Skip to content

Preserve workspace tags on first apply #1851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Preserve workspace tags on first apply #1851

wants to merge 4 commits into from

Conversation

shwetamurali
Copy link
Contributor

@shwetamurali shwetamurali commented Sep 19, 2025 •
edited
Loading

Description

When tfe_workspace sets workspace-level tags and tfe_workspace_settings is applied without a tags argument, the first apply could clear workspace-level tags, leaving only project-inherited tags visible until a second apply reconciles them.

Root cause: In updateSettings, the provider treated an unset tags attribute as empty, which triggered DeleteAllTagBindings and unintentionally wiped workspace-level tags.

Fix: Only touch tags when tags is explicitly set

  • tags = {} → clear workspace-level tag bindings.
  • Non-empty map → set/replace workspace-level tag bindings.
  • Unset/unknown → omit tags from the update

Remember to:

Testing plan

Apply this config:

terraform {

  required_providers {
    tfe = {
      source  = "hashicorp/tfe"
      version = "0.68.0"
    }
  }
}

  provider "tfe" {
      hostname = "app.terraform.io"
  }
  
  resource "tfe_project" "this" {
    name         = var.project_name
    organization = var.organization_name
    tags = var.tags
  }
  
  resource "tfe_workspace" "this" {
    name         = var.workspace_name
    organization = var.organization_name
    project_id   = var.project_id
    tags = var.tags
  }
  
  resource "tfe_workspace_settings" "self" {
    workspace_id        = tfe_workspace.this.id
    #assessments_enabled = true
  }

}

Pre-fix: first apply shows only project tag(s); workspace tag appears only after a second apply.

Post-fix: Apply once with the same config. Output includes both env=dev and app=web after a single apply.

  1. Acceptance tests
shweta.murali@shweta terraform-provider-tfe % go test ./internal/provider -v -run TestAccTFEWorkspaceSettings_preservesWorkspaceTagsOnFirstApply
=== RUN   TestAccTFEWorkspaceSettings_preservesWorkspaceTagsOnFirstApply
--- PASS: TestAccTFEWorkspaceSettings_preservesWorkspaceTagsOnFirstApply (4.96s)
PASS
ok  	github.com/hashicorp/terraform-provider-tfe/internal/provider	5.624s

shweta.murali@shweta terraform-provider-tfe % go test ./internal/provider -v -run TestAccTFEWorkspaceSettings_explicitEmptyClearsWorkspaceTags
=== RUN   TestAccTFEWorkspaceSettings_explicitEmptyClearsWorkspaceTags
--- PASS: TestAccTFEWorkspaceSettings_explicitEmptyClearsWorkspaceTags (9.33s)
PASS
ok  	github.com/hashicorp/terraform-provider-tfe/internal/provider	9.695s

@shwetamurali shwetamurali marked this pull request as ready for review September 19, 2025 18:39
@shwetamurali shwetamurali requested a review from a team as a code owner September 19, 2025 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@shwetamurali