Repository: hashicorp/terraform-provider-kubernetes

Issue:
`kubernetes_manifest` throws "Provider produced inconsistent result after apply" error when applying PrometheusRules CRD
### Terraform Version, Provider Version and Kubernetes Version

```
Terraform version: 0.15.1
Kubernetes provider version: v2.5.0
Kubernetes version: 1.20
```

### Affected Resource(s)

PrometheusRule


### Steps to Reproduce
1. https://github.com/strimzi/strimzi-kafka-operator/blob/main/examples/metrics/prometheus-install/prometheus-rules.yaml
2. `tfk8s -f prometheus-rules.yaml -o prometheus-rules.tf`  
3.  `terraform apply`

### Expected Behavior
No errors should be thrown. 

### Actual Behavior
```

  | [2021-09-22T16:07:58Z] │ Error: Provider produced inconsistent result after apply
  | [2021-09-22T16:07:58Z] │
  | [2021-09-22T16:07:58Z] │ When applying changes to kubernetes_manifest.prometheus_rules, provider
  | [2021-09-22T16:07:58Z] │ "provider[\"registry.terraform.io/hashicorp/kubernetes\"]" produced an
  | [2021-09-22T16:07:58Z] │ unexpected new value: .object: wrong final value type: incorrect object
  | [2021-09-22T16:07:58Z] │ attributes.
  | [2021-09-22T16:07:58Z] │
  | [2021-09-22T16:07:58Z] │ This is a bug in the provider, which should be reported in the provider's
  | [2021-09-22T16:07:58Z] │ own issue tracker.


```




Discussion:
@AntonyKapustin: Having same.@rlafferty: Any idea when https://github.com/hashicorp/terraform-provider-kubernetes/pull/1443 will get shipped in a release?  I believe this will resolve quite a few problems Im having around `kubernetes_manifest` when used with a CRD.@M1kep: Same issue with [Bitnami SealedSecrets](https://github.com/bitnami-labs/sealed-secrets).@alexsomesan: Hi all! This issue should now be resolved in provider release 2.6.0

Can you please confirm if your specific use-case is also unblocked?@kjagiello: I am still experiencing this issue in 2.6.1. @alexsomesan In my case the problem appears when creating an Argo CD eventsource. The interesting thing is that I'm getting following plan for the resource:

```
  # module.application.module.api.module.cd_eventsource.kubernetes_manifest.eventsource will be updated in-place
  ~ resource "kubernetes_manifest" "eventsource" {
      ~ object   = {
          ~ spec       = {
              ~ github  = {
                  ~ default = {
                      ~ events        = [
                          - "deployment",
                        ] -> [
                          + "deployment",
                        ]
                        # (8 unchanged elements hidden)
                    }
                }
                # (1 unchanged element hidden)
            }
            # (3 unchanged elements hidden)
        }
        # (1 unchanged attribute hidden)
    }
```

### Apply output

```
╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to module.application.module.api.module.cd_eventsource.kubernetes_manifest.eventsource, provider "provider[\"registry.terraform.io/hashicorp/kubernetes\"]" produced an unexpected new value: .object: wrong final
│ value type: incorrect object attributes.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵
```

### Versions

- Terraform: 1.0.10
- Kubernetes provider: 2.6.1@nbwest: This still seems to be an issue with version v2.16.1

```bash
curl https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.2.0/deploy/static/provider/aws/deploy.yaml -o ingress-nginx-deploy.yaml
tfk8s -f ingress-nginx-deploy.yaml -o ingress-nginx-deploy.tf
terraform apply
```

```
Error: Provider produced inconsistent result after apply
When applying changes to kubernetes_manifest.job_ingress_nginx_ingress_nginx_admission_create,
 provider "provider[\"registry.terraform.io/hashicorp/kubernetes\"]"
 produced an unexpected new value: .object.spec.template.metadata.labels:
 new element "controller-uid" has appeared.
 
 This is a bug in the provider, which should be reported in the provider's
own issue tracker.
```
@avdhoot: Still an issue with v2.7.1
Here Prometheus operator(admission controller ) adds [annotaion](https://github.com/prometheus-operator/prometheus-operator/blob/32ebc58aeaf6266946d67c4b446f7a36265e543d/pkg/admission/admission.go#LL42C10-L42C10) . Then terraform the complaint with the below error . 

```
provider
"provider[\"registry.terraform.io/hashicorp/kubernetes\"]" produced an
unexpected new value: .object.metadata.annotations: was null, but now
cty.MapVal(map[string]cty.Value***"prometheus-operator-validated":cty.StringVal("true")***).
```@github-actions: Marking this issue as stale due to inactivity. If this issue receives no comments in the next 30 days it will automatically be closed. If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. This helps our maintainers find and focus on the active issues. Maintainers may also remove the stale label at their discretion. Thank you!

