azurerm_kusto_cluster: fix perpetual diff on trusted_external_tenants by tpdownes · Pull Request #32794 · hashicorp/terraform-provider-azurerm

tpdownes · 2026-07-14T18:50:00Z

Community Note

Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

azurerm_kusto_cluster.trusted_external_tenants produces a permanent, no-op plan diff. The Azure Data Explorer API returns the trusted tenants in its own canonical order, which frequently differs from the order submitted in configuration. Because the attribute is an order-significant TypeList, that reordering surfaces as a perpetual diff (typically a single-element rotation). Client-side normalization (sort() / reverse(sort())) in configuration cannot fix it, because the API's order is not derivable from the tenant values.

Trust relationships are semantically an unordered set, so a CustomizeDiff now compares the old and new values as sets and, when they match, resets the planned value back to state. A genuine add/removal changes the set and still applies normally, so the attribute stays fully manageable.

The comparison is skipped unless the configured collection is wholly known: GetChange can surface an unknown (known-after-apply) list as an empty slice, and if state is also empty the two would compare equal and SetNew would incorrectly suppress a legitimate change.

trustedExternalTenantsEqual compares the two lists by their unique tenant IDs — set equality, ignoring order and duplicates.

The attribute's schema type is unchanged. An earlier revision of this PR switched it to a TypeSet under the next major version flag; that has been dropped so this remains a non-breaking bug fix.

PR Checklist

I have followed the guidelines in our Contributing Documentation.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.

Changes to existing Resource / Data Source

I have added an explanation of what my changes do and why I'd like you to include them.
I have written new tests for my resource or datasource changes & updated any relevant documentation.
I have successfully run tests with my changes locally. (Unit test + go build/go vet/gofmt pass locally; the acceptance test requires Azure credentials and has not been run end-to-end — see Testing.)

Testing

TestTrustedExternalTenantsEqual unit-tests the set-equality helper, including duplicate handling (a duplicate collapsing to the same set, reordered duplicates, and a duplicate masking a missing member). Passes locally:

--- PASS: TestTrustedExternalTenantsEqual (0.00s)
    --- PASS: TestTrustedExternalTenantsEqual/both_empty
    --- PASS: TestTrustedExternalTenantsEqual/same_order
    --- PASS: TestTrustedExternalTenantsEqual/different_order_same_set
    --- PASS: TestTrustedExternalTenantsEqual/different_lengths
    --- PASS: TestTrustedExternalTenantsEqual/disjoint_sets
    --- PASS: TestTrustedExternalTenantsEqual/same_length_different_members
    --- PASS: TestTrustedExternalTenantsEqual/wildcard_and_empty_string_reordered
    --- PASS: TestTrustedExternalTenantsEqual/duplicate_collapses_to_same_set
    --- PASS: TestTrustedExternalTenantsEqual/duplicates_reordered_same_set
    --- PASS: TestTrustedExternalTenantsEqual/duplicate_masking_missing_member
ok  github.com/hashicorp/terraform-provider-azurerm/internal/services/kusto

TestAccKustoCluster_trustedExternalTenants re-applies the same set of tenants and then asserts an empty plan (PlanOnly: true) for both orderings — ["*", tenant_id] and [tenant_id, "*"]. Because plan-only steps do not update state, at least one permutation is guaranteed to differ from Azure's canonical ordering, so the step reliably catches the perpetual diff regardless of which order the API returns. I do not have an Azure subscription set up to run the acceptance test end-to-end; happy for a maintainer to run it or for guidance.
go build ./internal/services/kusto/..., go vet ./internal/services/kusto/..., gofmt, and TestProvider schema validation are clean.

Change Log

azurerm_kusto_cluster - prevent a perpetual diff on trusted_external_tenants caused by the Azure Data Explorer API returning the tenants in a different order than configured [azurerm_kusto_cluster: fix perpetual diff on trusted_external_tenants #32794]

This is a (please select all that apply):

Bug Fix

Related Issue(s)

Fixes #32793

AI Assistance Disclosure

AI/LLM assistance was used for this contribution.

