Hi Everyone, I’m building a custom Pulumi provider for Keycloak (called pulumi-qeycloak) using the pulumi-go-provider SDK. I’ve implemented a provider that authenticates to a Keycloak instance and a Realm resource that manages realm creation/deletion. On the first pulumi up, everything works fine — the realm gets created successfully. However, on subsequent pulumi up runs, even with no configuration changes, Pulumi reports the diff as:

[urn=urn:pulumi:local::keycloak-realm::pulumi:pulumi:Stack::keycloak-realm-local]
    ++pulumi:providers:qeycloak: (create-replacement)
        [id=57231a1f-5433-491b-bfcd-e07ea1691edd]
        [urn=urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak]
      + version: "0.0.1"
    +-pulumi:providers:qeycloak: (replace)
        [id=57231a1f-5433-491b-bfcd-e07ea1691edd]
        [urn=urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak]
      + version: "0.0.1"
    ++qeycloak:realm:Realm: (create-replacement)
        [id=payara-qube]
        [urn=urn:pulumi:local::keycloak-realm::qeycloak:realm:Realm::qube-realm]
        [provider: urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak::57231a1f-5433-491b-bfcd-e07ea1691edd => urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak::[unknown]]
        accountTheme   : "payara"
        adminTheme     : "payara"
        displayName    : "Payara Qube"
        displayNameHtml: "<div class=\"kc-logo-text\"><span>Payara Qube</span></div>"
        emailTheme     : "payara"
        enabled        : true
        loginTheme     : "payara"
        name           : "payara-qube"
    +-qeycloak:realm:Realm: (replace)
        [id=payara-qube]
        [urn=urn:pulumi:local::keycloak-realm::qeycloak:realm:Realm::qube-realm]
        [provider: urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak::57231a1f-5433-491b-bfcd-e07ea1691edd => urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak::[unknown]]
      ~ realmId        : "payara-qube" => [unknown]
    --qeycloak:realm:Realm: (delete-replaced)
        [id=payara-qube]
        [urn=urn:pulumi:local::keycloak-realm::qeycloak:realm:Realm::qube-realm]
        [provider=urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak::57231a1f-5433-491b-bfcd-e07ea1691edd]
    --pulumi:providers:qeycloak: (delete-replaced)
        [id=57231a1f-5433-491b-bfcd-e07ea1691edd]
        [urn=urn:pulumi:local::keycloak-realm::pulumi:providers:qeycloak::localKeycloak]

Essentially, both the provider and all dependent resources get replaced every time. This causes unnecessary re-creation of realms on each deployment. It says version change in diff but in the above logs, both the version are same, and I just hardcoded version in my main.go file to test it out. My Repo URL: https://github.com/raushan606/pulumi-qeycloak I took inspiration from the pulumi-kafka-connect pulumi provider. Still I"m facing this issue as roadblock for me to develop this provider. Any guidance or examples (especially from custom REST clients) would be super helpful. 🙏

Are you on the latest version of pulumi-go-provider? There was a bug between the provider framework and the engine which got confused about the "version" field. It was fixed a while ago, so if your on latest it should be fine.

Thanks for replying @echoing-dinner-19531 I have updated to the latest version for pulumi-go-provider v1.1.1 I see there is still a saying that version diff, but I didn't do anything before hitting it a second time with pulumi up.

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::keycloak-realm::pulumi:pulumi:Stack::keycloak-realm-dev]
    ~ pulumi:providers:qeycloak: (update)
        [id=ea0341ae-0e82-4913-873d-84299bcd624a]
        [urn=urn:pulumi:dev::keycloak-realm::pulumi:providers:qeycloak::localKeycloak]
      + version: "0.0.1"

you might need run that one update, then the state will be fixed

Right, I ran the second update, but upon doing another pulumi up next time, it still have the same version diff issue like previous one:

pulumi:pulumi:Stack: (same)
    [urn=urn:pulumi:dev::keycloak-realm::pulumi:pulumi:Stack::keycloak-realm-dev]
    ~ pulumi:providers:qeycloak: (update)
        [id=ea0341ae-0e82-4913-873d-84299bcd624a]
        [urn=urn:pulumi:dev::keycloak-realm::pulumi:providers:qeycloak::localKeycloak]
      + version: "0.0.1"

Also I check the state, it have this version already:

{
                "urn": "urn:pulumi:dev::keycloak-realm::pulumi:providers:qeycloak::localKeycloak",
                "custom": true,
                "id": "ea0341ae-0e82-4913-873d-84299bcd624a",
                "type": "pulumi:providers:qeycloak",
                "inputs": {
                    "__internal": {},
                    "password": {
                        "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
                        "ciphertext": "AAABAGnv52vMZWIw/IDYxrCttI703VbTKrgdUZtO+ujCOF+vyRVX"
                    },
                    "realm": "master",
                    "url": "<http://localhost:8080>",
                    "username": "admin",
                    "version": "0.0.1"
                },

Ah looks like the team did fix it: https://github.com/pulumi/pulumi-go-provider/commit/06cebfac49a32ae88871f555e222a9b507e96123 But they never tagged a release for it

I think it is in v1.1.1, https://github.com/pulumi/pulumi-go-provider/releases/tag/v1.1.1

You can pull the module from the latest git sha instead of the tagged version to get the fix in the meantime

Right, I just check it is tagged.

If you run with

PULUMI_DEBUG_GRPC=log.json

can you check what the Diff request/result looks like?

{
  "method": "/pulumirpc.ResourceProvider/DiffConfig",
  "request": {
    "urn": "urn:pulumi:dev::keycloak-realm::pulumi:providers:qeycloak::localKeycloak",
    "olds": {
      "password": "admin",
      "realm": "master",
      "url": "<http://localhost:8080>",
      "username": "admin",
      "version": "0.0.1"
    },
    "news": {
      "password": "admin",
      "realm": "master",
      "url": "<http://localhost:8080>",
      "username": "admin",
      "version": "0.0.1"
    },
    "oldInputs": {
      "password": "admin",
      "realm": "master",
      "url": "<http://localhost:8080>",
      "username": "admin",
      "version": "0.0.1"
    },
    "name": "localKeycloak",
    "type": "pulumi:providers:qeycloak"
  },
  "response": {
    "changes": "DIFF_SOME",
    "diffs": [
      "version"
    ],
    "detailedDiff": {
      "version": {}
    },
    "hasDetailedDiff": true
  },
  "metadata": {
    "kind": "resource",
    "mode": "client",
    "name": "qeycloak"
  }
}

It says that version diff but you see there is no difference between olds and news version.

Have you implemented your own DiffConfig function?

https://github.com/raushan606/pulumi-qeycloak/blob/main/provider/pkg/qeycloak/config/config.go I'm sorry, but I didn't implement it in my config. Is it necessary to have my own implementation of DiffConfig?

No it shouldn't be, but if you had overridden it might have been something in that

No I didn't overriden it as per my config.go file. https://github.com/raushan606/pulumi-qeycloak/blob/main/provider/pkg/qeycloak/config/config.go

No as in you can just run

go get

for the latest sha

Okay, Let me try it

Great 🙂 glad that fixed it