Solution patch:
diff --git a/manifest/provider/resource.go b/manifest/provider/resource.go
index f916cc62..b42b4a55 100644
--- a/manifest/provider/resource.go
+++ b/manifest/provider/resource.go
@@ -129,13 +129,11 @@ func (ps *RawProviderServer) TFTypeFromOpenAPI(ctx context.Context, gvk schema.G
 		if _, ok := atts["kind"]; !ok {
 			atts["kind"] = tftypes.String
 		}
-		if _, ok := atts["metadata"]; !ok {
-			metaType, err := oapi.GetTypeByGVK(openapi.ObjectMetaGVK)
-			if err != nil {
-				return nil, fmt.Errorf("failed to generate tftypes for v1.ObjectMeta: %s", err)
-			}
-			atts["metadata"] = metaType.(tftypes.Object)
+		metaType, err := oapi.GetTypeByGVK(openapi.ObjectMetaGVK)
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate tftypes for v1.ObjectMeta: %s", err)
 		}
+		atts["metadata"] = metaType.(tftypes.Object)
 
 		tsch = tftypes.Object{AttributeTypes: atts}
 	}



Test patch:
diff --git a/manifest/test/acceptance/customresourcedefinition_oapi3_metadata_test.go b/manifest/test/acceptance/customresourcedefinition_oapi3_metadata_test.go
new file mode 100644
index 00000000..a9b6d9a3
--- /dev/null
+++ b/manifest/test/acceptance/customresourcedefinition_oapi3_metadata_test.go
@@ -0,0 +1,176 @@
+// +build acceptance
+
+package acceptance
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/terraform-provider-kubernetes/manifest/provider"
+	tfstatehelper "github.com/hashicorp/terraform-provider-kubernetes/manifest/test/helper/state"
+)
+
+func TestKubernetesManifest_CustomResource_OAPIv3_metadata(t *testing.T) {
+	kind := strings.Title(randString(8))
+	plural := strings.ToLower(kind) + "s"
+	group := "terraform.io"
+	version := "v1"
+	groupVersion := group + "/" + version
+	crd := fmt.Sprintf("%s.%s", plural, group)
+
+	name := strings.ToLower(randName())
+	namespace := "default" //randName()
+
+	tfvars := TFVARS{
+		"name":          name,
+		"namespace":     namespace,
+		"kind":          kind,
+		"plural":        plural,
+		"group":         group,
+		"group_version": groupVersion,
+		"cr_version":    version,
+	}
+
+	step1 := tfhelper.RequireNewWorkingDir(t)
+	step1.SetReattachInfo(reattachInfo)
+	defer func() {
+		step1.RequireDestroy(t)
+		step1.Close()
+		k8shelper.AssertResourceDoesNotExist(t, "apiextensions.k8s.io/v1", "customresourcedefinitions", crd)
+	}()
+
+	// Step 1: Create a structural CRD with a fairly complex schema
+	// (inspired by the Prostgres Operator)
+	tfconfig := loadTerraformConfig(t, "CustomResourceOAPI3-metadata/custom_resource_definition.tf", tfvars)
+	step1.RequireSetConfig(t, string(tfconfig))
+	step1.RequireInit(t)
+	step1.RequireApply(t)
+	k8shelper.AssertResourceExists(t, "apiextensions.k8s.io/v1", "customresourcedefinitions", crd)
+
+	// wait for API to finish ingesting the CRD
+	time.Sleep(5 * time.Second) //lintignore:R018
+
+	reattachInfo2, err := provider.ServeTest(context.Background(), hclog.Default())
+	if err != nil {
+		t.Errorf("Failed to create additional provider instance: %q", err)
+	}
+	step2 := tfhelper.RequireNewWorkingDir(t)
+	step2.SetReattachInfo(reattachInfo2)
+	defer func() {
+		step2.RequireDestroy(t)
+		step2.Close()
+		k8shelper.AssertResourceDoesNotExist(t, groupVersion, kind, name)
+	}()
+
+	// Step 2: create a CR of the type defined by the CRD above
+	tfconfig = loadTerraformConfig(t, "CustomResourceOAPI3-metadata/custom_resource.tf", tfvars)
+	step2.RequireSetConfig(t, string(tfconfig))
+	step2.RequireInit(t)
+	step2.RequireApply(t)
+
+	tfstate := tfstatehelper.NewHelper(step2.RequireState(t))
+	tfstate.AssertAttributeValues(t, tfstatehelper.AttributeValues{
+		"kubernetes_manifest.test_cr.object.metadata.name":           name,
+		"kubernetes_manifest.test_cr.object.metadata.namespace":      namespace,
+		"kubernetes_manifest.test_cr.object.spec.teamId":             "test",
+		"kubernetes_manifest.test_cr.object.spec.volume.size":        "1Gi",
+		"kubernetes_manifest.test_cr.object.spec.users.foo_user":     []interface{}{"superuser"},
+		"kubernetes_manifest.test_cr.object.spec.users.bar_user":     []interface{}{},
+		"kubernetes_manifest.test_cr.object.spec.users.mike":         []interface{}{"superuser", "createdb"},
+		"kubernetes_manifest.test_cr.object.spec.numberOfInstances":  json.Number("2"),
+		"kubernetes_manifest.test_cr.object.spec.databases.foo":      "devdb",
+		"kubernetes_manifest.test_cr.object.spec.postgresql.version": "12",
+	})
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.additionalVolumes")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.allowedSourceRanges")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.cluster")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.s3_access_key_id")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.s3_endpoint")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.s3_force_path_style")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.s3_secret_access_key")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.s3_wal_path")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.timestamp")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.clone.uid")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.dockerImage")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.maxDBConnections")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.mode")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.numberOfInstances")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.schema")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.user")
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.connectionPooler.resources")
+
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.dockerImage")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableConnectionPooler")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableLogicalBackup")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableMasterLoadBalancer")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableReplicaConnectionPooler")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableReplicaLoadBalancer")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.enableShmVolume")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.initContainers")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.init_containers")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.logicalBackupSchedule")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.maintenanceWindows")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.nodeAffinity")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution")
