write only values are lost during update

[asheynkmantyler]

Terraform, Provider, Kubernetes and Helm Versions

Terraform version: 1.14.4
Provider version: 3.1.1
Kubernetes version: 1.32

Affected Resource(s)

• helm_release

Terraform Configuration Files

first you create helm release:

resource "helm_release" "app" {
	repository = "${path.module}"
	name = "echo"
	chart = "echo"
	namespace = "echo1"
	create_namespace = true
  set_wo = [ {
    name = "foo"
    value = "bar"
  } ]
  set_wo_revision = 1
}

then you update helm release:

resource "helm_release" "app" {
repository = "${path.module}"
name = "echo"
chart = "echo"
namespace = "echo1"
create_namespace = true
set = [{
name = "foo2"
value = "bar2"
}]

set_wo = [ {
name = "foo"
value = "bar"
} ]
set_wo_revision = 1
}

Steps to Reproduce

1. create any helm release resource with set_wo argument and run terraform apply
2. Update helm_release resource, but not write only argument and run terraform apply again

Expected Behavior

I would expect the helm chart after second apply to contain both new set argument and unchanged set_wo argument, since set_wo_revision was not changed

Actual Behavior

the set_wo parameter is no longer applied to helm chart after second apply

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[dza89]

This looks like expected behaviour, not really sure how this should work.

Fyi:

reuse_values = true

should at least mitigate this behaviour.

[asheynkmantyler]

Thank you for mitigation suggestion - I will definetely try it.

I dont think this is expected behavior. If it is, you need to increment set_wo_revision any time you change something in resource, even if it is completely unrelated to write-only setting. To me at least it doesn't make sense. To me, you should increment set_wo_revision only when you actually change set_wo parameter

[dennismdejong]

Thanks for filing this. Write-only () values are intentionally not stored in Terraform state — this is the defining characteristic of write-only attributes. When write-only values change, they are re-applied during the next update.

To ensure write-only values are re-applied when other changes occur (or on every update):

1. Increment when you want write-only values to be re-sent to Helm
2. Consider using so that prior values are preserved during upgrades

This is working as designed, but we understand the UX friction. We'll consider improvements to make write-only value handling more intuitive in a future release.

[dennismdejong]

Thanks for filing this. Write-only (set_wo) values are intentionally not stored in Terraform state — this is the defining characteristic of write-only attributes. When write-only values change, they are re-applied during the next update.

To ensure write-only values are re-applied when other changes occur (or on every update):

1. Increment set_wo_revision when you want write-only values to be re-sent to Helm
2. Consider using reuse_values = true so that prior values are preserved during upgrades

This is working as designed, but we understand the UX friction. We'll consider improvements to make write-only value handling more intuitive in a future release.