OCM-23281 | fix: change rhcs_hcp_default_ingress to fall back to var.wait_for_create_complete

Author: amandahla

.cursor/rules/rosa-hcp-terraform.mdc

@@ -33,12 +33,14 @@ This repository implements **ROSA with Hosted Control Plane (HCP)** only. Do not
 ## Security
 
 - Do not hardcode secrets or long-lived AWS keys in Terraform. Align with existing **`examples/`** and Red Hat guidance for STS, OIDC, and IRSA. Use **`sensitive`** where appropriate; avoid exposing secrets in outputs, state-adjacent logging, or ad-hoc debug prints.
+- **Outputs:** If a submodule output is **`sensitive = true`**, any **root** (or parent) output that passes it through (e.g. **`value = module.child.output_name`**) must also use **`sensitive = true`**. Terraform requires this when the value is or derives from sensitive data; keep child and parent aligned (e.g. **`cluster_admin_username`** alongside **`cluster_admin_password`**).
 
 ## Variables
 
 - Every variable: `type`, `description`, and `default` when optional — match tone and structure of existing `variables.tf`.
 - Use **`snake_case`** for names (Terraform convention). Prefer **validation** / **lifecycle precondition** for simple checks (null/empty/enum); let the provider enforce complex cross-field rules.
 - **Nullable values in `validation` conditions:** Do not pass a possibly-**`null`** expression into **`contains(...)`** (or similar functions that reject null). That can surface as **`Invalid value for "value" parameter: argument must not be null.`** during validation/plan. Use a **short-circuiting ternary** so `contains` runs only when the value is non-null, e.g. `var.example == null ? true : contains(["a", "b"], var.example)` — not `var.example == null || contains(..., var.example)`.
+- **Import-safe `count` / `for_each`:** Avoid boolean **`count`** / **`for_each`** conditions that depend **only** on a **resource or data source attribute** that can be **`null`** in partial state (e.g. immediately after **`terraform import`** before refresh). Terraform requires **`true` or `false`**; **`null`** triggers **`The condition value is null. Conditions must either be true or false.`** Prefer driving **`count` / `for_each` from `var.*`** only. 
 - **Typed maps vs `map(any)`:** When a map’s values are the same logical object (e.g. keyed log forwarders, pools), prefer **`map(object({ ... }))`** with **`optional(...)`** for nullable blocks — not **`map(any)`** — so mixed entries (e.g. one key uses `s3`, another `cloudwatch`) type-check without “all map elements must have the same type”. Add root **`validation`** blocks for cross-field rules users hit early; child modules may keep **`lifecycle` precondition** as a second line of defense.
 
 ## Procedures and commands

AGENTS.md

@@ -50,7 +50,7 @@ Useful skills for this codebase:
 **Agent-oriented checks** when editing Terraform, **`examples/`**, and tests:
 
 - Do **not** hardcode secrets, API keys, or long-lived AWS access keys in Terraform, examples, or tests. Prefer patterns in existing **`examples/`** and Red Hat documentation (STS, OIDC, IRSA, short-lived credentials).
-- Use **`sensitive`** on variables and outputs where values must not appear in logs or casual `terraform show` output; avoid echoing secrets in `local` values used only for debugging.
+- Use **`sensitive`** on variables and outputs where values must not appear in logs or casual `terraform show` output; avoid echoing secrets in `local` values used only for debugging. Passthrough outputs (**`module.*` → root output**) must match submodule sensitivity—see **Security** in [`.cursor/rules/rosa-hcp-terraform.mdc`](.cursor/rules/rosa-hcp-terraform.mdc).
 - Do not add logging, outputs, or comments that expose credentials or session tokens.
 
 ## Critical Module Guardrails
@@ -74,4 +74,6 @@ New features should include a new `.tftest.hcl` file or an update to an existing
 
 Use mocks for AWS and RHCS resources to verify logic without requiring live credentials.
 