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.initdb")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.loop_wait")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.maximum_lag_on_failover")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.pg_hba")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.retry_timeout")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.slots")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.synchronous_mode")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.synchronous_mode_strict")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.patroni.ttl")
+
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.podAnnotations")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.podPriorityClassName")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.pod_priority_class_name")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.postgresql")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.postgresql.parameters")
+
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.preparedDatabases")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.replicaLoadBalancer")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources")
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.limits")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.limits.cpu")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.limits.memory")
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.requests")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.requests.cpu")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.resources.requests.memory")
+
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.schedulerName")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.serviceAnnotations")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.sidecars")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.spiloFSGroup")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.spiloRunAsGroup")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.spiloRunAsUser")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.standby")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.standby.s3_wal_path")
+
+	tfstate.AssertAttributeNotEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls.caFile")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls.caSecretName")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls.certificateFile")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls.privateKeyFile")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tls.secretName")
+
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.tolerations")
+	tfstate.AssertAttributeEmpty(t, "kubernetes_manifest.test_cr.object.spec.useLoadBalancer")
+
+}
diff --git a/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource.tf b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource.tf
new file mode 100644
index 00000000..0654976a
--- /dev/null
+++ b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource.tf
@@ -0,0 +1,34 @@
+resource "kubernetes_manifest" "test_cr" {
+
+  manifest = {
+    apiVersion = "${var.group}/${var.cr_version}"
+    kind       = var.kind
+    metadata = {
+      name      = var.name
+      namespace = var.namespace
+    }
+    spec = {
+      teamId = "test"
+      volume = {
+        size = "1Gi"
+      }
+      numberOfInstances = 2
+      users = {
+        mike = [
+          "superuser",
+          "createdb"
+        ]
+        foo_user = [
+          "superuser"
+        ]
+        bar_user = []
+      }
+      databases = {
+        foo = "devdb"
+      }
+      postgresql = {
+        version = "12"
+      }
+    }
+  }
+}
diff --git a/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource_definition.tf b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource_definition.tf
new file mode 100644
index 00000000..b8856de1
--- /dev/null
+++ b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/custom_resource_definition.tf
@@ -0,0 +1,797 @@
+resource "kubernetes_manifest" "test_crd" {
+
+  manifest = {
+    "apiVersion" = "apiextensions.k8s.io/v1"
+    "kind"       = "CustomResourceDefinition"
+    "metadata" = {
+      "name" = "${var.plural}.${var.group}"
+    }
+    "spec" = {
+      "group" = var.group
+      "names" = {
+        "categories" = [
+          "all",
+        ]
+        "kind"     = var.kind
+        "listKind" = "${var.kind}List"
+        "plural"   = var.plural
+        "singular" = lower(var.kind)
+      }
+      "scope" = "Namespaced"
+      "versions" = [
+        {
+          "additionalPrinterColumns" = [
+            {
+              "description" = "Team responsible for Postgres cluster"
+              "jsonPath"    = ".spec.teamId"
+              "name"        = "Team"
+              "type"        = "string"
+            },
+            {
+              "description" = "PostgreSQL version"
+              "jsonPath"    = ".spec.postgresql.version"
+              "name"        = "Version"
+              "type"        = "string"
+            },
+            {
+              "description" = "Number of Pods per Postgres cluster"
+              "jsonPath"    = ".spec.numberOfInstances"
+              "name"        = "Pods"
+              "type"        = "integer"
+            },
+            {
+              "description" = "Size of the bound volume"
+              "jsonPath"    = ".spec.volume.size"
+              "name"        = "Volume"
+              "type"        = "string"
+            },
+            {
+              "description" = "Requested CPU for Postgres containers"
+              "jsonPath"    = ".spec.resources.requests.cpu"
+              "name"        = "CPU-Request"
+              "type"        = "string"
+            },
+            {
+              "description" = "Requested memory for Postgres containers"
+              "jsonPath"    = ".spec.resources.requests.memory"
+              "name"        = "Memory-Request"
+              "type"        = "string"
+            },
+            {
