Error when adding list of instances to firewall

[svdo]

What happened?

I'm trying to create a number of nodes, and add them to a firewall. When I specify a hard-coded list of instance ids, it works, but when I try to make it dynamic, I get an error.

Steps to reproduce

Using a new Pulumi project using the Linode typescript template, I create a number of nodes:

let instances = []
const numNodes = 2

for (let n = 0; n < numNodes; n++) {
    // Create a Linode resource (Linode Instance)
    const instance = new linode.Instance(`foo-${n}`, {
        type: "g6-nanode-1",
        region: "eu-central",
        image: 'linode/ubuntu22.04',
        label: `foo-${n}`,
        group: 'foo',
        tags: ["test"],
        privateIp: true,
        interfaces: [{purpose: 'public'}, {purpose: 'vlan', label: 'acc-swarm', ipamAddress: '192.0.2.0/24'}],
    });

    instances.push(instance)
}

I then create a firewall for those nodes:

const accSwarmFirewall = new linode.Firewall("acc-swarm", {
    label: 'acc_swarm',
    inbounds: [ ... ],
    inboundPolicy: 'DROP',
    outbounds: [ ... ],
    outboundPolicy: "ACCEPT",
    linodes: [instances[0].id, instances[1].id]     //   <=== note: hard-coded list of ids from instances above
})

Instead of hard-coding the list of linodes in the firewall declaration, I want to make it dynamic. The obvious way would be:

const accSwarmFirewall = new linode.Firewall("acc-swarm", {
    label: 'acc_swarm',
    inbounds: [ ... ],
    inboundPolicy: 'DROP',
    outbounds: [ ... ],
    outboundPolicy: "ACCEPT",
    linodes: instances.map(i => i.id)     //   <=== note: no longer hard-coded
})

Expected Behavior

After deploying with numNodes=2, then increasing numNodes to 3, I expect the third node to be added to the firewall.

Actual Behavior

During preview, I get this error:

  pulumi:pulumi:Stack (foo-dev):
    panic: interface conversion: interface {} is string, not int
    goroutine 67 [running]:
    github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.HashInt({0x291b0a0?, 0x31acd50?})
        /home/runner/go/pkg/mod/github.com/pulumi/terraform-plugin-sdk/v2@v2.0.0-20220824175045-450992f2f5b9/helper/schema/set.go:24 +0x55
    github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfshim/sdk-v2.v2Schema.SetHash({0x0?}, {0x291b0a0, 0x31acd50})
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v3@v3.28.1/pkg/tfshim/sdk-v2/schema.go:176 +0x43
    github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge.visitPropertyValue({0xc00400a8e0, 0x7}, {0xc001062284, 0x7}, {{0x28c7ba0?, 0xc00106eb58?}}, {0x31dd8b8?, 0xc0000b12c0}, 0x0, 0x0, ...)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v3@v3.28.1/pkg/tfbridge/diff.go:114 +0x812
    github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge.doIgnoreChanges({0x31d1070, 0xc0002a0060}, 0xc003f53810?, 0x31b5c00?, 0xc003f5e690?, {0x0, 0x0, 0x0?}, {0x31d3b78, 0xc003f1e980})
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v3@v3.28.1/pkg/tfbridge/diff.go:260 +0x3ce
    github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge.(*Provider).Diff(0xc000560b40, {0x31cbc88?, 0xc001060690?}, 0xc00044e070)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi-terraform-bridge/v3@v3.28.1/pkg/tfbridge/provider.go:762 +0x608
    github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_Diff_Handler.func1({0x31cbc88, 0xc001060690}, {0x2bb6760?, 0xc00044e070})
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v3@v3.38.0/proto/go/provider.pb.go:3707 +0x78
    github.com/grpc-ecosystem/grpc-opentracing/go/otgrpc.OpenTracingServerInterceptor.func1({0x31cbc88, 0xc0010601b0}, {0x2bb6760, 0xc00044e070}, 0xc001074060, 0xc00106e0c0)
        /home/runner/go/pkg/mod/github.com/grpc-ecosystem/grpc-opentracing@v0.0.0-20180507213350-8e809c8a8645/go/otgrpc/server.go:57 +0x3f9
    github.com/pulumi/pulumi/sdk/v3/proto/go._ResourceProvider_Diff_Handler({0x2c7fb80?, 0xc000560b40}, {0x31cbc88, 0xc0010601b0}, 0xc00044e000, 0xc00053fc40)
        /home/runner/go/pkg/mod/github.com/pulumi/pulumi/sdk/v3@v3.38.0/proto/go/provider.pb.go:3709 +0x138
    google.golang.org/grpc.(*Server).processUnaryRPC(0xc0007e0000, {0x31d4240, 0xc0004f5380}, 0xc001070000, 0xc000693da0, 0x4233608, 0x0)
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.48.0/server.go:1295 +0xb2b
    google.golang.org/grpc.(*Server).handleStream(0xc0007e0000, {0x31d4240, 0xc0004f5380}, 0xc001070000, 0x0)
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.48.0/server.go:1636 +0xa2f
    google.golang.org/grpc.(*Server).serveStreams.func1.2()
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.48.0/server.go:932 +0x98
    created by google.golang.org/grpc.(*Server).serveStreams.func1
        /home/runner/go/pkg/mod/google.golang.org/grpc@v1.48.0/server.go:930 +0x28a