Extent of AI usage: the code change, the unit/acceptance tests, and this PR description were drafted with the help of an AI coding assistant (GitHub Copilot). All changes were reviewed by me, and the unit tests, go build, go vet, and gofmt were run locally to validate them. Responses to review feedback on this PR may also be prepared with AI assistance.

liuwuliuyun

Hi @tpdownes , thanks for the PR, I left some comments on the changed lines and I hope this PR could catch up to the 5.0 release in time.

liuwuliuyun · 2026-07-20T01:34:14Z

+// set of tenant IDs, ignoring order and duplicates. It is used to suppress the perpetual diff caused
+// by the Azure Data Explorer API returning the tenants in a different order than configured.
+func trustedExternalTenantsEqual(a, b []interface{}) bool {
+	if len(a) != len(b) {


The comment says this compares sets while ignoring duplicates, but the length check and occurrence counts implement multiset equality. For example, ["tenant-a"] and ["tenant-a", "tenant-a"] return false.

Since this property is semantically set-valued and TypeSet deduplicates values in 5.0, please compare unique-value maps instead and add a duplicate-focused unit test. Alternatively, if duplicate counts are intentionally significant, please update the comment and naming accordingly.

Implementation changed in ff9122a

liuwuliuyun · 2026-07-20T01:35:26Z

 	}

+	if features.FivePointOh() {
+		// `trusted_external_tenants` is an unordered set of tenant IDs. The Azure Data Explorer API


Changing trusted_external_tenants from TypeList to TypeSet is a breaking schema change: values become unordered and configurations can no longer reference them by numeric index.

The contributing guide requires breaking schema changes to be documented. Please add a bullet under azurerm_kusto_cluster in website/docs/5.0-upgrade-guide.html.markdown, such as:

The trusted_external_tenants property's type has changed from a List to a Set, meaning its values are unordered and can no longer be referenced by numeric index.

This follows the precedent established by #32460.

Adopted suggested text in ff9122a

liuwuliuyun · 2026-07-20T01:39:00Z

+				Type:         pluginsdk.TypeString,
+				ValidateFunc: validation.Any(validation.IsUUID, validation.StringIsEmpty, validation.StringInSlice([]string{"*"}, false)),
+			},
+		}


The breaking-change guide recommends defining the target 5.0 schema normally and restoring the current behavior inside if !features.FivePointOh(). This keeps the eventual 5.0 cleanup deletion-only.

Please define trusted_external_tenants as the desired TypeSet in the main schema map, then replace it with the complete 4.x TypeList schema—including ConfigMode: pluginsdk.SchemaConfigModeAttr—inside the existing if !features.FivePointOh() block. The trailing if features.FivePointOh() block can then be removed.

Implementation swapped in ff9122a

liuwuliuyun

Left one comment, thanks~

liuwuliuyun

The code changes look good to me now. One heads-up: since the main branch is on 5.0 now, you may need to follow the latest guideline for breaking changes once it’s published and adjust accordingly.

tpdownes · 2026-07-31T13:41:55Z

The code changes look good to me now. One heads-up: since the main branch is on 5.0 now, you may need to follow the latest guideline for breaking changes once it’s published and adjust accordingly.

Are you telling me that I may need to update all the breaking features from 5.0 to 6.0?

liuwuliuyun · 2026-08-03T04:04:09Z

For the custom logic that compares two lists, I believe it will work in the 5.x release once this PR is merged, so it should not block any features.

As for changing the property type from List to Set, I'm afraid that won't make it into 5.x because this PR was not merged before the 5.0 branch cut. In theory, that change would therefore be included in the 6.x release.

Regarding your question, "Are you telling me that I may need to update all the breaking changes from 5.0 to 6.0?":

Not necessarily. The custom list comparison logic should be available in 5.x, so that part does not require waiting for 6.x. The only change that would likely be deferred to 6.x is the List to Set property type change. And I respect members from Hashicorp's decision on this.

The Azure Data Explorer API returns `trustedExternalTenants` in its own canonical order, which often differs from the configured order, producing a permanent no-op diff (hashicorp#32793). Add a `CustomizeDiff` that compares the old and new values as sets and, when they match, resets the planned value back to state. Genuine additions and removals change the set and still apply. The comparison is skipped unless the configured collection is wholly known, since `GetChange` can surface an unknown (known-after-apply) list as an empty slice, which would otherwise suppress a legitimate change.

tpdownes · 2026-08-25T13:55:05Z

I've updated the PR for 5.0. I decided to remove all breaking changes and leave that as potential future work to plan and review.

liuwuliuyun

LGTM, Thanks~

hc-github-team-tf-azure · 2026-08-28T07:12:48Z

@tpdownes - One or more tests failed in this PR. Please review the failures.

