diff: don't panic on invalid keys for relevant attrs#38264
Merged
Conversation
The PathMatcher used when rendering diffs assumes the caller knows the structure the path was derived from, which is incorrect. RelevantAttributes is derived from references to an object, which may have errors hidden by `try` or `can` functions, or the data may not have been updated to match paths via targeted operations. Even in the case where the data may be incorrect, we can't crash when rendering the data, because the user may not be able to work around the panic with no other information about which resource contains unexpected references.
jbardin
added
the
1.14-backport
Member
Author
|
I'm still curious about how the invalid paths managed to get all the way to the rendering step, but we need a better plan to catch them. This class of panic was chased through multiple issues already (#33472, #37271, #37360, #37710, #38257). We either have paths which are incorrectly clearing the validation added in #37290, or are incorrectly serializing/deserializing them through the multiple plan and rendering formats. |
mildwonkey
approved these changes
Mar 12, 2026
jbardin
added a commit
that referenced
this pull request
Mar 12, 2026
manual v1.14 backport of #38264
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
PathMatcherused when rendering diffs assumes the caller knows the structure the path was derived from, which is isn't always correct.RelevantAttributesis derived from references to an object, which may have errors hidden bytryorcanfunctions, or the target resource structure may have changed via a schema upgrade.Even in the case where the data may be incorrect, we can't crash when rendering the data, because the user may not be able to work around the panic with no other information about which resource contains unexpected references. This part of the rendering is only a best effort to display relevant diffs from changes outside of Terraform, and is not the place to catch any attribute path errors.
Closes #38257