+              "jsonPath" = ".metadata.creationTimestamp"
+              "name"     = "Age"
+              "type"     = "date"
+            },
+            {
+              "description" = "Current sync status of postgresql resource"
+              "jsonPath"    = ".status.PostgresClusterStatus"
+              "name"        = "Status"
+              "type"        = "string"
+            },
+          ]
+          "name" = var.cr_version
+          "schema" = {
+            "openAPIV3Schema" = {
+              "properties" = {
+                "apiVersion" = {
+                  "enum" = [
+                    "${var.group}/${var.cr_version}",
+                  ]
+                  "type" = "string"
+                }
+                "kind" = {
+                  "enum" = [
+                    var.kind,
+                  ]
+                  "type" = "string"
+                }
+                "metadata" = {
+                  "type" = "object"
+                }
+                "spec" = {
+                  "properties" = {
+                    "additionalVolumes" = {
+                      "items" = {
+                        "properties" = {
+                          "mountPath" = {
+                            "type" = "string"
+                          }
+                          "name" = {
+                            "type" = "string"
+                          }
+                          "subPath" = {
+                            "type" = "string"
+                          }
+                          "targetContainers" = {
+                            "items" = {
+                              "type" = "string"
+                            }
+                            "nullable" = true
+                            "type"     = "array"
+                          }
+                          "volumeSource" = {
+                            "type"                                 = "object"
+                            "x-kubernetes-preserve-unknown-fields" = true
+                          }
+                        }
+                        "required" = [
+                          "name",
+                          "mountPath",
+                          "volumeSource",
+                        ]
+                        "type" = "object"
+                      }
+                      "type" = "array"
+                    }
+                    "allowedSourceRanges" = {
+                      "items" = {
+                        "pattern" = "^(\\d|[1-9]\\d|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d|[1-9]\\d|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d|[1-9]\\d|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d|[1-9]\\d|1\\d\\d|2[0-4]\\d|25[0-5])\\/(\\d|[1-2]\\d|3[0-2])$"
+                        "type"    = "string"
+                      }
+                      "nullable" = true
+                      "type"     = "array"
+                    }
+                    "clone" = {
+                      "properties" = {
+                        "cluster" = {
+                          "type" = "string"
+                        }
+                        "s3_access_key_id" = {
+                          "type" = "string"
+                        }
+                        "s3_endpoint" = {
+                          "type" = "string"
+                        }
+                        "s3_force_path_style" = {
+                          "type" = "boolean"
+                        }
+                        "s3_secret_access_key" = {
+                          "type" = "string"
+                        }
+                        "s3_wal_path" = {
+                          "type" = "string"
+                        }
+                        "timestamp" = {
+                          "pattern" = "^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(\\.[0-9]+)?(([+-]([01][0-9]|2[0-3]):[0-5][0-9]))$"
+                          "type"    = "string"
+                        }
+                        "uid" = {
+                          "format" = "uuid"
+                          "type"   = "string"
+                        }
+                      }
+                      "required" = [
+                        "cluster",
+                      ]
+                      "type" = "object"
+                    }
+                    "connectionPooler" = {
+                      "properties" = {
+                        "dockerImage" = {
+                          "type" = "string"
+                        }
+                        "maxDBConnections" = {
+                          "type" = "integer"
+                        }
+                        "mode" = {
+                          "enum" = [
+                            "session",
+                            "transaction",
+                          ]
+                          "type" = "string"
+                        }
+                        "numberOfInstances" = {
+                          "minimum" = 2
+                          "type"    = "integer"
+                        }
+                        "resources" = {
+                          "properties" = {
+                            "limits" = {
+                              "properties" = {
+                                "cpu" = {
+                                  "pattern" = "^(\\d+m|\\d+(\\.\\d{1,3})?)$"
+                                  "type"    = "string"
+                                }
+                                "memory" = {
+                                  "pattern" = "^(\\d+(e\\d+)?|\\d+(\\.\\d+)?(e\\d+)?[EPTGMK]i?)$"
+                                  "type"    = "string"
+                                }
+                              }
+                              "required" = [
+                                "cpu",
+                                "memory",
+                              ]
+                              "type" = "object"
+                            }
+                            "requests" = {
+                              "properties" = {
+                                "cpu" = {
+                                  "pattern" = "^(\\d+m|\\d+(\\.\\d{1,3})?)$"
+                                  "type"    = "string"
+                                }
