalue.StringExact(name),
-							"api_version": knownvalue.StringExact("networking/v1"),
+							"api_version": knownvalue.StringExact("networking.k8s.io/v1"),
 							"kind":        knownvalue.StringExact("NetworkPolicy"),
 						},
 					),
diff --git a/kubernetes/resource_kubernetes_validating_webhook_configuration_v1.go b/kubernetes/resource_kubernetes_validating_webhook_configuration_v1.go
@@ -219,7 +219,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Read(ctx context.Context,
 		return diag.FromErr(err)
 	}
 
-	err = setResourceIdentityNonNamespaced(d, "admissionregistration/v1", "ValidatingWebhookConfiguration", name)
+	err = setResourceIdentityNonNamespaced(d, "admissionregistration.k8s.io/v1", "ValidatingWebhookConfiguration", name)
 	if err != nil {
 		return diag.FromErr(err)
 	}
diff --git a/kubernetes/resource_kubernetes_validating_webhook_configuration_v1_test.go b/kubernetes/resource_kubernetes_validating_webhook_configuration_v1_test.go
@@ -171,7 +171,7 @@ func TestAccKubernetesValidatingWebhookConfigurationV1_identity(t *testing.T) {
 					statecheck.ExpectIdentity(
 						resourceName, map[string]knownvalue.Check{
 							"name":        knownvalue.StringExact(name),
-							"api_version": knownvalue.StringExact("admissionregistration/v1"),
+							"api_version": knownvalue.StringExact("admissionregistration.k8s.io/v1"),
 							"kind":        knownvalue.StringExact("ValidatingWebhookConfiguration"),
 						},
 					),
diff --git a/version/VERSION b/version/VERSION
@@ -1 +1 @@
-2.37.1
+2.38.0

Original file line number	Diff line number	Diff line change
`@@ -113,7 +113,7 @@ func resourceKubernetesIngressClassV1Create(ctx context.Context, d *schema.Resou`
`113`	`113`	`log.Printf("[INFO] Submitted new IngressClass: %#v", out)`
`114`	`114`	`d.SetId(out.ObjectMeta.GetName())`
`115`	`115`
`116`		`- err = setResourceIdentityNonNamespaced(d, "networking/v1", "IngressClass", out.GetName())`
	`116`	`+ err = setResourceIdentityNonNamespaced(d, "networking.k8s.io/v1", "IngressClass", out.GetName())`
`117`	`117`	`if err != nil {`
`118`	`118`	`return diag.FromErr(err)`
`119`	`119`	`}`
`@@ -156,7 +156,7 @@ func resourceKubernetesIngressClassV1Read(ctx context.Context, d *schema.Resourc`
`156`	`156`	`return diag.FromErr(err)`
`157`	`157`	`}`
`158`	`158`
`159`		`- err = setResourceIdentityNonNamespaced(d, "networking/v1", "IngressClass", ing.GetName())`
	`159`	`+ err = setResourceIdentityNonNamespaced(d, "networking.k8s.io/v1", "IngressClass", ing.GetName())`
`160`	`160`	`if err != nil {`
`161`	`161`	`return diag.FromErr(err)`
`162`	`162`	`}`
Original file line number	Diff line number	Diff line change
`@@ -275,7 +275,7 @@ func resourceKubernetesIngressV1Read(ctx context.Context, d *schema.ResourceData`
`275`	`275`	`return diag.FromErr(err)`
`276`	`276`	`}`
`277`	`277`
`278`		`- err = setResourceIdentityNamespaced(d, "networking/v1", "Ingress", namespace, name)`
	`278`	`+ err = setResourceIdentityNamespaced(d, "networking.k8s.io/v1", "Ingress", namespace, name)`
`279`	`279`	`if err != nil {`
`280`	`280`	`return diag.FromErr(err)`
`281`	`281`	`}`
Original file line number	Diff line number	Diff line change
`@@ -198,7 +198,7 @@ func resourceKubernetesMutatingWebhookConfigurationV1Read(ctx context.Context, d`
`198`	`198`	`return diag.FromErr(err)`
`199`	`199`	`}`
`200`	`200`
`201`		`- err = setResourceIdentityNonNamespaced(d, "admissionregistration/v1", "MutatingWebhookConfiguration", name)`
	`201`	`+ err = setResourceIdentityNonNamespaced(d, "admissionregistration.k8s.io/v1", "MutatingWebhookConfiguration", name)`
`202`	`202`	`if err != nil {`
`203`	`203`	`return diag.FromErr(err)`
`204`	`204`	`}`
Original file line number	Diff line number	Diff line change
`@@ -313,7 +313,7 @@ func resourceKubernetesNetworkPolicyV1Read(ctx context.Context, d *schema.Resour`
`313`	`313`	`if err != nil {`
`314`	`314`	`return diag.FromErr(err)`
`315`	`315`	`}`
`316`		`- err = setResourceIdentityNamespaced(d, "networking/v1", "NetworkPolicy", namespace, name)`
	`316`	`+ err = setResourceIdentityNamespaced(d, "networking.k8s.io/v1", "NetworkPolicy", namespace, name)`
`317`	`317`	`if err != nil {`
`318`	`318`	`return diag.FromErr(err)`
`319`	`319`	`}`
Original file line number	Diff line number	Diff line change
`@@ -219,7 +219,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Read(ctx context.Context,`
`219`	`219`	`return diag.FromErr(err)`
`220`	`220`	`}`
`221`	`221`
`222`		`- err = setResourceIdentityNonNamespaced(d, "admissionregistration/v1", "ValidatingWebhookConfiguration", name)`
	`222`	`+ err = setResourceIdentityNonNamespaced(d, "admissionregistration.k8s.io/v1", "ValidatingWebhookConfiguration", name)`
`223`	`223`	`if err != nil {`
`224`	`224`	`return diag.FromErr(err)`
`225`	`225`	`}`