Terraform-provider-vault: Error: Provider produced inconsistent result after apply

[Johnch9]

We are getting an error with Terraform 0.12.2 and Vault Provider 2.0.0

Even though we are seeing this error it appears that the secret is written successfully. Reporting as the error message stated that this was a bug in the provider.

Terraform Version

0.12.2

Expected Behavior

No error

Actual Behavior

Seeing the following error
Error: Provider produced inconsistent result after apply

When applying changes to
module.vault-kube-write.vault_generic_secret.kube_config, provider "vault"
produced an unexpected new value for was present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:
```resource "vault_generic_secret" "service_account" {
path = "secret/${var.application}/service_account"

data_json = < {
"ca-cert": "${var.cluster_ca_certificate}",
"host": "${var.host}",
"token": "${var.service_account_token}",
"client-cert": "${var.client_certificate}",
"client-key": "${var.client_key}",
"raw": "${var.raw}"
}
EOT
}
```

[dzirg44]

It is not a bug, just default behavior. You should update your Vault policy with 'read' permission.
Or you can use

disable_read  = "true"

and it will make what you want.

[peric]

I have the same problem. At first I thought that recreating the whole module will help, but I keep getting the same error.

@dzirg44 to which endpoint should we add read permission, or what exactly do you mean by this?

[Inshaal93]

I'm seeing this issue even when trying to generate a token:

```# Generate Vault Token
resource "vault_token" "nomad_server_token" {
role_name = var.vault_role
policies = var.vault_policies

renewable = true
ttl = "72h"
no_parent = true

renew_min_lease = 43200
renew_increment = 86400
}

Response:
```vault_token.nomad_server_token: Creating...

Error: Provider produced inconsistent result after apply

When applying changes to vault_token.nomad_server_token, provider "vault"
produced an unexpected new value for was present, but now absent.

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

And my policy already has read permissions for the tokens:
```# allow creation of tokens
path "auth/token/create/role*" {
capabilities = ["create", "read", "update", "delete", "sudo", "list"]
}

Allow looking up and creating token roles.

path "auth/token/roles/role*" {
capabilities = ["read", "create", "update", "delete"]
}

Allow looking up the token passed to Nomad to validate # the token has the

proper capabilities. This is provided by the "default" policy.

path "auth/token/lookup-self" {
capabilities = ["read"]
}

Allow looking up incoming tokens to validate they have permissions to access

the tokens they are requesting. This is only required if

allow_unauthenticated is set to false.

path "auth/token/lookup" {
capabilities = ["update"]
}

Allow revoking tokens that should no longer exist. This allows revoking

tokens for dead tasks.

path "auth/token/revoke-accessor" {
capabilities = ["update"]
}

Allow checking the capabilities of our own token. This is used to validate the

token upon startup.

path "sys/capabilities-self" {
capabilities = ["update"]
}

Allow our own token to be renewed.

path "auth/token/renew-self" {
capabilities = ["update"]
}
```

[joemiller]

@Inshaal93 We were running into this issue as well when creating a token with the vault_token resource. Ran terraform with TF_LOG=debug and noticed that vault was returning a permission denied on POST /v1/auth/token/lookup-accessor. Solved this by adding this to the token policy used by TF:

path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}

[Inshaal93]

@Inshaal93 We were running into this issue as well when creating a token with the vault_token resource. Ran terraform with TF_LOG=debug and noticed that vault was returning a permission denied on POST /v1/auth/token/lookup-accessor. Solved this by adding this to the token policy used by TF:

path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}

Found that this was the solution for me too. Thank you for commenting!