+                                "memory" = {
+                                  "pattern" = "^(\\d+(e\\d+)?|\\d+(\\.\\d+)?(e\\d+)?[EPTGMK]i?)$"
+                                  "type"    = "string"
+                                }
+                              }
+                              "required" = [
+                                "cpu",
+                                "memory",
+                              ]
+                              "type" = "object"
+                            }
+                          }
+                          "required" = [
+                            "requests",
+                            "limits",
+                          ]
+                          "type" = "object"
+                        }
+                        "schema" = {
+                          "type" = "string"
+                        }
+                        "user" = {
+                          "type" = "string"
+                        }
+                      }
+                      "type" = "object"
+                    }
+                    "databases" = {
+                      "additionalProperties" = {
+                        "type" = "string"
+                      }
+                      "type" = "object"
+                    }
+                    "dockerImage" = {
+                      "type" = "string"
+                    }
+                    "enableConnectionPooler" = {
+                      "type" = "boolean"
+                    }
+                    "enableLogicalBackup" = {
+                      "type" = "boolean"
+                    }
+                    "enableMasterLoadBalancer" = {
+                      "type" = "boolean"
+                    }
+                    "enableReplicaConnectionPooler" = {
+                      "type" = "boolean"
+                    }
+                    "enableReplicaLoadBalancer" = {
+                      "type" = "boolean"
+                    }
+                    "enableShmVolume" = {
+                      "type" = "boolean"
+                    }
+                    "initContainers" = {
+                      "items" = {
+                        "type"                                 = "object"
+                        "x-kubernetes-preserve-unknown-fields" = true
+                      }
+                      "nullable" = true
+                      "type"     = "array"
+                    }
+                    "init_containers" = {
+                      "items" = {
+                        "type"                                 = "object"
+                        "x-kubernetes-preserve-unknown-fields" = true
+                      }
+                      "nullable" = true
+                      "type"     = "array"
+                    }
+                    "logicalBackupSchedule" = {
+                      "pattern" = "^(\\d+|\\*)(/\\d+)?(\\s+(\\d+|\\*)(/\\d+)?){4}$"
+                      "type"    = "string"
+                    }
+                    "maintenanceWindows" = {
+                      "items" = {
+                        "pattern" = "^\\ *((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\\d):([0-5]?\\d)|(2[0-3]|[01]?\\d):([0-5]?\\d))-((Mon|Tue|Wed|Thu|Fri|Sat|Sun):(2[0-3]|[01]?\\d):([0-5]?\\d)|(2[0-3]|[01]?\\d):([0-5]?\\d))\\ *$"
+                        "type"    = "string"
+                      }
+                      "type" = "array"
+                    }
+                    "nodeAffinity" = {
+                      "properties" = {
+                        "preferredDuringSchedulingIgnoredDuringExecution" = {
+                          "items" = {
+                            "properties" = {
+                              "preference" = {
+                                "properties" = {
+                                  "matchExpressions" = {
+                                    "items" = {
+                                      "properties" = {
+                                        "key" = {
+                                          "type" = "string"
+                                        }
+                                        "operator" = {
+                                          "type" = "string"
+                                        }
+                                        "values" = {
+                                          "items" = {
+                                            "type" = "string"
+                                          }
+                                          "type" = "array"
+                                        }
+                                      }
+                                      "required" = [
+                                        "key",
+                                        "operator",
+                                      ]
+                                      "type" = "object"
+                                    }
+                                    "type" = "array"
+                                  }
+                                  "matchFields" = {
+                                    "items" = {
+                                      "properties" = {
+                                        "key" = {
+                                          "type" = "string"
+                                        }
+                                        "operator" = {
+                                          "type" = "string"
+                                        }
+                                        "values" = {
+                                          "items" = {
+                                            "type" = "string"
+                                          }
+                                          "type" = "array"
+                                        }
+                                      }
+                                      "required" = [
+                                        "key",
+                                        "operator",
+                                      ]
+                                      "type" = "object"
+                                    }
+                                    "type" = "array"
+                                  }
