fix(helm_release): Preserve Terraform state on failed Helm operations (#1669)

[desek]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls (access controls, encryption, logging) in this pull request.

Description

This PR fixes a critical bug where helm_release resources are randomly removed from Terraform state after failed deployments or during refresh operations. This issue causes subsequent terraform apply runs to fail with the error "cannot re-use a name that is still in use" because Terraform attempts to recreate releases that already exist in the Kubernetes cluster but are no longer tracked in state.

Root Causes Addressed:

1. Update Function (Primary Fix): When a Helm upgrade fails, the function now saves state before returning an error. Previously, it returned immediately without updating state, causing state loss when combined with subsequent Read operations.

2. Create Function: Added state persistence before returning error on failed create to prevent orphaning releases from Terraform tracking.

3. Read Function: Improved error handling order and added informative logging when removing resources from state.

4. resourceReleaseExists Function: Completely rewritten to use action.List instead of getRelease to detect releases in ALL states (deployed, failed, pending-install, pending-upgrade, etc.). This is more comprehensive and prevents false negatives that led to state removal.

Changes Summary:

• helm/resource_helm_release.go: Enhanced error handling in Create, Read, and Update functions to preserve state on failures; rewrote resourceReleaseExists for comprehensive release detection
• helm/resource_helm_release_test.go: Added 8 new acceptance tests covering various failure scenarios

Fixes #1669

Acceptance tests

• Have you added an acceptance test for the functionality being added?

New Acceptance Tests:

• TestAccResourceRelease_updateExistingFailed - Tests failed deployment preserves state and recovery
• TestAccResourceRelease_statePreservedDuringRefresh - Tests state not removed during refresh
• TestAccResourceRelease_refreshPreservesFailedState - Tests refresh preserves failed release state
• TestAccResourceRelease_comprehensiveReleaseDetection - Tests release detection in all states
• TestAccResourceRelease_failedInitialDeployPreservesState - Tests failed initial deployment preserves state
• TestAccResourceRelease_failedInitialDeployAtomicNoState - Tests atomic=true behavior on failed installation
• TestAccResourceRelease_deleteOperationCorrectBehavior - Tests delete operation maintains correct behavior
• TestAccResourceRelease_deleteAlreadyRemovedRelease - Tests delete handles already-removed release gracefully

Release Note

Release note for CHANGELOG:

bug: Fix helm_release resources being randomly removed from Terraform state after failed deployments or during refresh operations (#1669)

References

• GitHub Issue: v3 Provider appears to randomly remove helm_release resources from TF state - Hard to reproduce #1669

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[hashicorp-cla-app]

All committers have signed the CLA.

[desek]

@jrhouston / @jaylonmcshan19-x - any chance you can have a look at this?

[CRASH-Tech]

Merge please

[schnell3526]

Hi @desek, thank you for this important fix! I've cherry-picked your changes into my fork and found a few issues in the test cases that cause CI failures:

1. TestAccResourceRelease_updateExistingFailed

The expected revision in Step 4 should be "4" instead of "3", because each failed upgrade (Step 2 and Step 3) increments the Helm revision:

• Step 1: revision 1 (initial deploy)
• Step 2: revision 2 (failed upgrade)
• Step 3: revision 3 (failed upgrade again)
• Step 4: revision 4 (successful recovery)

2. TestAccResourceRelease_statePreservedDuringRefresh and TestAccResourceRelease_refreshPreservesFailedState

These tests fail with:

TestStep cannot have Config or ConfigDirectory or ConfigFile and RefreshState

The terraform-plugin-testing framework does not allow Config and RefreshState to be used in the same TestStep. The fix is to remove Config from the RefreshState steps.

3. Hardcoded "FAILED" status

Several tests use hardcoded "FAILED" string, but Helm returns lowercase "failed". The fix is to use release.StatusFailed.String() for consistency with other tests in this file.

---

I've fixed these issues in my fork. Here are the commits if they help:

• schnell3526@802470130
• schnell3526@da816b8bd

[desek]

@schnell3526 can you have a look if it passes the test now?