Terraform recipes fail when the module declares provider configuration_aliases #13299

Bug information

Steps to reproduce

1. Create a Terraform recipe module that declares an aliased provider:

   terraform {
     required_providers {
       azurerm = {
         source                = "hashicorp/azurerm"
         configuration_aliases = [azurerm.custom]
       }
     }
   }
   
   resource "azurerm_resource_group" "test_rg" {
     provider = azurerm.custom
     name     = var.name
     location = var.location
   }

2. Register the recipe in an environment. Add a matching provider entry with alias: 'custom' in recipeConfig.terraform.providers.azurerm.

3. Deploy a resource that uses the recipe.

An example is test/testrecipes/test-terraform-recipes/azure-rg-custom-provider with test/functional-portable/corerp/cloud/resources/testdata/corerp-resources-terraform-azurerg-custom-provider.bicep from #13296.

Observed behavior

The deployment fails before Radius adds the provider configuration:

code RecipeDownloadFailed: failed to download Terraform module from source ".../azure-rg-custom-provider.zip":
Error: Missing required provider configuration
The child module requires an additional configuration for provider hashicorp/azurerm, with the local name "azurerm.custom".

Delete fails with the same error (RecipeDeletionFailed), so the resource cannot be cleaned up through Radius.

Root cause: getTerraformConfig in pkg/recipes/terraform/execute.go saves main.tf.json with only the module block. Then downloadAndInspect in pkg/recipes/terraform/module.go runs terraform get. Terraform validates module provider requirements during get, so it rejects a module that declares configuration_aliases when the module block has no providers map. AddProviders (which writes the alias providers and the module providers map) runs only after the download, so it never gets the chance.

I reproduced this with terraform get on Terraform 1.5.7, 1.15.8, and 1.16.5 (the version Radius installs). So provider aliases in recipe configuration do not work in any supported version. This bug probably also caused the old Test_TerraformRecipe_KubernetesPostgres skip (#10705), because that module also used configuration_aliases.

Unit tests did not find this bug because they use a fake Terraform binary.

Desired behavior

A recipe module that declares configuration_aliases deploys and deletes when the environment recipeConfig supplies matching aliased provider configuration.

Possible fix (tested locally with terraform get on 1.16.5): before terraform get, write placeholder provider blocks (only alias) and the module providers map for each aliased provider in recipeConfig.terraform.providers. After inspection, AddProviders must always replace these placeholders. It must also remove the module providers map when no alias matches. If the module does not declare an alias, Terraform gives only a warning ("Reference to undefined provider"), not an error. Apply the fix to all paths that call downloadAndInspect: deploy, delete, and GetRecipeMetadata.

Workaround

None for modules that need aliased providers. A module can use the default (non-aliased) provider configuration instead.

System information

rad Version

main (Terraform 1.16.5)

Operating system

N/A (control plane, CI cloud functional tests)

Additional context

Required as part of the fix: write and enable the custom subtest of Test_TerraformRecipe_AzureResourceGroup in test/functional-portable/corerp/cloud/resources/recipe_terraform_test.go. #13296 adds this subtest skipped with a link to this issue. Remove the skip, complete the subtest as needed, and verify that it passes in the corerp-cloud functional test run. Also add a unit test that runs a real terraform get against a module with configuration_aliases, so this regression is caught without a cloud run.

CI evidence: corerp-cloud run https://github.com/radius-project/radius/actions/runs/38629483014 (the default subtest passed; the custom subtest failed with the error above).