Output of pulumi about

CLI          
Version      3.52.1
Go Version   go1.19.5
Go Compiler  gc

Plugins
NAME       VERSION
cloudinit  1.3.0
command    0.7.0
linode     3.10.1
nodejs     unknown

Host     
OS       darwin
Version  13.1
Arch     x86_64

This project is written in nodejs: executable='/Users/[redacted]/.asdf/shims/node' version='v18.13.0'

Current Stack: dev

TYPE                            URN
pulumi:pulumi:Stack             urn:pulumi:dev::foo::pulumi:pulumi:Stack::foo-dev
pulumi:providers:linode         urn:pulumi:dev::foo::pulumi:providers:linode::default_3_10_1
linode:index/instance:Instance  urn:pulumi:dev::foo::linode:index/instance:Instance::foo-0
linode:index/instance:Instance  urn:pulumi:dev::foo::linode:index/instance:Instance::foo-1
linode:index/instance:Instance  urn:pulumi:dev::foo::linode:index/instance:Instance::foo-2
linode:index/firewall:Firewall  urn:pulumi:dev::foo::linode:index/firewall:Firewall::acc-swarm


Found no pending operations associated with dev

Backend        
Name           [redacted]
URL            file://~
User           [redacted]
Organizations  

Dependencies:
NAME               VERSION
@pulumi/cloudinit  1.3.0
@pulumi/command    0.7.0
@pulumi/linode     3.10.1
@pulumi/pulumi     3.51.0

Pulumi locates its logs in /var/folders/m7/ykdfcv0x2xb1p75hztn5d9s40000gt/T/ by default

Additional context

Please note that this error happens during the "preview" phase. When I run pulumi with --skip-preview, it works as expected.

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[svdo]

One more thing: it seems strange that Instance.id is of type Output<ID>, where ID is a string, but the Firewall expects a list of IDs that are declared as number.

[Frassle]

Notes from slack.
It was noted this only failed on update, not on create. It also failed at preview time, and when running up with --skip-preview it worked.
This is almost certainly the provider not handling an input to update being "unknown".

[svdo]

I just verified that it also fails in the preview stage when adding nodes when using the syntax linodes: [instances[0].id, instances[1].id].

[aq17]

Hi @svdo , apologies for this – we are currently tracking this issue here. There is a workaround explained in the discussion that should work in the meantime:
instances.map(i => i.id.apply(parseInt))