AtLeastOneOf doesn't work for Optional attributes (references self)

[dak1n1]

SDK version

github.com/hashicorp/terraform-plugin-sdk/v2 v2.4.3

Relevant provider source code

The problem happens when I include AtLeastOneOf in one of my optional provider attributes.

func Provider() *schema.Provider {
	p := &schema.Provider{
		Schema: map[string]*schema.Schema{
			"host": {
				Type:             schema.TypeString,
				Optional:         true,
				Description:      "The hostname (in form of URI) of Kubernetes master.",
				AtLeastOneOf: []string{"token", "exec", "username", "password", "client_certificate", "client_key"},
			},

When this code runs, the attribute references itself as one of the required attributes. (host appears in the list below).

$ terraform plan
╷
│ Error: AtLeastOne
│ 
│ "host": one of `client_certificate,client_key,exec,host,password,token,username` must be specified
╵

Terraform Configuration Files

$ cat main.tf 
terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "9.9.9" # this is my dev version
    }
  }
}

provider "kubernetes" {
  config_path = "~/.kube/config"
  # note that `host` is omitted
}

resource "kubernetes_namespace" "test" {
  metadata {
    name = "test"
  }
}

Debug Output

https://gist.githubusercontent.com/dak1n1/61c8ee5525332b1fc4da7ad334cf574f/raw/d3559213f651df7cfd1872c2ac966728b5c8dc4c/gistfile1.txt

Expected Behavior

I read the docs and they say:

AtLeastOneOf is a set of schema keys that, when set, at least one of the keys in that list must be specified.

I expected to get an error when I specify host without specifying one of the options that are needed with host. Specifically, client_certificate, client_key, exec, password, token, username.

Actual Behavior

I didn't specify host, because it's optional. But AtLeastOneOf tells me I need to specify host.

Steps to Reproduce

1. Grab your favorite provider to do some development with, or fetch my branch here.
2. If needed, add AtLeastOneOf to an optional schema attribute. (This is already done on my branch).
3. Build the provider and initialize it using a configuration that specifies at least one resource (like my example config above). Omit the attribute that has AtLeastOneOf from your provider configuration.
4. terraform plan or terraform apply.

References

This is my PR where I'm trying to use AtLeastOneOf. hashicorp/terraform-provider-kubernetes#1141

[bflad]

This is (unfortunately) the expected behavior with AtLeastOneOf and most (if not all) of the other schema behavior fields like this -- essentially it will automatically add the "local" attribute to the behavior. In this case, being the list of attributes that require at least one to be configured or an error will be thrown. I vaguely recall during the design of this feature before I joined the maintainers that there was a tradeoff of whether this type of SDK-defined validation should instead be defined outside the schema for clarity, since it can feel awkward in some cases or redundant in others (such as symmetrically declaring ConflictsWith in all effected attributes).

In any event, we'll get the documentation for this adjusted.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.