+                                }
+                                "type" = "object"
+                              }
+                              "weight" = {
+                                "format" = "int32"
+                                "type"   = "integer"
+                              }
+                            }
+                            "required" = [
+                              "weight",
+                              "preference",
+                            ]
+                            "type" = "object"
+                          }
+                          "type" = "array"
+                        }
+                        "requiredDuringSchedulingIgnoredDuringExecution" = {
+                          "properties" = {
+                            "nodeSelectorTerms" = {
+                              "items" = {
+                                "properties" = {
+                                  "matchExpressions" = {
+                                    "items" = {
+                                      "properties" = {
+                                        "key" = {
+                                          "type" = "string"
+                                        }
+                                        "operator" = {
+                                          "type" = "string"
+                                        }
+                                        "values" = {
+                                          "items" = {
+                                            "type" = "string"
+                                          }
+                                          "type" = "array"
+                                        }
+                                      }
+                                      "required" = [
+                                        "key",
+                                        "operator",
+                                      ]
+                                      "type" = "object"
+                                    }
+                                    "type" = "array"
+                                  }
+                                  "matchFields" = {
+                                    "items" = {
+                                      "properties" = {
+                                        "key" = {
+                                          "type" = "string"
+                                        }
+                                        "operator" = {
+                                          "type" = "string"
+                                        }
+                                        "values" = {
+                                          "items" = {
+                                            "type" = "string"
+                                          }
+                                          "type" = "array"
+                                        }
+                                      }
+                                      "required" = [
+                                        "key",
+                                        "operator",
+                                      ]
+                                      "type" = "object"
+                                    }
+                                    "type" = "array"
+                                  }
+                                }
+                                "type" = "object"
+                              }
+                              "type" = "array"
+                            }
+                          }
+                          "required" = [
+                            "nodeSelectorTerms",
+                          ]
+                          "type" = "object"
+                        }
+                      }
+                      "type" = "object"
+                    }
+                    "numberOfInstances" = {
+                      "minimum" = 0
+                      "type"    = "integer"
+                    }
+                    "patroni" = {
+                      "properties" = {
+                        "initdb" = {
+                          "additionalProperties" = {
+                            "type" = "string"
+                          }
+                          "type" = "object"
+                        }
+                        "loop_wait" = {
+                          "type" = "integer"
+                        }
+                        "maximum_lag_on_failover" = {
+                          "type" = "integer"
+                        }
+                        "pg_hba" = {
+                          "items" = {
+                            "type" = "string"
+                          }
+                          "type" = "array"
+                        }
+                        "retry_timeout" = {
+                          "type" = "integer"
+                        }
+                        "slots" = {
+                          "additionalProperties" = {
+                            "additionalProperties" = {
+                              "type" = "string"
+                            }
+                            "type" = "object"
+                          }
+                          "type" = "object"
+                        }
+                        "synchronous_mode" = {
+                          "type" = "boolean"
+                        }
+                        "synchronous_mode_strict" = {
+                          "type" = "boolean"
+                        }
+                        "ttl" = {
+                          "type" = "integer"
+                        }
+                      }
+                      "type" = "object"
+                    }
+                    "podAnnotations" = {
+                      "additionalProperties" = {
+                        "type" = "string"
+                      }
+                      "type" = "object"
+                    }
+                    "podPriorityClassName" = {
+                      "type" = "string"
+                    }
+                    "pod_priority_class_name" = {
+                      "type" = "string"
+                    }
+                    "postgresql" = {
+                      "properties" = {
