Using terrafrom azurerm provider enabling OIDC Issuer for AKS Cluster and creating federated Identity Credentials. After Apply terraform it is enabled OIDC issuer and creating fedrated Identity Credentials is Failed

[ashishreddyaleti]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.0.10

AzureRM Provider Version

3.57.0

Affected Resource(s)/Data Source(s)

azurerm_federated_identity_credential

Terraform Configuration Files

resource "azurerm_kubernetes_cluster" "aks" {
  

  name                = "name"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "dns"
  oidc_issuer_enabled =  true 
  workload_identity_enabled = true 
}

resource "azurerm_federated_identity_credential" "afic" {
  
  name                =  name
  resource_group_name =  azurerm_resource_group.rg.name
  audience            =  ["api://AzureADTokenExchange"]
  issuer              =  azurerm_kubernetes_cluster.aks.oidc_issuer_url
  parent_id           =  azurerm_user_assigned_identity.uai.id
  subject             =  "system:serviceaccount:namespace:default"

  depends_on = [
    azurerm_kubernetes_cluster.aks,
    azurerm_resource_group.rg,
    azurerm_user_assigned_identity.uai
  ]
 }

Debug Output/Panic Output

Terraform plan show as expected. But When I apply terraform plan  OIDC is Issuer is enabled 
but it show below error 

 Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for
│ azurerm_federated_identity_credential.afic["name"] to include new
│ values learned so far during apply, provider
│ "registry.terraform.io/hashicorp/azurerm" produced an invalid new value for
│ .issuer: was cty.StringVal(""), but now
│ cty.StringVal("https://westus.oic.prod-aks.azure.com/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXX").
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.

Expected Behaviour

Should create federated identity Credentials after enabiling oidc issuer.

Actual Behaviour

failed to create the federated identity credentials

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[stephybun]

Thanks for raising this issue @ashishreddyaleti.

This was raised a few weeks ago in #21805 and a fix has already been merged and released in v3.59.0 of the provider. Upgrading to the latest version should fix this issue. Since this should already be resolved I'm going to close this issue.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.