Fix PF extra config triggering check config errors (#2701)

Pulumi providers can specify an `ExtraConfig` field for provider
configuration which is exclusive to Pulumi and is not passed to the
underlying TF provider. This works correctly for the SDKv2 bridge but
the PF bridge errors when that config is used.

This PR fixes that and adds a test.

fixes #2702

pkg/pf/tests/provider_checkconfig_test.go

@@ -22,6 +22,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	rschema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
 	"github.com/hexops/autogold/v2"
@@ -34,10 +35,14 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/structpb"
 
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/pf/tests/internal/providerbuilder"
 	pb "github.com/pulumi/pulumi-terraform-bridge/v3/pkg/pf/tests/internal/providerbuilder"
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/pf/tests/pulcheck"
 	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/pf/tfbridge"
 	tfbridge0 "github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge"
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge/info"
 	shim "github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfshim"
+	shimschema "github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfshim/schema"
 )
 
 func TestCheckConfig(t *testing.T) {
@@ -802,3 +807,75 @@ func makeProviderServer(
 	require.NoError(t, err)
 	return server
 }
+
+func TestExtraConfig(t *testing.T) {
+	t.Parallel()
+
+	provBuilder := providerbuilder.NewProvider(
+		providerbuilder.NewProviderArgs{
+			AllResources: []providerbuilder.Resource{
+				providerbuilder.NewResource(providerbuilder.NewResourceArgs{
+					ResourceSchema: rschema.Schema{
+						Attributes: map[string]rschema.Attribute{
+							"s": rschema.StringAttribute{Optional: true},
+						},
+					},
+				}),
+			},
+			ProviderSchema: schema.Schema{
+				Attributes: map[string]schema.Attribute{
+					"config": schema.StringAttribute{Optional: true},
+				},
+			},
+		})
+
+	prov := bridgedProvider(provBuilder)
+
+	prov.ExtraConfig = map[string]*info.Config{
+		"extraConf": {
+			Schema: (&shimschema.Schema{
+				Type:     shim.TypeString,
+				Optional: true,
+			}).Shim(),
+		},
+	}
+
+	t.Run("unknown config causes check failure", func(t *testing.T) {
+		t.Parallel()
+
+		program := `
+name: test
+runtime: yaml
+resources:
+    mainRes:
+        type: testprovider:index:Test
+        properties:
+            s: "hello"`
+
+		pt, err := pulcheck.PulCheck(t, prov, program)
+		require.NoError(t, err)
+		pt.SetConfig(t, "testprovider:unknown", "value")
+
+		_, err = pt.CurrentStack().Up(pt.Context())
+		require.ErrorContains(t, err, "is not a valid configuration key for the testprovider provider")
+	})
+
+	t.Run("extra config does not cause check failure", func(t *testing.T) {
+		t.Parallel()
+
+		program := `
+name: test
+runtime: yaml
+resources:
+    mainRes:
+        type: testprovider:index:Test
+        properties:
+            s: "hello"`
+
+		pt, err := pulcheck.PulCheck(t, prov, program)
+		require.NoError(t, err)
+		pt.SetConfig(t, "testprovider:extraConf", "value")
+
+		pt.Up(t)
+	})
+}

pkg/pf/tests/pulcheck/pulcheck.go

@@ -90,6 +90,7 @@ func skipUnlessLinux(t T) {
 // PulCheck creates a new Pulumi test from a bridged provider and a program.
 func PulCheck(t T, bridgedProvider info.Provider, program string, opts ...opttest.Option) (*pulumitest.PulumiTest, error) {
 	skipUnlessLinux(t)
+	t.Helper()
 	puwd := t.TempDir()
 	p := filepath.Join(puwd, "Pulumi.yaml")
 

pkg/pf/tfbridge/provider_checkconfig.go

@@ -197,6 +197,10 @@ func (p *provider) validateProviderConfig(
 		if k == "version" || k == "pluginDownloadURL" {
 			continue
 		}
+
+		if _, has := p.info.ExtraConfig[string(k)]; has {
+			continue
+		}
 		// TODO[https://github.com/pulumi/pulumi/issues/16757] While #16757 is
 		// outstanding, we need to filter out the keys for parameterized providers
 		// from the top level namespace.