+When module behavior branches on a **boolean variable** (e.g. **`count = var.x ? 1 : 0`**), prefer **more than one `run` block** (or clearly separated scenarios) so **both** outcomes are covered—typically **`true` / `count = 1`** and **`false` / `count = 0`**—not only the default or “happy” path. That avoids regressions where the positive case passes but the opt-out path breaks.
+
 For exact commands and pass/fail criteria, follow **`CONTRIBUTING.md`**.

modules/rosa-cluster-hcp/main.tf

@@ -147,7 +147,9 @@ resource "rhcs_hcp_cluster_autoscaler" "cluster_autoscaler" {
 }
 
 resource "rhcs_hcp_default_ingress" "default_ingress" {
-  count   = rhcs_cluster_rosa_hcp.rosa_hcp_cluster.wait_for_create_complete ? 1 : 0
+  # After import, cluster.wait_for_create_complete may be null until refresh; 
+  # always fall back to var and its default.
+  count   = var.wait_for_create_complete ? 1 : 0
   cluster = rhcs_cluster_rosa_hcp.rosa_hcp_cluster.id
   listening_method = var.default_ingress_listening_method != "" ? (
     var.default_ingress_listening_method) : (

modules/rosa-cluster-hcp/outputs.tf

@@ -6,6 +6,7 @@ output "cluster_id" {
 output "cluster_admin_username" {
   value       = rhcs_cluster_rosa_hcp.rosa_hcp_cluster.admin_credentials == null ? null : rhcs_cluster_rosa_hcp.rosa_hcp_cluster.admin_credentials.username
   description = "The username of the admin user."
+  sensitive   = true
 }
 
 output "cluster_admin_password" {

modules/rosa-cluster-hcp/tests/rosa_cluster_hcp.tftest.hcl

@@ -0,0 +1,86 @@
+# rhcs_hcp_default_ingress count follows var.wait_for_create_complete only (see main.tf).
+# Driving count from resource attributes that can be null after import caused:
+# "The condition value is null. Conditions must either be true or false."
+# These plan-mode runs assert both branches: count 1 when true, count 0 when false.
+
+mock_provider "aws" {
+  alias = "default"
+
+  mock_data "aws_partition" {
+    defaults = {
+      dns_suffix         = "amazonaws.com"
+      id                 = "aws"
+      partition          = "aws"
+      reverse_dns_prefix = "amazonaws.com"
+    }
+  }
+
+  mock_data "aws_subnet" {
+    defaults = {
+      availability_zone = "us-east-1a"
+      id                = "subnet-fake12345"
+    }
+  }
+}
+
+mock_provider "rhcs" {
+  alias           = "import_sim"
+  override_during = plan
+
+  # Partial cluster state simulation for plan (not used for default_ingress count).
+  mock_resource "rhcs_cluster_rosa_hcp" {
+    defaults = {
+      id                       = "rhcs-fake-cluster-id"
+      wait_for_create_complete = null
+    }
+  }
+
+  mock_resource "rhcs_hcp_default_ingress" {
+    defaults = {}
+  }
+}
+
+variables {
+  cluster_name           = "existing-cluster"
+  openshift_version      = "4.15.0"
+  oidc_config_id         = "00000000000000000000000000000000"
+  operator_role_prefix   = "test-operator-prefix"
+  account_role_prefix    = "test-account-prefix"
+  aws_subnet_ids         = ["subnet-fake12345"]
+  aws_availability_zones = ["us-east-1a"]
+  aws_account_id         = "123456789012"
+  aws_account_arn        = "arn:aws:iam::123456789012:root"
+  aws_region             = "us-east-1"
+}
+
+run "plan_default_ingress_count_when_wait_for_create_complete_true" {
+  command = plan
+
+  providers = {
+    aws  = aws.default
+    rhcs = rhcs.import_sim
+  }
+
+  assert {
+    condition     = length(rhcs_hcp_default_ingress.default_ingress) == 1
+    error_message = "rhcs_hcp_default_ingress.default_ingress must have count 1 when var.wait_for_create_complete is true."
+  }
+}
+
+run "plan_default_ingress_count_when_wait_for_create_complete_false" {
+  command = plan
+
+  providers = {
+    aws  = aws.default
+    rhcs = rhcs.import_sim
+  }
+
+  variables {
+    wait_for_create_complete = false
+  }
+
+  assert {
+    condition     = length(rhcs_hcp_default_ingress.default_ingress) == 0
+    error_message = "rhcs_hcp_default_ingress.default_ingress must have count 0 when var.wait_for_create_complete is false."
+  }
+}

outputs.tf

@@ -8,6 +8,7 @@ output "cluster_id" {
 output "cluster_admin_username" {
   value       = module.rosa_cluster_hcp.cluster_admin_username
   description = "The username of the admin user."
+  sensitive   = true
 }
 
 output "cluster_admin_password" {