+                        "parameters" = {
+                          "additionalProperties" = {
+                            "type" = "string"
+                          }
+                          "type" = "object"
+                        }
+                        "version" = {
+                          "enum" = [
+                            "9.3",
+                            "9.4",
+                            "9.5",
+                            "9.6",
+                            "10",
+                            "11",
+                            "12",
+                            "13",
+                          ]
+                          "type" = "string"
+                        }
+                      }
+                      "required" = [
+                        "version",
+                      ]
+                      "type" = "object"
+                    }
+                    "preparedDatabases" = {
+                      "additionalProperties" = {
+                        "properties" = {
+                          "defaultUsers" = {
+                            "type" = "boolean"
+                          }
+                          "extensions" = {
+                            "additionalProperties" = {
+                              "type" = "string"
+                            }
+                            "type" = "object"
+                          }
+                          "schemas" = {
+                            "additionalProperties" = {
+                              "properties" = {
+                                "defaultRoles" = {
+                                  "type" = "boolean"
+                                }
+                                "defaultUsers" = {
+                                  "type" = "boolean"
+                                }
+                              }
+                              "type" = "object"
+                            }
+                            "type" = "object"
+                          }
+                        }
+                        "type" = "object"
+                      }
+                      "type" = "object"
+                    }
+                    "replicaLoadBalancer" = {
+                      "type" = "boolean"
+                    }
+                    "resources" = {
+                      "properties" = {
+                        "limits" = {
+                          "properties" = {
+                            "cpu" = {
+                              "pattern" = "^(\\d+m|\\d+(\\.\\d{1,3})?)$"
+                              "type"    = "string"
+                            }
+                            "memory" = {
+                              "pattern" = "^(\\d+(e\\d+)?|\\d+(\\.\\d+)?(e\\d+)?[EPTGMK]i?)$"
+                              "type"    = "string"
+                            }
+                          }
+                          "required" = [
+                            "cpu",
+                            "memory",
+                          ]
+                          "type" = "object"
+                        }
+                        "requests" = {
+                          "properties" = {
+                            "cpu" = {
+                              "pattern" = "^(\\d+m|\\d+(\\.\\d{1,3})?)$"
+                              "type"    = "string"
+                            }
+                            "memory" = {
+                              "pattern" = "^(\\d+(e\\d+)?|\\d+(\\.\\d+)?(e\\d+)?[EPTGMK]i?)$"
+                              "type"    = "string"
+                            }
+                          }
+                          "required" = [
+                            "cpu",
+                            "memory",
+                          ]
+                          "type" = "object"
+                        }
+                      }
+                      "required" = [
+                        "requests",
+                        "limits",
+                      ]
+                      "type" = "object"
+                    }
+                    "schedulerName" = {
+                      "type" = "string"
+                    }
+                    "serviceAnnotations" = {
+                      "additionalProperties" = {
+                        "type" = "string"
+                      }
+                      "type" = "object"
+                    }
+                    "sidecars" = {
+                      "items" = {
+                        "type"                                 = "object"
+                        "x-kubernetes-preserve-unknown-fields" = true
+                      }
+                      "nullable" = true
+                      "type"     = "array"
+                    }
+                    "spiloFSGroup" = {
+                      "type" = "integer"
+                    }
+                    "spiloRunAsGroup" = {
+                      "type" = "integer"
+                    }
+                    "spiloRunAsUser" = {
+                      "type" = "integer"
+                    }
+                    "standby" = {
+                      "properties" = {
+                        "s3_wal_path" = {
+                          "type" = "string"
+                        }
+                      }
+                      "required" = [
+                        "s3_wal_path",
+                      ]
+                      "type" = "object"
+                    }
+                    "teamId" = {
+                      "type" = "string"
+                    }
+                    "tls" = {
+                      "properties" = {
+                        "caFile" = {
+                          "type" = "string"
+                        }
+                        "caSecretName" = {
+                          "type" = "string"
+                        }
+                        "certificateFile" = {
+                          "type" = "string"
+                        }
+                        "privateKeyFile" = {
+                          "type" = "string"
+                        }
+                        "secretName" = {
+                          "type" = "string"
+                        }
+                      }
+                      "required" = [
