"Error: Output refers to sensitive values" when applying fleet configuration

[JulianCBC]

Describe the bug

When applying a spot-fleet configuration, the apply fails with this error:

Error: Output refers to sensitive values

  on outputs.tf line 56:
  56: output "runner_user_data" {

To reduce the risk of accidentally exporting sensitive data that was
intended to be only internal, Terraform requires that any root module
output containing sensitive data be explicitly marked as sensitive, to
confirm your intent.

If you do intend to export this data, annotate the output value as
sensitive by adding the following argument:
    sensitive = true

This is because that output is exporting local.template_user_data which is templated using local.template_gitlab_runner which is templated using tls_private_key.fleet[0].private_key_pem which is flagged as sensitive according to the documentation. https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key#private_key_pem

To Reproduce

This is reproducible using any fleet configuration. Relevant parts of my configuration:

  environment = "test-runners"

  vpc_id    = var.vpc_id
  subnet_id = var.public_subnets[2]

  runner_gitlab_registration_config = {
    registration_token = var.runners_token
    description        = "Test Runners"
    locked_to_project  = "true"
    run_untagged       = "true"
    maximum_timeout    = "3600"
  }

  runner_instance = {
    name       = "Test Runners"
    ssm_access = true
  }

  runner_gitlab = {
    url = "https://gitlab.com"
  }

  runner_worker_docker_machine_instance = {
    private_address_only = false
    idle_count           = 0
    root_size            = 16
    subnet_ids           = var.public_subnets
    types = [
      "m6i.large", "m6a.large", "m5zn.large", "m5a.large", "m5.large",
    ]
  }

  runner_worker_docker_machine_fleet = {
    enable = true
  }

Expected behavior

Apply proceeds without errors.

[JulianCBC]

As far as I can tell, the underlying issue here - private key being sensitive - is the cause of basically all the various issues around sensitive output values since the fleet support was introduced.

1. Whoever developed that code didn't (fully) test it using non-fleet configurations, so they didn't discover that the nonsensitive() call was incorrect
2. When that issue was fixed: runner_user_data can not output nonsensitive value  #828 -> revert: removes the nonsensitive from runner_user_data output #832, the issue with the fleet configuration wasn't discovered

So now we end up here with the fleet configuration broken.

The "simple" fix is to throw a nonsensitive() around the tls_private_key.fleet[0].private_key_pem in the inner template, but another fix would be to make the output conditional based on whether fleet is enabled (i.e. fleet ? nonsensitive(value) : value) or just removing the output entirely.