Assertion failed 'Create cannot be called if the configuration is unknown' when alicloud provider returns VPC creation error

[yuzhichang]

Pulumi Issue Report

Title

Assertion failed "Create cannot be called if the configuration is unknown" when alicloud provider returns VPC creation error

Type

Bug Report

Environment

• Pulumi CLI: v3.217.1
• Go Version: go1.24.12 linux/amd64 (also tested with go1.25.5 and go1.25.6 - same issue)
• OS: Linux (kernel 6.18.7)
• Affected Providers:
  • pulumi-alicloud v3.93.0
  • pulumi-kubernetes v4.24.1
• Backend: Pulumi Cloud (https://app.pulumi.com)

Description

When creating an Aliyun VPC resource, if the alicloud provider returns an error during resource creation, Pulumi crashes with an assertion failure instead of gracefully handling the provider error. The crash occurs with the message:

panic: fatal: An assertion has failed: Create cannot be called if the configuration is unknown

This results in:

1. The entire pulumi up process crashing
2. The stack being left in a locked state
3. No clear error message about what actually went wrong with the Aliyun API call

Key Observation

• Preview: ✅ Success (28 resources planned)
• Deployment: ❌ Assertion panic when VPC creation fails
• Recovery: Requires pulumi cancel to unlock the stack

Steps to Reproduce

1. Configure a Pulumi stack with cloud: aliyun (VPC creation mode)
2. Use pulumi-alicloud provider with valid credentials
3. Include at least one VPC resource:

   vpc.NewNetwork(ctx, "ragflow-vpc", &vpc.NetworkArgs{
       CidrBlock: pulumi.String("10.0.0.0/16"),
   })

4. Run pulumi preview - completes successfully
5. Run pulumi up - crashes with assertion failure

Minimal Reproducible Configuration

# Pulumi.ali.yaml
config:
  pulumi_ragflow:cloud: aliyun
  pulumi_ragflow:region: cn-shanghai
  alicloud:accessKey: <valid-access-key>
  alicloud:secretKey: <valid-secret-key>

// main.go
network, err := vpc.NewNetwork(ctx, "ragflow-vpc", &vpc.NetworkArgs{
    CidrBlock: pulumi.String("10.0.0.0/16"),
})

Actual Behavior

Console Output

Updating (ali)

View Live: https://app.pulumi.com/yuzhichang/pulumi_ragflow/ali/updates/2

 +  alicloud:vpc:Network ragflow-vpc creating (0s) 
error: [ERROR] terraform-provider-alicloud@v1.269.0/alicloud/resource_alicloud_vpc.go:255: 
Resource alicloud_vpc CreateVpc Failed!!! [SDK alibaba-cloud-sdk-go ERROR]:

panic: fatal: An assertion has failed: Create cannot be called if the configuration is unknown

goroutine 221 [running]:
panic(...)
runtime/panic.go:802 +0x168
github.com/pulumi/pulumi/sdk/v3/go/common/util/contract.Assertf(...)
github.com/pulumi/pulumi/sdk/v3/go/common/util/contract/assert.go:35
github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin.(*provider).Create(...)
github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin/provider_plugin.go:1339

Stack Trace (Full)

github.com/pulumi/pulumi/pkg/v3/resource/deploy.(*stepExecutor).worker
	.../step_executor.go:661 +0x405
github.com/pulumi/pulumi/pkg/v3/resource/deploy.newStepExecutor.func3()
	.../step_executor.go:730 +0x1d
github.com/pulumi/pulumi/pkg/v3/resource/deploy.PanicRecovery
	.../goroutine_panic_recovery.go:44 +0x82
github.com/pulumi/pulumi/pkg/v3/resource/deploy.newStepExecutor.gowrap2()
	.../step_executor.go:729 +0x25
runtime.goexit({})
	runtime/asm_amd64.s:1693

Expected Behavior

1. Clear error message: Display the full Aliyun SDK error instead of truncating it
2. Graceful failure: Pulumi should handle provider errors without crashing
3. Unlocks stack: Stack should remain usable after a provider error
4. Retry capability: User should be able to fix the issue and retry without manual intervention

Actual Root Cause (Investigation)

The issue appears to be in how Pulumi's core engine handles provider errors during the Create operation:

1. Aliyun provider fails to create VPC (returns error)
2. Error message is truncated: [SDK alibaba-cloud-sdk-go ERROR]: (no actual error details)
3. Pulumi's assertion in provider_plugin.go:1339 fails
4. This triggers a panic instead of normal error handling

The assertion that fails:

// sdk/go/common/resource/plugin/provider_plugin.go:1339
contract.Assertf(unknown != nil, "Create cannot be called if the configuration is unknown")

Additional Context

Workaround That Works

Using cloud: existing mode (skipping VPC creation) works fine:

• Only uses Kubernetes provider
• No Aliyun VPC resources
• Deploys successfully

What Doesn't Work

• Downgrading Go versions (tested: 1.24.12, 1.25.5, 1.25.6)
• Different Pulumi versions (v3.217.0, v3.217.1)
• Reconfiguring Aliyun credentials

Impact

• Severity: High - Blocks deployment entirely
• Frequency: 100% reproducible when Aliyun VPC creation fails
• Affected Users: Anyone using pulumi-alicloud provider with VPC resources

Related Issues

• Panic from provider during an update pulumi/pulumi#411 (pulumi-aws)
• Pulumi update fails with panic pulumi/pulumi#16258

Log Output

Full panic dump and goroutine traces are available in the attached file.

Suggested Fix

The issue should be fixed in the Pulumi core engine's error handling:

1. Remove assertion or add better error handling in provider_plugin.go:1339
2. Propagate provider errors instead of panicking when configuration is unknown
3. Display full error messages from providers (currently truncated)
4. Keep stack unlocked when provider operations fail

The code location that needs fixing:

// File: sdk/go/common/resource/plugin/provider_plugin.go
// Line: ~1339

// Current code:
contract.Assertf(unknown != nil, "Create cannot be called if the configuration is unknown")

// Suggested fix:
if unknown == nil {
    return nil, errors.New("provider failed to return resource configuration")
}

---

Would you like me to:

1. Test with different provider versions?
2. Provide additional diagnostic information?
3. Test the fix once available?