client_flag is ignored on vault_pki_secret_backend_role

[kwohlfahrt]

Terraform Version

Run terraform -v to show the version. If you are not running the latest version of Terraform, please upgrade because your issue may have already been fixed.

Terraform v1.5.3
on darwin_arm64
+ provider registry.terraform.io/hashicorp/vault v3.18.0

Affected Resource(s)

Please list the resources as a list, for example:

• vault_pki_secret_backend_role

If this issue appears to affect multiple resources, it may be an issue with Terraform's core, so please mention this.

Terraform Configuration Files

terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.18.0"
    }
  }

  required_version = "~> 1.5.3"
}

provider "vault" {
  address = "<snip>"
}

resource "vault_pki_secret_backend_role" "role" {
  name               = "server"
  backend            = "vpn"
  allowed_domains    = ["<snip>"]
  allow_subdomains   = true
  allow_bare_domains = true
  server_flag        = true
  client_flag        = false
  key_type           = "ec"
  key_bits           = 384
  max_ttl            = (7 * 24 * 60 * 60)
  generate_lease     = true
}

Expected Behavior

I expect terraform to apply the change once, and then reach a stable state. I also expect to see client_flag set to false when running vault read vpn/roles/server.

Actual Behavior

vault read vpn/roles/server shows client_flag set to true, even after applying changes. Terraform also always shows the following plan, even when applying multiple times:

  # vault_pki_secret_backend_role.role will be updated in-place
  ~ resource "vault_pki_secret_backend_role" "role" {
      ~ client_flag                        = true -> false
        id                                 = "vpn/roles/server"
        name                               = "server"
        # (37 unchanged attributes hidden)
    }

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply

Important Factoids

Looking at the fix for the related issue in #1933, it seems like the following parameters all likely to be affected:

• consts.FieldClientFlag
• consts.FieldCodeSigningFlag
• consts.FieldEmailProtectionFlag

References

This is very similar to #1932.