+                        "secretName",
+                      ]
+                      "type" = "object"
+                    }
+                    "tolerations" = {
+                      "items" = {
+                        "properties" = {
+                          "effect" = {
+                            "enum" = [
+                              "NoExecute",
+                              "NoSchedule",
+                              "PreferNoSchedule",
+                            ]
+                            "type" = "string"
+                          }
+                          "key" = {
+                            "type" = "string"
+                          }
+                          "operator" = {
+                            "enum" = [
+                              "Equal",
+                              "Exists",
+                            ]
+                            "type" = "string"
+                          }
+                          "tolerationSeconds" = {
+                            "type" = "integer"
+                          }
+                          "value" = {
+                            "type" = "string"
+                          }
+                        }
+                        "required" = [
+                          "key",
+                          "operator",
+                          "effect",
+                        ]
+                        "type" = "object"
+                      }
+                      "type" = "array"
+                    }
+                    "useLoadBalancer" = {
+                      "type" = "boolean"
+                    }
+                    "users" = {
+                      "additionalProperties" = {
+                        "description" = "Role flags specified here must not contradict each other"
+                        "items" = {
+                          "enum" = [
+                            "bypassrls",
+                            "BYPASSRLS",
+                            "nobypassrls",
+                            "NOBYPASSRLS",
+                            "createdb",
+                            "CREATEDB",
+                            "nocreatedb",
+                            "NOCREATEDB",
+                            "createrole",
+                            "CREATEROLE",
+                            "nocreaterole",
+                            "NOCREATEROLE",
+                            "inherit",
+                            "INHERIT",
+                            "noinherit",
+                            "NOINHERIT",
+                            "login",
+                            "LOGIN",
+                            "nologin",
+                            "NOLOGIN",
+                            "replication",
+                            "REPLICATION",
+                            "noreplication",
+                            "NOREPLICATION",
+                            "superuser",
+                            "SUPERUSER",
+                            "nosuperuser",
+                            "NOSUPERUSER",
+                          ]
+                          "type" = "string"
+                        }
+                        "nullable" = true
+                        "type"     = "array"
+                      }
+                      "type" = "object"
+                    }
+                    "volume" = {
+                      "properties" = {
+                        "iops" = {
+                          "type" = "integer"
+                        }
+                        "size" = {
+                          "pattern" = "^(\\d+(e\\d+)?|\\d+(\\.\\d+)?(e\\d+)?[EPTGMK]i?)$"
+                          "type"    = "string"
+                        }
+                        "storageClass" = {
+                          "type" = "string"
+                        }
+                        "subPath" = {
+                          "type" = "string"
+                        }
+                        "throughput" = {
+                          "type" = "integer"
+                        }
+                      }
+                      "required" = [
+                        "size",
+                      ]
+                      "type" = "object"
+                    }
+                  }
+                  "required" = [
+                    "numberOfInstances",
+                    "teamId",
+                    "postgresql",
+                    "volume",
+                  ]
+                  "type" = "object"
+                }
+                "status" = {
+                  "additionalProperties" = {
+                    "type" = "string"
+                  }
+                  "type" = "object"
+                }
+              }
+              "required" = [
+                "kind",
+                "apiVersion",
+                "spec",
+              ]
+              "type"                                 = "object"
+              "x-kubernetes-preserve-unknown-fields" = true
+            }
+          }
+          "served"  = true
+          "storage" = true
+          "subresources" = {
+            "status" = {}
+          }
+        },
+      ]
+    }
+  }
+}
diff --git a/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/variables.tf b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/variables.tf
new file mode 100644
index 00000000..c031df61
--- /dev/null
+++ b/manifest/test/acceptance/testdata/CustomResourceOAPI3-metadata/variables.tf
@@ -0,0 +1,31 @@
+# These variable declarations are only used for interactive testing.
+# The test code will template in different variable declarations with a default value when running the test.
+#
+# To set values for interactive runs, create a var-file and set values in it. 
+# If the name of the var-file ends in '.auto.tfvars' (e.g. myvalues.auto.tfvars) 
+# it will be automatically picked up and used by Terraform.
+#
+# DO NOT check in any files named *.auto.tfvars when making changes to tests.
+
+variable "name" {
+  type = string
+}
+
+variable "namespace" {
+  type = string
+}
+
+variable "kind" {
+  type = string
+}
+
+variable "group" {
+  type = string
+}
+variable "cr_version" {
+  type = string
+}
+
+variable "plural" {
+  type = string
+}