Build: 733272
PR: #32794

Total: 16
Passed: 12
Failed: 4
Test Duration: 1h 33m 33s

Test Details

Status	Test Name	Duration	%❌	First	Last
❌ FAIL	TestAccKustoCluster_languageExtension	739.668s	34%	174d	14d
✅ PASS	TestAccKustoCluster_newSkus	1106.456s	27%	174d	0d
✅ PASS	TestAccKustoCluster_doubleEncryption	1159.142s	6%	174d	14d
✅ PASS	TestAccKustoClusterDataSource_basic	1160.034s	12%	174d	0d
✅ PASS	TestAccKustoCluster_basic	1182.403s	6%	197d	44d
✅ PASS	TestAccKustoCluster_UserAssignedIdentity	1222.998s	10%	174d	6d
✅ PASS	TestAccKustoCluster_zones	1249.704s	3%	198d	14d
✅ PASS	TestAccKustoCluster_multipleAssignedIdentity	1292.739s	12%	198d	0d
✅ PASS	TestAccKustoCluster_complete	1801.494s	22%	204d	28d
✅ PASS	TestAccKustoCluster_trustedExternalTenants	2038.645s	9%	191d	6d
❌ FAIL	TestAccKustoCluster_optimizedAutoScale	2071.525s	28%	212d	23d
✅ PASS	TestAccKustoCluster_sku	2348.831s	16%	192d	28d
✅ PASS	TestAccKustoCluster_update	2699.026s	7%	205d	7d
✅ PASS	TestAccKustoCluster_updateSkuAndOptimizedAutoScale	3367.165s	66%	210d	0d
❌ FAIL	TestAccKustoCluster_withTags	5529.917s	4%	176d	7d
❌ FAIL	TestAccKustoCluster_identitySystemAssigned	5530.803s	6%	178d	9d

tpdownes requested review from a team, WodansSon and magodo as code owners July 14, 2026 18:50

github-actions Bot added service/kusto size/L labels Jul 14, 2026

liuwuliuyun reviewed Jul 20, 2026

View reviewed changes

github-actions Bot added the documentation label Jul 24, 2026

tpdownes requested a review from liuwuliuyun July 24, 2026 01:57

liuwuliuyun reviewed Jul 27, 2026

View reviewed changes

Comment thread internal/services/kusto/kusto_cluster_resource.go Outdated

tpdownes requested a review from liuwuliuyun July 27, 2026 23:01

tpdownes force-pushed the f/kusto-trusted-external-tenants-perma-diff branch from 3986508 to 52c8327 Compare July 27, 2026 23:04

rcskosir added bug breaking-change ai-assisted labels Jul 28, 2026

liuwuliuyun approved these changes Jul 31, 2026

View reviewed changes

tpdownes force-pushed the f/kusto-trusted-external-tenants-perma-diff branch from 52c8327 to a7598d6 Compare August 25, 2026 13:53

tpdownes requested a review from liuwuliuyun August 25, 2026 13:55

liuwuliuyun approved these changes Aug 28, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

hc-github-team-tf-azure added the teamcity-failed Failures in teamcity tests, requires explanation or fixing label Aug 28, 2026

Uh oh!

Conversation

tpdownes commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Community Note

Description

PR Checklist

Changes to existing Resource / Data Source

Testing

Change Log

Related Issue(s)

AI Assistance Disclosure

Uh oh!

liuwuliuyun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

liuwuliuyun Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

tpdownes Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

liuwuliuyun Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

tpdownes Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

liuwuliuyun Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

tpdownes Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

liuwuliuyun left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

liuwuliuyun left a comment

Choose a reason for hiding this comment

Uh oh!

tpdownes commented Jul 31, 2026

Uh oh!

liuwuliuyun commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tpdownes commented Aug 25, 2026

Uh oh!

liuwuliuyun left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

hc-github-team-tf-azure commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tpdownes commented Jul 14, 2026 •

edited

Loading

liuwuliuyun commented Aug 3, 2026 •

edited

Loading