meshstack_landingzone owned_by_workspace Cannot set value for this attribute

[JohannesRudolph]

I upgraded from v0.12 to v0.21 of the provider and got this error

resource "meshstack_landingzone" "azure_m25_sandbox" {
  count = local.azure_m25_enabled ? 1 : 0

  metadata = {
    name = var.azure_m25_platform.sandbox_landing_zone.identifier
    tags = {
      "LandingZoneFamily" = ["sandbox"]
    }
  }
...

14:09:25.989 STDERR tofu: │ Error: Incorrect attribute value type
14:09:25.990 STDERR tofu: │ 
14:09:25.990 STDERR tofu: │   on resources.platform-setup.tf line 102, in resource "meshstack_landingzone" "azure_m25_sandbox":
14:09:25.990 STDERR tofu: │  102:   metadata = {
14:09:25.990 STDERR tofu: │  103:     name = var.azure_m25_platform.sandbox_landing_zone.identifier
14:09:25.990 STDERR tofu: │  104:     tags = {
14:09:25.990 STDERR tofu: │  105:       "LandingZoneFamily" = ["sandbox"]
14:09:25.990 STDERR tofu: │  106:     }
14:09:25.990 STDERR tofu: │  107:   }
14:09:25.990 STDERR tofu: │ 
14:09:25.990 STDERR tofu: │ Inappropriate value for attribute "metadata": attribute
14:09:25.990 STDERR tofu: │ "owned_by_workspace" is required.
14:09:25.990 STDERR tofu: ╵

Okay so let's add one

resource "meshstack_landingzone" "azure_m25_sandbox" {
  count = local.azure_m25_enabled ? 1 : 0

  metadata = {
    name = var.azure_m25_platform.sandbox_landing_zone.identifier
    owned_by_workspace = "test"
    tags = {
      "LandingZoneFamily" = ["sandbox"]
    }
  }

But now i get

  │ Error: Invalid Configuration for Read-Only Attribute
  │ 
  │   with meshstack_landingzone.azure_m25_sandbox,
  │   on resources.platform-setup.tf line 99, in resource "meshstack_landingzone" "azure_m25_sandbox":
  │   99: resource "meshstack_landingzone" "azure_m25_sandbox" {
  │ 
  │ Cannot set value for this attribute as the provider has marked it as
  │ read-only. Remove the configuration line setting the value.
  │ 
  │ Refer to the provider documentation or contact the provider developers for
  │ additional information about configurable and read-only attributes that are
  │ supported.

With no further details about the offending attribute as the line it targets is the resource declaration itself. I suppose it must be the owned_by_workspace attribute. Unfortunately, now I'm stuck.

[JohannesRudolph]

TL;DR — Workaround

Re-import the affected resource(s) to refresh the state with the current schema, then add the owned_by_workspace value the import reveals:

tofu state rm meshstack_landingzone.azure_m25_sandbox[0]
tofu import meshstack_landingzone.azure_m25_sandbox[0] <landing-zone-name>
# import output will show the owned_by_workspace value; add it to your config

Then add owned_by_workspace = "<value from import>" to your metadata block. You should not need to destroy/recreate the resource.

---

Root Cause Analysis

The issue is a missing state migration introduced in v0.16.5 when metadata.owned_by_workspace was added as Required: true — without incrementing SchemaVersion or providing ResourceWithUpgradeState. This creates a catch-22 for anyone upgrading from a pre-v0.16.5 state.

What the old state looks like (v0.12)

The v0.12 schema stored metadata with only name and tags — no owned_by_workspace. The state file also has top-level api_version and kind attributes (removed in v0.18.x, also without state upgraders).

Why Error 1 occurs (no owned_by_workspace in config)

Standard HCL config validation: the new schema requires it, so Terraform rejects the config before state is even read.

Why Error 2 occurs (the actual bug — owned_by_workspace set but "read-only")

When owned_by_workspace = "test" is added and the plan is re-run, OpenTofu:

1. Reads the old state — owned_by_workspace is absent in the JSON, so it deserialises as null
2. Calls Read, which fetches the landing zone from the API and writes the full struct back via resp.State.Set(ctx, landingZone) — this now populates owned_by_workspace from the API response
3. The framework ends up with: prior-state = null, post-refresh state = <api value>, config = "test"

Because the prior state had the attribute as null (absent) rather than a known value, but the provider's Read is now returning it, the framework misidentifies it as a provider-managed (computed) value. When the user then tries to set it in config, the framework produces the misleading "Cannot set value for this attribute as the provider has marked it as read-only" error instead of correctly planning a replace. The error points to the resource block (line 99) rather than a specific attribute because the path resolution fails on the null prior-state entry.

Additional compounding schema changes (also without state upgraders)

Version	Change
v0.16.3	metadata.tags element type changed from ListType → SetType
v0.16.5	metadata.owned_by_workspace added as Required
v0.18.x	Top-level api_version and kind removed entirely

Proper fix

The correct long-term fix is to implement ResourceWithUpgradeState covering all the above schema changes, reading owned_by_workspace from the API during migration. A simpler short-term fix is changing owned_by_workspace from Required to Optional + Computed — this lets existing resources have the value populated from the API on first refresh without requiring the user to specify it in config, while still allowing RequiresReplace() to trigger if the value is later changed.